Edgar Filing: SOURCEFIRE INC

e10vq

UNITED STATES SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

Form 10-Q

(Mark One)


þ		QUARTERLY REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the quarterly period ended September 30, 2007


o		TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

Commission file no. 1-33350

SOURCEFIRE, INC.

(Exact Name of Registrant as Specified in its Charter)


Delaware (State or Other Jurisdiction of Incorporation or Organization)		52-2289365 (I.R.S. Employer Identification No.)

9770 Patuxent Woods Drive Columbia, Maryland (Address of Principal Executive Offices)		21046 (Zip Code)

Registrant’s telephone number including area code: 410-290-1616

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes þ No o

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, or a non-accelerated filer. See definition of “accelerated filer and large accelerated filer in Rule 12b-2 of the Exchange Act. (Check one)

Large Accelerated filer o Accelerated filer o Non-accelerated filer þ

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). Yes o No þ

As of November 5, 2007 there were 24,466,816 shares of the registrant’s common stock outstanding.

Sourcefire, Inc.
Index
Form 10-Q


		Page
PART I. FINANCIAL INFORMATION

Item 1.	Financial Statements (Unaudited)	3
	Consolidated Balance Sheets as of September 30, 2007 and December 31, 2006	3
	Consolidated Statements of Operations for the three and nine months ended September 30, 2007 and 2006	4
	Consolidated Statement of Changes in Convertible Preferred Stock and Stockholders’ Equity (Deficit) for the nine months ended September 30, 2007	5
	Consolidated Statements of Cash Flows for the nine months ended September 30, 2007 and 2006	6
	Notes to Consolidated Financial Statements	7
Item 2.	Management’s Discussion and Analysis of Financial Condition and Results of Operations	15
Item 3.	Quantitative and Qualitative Disclosures About Market Risk	28
Item 4.	Controls and Procedures	28

PART II. OTHER INFORMATION

Item 1.	Legal Proceedings	29
Item 1A.	Risk Factors	29
Item 2.	Unregistered Sales of Equity Securities and Use of Proceeds	41
Item 3.	Defaults Upon Senior Securities	42
Item 4.	Submission of Matters to a Vote of Security Holders	42
Item 5.	Other Information	42
Item 6.	Exhibits	43
	Signatures	44

PART I. FINANCIAL INFORMATION

Item 1. Financial Statements

SOURCEFIRE, INC.

CONSOLIDATED BALANCE SHEETS
(Amounts in thousands, except share and per share data)


	September 30			December 31
	2007			2006
	(Unaudited)
Assets
Current assets:
Cash and cash equivalents	$	27,217		$	13,029
Held-to-maturity investments		70,204			12,385
Accounts receivable, net of allowance for doubtful accounts of $147 in 2007 and $166 in 2006		13,920			16,507
Inventory		3,164			2,099
Prepaid expenses and other current assets		2,981			919

Total current assets		117,486			44,939
Property and equipment, net		3,848			2,546
Intangible assets, net		624			—
Held-to-maturity investments, less current portion		5,916			908
Restricted cash		1,000			—
Other assets		329			1,559

Total assets	$	129,203		$	49,952

Liabilities, convertible preferred stock and stockholders’ equity (deficit)
Current liabilities:
Accounts payable	$	1,936		$	3,081
Accrued compensation and related expenses		1,979			1,783
Other accrued expenses		1,170			1,312
Current portion of deferred revenue		13,362			11,735
Current portion of long-term debt		—			675
Other current liabilities		721			501

Total current liabilities		19,168			19,087
Deferred revenue, less current portion		2,526			2,380
Long-term debt, less current portion		—			637
Other long-term liabilities		83			—

Total liabilities		21,777			22,104

Commitments and contingencies
Series A convertible preferred stock, $0.001 par value; 2,495,410 shares authorized at December 31, 2006, 2,475,410 shares issued and outstanding at December 31, 2006; aggregate liquidation preference of $14,093 at December 31, 2006; no shares authorized, issued or outstanding at September 30, 2007		—			10,308
Warrants to purchase Series A convertible preferred stock		—			25
Series B convertible preferred stock, $0.001 par value; 7,132,205 shares authorized, issued and outstanding at December 31, 2006; aggregate liquidation preference of $19,947 at December 31, 2006; no shares authorized, issued or outstanding at September 30, 2007		—			14,265
Series C convertible preferred stock, $0.001 par value; 5,404,043 shares authorized, issued and outstanding at December 31, 2006; aggregate liquidation preference of $26,050 at December 31, 2006; no shares authorized, issued or outstanding at September 30, 2007		—			18,270
Series D convertible preferred stock, $0.001 par value; 3,264,449 shares authorized, issued and outstanding at December 31, 2006; aggregate liquidation preference of $29,847 at December 31, 2006; no shares authorized, issued or outstanding at September 30, 2007		—			23,879
Total convertible preferred stock		—			66,747
Stockholders’ equity (deficit):
Preferred stock, $0.001 par value; 20,000,000 shares authorized; no shares issued and outstanding at September 30, 2007 and December 31, 2006		—			—
Common stock, $0.001 par value; 240,000,000 shares authorized; 24,464,116 and 3,491,764 shares issued and outstanding at September 30, 2007 and December 31, 2006, respectively		24			3
Additional paid-in capital		152,733			—
Accumulated deficit		(45,331	)		(38,902	)

Total stockholders’ equity (deficit)		107,426			(38,899	)

Total liabilities, convertible preferred stock and stockholders’ equity (deficit)	$	129,203		$	49,952

SOURCEFIRE, INC.

CONSOLIDATED STATEMENTS OF OPERATIONS
(Amounts in thousands, except share and per share data)


	Three Months Ended						Nine Months Ended
	September 30						September 30
	2007			2006			2007			2006
	(Unaudited)						(Unaudited)
Revenue:
Products	$	9,403		$	6,927		$	21,103		$	18,390
Technical support and professional services		5,403			3,940			15,418			10,544

Total revenue		14,806			10,867			36,521			28,934
Cost of revenue:
Products		2,665			1,813			5,809			4,931
Technical support and professional services		800			725			2,277			2,016

Total cost of revenue		3,465			2,538			8,086			6,947

Gross profit		11,341			8,329			28,435			21,987
Operating expenses:
Research and development		2,895			2,082			8,076			6,334
Sales and marketing		6,746			4,929			18,563			14,512
General and administrative		2,540			1,103			7,288			3,587
Depreciation and amortization		427			306			1,177			912
In-process research and development		2,947			—			2,947			—

Total operating expenses		15,555			8,420			38,051			25,345

Loss from operations		(4,214	)		(91	)		(9,616	)		(3,358	)
Other income (expense):
Interest and investment income		1,417			294			3,351			447
Interest expense		—			(20	)		(35	)		(61	)
Other income (expense)		3			22			(9	)		56

Total other income (expense)		1,420			296			3,307			442
Income (loss) before income taxes		(2,794	)		205			(6,309	)		(2,916	)
Income tax expense		(50	)		—			(120	)		—

Net income (loss)		(2,844	)		205			(6,429	)		(2,916	)
Accretion of preferred stock		—			(1,131	)		(870	)		(2,687	)

Net loss attributable to common stockholders	$	(2,844	)	$	(926	)	$	(7,299	)	$	(5,603	)

Net loss attributable to common stockholders per share:
Basic and diluted	$	(0.12	)	$	(0.27	)	$	(0.38	)	$	(1.67	)
Weighted average shares outstanding used in computing per share amounts:
Basic and diluted		24,218,634			3,392,526			19,027,750			3,360,099

See accompanying notes to consolidated financial statements.

SOURCEFIRE, INC.

CONSOLIDATED STATEMENT OF CHANGES IN CONVERTIBLE PREFERRED STOCK AND STOCKHOLDERS’ EQUITY (DEFICIT)
(Amounts in thousands, except share data)
(unaudited)


							Warrants to
							Purchase
							Series A
	Series A Convertible						Convertible			Series B Convertible						Series C Convertible						Series D Convertible										Additional
	Preferred Stock						Preferred			Preferred Stock						Preferred Stock						Preferred Stock						Common Stock				Paid-in			Accumulated
	Shares			Amount			Stock			Shares			Amount			Shares			Amount			Shares			Amount			Shares		Amount		Capital			Deficit			Total
Balance at December 31, 2006		2,475,410		$	10,308		$	25			7,132,205		$	14,265			5,404,043		$	18,270			3,264,449		$	23,879			3,491,764	$	3	$	—		$	(38,902	)	$	(38,899	)
Exercise of common stock options		—			—			—			—			—			—			—			—			—			172,998		1		213			—			214
Issuance of restricted common stock		—			—			—			—			—			—			—			—			—			311,798		—		—			—			—
Stock-based compensation expense		—			—			—			—			—			—			—			—			—			—		—		1,911			—			1,911
Issuance of common stock in initial public offering, net of issuance costs of $8,901		—			—			—			—			—			—			—			—			—			6,185,500		6		83,876			—			83,882
Accretion of convertible preferred stock to redemption value		—			140			—			—			186			—			237			—			307			—		—		(870	)		—			(870	)
Conversion of preferred stock to common stock		(2,475,410	)		(10,448	)		(25	)		(7,132,205	)		(14,451	)		(5,404,043	)		(18,507	)		(3,264,449	)		(24,186	)		14,302,056		14		67,603			—			67,617
Net loss for the nine months ended September 30, 2007		—			—			—			—			—			—			—			—			—			—		—		—			(6,429	)		(6,429	)

Balance at September 30, 2007		—		$	—		$	—			—		$	—			—		$	—			—		$	—			24,464,116	$	24	$	152,733		$	(45,331	)	$	107,426

See accompanying notes to consolidated financial statements.

SOURCEFIRE, INC.

CONSOLIDATED STATEMENTS OF CASH FLOWS
(Amounts in thousands)


	Nine Months Ended
	September 30
	2007			2006
	(Unaudited)
Operating activities
Net loss	$	(6,429	)	$	(2,916	)
Adjustments to reconcile net loss to net cash (used in) provided by operating activities:
Depreciation and amortization		1,202			934
Provision for doubtful accounts		(1	)		—
Amortization of unearned compensation		—			15
Stock-based compensation		1,911			267
Amortization of (premium) discount on held-to-maturity investments		(933	)		5
Write-off of acquired in-process research and development costs		2,947			—
Changes in operating assets and liabilities:
Accounts receivable		2,588			2,430
Inventory		(1,065	)		(659	)
Prepaid expenses and other assets		(1,871	)		(360	)
Accounts payable		(1,145	)		(104	)
Accrued expenses		54			1,657
Deferred revenue		1,773			664
Other current liabilities		303			(21	)

Net cash (used in) provided by operating activities		(666	)		1,912
Investing activities
Purchase of property and equipment		(2,494	)		(815	)
Purchase of held-to-maturity investments		(95,895	)		(1,401	)
Proceeds from maturities of held-to-maturity investments		34,000			2,000
Cash paid for acquisition of ClamAV, including direct acquisition costs of $81		(3,581	)		—
Cash held in escrow related to acquisition of ClamAV		(1,000	)		—

Net cash used in investing activities		(68,970	)		(216	)
Financing activities
Borrowings of long-term debt		113			383
Repayments of long-term debt		(1,424	)		(403	)
Proceeds from issuance of Series D Redeemable Convertible Preferred Stock, net of offering costs		—			22,921
Proceeds from issuance of common stock, net of underwriters’ discount of $6,495		86,288			—
Proceeds from exercise of stock options		214			142
Payment of equity offering costs		(1,367	)		(708	)

Net cash provided by financing activities		83,824			22,335

Net increase in cash and cash equivalents		14,188			24,031
Cash and cash equivalents at beginning of period		13,029			1,106

Cash and cash equivalents at end of period	$	27,217		$	25,137

See accompanying notes to consolidated financial statements.

SOURCEFIRE, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS
September 30, 2007
(Unaudited)

1. Initial Public Offering

In March 2007, Sourcefire, Inc. (the “Company”) completed an initial public offering (“IPO”) of common stock in which it sold and issued 6,185,500 shares of common stock, including 865,500 shares sold pursuant to the underwriters’ full exercise of their over-allotment option, at an issue price of $15.00 per share. The Company raised a total of $92.8 million in gross proceeds from the IPO, or approximately $83.9 million in net proceeds after deducting underwriting discounts and commissions of $6.5 million and other offering costs of $2.4 million. Upon the closing of the IPO, all shares of convertible preferred stock outstanding automatically converted into an aggregate of 14,302,056 shares of common stock.

2. Description of Business

Founded in January 2001, Sourcefire, Inc. (the “Company”) is a provider of Enterprise Threat Management (“ETM”) solutions for information technology (“IT”) infrastructures of commercial enterprises (e.g., healthcare, financial services, manufacturing, energy, education, retail, telecommunications) and federal and state government organizations. The Sourcefire 3D™ System—comprised of multiple Sourcefire hardware and software product offerings—provides a comprehensive, intelligent network defense that unifies intrusion prevention system (“IPS”), network behavior analysis (“NBA”), network access control (“NAC”) and vulnerability assessment (“VA”) solutions under a common management framework.

The Company is also the creator of Snort^®, an open source intrusion prevention technology that is incorporated into the IPS software component of the Sourcefire 3D™ System (Discover, Determine, Defend).

On August 17, 2007, the Company completed its acquisition of ClamAV, an open source gateway anti-virus and anti-malware project. ClamAV will broaden the company’s open source footprint while providing the technology foundation for new products and services that will extend the company’s ETM network security portfolio.

In addition to its commercial and open source network security products, Sourcefire also offers a variety of services to aid its customers with installing and supporting Sourcefire ETM solutions. Available services include Customer Support, Education, Product Services and Sourcefire Vulnerability Research Team (VRT) Snort rule subscriptions.

3. Summary of Significant Accounting Policies

Basis of Presentation

The accompanying unaudited consolidated financial statements have been prepared in accordance with generally accepted accounting principles for interim financial reporting and in accordance with the instructions to Form 10-Q and Article 10 of Regulation S-X. Certain information and footnote disclosures normally included in annual financial statements prepared in accordance with generally accepted accounting principles in the United States have been condensed or omitted pursuant to those rules or regulations. The interim financial statements are unaudited, but reflect all adjustments (consisting of normal recurring accruals) which are, in the opinion of management, considered necessary for a fair presentation. These financial statements should be read in conjunction with the audited consolidated financial statements and the notes thereto for the year ended December 31, 2006 included in the Company’s registration statement on Form S-1 dated March 8, 2007. The results of operations for the interim periods are not necessarily indicative of results to be expected in future periods.

Use of Estimates

The preparation of financial statements in conformity with accounting principles generally accepted in the United States requires management to make estimates and assumptions that affect the amounts reported in the financial statements and accompanying notes. Actual results could differ from those estimates.

Accounts Receivable and Allowance for Doubtful Accounts

The Company reports accounts receivable at net realizable value. The Company maintains an allowance for doubtful accounts for estimated losses resulting from the inability of its customers to make required payments. The Company calculates the allowance based on a specific analysis of past due balances and also considers historical trends of write-offs. Actual collection experience has not differed significantly from the Company’s estimates, due primarily to the Company’s credit and collections practices and the financial strength of its customers.

The Company offers standard payment terms that typically range from 30 to 60 days from the invoice date. Invoices are typically generated when the Company delivers the product and/or service to the customer. Standard terms do not require a down payment from the customer or any other collateral and payments terms are not tied to specific milestones or acceptance clauses. Additionally, the Company does not generally accept product returns or offer refunds.

Inventories

Inventories consist of hardware and related component parts and are stated at the lower of cost (on a first-in, first-out basis) or market. A significant portion of the Company’s inventory includes products used for customer testing and evaluation. This inventory is predominantly located at the customer’s premises. Inventory that is obsolete or in excess of the Company’s forecasted demand is written down to its estimated net realizable value based on historical usage, expected demand, and evaluation unit age. Inherent in the Company’s estimates of market value in determining inventory valuation are estimates related to economic trends, as well as technological obsolescence of the Company’s products.

Revenue Recognition

The Company derives revenue from arrangements that include products with embedded software, software licenses and royalties, technical support, and professional services. Revenue from products in the accompanying consolidated statements of operations consists primarily of sales of software-based appliances, but also includes fees and royalties for the license of the Company’s technology in a software-only format and subscriptions to receive rules released by the Company’s Vulnerability Research Team (“VRT”) that are used to update the appliances for current exploits and vulnerabilities. Revenues derived from the non-product components of products currently represent less than 10% of total “products” revenue in the accompanying consolidated statements of operations. Technical support, which typically has a term of 12 to 48 months, includes telephone and web-based support, software updates, and rights to software upgrades on a when-and-if-available basis. Professional services include training and consulting.

For each arrangement, the Company defers revenue recognition until: (a) persuasive evidence of an arrangement exists; (b) delivery of the product has occurred and there are no remaining obligations or substantive customer acceptance provisions; (c) the fee is fixed or determinable; and (d) collection of the fee is probable.

The Company allocates the total arrangement fee among each deliverable based on the fair value of each of the deliverables, determined based on vendor-specific objective evidence. If vendor-specific objective evidence of fair value does not exist for each of the deliverables, all revenue from the arrangement is deferred until the earlier of the point at which sufficient vendor-specific objective evidence of fair value can be determined for any undelivered elements or all elements of the arrangement have been delivered. However, if the only undelivered elements are elements for which the Company currently has vendor specific objective evidence of fair value, the Company recognizes revenue for the delivered elements based on the residual method as prescribed by SOP 98-9, Modification of SOP 97-2, Software Revenue Recognition with Respect to Certain Transactions.

The Company has established vendor specific objective evidence of fair value for its technical support based upon actual renewals of technical support for each type of technical support that is offered and for each customer class. Technical support and technical support renewals are currently priced based on a percentage of the list price of the respective product or software and historically have not varied from a narrow range of values in the substantial majority of the Company’s arrangements. Revenue related to technical support is deferred and recognized ratably over the contractual period of the technical support arrangement, which ranges from 12 to 48 months in most arrangements. The vendor specific objective evidence of fair value of the Company’s other services is based on the price for these same services when they are sold separately. Revenue for services that are sold either on a stand-alone basis or included in multiple element arrangements is deferred and recognized as the services are performed.

All amounts billed or received in excess of the revenue recognized are included in deferred revenue. In addition, the Company defers all direct costs associated with revenue that has been deferred. These amounts are included in either prepaid expenses and other current assets or inventory in the accompanying balance sheets, depending on the nature of the costs and the reason for the deferral.

For sales through resellers and distributors, the Company recognizes revenue upon the shipment of the product only if those resellers and distributors provide the Company, at the time of placing their order, with the identity of the end user customer to whom the product has been sold. The Company does not currently offer any rights to return products sold to resellers and distributors. To the extent that a reseller or distributor requests an inventory or stock of products, the Company defers revenue on that product until it receives notification that it has been sold through to an identified end user.

For the three months ended September 30, 2007 and 2006, the Company had one significant customer, a reseller, that accounted for 15% and 14% of the revenue recognized, respectively. For the nine months ended September 30, 2007, the Company had one significant customer that accounted for 10% of the revenue recognized. For the nine months ended September 30, 2006, the Company had no significant customers that accounted for greater than 10% of the revenue recognized.

Warranty

The Company warrants that its software will perform in accordance with its documentation for a period of 90 days from the date of shipment. Similarly, the Company warrants that the hardware will perform in accordance with its documentation for a period of one year from date of shipment. The Company further agrees to repair or replace software or products that do not conform to those warranties. The one year warranty on hardware coincides with the hardware warranty that the Company obtains from the manufacturer. The Company estimates the costs that may be incurred under its warranties and records a liability at the time product revenue is recognized. Factors that affect the Company’s warranty liability include the number of installed units, historical and anticipated rates of warranty claims and the estimated cost per claim. The Company periodically assesses the adequacy of its recorded warranty liability and adjusts the amounts as necessary. While warranty costs have historically been within the Company’s expectations, it is possible that warranty rates will change in the future based on new product introductions and other factors.

Income Taxes

The Company accounts for income taxes in accordance with FASB Statement No. 109, Accounting for Income Taxes. Deferred income taxes are recorded for the expected tax consequences of temporary differences between the tax basis of assets and liabilities for financial reporting purposes and amounts recognized for income tax purposes. The Company records a valuation allowance to reduce the Company’s deferred tax assets to the amount of future tax benefit that is more likely than not to be realized. At September 30, 2007 and December 31, 2006, the Company recorded a valuation allowance equal to the full recorded amount of the Company’s net deferred tax assets since it was not more likely than not that such benefits would be realized. The Company recorded a provision for income taxes of $50,000 and $120,000 for the three and nine month periods ended September 30, 2007, respectively, principally related to foreign income taxes.

Acquired Intangible Assets

In conjunction with the ClamAV acquisition in 2007, the Company acquired certain marketing related intangible assets totaling $634,000 that will be amortized over their respective estimated useful lives.

The intangible assets acquired in the ClamAV acquisition were determined to have useful lives of 5 years, with a weighted-average useful life of 5 years. We are amortizing these assets using the straight-line method.

Stock-Based Compensation

On January 1, 2006, the Company adopted the fair value recognition provisions of SFAS No. 123(R) which requires the Company to expense the cost of employee services received in exchange for an award of equity instruments based on the grant date fair value of the award. The expense must be recognized ratably over the requisite service period following the date of grant. The Company applied the prospective transition method, which requires the Company to apply its provisions only to awards granted, modified, repurchased or cancelled after the effective date. Under this transition method, stock-based compensation expense recognized beginning January 1, 2006 is based on the grant date fair value of stock awards granted or modified after January 1, 2006. As the Company had used the minimum value method for valuing its stock options under the disclosure requirements of Statement of Financial Accounting Standard (“SFAS”) No. 123, Accounting for Stock Based Compensation (“SFAS No. 123”), all options granted prior to January 1, 2006 continue to be accounted for under Accounting Principles Board Opinion No. 25, Accounting for Stock Issued to Employees (“APB No. 25”). Additionally, the pro forma disclosures that were required under the original provisions of SFAS No. 123 are no longer provided for outstanding awards accounted for under the intrinsic-value method of APB No. 25 beginning in periods after the adoption of SFAS No. 123(R).

Based on the estimated grant date fair value of employee stock options subsequently granted or modified, the Company recognized aggregate compensation expense of $626,000 and $109,000 for the three months ended September 30, 2007 and 2006, respectively, and $1,480,000 and $239,000 for the nine months ended September 30, 2007 and 2006, respectively. The Company uses the Black-Scholes option pricing model to estimate the fair value of granted stock options. The use of option valuation models requires the input of highly subjective assumptions, including the expected term and the expected stock price volatility. However, the Company currently does not have sufficient information available on which to base a reasonable and supportable estimate of the expected volatility of its share prices. Accordingly, the Company uses an alternative method (defined as “calculated value”) that incorporates each of the inputs required by SFAS No. 123(R), with the exception of the expected volatility of its stock. Rather than use the expected volatility of the Company’s own stock, the Company has identified similar public entities for which sufficient historical share price information is available and has considered the volatility of those entities’ share prices in estimating expected volatility. Additionally, the Company has estimated the expected term of granted options to be the weighted-average mid-point between the vesting date and the end of the contractual term of an award, in accordance with SEC Staff Accounting Bulletin No. 107.

The weighted-average estimated fair value of stock options granted during the three months ended September 30, 2007 was $6.80 per share, and there were no stock options granted during the three months ended September 30, 2006. The weighted-average estimated fair value of stock options granted during the nine months ended September 30, 2007 and 2006 was $8.68 and $4.46 per share, respectively, calculated using the following weighted average assumptions:


	Three Months Ended			Nine Months Ended
	September 30			September 30
	2007			2007			2006
Average risk-free interest rate		4.3	%		4.6	%		4.7	%
Expected dividend yield		—			—			—
Expected useful life (years)		6.25			6.25			6.25
Expected volatility		71.1	%		74.9	%		80.1	%

The grant date aggregate fair value of options, net of estimated forfeitures, not yet recognized as expense as of September 30, 2007 was $5.7 million, which will be recognized over a weighted-average period of 3.03 years.

The fair value of the unvested restricted stock awards is measured using the closing price of the Company’s stock on the date of grant, or the estimated fair value of the common stock if granted prior to the Company’s initial public offering. The total compensation expense related to restricted stock awards was $93,000 and $32,000 for the three months ended September 30, 2007 and 2006, respectively, and $431,000 and $42,000 for the nine months ended September 30, 2007 and 2006, respectively.

As of September 30, 2007, there was $2.5 million of unrecognized equity-based compensation expense related to unvested restricted stock awards. The cost is expected to be recognized over a weighted-average remaining period of 3.38 years.

Compensation cost under SFAS 123(R) for the three and nine months ended September, 2007 and 2006 is included in the accompanying consolidated statement of operations as follows (in thousands except per share data):


	Three Months Ended				Nine Months Ended
	September 30				September 30
	2007		2006		2007		2006
Cost of sales product		11		—		16		—
Cost of sales services		38		—		50		—

Stock based compensation expense included in cost of sales		49		—		66		—
Research and development		88		20		257		43
Sales and marketing		300		55		755		119
General and administrative		282		67		833		120

Stock-based compensation included in operating expenses		670		142		1,845		282
Total stock-based compensation		719		142		1,911		282
Effect on net loss per share:
Basic and diluted	$	0.03	$	0.04	$	0.10	$	0.08

The Company accounts for stock option grants to non-employees who are not directors in accordance with SFAS No. 123(R) and Emerging Issues Tax Force (“EITF”) Issue No. 96-18, Accounting for Equity Instruments That Are Issued to Other Than Employees for Acquiring, or in Conjunction with Selling, Goods or Services, which require that the estimated fair value of these instruments measured at the earlier of the performance commitment date or the date at which performance is complete be recognized as an expense ratably over the period in which the related services are rendered. The Company determines the fair value of these instruments using the Black-Scholes option pricing model.

Net Loss Attributable to Common Stockholders Per Share

Basic net loss attributable to common stockholders per share is computed by dividing net loss attributable to common stockholders by the weighted average number of common shares outstanding for the period. Diluted net loss attributable to common stockholders per share includes the potential dilution that could occur if securities or other contracts to issue common stock were exercised or converted into common stock.

The following summarizes the potential outstanding common stock of the Company as of the end of each period:


	September 30
	2007		2006
Options to purchase common stock		3,313,532		2,744,991
Shares of common stock into which outstanding warrants are convertible		36,944		36,944
Shares of common stock into which outstanding preferred stock is convertible		—		14,302,056
Unvested shares of restricted common stock		12,315		81,588

Total		3,362,791		17,165,579

If the outstanding options, warrants, unvested restricted stock, and preferred stock were exercised or converted into common stock, the result would be anti-dilutive. Accordingly, basic and diluted net loss attributable to common stockholders per share are identical for all periods presented in the accompanying consolidated statements of operations.

Fair Value of Financial Instruments

The Company’s financial instruments consist primarily of cash and cash equivalents, held-to-maturity investments, accounts receivable, accounts payable and long-term debt. The fair value of these financial instruments approximates their carrying amounts reported in the consolidated balance sheets.

Recent Accounting Pronouncements

In June 2006, FASB issued Interpretation No. 48, Accounting for Uncertainty in Income Taxes, an interpretation of SFAS No. 109, Accounting for Income Taxes (“FIN 48”), to create a single model to address accounting for uncertainty in tax positions. FIN 48 clarifies the accounting for income taxes by prescribing a minimum recognition threshold a tax position is required to meet before being recognized in the financial statements. FIN 48 also provides guidance on derecognition, measurement, classification, interest and penalties, accounting in interim periods, disclosure and transition. FIN 48 is effective for fiscal years beginning after December 15, 2006. As of January 1, 2007, the Company adopted FIN 48. The adoption of FIN 48 did not have an impact on the Company’s financial position and results of operations.

In September 2006, FASB issued Statement of Financial Accounting Standards No. 157, Fair Value Measurements (“SFAS No. 157”). This statement defines fair value and provides guidance for measuring fair value and the necessary disclosures. SFAS No. 157 does not require any new fair value measurements but rather applies to all other accounting pronouncements that require or permit fair value measurements. SFAS No. 157 will be effective for the fiscal year ending December 31, 2008. The Company does not currently expect any material impact from adoption of this new accounting pronouncement on the consolidated financial statements.

4. Acquisition

During the quarter, the Company closed on the acquisition of the intellectual property assets of ClamAV, an open source gateway anti-virus and anti-malware project. At closing, the Company paid $3.5 million in cash to the former owners, and deposited an additional $1 million in cash in escrow, which will be paid to the sellers, if at all, upon the completion of the remaining source code.

The Company allocated $2.9 million of the purchase price to in-process research and development and allocated the remaining $634,000 to certain marketing related intangible assets, with the assistance of a third party valuation. The estimated fair value of the in-process research and development project was determined by the use of a discounted cash flow model, using a discount rate that took into account the stage of completion, and the risks surrounding the successful development and commercialization of the technology and product. The amounts allocated to in-process research and development were immediately expensed, as there is no alternative future use for the acquired technology.

The $1 million in escrow, if paid to the sellers, will be accounted for as compensation expense in our financial statements, as the sellers are now employees. The Company will evaluate the status of the sellers’ efforts in completing the source code at each reporting date and record a liability when the obligation of payment becomes probable as the payment is contingent upon the completion of the remaining source code. Additionally, the Company will evaluate whether any amount should be capitalized depending on the stage of development that results in the establishment of technological feasibility.

5. Property and Equipment

Property and equipment consists of the following (dollars in thousands):


	September 30		December 31
	2007		2006
	(unaudited)
Furniture, fixtures and equipment	$	6,789	$	5,025
Leasehold improvements		1,699		969

Total property and equipment		8,488		5,994
Less accumulated depreciation and amortization		4,640		3,448

Net property and equipment	$	3,848	$	2,546

6. Stock Incentive Plans

During 2002, the Company adopted the Sourcefire, Inc. 2002 Stock Incentive Plan. The plan provides for the granting of equity-based awards, including stock options, restricted or unrestricted stock awards, and stock appreciation rights to employees, officers, directors, and other individuals as determined by the Board of Directors. The Company has reserved 5,100,841 shares of common stock under the 2002 plan.

In March 2007, in connection with the Company’s IPO, the Board of Directors approved the 2007 Stock Incentive Plan. The plan provides for the granting of equity-based awards, including stock options, restricted or unrestricted stock awards, and stock appreciation rights to employees, officers, directors, and other individuals as determined by the Board of Directors. The Company has reserved 3,142,452 shares of common stock under the 2007 plan.

The plan administrator determines the vesting period for awards under each plan, which generally ranges from three to four years, and options granted have a maximum term of 10 years. The exercise price of the awards is equal to or greater than the fair value of the common stock as estimated by the Board of Directors on the date of grant. Following the Company’s IPO, the fair value of the common stock is determined by the closing trading price of such stock on the NASDAQ Global Market on the date of grant.

The restricted stock awards are subject to various restrictions including time-based vesting provisions, performance-based vesting provisions and provisions for acceleration of vesting upon change in control and in certain other circumstances. The compensation expense associated with these awards is evaluated on a quarterly basis based upon the criteria stated above. The compensation expense is recognized ratably over the estimated vesting period. The vesting restrictions for outstanding restricted stock lapse over a period of 6 to 48 months.

The following table summarizes the aggregate activity of the plans (dollars in thousands, except per share data):


						Weighted
						Average		Aggregate
	Number of			Range of		Exercise		Intrinsic
	Shares			Exercise Prices		Price		Value
Outstanding at December 31, 2006		3,199,903		$	0.24 to $11.34	$	2.96
Granted		414,514		$	9.72 to $15.49	$	12.40
Exercised		(172,998	)	$	0.24 to $5.26	$	1.24
Forfeited		(127,887	)	$	0.24 to $13.10	$	7.00

Outstanding at September 30, 2007		3,313,532		$	0.24 to $15.49	$	4.06	$	18,237
Exercisable at September 30, 2007		2,001,981		$	0.24 to $10.41	$	1.55	$	15,111
Vested and expected to vest at September 30, 2007		3,007,002				$	3.72	$	17,352

The total intrinsic value of options exercised during the nine months ended September 30, 2007 was $1,479,000.

The following table summarizes information about stock options outstanding at September 30, 2007:


	Options Outstanding						Options Exercisable
			Weighted		Weighted Average				Weighted
			Average		Remaining				Average
	Number of		Exercise		Contractual Life		Number of		Exercise
Range of Exercise Prices	Shares		Prices		(Years)		Shares		Prices
$0.24 – $0.32		938,143	$	0.29		5.6		935,447	$	0.29
$1.14 – $2.03		1,150,417	$	1.63		7.2		820,590	$	1.54
$3.69 – $10.05		829,153	$	7.64		8.9		242,610	$	6.32
$10.41 – $15.49		395,819	$	12.61		9.0		3,334	$	10.41

		3,313,532	$	4.06		7.4		2,001,981	$	1.55

Unvested restricted stock awards as of September 30, 2007 and changes during the nine months then ended are as follows:


				Weighted-
				Average
	Number of			Grant Date
	Shares			Fair Value
Unvested at December 31, 2006		27,709		$	7.63
Granted		296,404			10.66
Restrictions Lapsed		(27,709	)		7.63
Forfeited		—			—

Unvested at September 30, 2007		296,404			10.66

7. Business and Geographic Segment Information

The Company manages its operations on a consolidated basis for purposes of assessing performance and making operating decisions. Accordingly, the Company does not have reportable segments of its business.

Revenues by geographic area are as follows (dollars in thousands):


	Three Months Ended				Nine Months Ended
	September 30				September 30
	2007		2006		2007		2006
United States		11,415		9,287		27,981		23,184
All foreign countries		3,391		1,580		8,540		5,750

Consolidated total	$	14,806	$	10,867	$	36,521	$	28,934

8. Legal Proceedings

On May 8, 2007, a putative class action lawsuit was filed in the United States District Court for the District of Maryland (the “Court”), against us and certain of our officers and directors, captioned Howard Katz v. Sourcefire, Inc., et al., Case No. 1:07-cv-01210-WMN. Since then, two other putative class action lawsuits were filed in the United States District Court of Maryland against us and certain of our officers and directors and other parties making similar allegations, captioned Mark Reaves v. Sourcefire, Inc. et al, Case No. 1:07-cv-01351-JFM and Joan Raveill v. Sourcefire, Inc. et al, Case No. 1:07-cv-01425-WMN. In addition, a fourth putative class action lawsuit was filed in the United States District Court for the Southern District of New York against us and certain of our officers and directors and other parties making similar allegations, captioned Barry Pincus v. Sourcefire, Inc., et al., Case No. 1:07-cv-04720-RJH. Pursuant to a stipulation of the parties, in an order entered on or about June 29, 2007 by the United States District Court of the Southern District of New York, the court ordered that the Pincus case should be transferred to the United States District Court for the District of Maryland.

These actions claim to be filed on behalf of all persons or entities who purchased our common stock pursuant to the registration statement and prospectus issued in connection with the Company’s initial public offering. These lawsuits allege violations of Section 11, Section 12 and Section 15 of the Securities Act of 1933, as amended, in connection with allegedly material misleading statements and/or omissions contained in the registration statement and prospectus. The plaintiffs seek, among other things, a determination of class action status, compensatory and rescission damages, a rescission of the initial public offering, as well as fees and costs on behalf of a putative class.

On September 4, 2007, the Court granted a motion to consolidate the four putative class action lawsuits into a single civil action. In that same Order, the Court also appointed Ms. Amrheim as lead plaintiff, the law firm of Kaplan Fox & Kilsheimer LLP as lead counsel, and Tydings & Rosenberg LLP as liaison counsel. On October 4, 2007, Ms. Amrheim filed an Amended Consolidated Class Action Complaint asserting legal claims that previously had been asserted in one or more of the four original actions. Pursuant to a Stipulated Motion filed on October 22, 2007, the Company and the Individual Defendants will file a motion to dismiss the Amended Consolidated Class Action Complaint on or before November 20, 2007.

The Court has not made a determination of whether a putative class can be certified. At this time, plaintiffs have not specified the amount of damages they are seeking in these actions. We intend to vigorously defend these actions.

9. Commitments and Contingencies

The Company has entered into a purchase commitment with a hardware manufacturing vendor with whom it has a current arrangement. Under the terms of this commitment, the Company has agreed to purchase a fixed quantity of inventory over an 18-month period beginning in May of 2007. The value of the purchase commitment is approximately $800,000 of which $160,000 has been purchased to date.

Additionally, the Company purchases components for its products from a variety of suppliers and uses several contract manufacturers to provide manufacturing services for its products. During the normal course of business, in order to manage manufacturing lead times and help ensure adequate component supply, the Company enters into agreements with contract manufacturers and suppliers that allow them to procure inventory based upon information provided by the Company. In certain instances, these agreements allow the Company the option to cancel, reschedule, and adjust the Company’s requirements based on its business needs prior to firm orders being placed. Consequently, a portion of the Company’s reported purchase commitments arising from these agreements are firm, non-cancelable, and unconditional commitments. As of September 30, 2007, the Company had total purchase commitments for inventory of approximately $5.5 million, exclusive of the commitment described above.

The Company maintains office space in the United Kingdom which it intends to vacate within five years. The lease agreement requires that the Company return the office space to its original shell condition upon vacating the premises. The present value of the costs associated with this retirement obligation is approximately $140,000, payable upon termination of the lease. This cost is being accreted based on estimated discounted cash flows over the five year period.

10. Subsequent Event

On October 3, 2007, the stockholders of the Company approved the 2007 Employee Stock Purchase Plan (the “2007 ESPP”). The Board approved the 2007 ESPP to provide a means by which the Company’s employees (and employees of any parent or subsidiary of the Company as may be designated by the Board) will be given an opportunity to purchase shares of the Company’s common stock. The 2007 ESPP will be administered by the Board or an authorized committee of the Board. An aggregate of one million shares of the Company’s common stock has been reserved for issuance under the 2007 ESPP.


ITEM 2.		*MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS OF OPERATIONS*

Certain statements contained in this Quarterly Report on From 10-Q may constitute forward-looking statements within the meaning of Section 27A of the Securities Act of 1933, as amended, and Section 21E of the Securities Exchange Act of 1934, as amended. The words or phrases “would be,” “will allow,” “intends to,” “will likely result,” “are expected to,” “will continue,” “is anticipated,” “estimate,” “project,” or similar expressions, or the negative of such words or phrases, are intended to identify “forward-looking statements.” We have based these forward-looking statements on our current expectations and projections about future events. Because such statements include risks and uncertainties, actual results may differ materially from those expressed or implied by such forward-looking statements. Factors that could cause or contribute to these differences include those discussed below and elsewhere in this Quarterly Report on Form 10-Q, particularly in “Risk Factors,” and our other filings with the Securities and Exchange Commission. Statements made herein are as of the date of the filing of this Form 10-Q with the Securities and Exchange Commission and should not be relied upon as of any subsequent date. Unless otherwise required by applicable law, we do not undertake, and we specifically disclaim, any obligation to update any forward-looking statements to reflect occurrences, developments, unanticipated events or circumstances after the date of such statement.

The following discussion and analysis of our financial condition and results of operations should be read in conjunction with our consolidated financial statements and related notes that appear elsewhere in this Quarterly Report on Form 10-Q and in our other Securities and Exchange Commission filings, including our final prospectus dated March 8, 2007, which we filed in connection with our IPO. Our actual results could differ materially from those discussed in or implied by the forward-looking statements.

Overview

Sourcefire is a world leader in Enterprise Threat Management (“ETM”) solutions. The Company is transforming the way Global 2000 organizations and government agencies manage and minimize network security risks with its 3D Approach—Discover, Determine, Defend—to securing real networks. The Sourcefire 3D™ System is the first to unify IPS, NBA, NAC and Vulnerability Assessment technologies under a common management framework. This ETM approach equips customers with an efficient and effective layered security defense—protecting network assets before, during and after an attack.

The Company sells its network security solutions to a diverse customer base that includes 29 of the Fortune 100 and over half of the 30 largest U.S. government agencies. The Company also manages one of the security industry’s leading open source initiatives, Snort.

The Sourcefire 3D System is comprised of the following hardware and software product offerings:

Sourcefire Defense Center™ – The nerve center of the Sourcefire 3D System, Defense Center unifies critical network security functions including event monitoring, correlation, and prioritization with network and user intelligence for forensic analysis, trends analysis, reporting and alerting. Defense Center is highly extensible, providing application programming interfaces (“APIs”) to interoperate with a variety of third-party systems (e.g., firewalls, routers, SIEMs, trouble ticketing and patch management systems). Using Defense Center, customers can control multiple Sourcefire 3D Sensors from a single management console while aggregating and analyzing security and compliance events from across the organization.

Sourcefire 3D Sensors – Scaling from 5 Mbps to 10 Gbps, Sourcefire 3D Sensors are highly scalable, fault-tolerant appliances responsible for processing Sourcefire IPS, RNA, RUA and NetFlow Analysis software applications. Sourcefire 3D Sensors are available with a variety of copper and fiber interfaces to meet the connectivity needs of virtually any organization.

Sourcefire IPS™ (Intrusion Prevention System) – Built on the foundation of Snort, the world’s most popular open source intrusion prevention technology (also created by Sourcefire), Sourcefire’s IPS uses a rules-based language—a powerful combination of signature-, protocol-, and vulnerability-based inspection methods—to examine network packets for threats. Sourcefire’s IPS allows users to create, edit, and view detection rules, and full packet payloads are logged for every event so users can see exactly what threatening traffic has been detected. Sourcefire 3D Sensors equipped with Sourcefire IPS software can be placed in passive IDS mode to notify users of incoming threats or in inline IPS mode to block incoming threats.

Sourcefire RNA™ (Real-time Network Awareness) – At the heart of the Sourcefire 3D System is RNA, Sourcefire’s network intelligence product that provides persistent visibility into the composition, behavior, topology (the relationship of network components) and risk profile of the network. Network intelligence derived by RNA provides a platform for Defense Center’s automated decision-making and network policy compliance enforcement. The ability to continuously discover characteristics and vulnerabilities of virtually any computing device communicating on a network enables Sourcefire’s IPS to more precisely identify and block threatening traffic and to more efficiently classify threatening and/or suspicious behavior.

Sourcefire RUA™ (Real-time User Awareness) – Sourcefire RUA enables customers to link user identity to security and compliance events. RUA leverages existing investments in Active Directory or LDAP systems by pairing usernames with host IP addresses involved in security and compliance events. Additional user attributes—including first name, last name, email address, phone number and department—are also available at one’s fingertips. Now security and compliance events can be addressed quicker than ever, when time is of the essence.

Sourcefire NetFlow Analysis – Sourcefire NetFlow (NetFlow) aggregates data from Cisco routers and switches, thus extending the reach of Sourcefire’s network behavior analysis, or NBA, solution to corners of the network where Sourcefire 3D Sensors previously did not exist. The combination of RNA and NetFlow data provides customers with the ability to baseline “normal” network traffic across the enterprise, enabling security analysts to detect suspicious deviations (i.e., worm propagation) from established baselines. Further, the ability to analyze NetFlow also provides network managers with the network usage intelligence required to identify performance bottlenecks and/or areas of the network where too much bandwidth has been allocated.

Sourcefire Intrusion Agent for Snort – Many Sourcefire commercial customers start out as open source Snort users. To ease the migration from Snort to the more scalable and manageable Sourcefire 3D System, Sourcefire offers Intrusion Agent software that can be placed on open source Snort Sensors. This enables customers with Defense Center appliances to aggregate and analyze intrusion events from both open source Snort Sensors and commercial 3D Sensor appliances.

In addition to its commercial product offerings, Sourcefire also derives revenue from the following service offerings:

Sourcefire Customer Support – Sourcefire’s customer support is designed to ensure customer satisfaction with Sourcefire products. Sourcefire’s comprehensive support services include technical support online and over the phone, hardware repair/advanced replacement, and ongoing software updates to Sourcefire products.

Sourcefire Product Services – Sourcefire offers a variety of professional services solutions to provide customers with best practices for planning, installing, configuring, and managing all components of the Sourcefire 3D System. The Sourcefire Product Services Team provides customers with individualized, highly concentrated attention that gives organizations a “running start” and lasting knowledge transfer.

Sourcefire Education & Certification – Sourcefire offers a variety of training programs to help security professionals using Sourcefire commercial or open source security solutions get the most out of their investment. Sourcefire training includes instructor-led and custom classes delivered at various locations around the world, onsite at customer premises, and online. In addition, Sourcefire provides a path for interested candidates to distinguish themselves through a certification program. Certification can be achieved on both Sourcefire products and open source Snort, including an expert-level exam for those security professionals who want to obtain certification on both technologies. Through testing and training, certification provides customers and their employees with an understanding of individual skills and experience with Snort and Sourcefire products.

Sourcefire Vulnerability Research Team (VRT) Subscriptions – The Sourcefire VRT is a team of experienced network security developers responsible for writing, testing and publishing Snort rules to defend against both known and zero-day exploits. Snort rules published by the Sourcefire VRT are made available to open source Snort users at no charge on a 30-day delayed basis. Real-time VRT rules updates are made available to Sourcefire commercial IPS customers with an active customer support agreement and to open source Snort users on a subscription basis.

Initial Public Offering

In March 2007, we completed the initial public offering or IPO of our common stock in which we sold and issued 6,185,500 shares of our common stock, including 865,500 shares sold by us pursuant to the underwriters’ full exercise of their over-allotment option, at an issue price of $15.00 per share. We raised a total of $92.8 million in gross proceeds from the IPO, or approximately $83.9 million in net proceeds after deducting underwriting discounts and commissions of $6.5 million and other offering costs of $2.4 million. Upon the closing of the IPO, all shares of convertible preferred stock outstanding automatically converted into an aggregate of 14,302,056 shares of common stock.

Acquisition

During the quarter, we closed on our acquisition of the intellectual property assets of ClamAV, an open source gateway anti-virus and anti-malware project. We paid $3.5 million in cash to the former owners, and deposited $1 million in cash in escrow, which will be paid to the sellers upon the completion of the remaining source code, which we currently expect in the first quarter of 2008. We allocated $2.9 million of the purchase price to in-process research and development and allocated the remaining $634,000 to certain marketing related intangible assets, with the assistance of a third party valuation. The estimated fair value of the in-process research and development project was determined by the use of a discounted cash flow model, using a discount rate that took into account the stage of completion, and the risks surrounding the successful development and commercialization of the technology and product. The amounts allocated to in-process research and development were immediately expensed as there is no alternative future use for the acquired technology.

The $1 million in escrow, if paid to the sellers, will be accounted for as compensation expense, as the sellers are now our employees. We will evaluate the status of the sellers’ efforts in completing the source code at each reporting date and record a liability when the obligation of payment becomes probable as the payment is contingent upon the completion of the remaining source code. Additionally, we will evaluate whether any amount should be capitalized depending on the stage of development that results in the establishment of technological feasibility.

Key Financial Metrics and Trends

Pricing and Discounts

We maintain a standard price list for all our products. Additionally, we have a corporate policy that governs the level of discounts our sales organization may offer on our products based on factors such as transaction size, volume of products, federal or state programs, reseller or distributor involvement and the level of technical support commitment. Our total product revenue and the resulting cost of revenue and gross profit percentage are directly affected by our ability to manage our product pricing policy. Although we have not experienced pressure to reduce our prices, competition is increasing and, in the future, we may be forced to reduce our prices to remain competitive.

Revenue

We currently derive revenue from product sales and services. Product revenue is principally derived from the sale of our network security solutions. Our network security solutions include a perpetual software license bundled with a third-party hardware platform. Services revenue is principally derived from technical support and professional services. We typically sell technical support to complement our network security solutions. Technical support entitles a customer to product updates, new Rules releases and both telephone and web assistance for using our products. Our professional services revenue includes optional installation, configuration and tuning (“network security deployment services”). These network security deployment services typically occur on-site after delivery has occurred.

Product sales are typically recognized as revenue at shipment of the product to the customer, whether sold directly or through resellers. For sales made through distributors and original equipment manufacturers, or OEMs, we do not recognize revenue until we receive the monthly sales report which indicates the sell-through volume to end user customers. Revenue from services is recognized when the services are performed. For technical support services, revenue is recognized ratably over the term of the support arrangement, which is usually a 12-month agreement providing for payment in advance and automatic renewals.

We sell our network security solutions globally. However, over 80% of our revenue for 2006 and 77% of our revenue for the nine months ended September 30, 2007 was generated by sales to U.S.-based customers. We expect that our revenue from customers based outside of the United States will increase in amount and as a percentage of total revenue as we execute our strategy to strengthen our international presence. We also expect that our revenue from sales through OEMs and distributors will increase in amount and as a percentage of total revenue as we execute our strategy to expand such relationships. We manage our operations on a consolidated basis for purposes of assessing performance and making operating decisions. Accordingly, our business does not have reportable segments.

Revenue from product sales has historically been highly seasonal, with more than one-third of our total product revenue in recent fiscal years generated in the fourth quarter. The timing of our year-end shipments could materially affect our fourth quarter product revenue in any fiscal year and sequential quarterly comparisons. Revenue from our government customers has occasionally been influenced by the September 30th fiscal year-end of the U.S. federal government, which has historically resulted in our revenue from government customers being highest in the third quarter. Although we do not expect these general seasonal patterns to change substantially in the future, our revenue within a particular quarter is often affected significantly by the unpredictable procurement patterns of our customers. Our prospective customers usually spend a long time evaluating and making purchase decisions for network security solutions. Historically, many of our customers have not finalized their purchasing decisions until the final weeks or days of a quarter. We expect these purchasing patterns to continue in the future. Therefore, a delay in even one large order beyond the end of the quarter could materially reduce our anticipated revenue for a quarter. Because many of our expenses must be incurred before we expect to generate revenue, delayed orders could negatively impact our results of operations for the period and cause us to fail to meet the financial performance expectations of securities industry research analysts or investors.

Cost of Revenue

Cost of product revenue includes the cost of the hardware platform bundled into our network security solution, royalties for third-party software included in our network security solution, materials and labor that are incorporated in the quality assurance of our products, logistics, warranty, shipping and handling costs and, in the limited instance where we lease our network security solutions to our customers, depreciation and amortization. For the three months ended September, 2007 and 2006, cost of product revenue was 28% and 26% of total product revenue for each period, respectively. For the nine months ended September, 2007 and 2006, cost of product revenue was 28% and 27% of total product revenue for each period, respectively. Hardware costs, which are our most significant cost item, generally have not fluctuated materially as a percentage of revenue in recent years because competition among hardware platform suppliers has remained strong and, therefore, per unit hardware cost has remained consistent. Because of the competition among hardware suppliers and our outsourcing of the manufacture of our products to three separate domestic contract manufacturers, we currently have no reason to expect that our cost of product revenue as a percentage of total product revenue will change significantly in the foreseeable future due to hardware pricing increases. However, hardware or other costs of manufacturing may increase in the future. We incur labor and associated overhead expenses, such as occupancy costs and fringe benefits costs, as part of managing the outsourced manufacturing process. These costs are included as a component of our cost of product revenue, but they have not been material.

Cost of service revenue includes the direct labor costs of professionals and outside consultants engaged to furnish those services, as well as their travel and associated direct material costs. Additionally, we include in cost of service revenue an allocation of overhead expenses such as occupancy costs, fringe benefits and supplies as well as the cost of time and materials to service or repair the hardware component of our products covered under a renewed support arrangement beyond the manufacturer’s warranty. For the three months ended September 30, 2007 and 2006, cost of service revenue was 15% and 18%, respectively, of total service revenue. For the nine months ended September 30, 2007 and 2006, cost of service revenue was 15% and 19%, respectively, of total service revenue. We anticipate incurring an increasing amount of costs in the future for additional personnel to support and service our growing customer base.

Gross Profit

Our gross profit is affected by a variety of factors, including competition, the mix and average selling prices of our products, our pricing policy, technical support and professional services, new product introductions, the cost of hardware platforms, the cost of labor to generate such revenue and the mix of distribution channels through which our products are sold. Although we have not had to reduce the prices of our products or vary our pricing policy in recent years, our gross profit would be adversely affected by price declines if we are unable to reduce costs on existing products and fail to introduce new products with higher margins. Currently, product sales typically have a lower gross profit as a percentage of revenue than our services due to the cost of the hardware platform. Our gross profit for any particular quarter could be adversely affected if we do not complete a sufficient level of sales of higher-margin products by the end of the quarter. As discussed above, many of our customers do not finalize purchasing decisions until the final weeks or days of a quarter, so a delay in even one large order of a higher-margin product could reduce our total gross profit percentage for that quarter. For the three months ended September 30, 2007 and 2006, gross profit was 77% of total revenue for both periods. For the nine months ended September 30, 2007 and 2006, gross profit was 78% and 76%, respectively, of total revenue. Based on current market conditions, we do not expect these percentages to change significantly in the foreseeable future, although unexpected pricing pressures or an increase in hardware or other costs would cause our gross profit percentage to decline.

Operating Expenses

Research and Development. Research and development expenses consist primarily of payroll, benefits and related occupancy and other overhead for our engineers, costs for professional services to test our products, and costs associated with data used by us in our product development.

We have significantly expanded our research and development capabilities and expect to continue to expand these capabilities in the future. We are committed to increasing the level of innovative design and development of new products as we strive to enhance our ability to serve our existing commercial and federal government markets as well as new markets for security solutions. To meet the changing requirements of our customers, we will need to fund investments in several development projects in parallel. Accordingly, we anticipate that our research and development expenses will continue to increase in absolute dollars for the foreseeable future, but should decline moderately as a percentage of total revenue as we expect to grow our revenues more rapidly than our research and development expenditures. For the three months ended September 30, 2007 and 2006, research and development expense was $2.9 million and $2.1 million, or 20% and 19% of total revenue, respectively. For the nine months ended September 30, 2007 and 2006, research and development expense was $8.1 million and $6.3 million, or 22% of total revenue for both periods.

Sales and Marketing. Sales and marketing expenses consist primarily of salaries, incentive compensation, benefits and related costs for sales and marketing personnel; trade show, advertising, marketing and other brand-building costs; marketing consultants and other professional services; training, seminars and conferences; travel and related costs; and occupancy and other overhead costs.

As we focus on increasing our market penetration, expanding internationally and continuing to build brand awareness, we anticipate that selling and marketing expenses will continue to increase in absolute dollars, but decrease as a percentage of our revenue, in the future.

For the three months ended September 30, 2007 and 2006, sales and marketing expense was $6.7 million and $4.9 million, or 46% of total revenue for both periods. For the nine months ended September 30, 2007 and 2006, sales and marketing expense was $18.6 million and $14.5 million, or 51% and 50% of total revenue, respectively.

General and Administrative. General and administrative expenses consist primarily of salaries, incentive compensation, benefits and related occupancy costs for executive, finance, information system and administrative personnel; legal, accounting and tax preparation and advisory fees; travel and related costs; information systems and infrastructure costs; and corporate insurance.

General and administrative expenses have increased during the period of time leading up to our IPO, and as we operate as a public company, we expect to incur additional expenses for costs associated with compliance with Section 404 of the Sarbanes-Oxley Act of 2002, directors’ and officers’ liability insurance, and our investor relations function.

For the three months ended September 30, 2007 and 2006, general and administrative expense was $2.5 million and $1.1 million, or 16% and 10% of total revenue, respectively. For the nine months ended September 30, 2007 and 2006, general and administrative expense was $7.3 million and $3.6 million, or 20% and 13% of total revenue, respectively.

Acquired in-process research and development costs. Acquired in-process research and development costs consists of amounts allocated to acquired assets for which technological feasibility has not yet been reached and no alternative future use exists.

As we consider merger and acquisition opportunities in the future, the purchase price for any such completed transactions must be allocated to the assets acquired on the basis of their relative fair value. We plan to determine these allocations using the assistance of third party valuation practitioners. These allocations may result in assigning a portion of the purchase price to in-process research and development which is then immediately expensed.

For the three and nine months ended September 30, 2007 acquired in-process research and development costs were $2.9 million for both periods. There was no corresponding expense during the same periods in 2006.

Stock-Based Compensation. Effective January 1, 2006, we adopted the fair value recognition provisions of the Financial Accounting Standards Board’s SFAS No. 123(R), “Share-Based Payment,” using the prospective transition method, which requires us to apply its provisions only to awards granted, modified, repurchased or cancelled after the effective date. Under this transition method, stock-based compensation expense recognized beginning January 1, 2006 is based on the grant date fair value of stock awards granted or modified after January 1, 2006.

As a result of adopting SFAS No. 123(R) on January 1, 2006, based on the estimated grant date fair value of employee stock options subsequently granted or modified, we recognized aggregate stock-based compensation expense of $719,000 and $142,000 for the three months ended September 30, 2007 and 2006, respectively and $1,911,000 and $282,000 for the nine months ended September 30, 2007 and 2006, respectively. We use the Black-Scholes option pricing model to estimate the calculated value of granted stock options. The use of option valuation models requires the input of highly subjective assumptions, including the expected term and the expected stock price volatility.

The grant date fair value of options not yet recognized as expense as of September 30, 2007 aggregated approximately $5.7 million, net of estimated forfeitures, which will be recognized over a weighted-average period of 3.03 years. We expect to record aggregate amortization of stock-based compensation related to granted stock options of approximately $0.5 million for the remainder of fiscal year 2007 and $1.9 million, $1.8 million, $1.3 million and $0.2 million during fiscal years 2008, 2009, 2010 and 2011, respectively, from these outstanding awards, subject to continued vesting.

Critical Accounting Policies and Estimates

Our consolidated financial statements are prepared in accordance with accounting principles generally accepted in the United States of America. The preparation of these consolidated financial statements requires us to make estimates and assumptions that affect the reported amounts of assets, liabilities, revenue, costs and expenses and related disclosures. We evaluate our estimates and assumptions on an ongoing basis. Our actual results may differ from these estimates.

We believe that, of our significant accounting policies, which are described in Note 3 to our unaudited consolidated financial statements contained in this report, the following accounting policies involve a greater degree of judgment and complexity. Accordingly, we believe that the following accounting policies are the most critical to aid in fully understanding and evaluating our consolidated financial condition and results of operations.

Revenue Recognition. We recognize substantially all of our revenue in accordance with Statement of Position No. 97-2, “Software Revenue Recognition,” or SOP 97-2, as amended by SOP 98-4 and SOP 98-9. For each arrangement, we defer revenue recognition until all of the following criteria have been met:

	•		persuasive evidence of an arrangement exists (e.g., a signed contract);

	•		delivery of the product has occurred and there are no remaining obligations or substantive customer acceptance provisions;

	•		the fee is fixed or determinable; and

	•		collection of the fee is probable.

We allocate the total value of the arrangement among each deliverable based on its fair value as determined by vendor-specific objective evidence, such as standard product discount levels, daily service rates and consistent support level renewal pricing. If vendor-specific objective evidence of fair value does not exist for each of the deliverables, all revenue from the arrangement is further deferred until the earlier of the point at which sufficient vendor-specific objective evidence of fair value can be determined or all elements of the arrangement have been delivered. However, if the only undelivered elements are those for which we currently have established vendor specific objective evidence of fair value, we recognize revenue for the delivered elements using the residual method. Changes in judgments and estimates about these assumptions could materially impact the timing of revenue recognition.

Accounting for Stock-Based Compensation. In December 2004, the Statement of Financial Accounting Standard (“SFAS”) No. 123(R), Share-Based Payment (“SFAS No. 123(R)”) was issued. SFAS No. 123(R) focuses primarily on transactions in which an entity obtains employee services in exchange for share-based payments. Under SFAS No. 123(R), we generally are required to measure the cost of employee services received in exchange for an award of equity instruments based on the grant date fair value of the award, with such cost recognized over the applicable requisite service period. In addition, SFAS No. 123(R) requires us to provide certain disclosures in order to assist in understanding the nature of share-based payment transactions and the effects of those transactions on the financial statements.

Effective January 1, 2006, we adopted the fair value recognition provisions of SFAS No. 123(R) using the prospective transition method, which requires us to apply its provisions only to awards granted, modified, repurchased or cancelled after the effective date. Under this transition method, stock-based compensation expense recognized beginning January 1, 2006 is based on the grant date fair value of stock awards granted or modified after January 1, 2006. As we had used the minimum value method for valuing our stock options under the disclosure requirements of Statement of Financial Accounting Standard (“SFAS”) No. 123, Accounting for Stock Based Compensation (“SFAS No. 123”), all options granted prior to January 1, 2006 continue to be accounted for under Accounting Principles Board Opinion No. 25, Accounting for Stock Issued to Employees (“APB No. 25”). Additionally, the pro forma disclosures that were required under the original provisions of SFAS No. 123 are no longer provided for outstanding awards accounted for under the intrinsic-value method of APB No. 25 beginning in periods after the adoption of SFAS No. 123(R).

Prior to March 8, 2007, we did not have any class of capital stock that was covered by an effective registration statement, and thus we had no public market from which we could determine fair value of any share based payments. Accordingly, for share-based payments made prior to March 8, 2007, we conducted contemporaneous valuations relying on the guidance prescribed by the American Institute of Certified Public Accountants in its practice aid, “Valuation of Privately-Held-Company Equity Securities Issued as Compensation,” or the Practice Aid, in order to determine the grant date fair value of such share-based payments. In each instance where we made such a valuation determination, and as more fully described below, we generally first determined a fair value of the enterprise using one or both of the market approach or the income approach, as described in the Practice Aid. Once we determined an estimated fair value of the enterprise, we then allocated that enterprise value to each of our classes of stock based upon a consideration of those classes’ relative economic and control rights, using a methodology consistent with the Practice Aid, as discussed in further detail below.

We did not obtain contemporaneous valuations by an unrelated valuation specialist that we could rely on during the periods outlined below. Instead, we relied on the experience of our management team and our board of directors, which includes several venture capitalists who have considerable experience in the valuation of emerging companies and one member with extensive experience as a chief financial officer of a publicly traded company who joined our board in August 2006.

In January 2007, we granted options to purchase a total of 67,730 shares of our common stock to our employees at an exercise price of $12.26 per share. In accordance with SFAS 123(R), we measured share-based compensation expense with respect to these grants using the Black-Scholes option pricing model using a fair value of our common stock of $12.26 per share. In concluding that $12.26 was the fair value of our common stock, we calculated an enterprise value of $250.0 million using a market approach, which we corroborated using both an income approach that considered discounted cash flows and valuation discussions that we conducted with our underwriters with respect to other recent technology initial public offerings, and our perceptions of the then-current market conditions.

In allocating the $250.0 million enterprise value, we followed the probability-weighted expected return method. Thus, we assigned a 100% likelihood that the IPO scenario would occur and a 0% likelihood that the M&A scenario would occur. Under the IPO scenario, we calculated the fair value of approximately $12.26 per share assuming conversion of all securities into shares of common stock. Thus, in January 2007, our board of directors considered the foregoing analysis and concluded that $12.26 was the best estimate of the fair value of our common stock for purposes of granting options at that time.

On March 9, 2007, we granted certain executives options to purchase an aggregate of 57,243 shares of common stock at an exercise price of $15.49. Additionally, on March 9, 2007, we granted certain of our executives and our board members an aggregate of 60,126 shares of restricted stock. Our board of directors determined that $15.49 was the best estimate of the fair value of our common stock for the purposes of granting options at that time because that was the per share price of our common stock as reported on NASDAQ Global Market as of close of business on March 9, 2007, and that approach was consistent with the terms and conditions of our 2007 Stock Incentive Plan.

For the period after March 9, 2007 and through September 30, 2007, we granted additional options to employees to purchase an aggregate of 289,541 shares of common stock. In accordance with the terms of our 2007 Stock Incentive Plan, the exercise prices for these grants are equal to the per share price of our common stock as reported on NASDAQ Global Market as of the close of business on the respective grant dates.

As noted above, we use the Black-Scholes option pricing model to estimate the calculated value of granted stock options. The use of option valuation models requires the input of highly subjective assumptions, including the expected term and the expected stock price volatility. Additionally, the recognition of expense requires the estimation of the number of options that will ultimately vest and the number of options that will ultimately be forfeited. Accordingly, the use of different estimates and assumptions can have a significant impact on the amount of stock-based compensation that is measured and recognized.

Accounting for Income Taxes. We account for income taxes in accordance with FASB Statement No. 109, Accounting for Income Taxes. Deferred income taxes are recorded for the expected tax consequences of temporary differences between the tax basis of assets and liabilities for financial reporting purposes and amounts recognized for income tax purposes. We record a valuation allowance to reduce our deferred tax assets to the amount of future tax benefit that is more likely than not to be realized. At September 30, 2007 and December 31, 2006, we recorded a valuation allowance equal to our net deferred tax assets since it was not more likely than not that such benefits would be realized. We recorded a provision for income taxes of $50,000 for the three month period ended September 30, 2007 and $120,000 for the nine month period ended September 30, 2007 principally related to foreign income taxes. For the year ending December 31, 2007, we anticipate an overall effective income tax rate of (13)%, consisting of state and foreign income taxes, and alternative minimum tax. The change in the overall effective income tax rate from the prior quarter was due to changes in forecasted net income(loss) for the year and tax projections for the Company’s various tax jurisdictions.

Warranty. We warrant that our software will perform in accordance with its documentation for a period of ninety days from the date of shipment. Similarly, we warrant that the hardware will perform in accordance with its documentation for a period of one year from date of shipment. We further agree to repair or replace software or products that do not conform to those warranties. The one year warranty on hardware coincides with the hardware warranty that we obtain from the manufacturer. We estimate the costs that may be incurred under our warranties, currently at less than 1.5% of product revenue, and record a liability at the time product revenue is recognized. Factors that affect our warranty liability include the number of installed units, historical and anticipated rates of warranty claims and the estimated cost per claim. We periodically assess the adequacy of our recorded warranty liability and adjust the amounts as necessary. While warranty costs have historically been within management’s expectations, it is possible that warranty rates will change in the future based on new product introductions and other factors.

Bad Debt Reserve. We have historically used a rate of 1.0%-2.0% of outstanding accounts receivable to estimate our reserve for bad debts based on analysis of past due balances and historical experiences of write-offs. As we expand our business, we expect our accounts receivable balance to grow. If our future experience of actual write-offs for bad debts exceeds 1.0%-2.0% of our accounts receivable balance, we will have to increase our reserve accordingly.

Inventory Valuation. We outsource our manufacturing and our products are generally drop-shipped directly to our customers by the manufacturers. Therefore, we usually carry relatively little inventory. The inventory on our balance sheet also includes products that we use for demonstration purposes at customer locations. We value our inventory at the lower of the actual cost of our inventory or its current estimated market value. We write down inventory for obsolescence or lack of marketability based upon condition of the inventory and our view about future demand and market conditions. Because of the seasonality of our product sales, obsolescence of technology and product life cycles, we generally write down inventory to net realizable value based on forecasted product demand. Actual demand and market conditions may be lower than those that we project and this difference could have a material adverse effect on our gross profit if inventory write-downs beyond those initially recorded become necessary.

Results of Operations

The following table sets forth our results of operations for the periods shown:


	Three Months Ended												Nine Months Ended
	September 30						Variance						September 30						Variance
	2007			2006			$			%			2007			2006			$			%
Revenue:
Products	$	9,403		$	6,927		$	2,476			36	%	$	21,103		$	18,390		$	2,713			15	%
Technical Support and Professional Services		5,403			3,940			1,463			37	%		15,418			10,544			4,874			46	%

Total revenue		14,806			10,867			3,939			36	%		36,521			28,934			7,587			26	%
Cost of revenue:
Products		2,665			1,813			852			47	%		5,809			4,931			878			18	%
Technical Support and Professional Services		800			725			75			10	%		2,277			2,016			261			13	%

Total cost of revenue		3,465			2,538			927			37	%		8,086			6,947			1,139			16	%

Gross profit		11,341			8,329			3,012			36	%		28,435			21,987			6,448			29	%
Operating expenses:
Research and development		2,895			2,082			813			39	%		8,076			6,334			1,742			28	%
Sales and marketing		6,746			4,929			1,817			37	%		18,563			14,512			4,051			28	%
General and administrative		2,540			1,103			1,437			130	%		7,288			3,587			3,701			103	%
Depreciation and amortization		427			306			121			40	%		1,177			912			265			29	%
Write-off of acquired in-process research and development costs		2,947			—			2,947			100	%		2,947			—			2,947			100	%

Total operating expenses		15,555			8,420			7,135			85	%		38,051			25,345			12,706			50	%

Operating loss		(4,214	)		(91	)		(4,123	)		4531	%		(9,616	)		(3,358	)		(6,258	)		(186	%)
Other income (expense), net		1,420			296			1,124			380	%		3,307			442			2,865			648	%


Income (loss) before income taxes		(2,794	)		205			(2,999	)		(1463	%)		(6,309	)		(2,916	)		(3,393	)		(116	%)
Income tax expense		(50	)		—			(50	)		100	%		(120	)		—			(120	)		100	%

Net Income (loss)	$	(2,844	)	$	205		$	(3,049	)		(1487	%)	$	(6,429	)	$	(2,916	)	$	(3,513	)		(120	%)

The following table sets forth our results of operations as a percentage of total revenue for the periods shown:


	Three Months						Nine Months
	Ended						Ended
	September 30						September 30
	2007			2006			2007			2006
Revenue:
Products		64	%		64	%		58	%		64	%
Technical Support and Professional Services		36	%		36	%		42	%		36	%
Total revenue		100	%		100	%		100	%		100	%
Cost of revenue:
Products		18	%		17	%		16	%		17	%
Technical Support and Professional Services		5	%		6	%		6	%		7	%
Total cost of revenue		23	%		23	%		22	%		24	%
Gross profit		77	%		77	%		78	%		76	%
Operating expenses:
Research and development		20	%		19	%		22	%		22	%
Sales and marketing		46	%		46	%		51	%		50	%
General and administrative		16	%		10	%		20	%		13	%
Depreciation and amortization		3	%		3	%		3	%		3	%
Write-off of acquired in-process research and development costs		20	%		0	%		8	%		0	%

Total operating expenses		105	%		78	%		104	%		88	%

Operating loss		(28	)%		(1	)%		(26	)%		(12	)%

Other income (expense), net		10	%		3	%		9	%		2	%
Income (loss) before income taxes		(18	)%		2	%		(17	)%		(10	)%

Income tax expense		(1	)%		0	%		(1	)%		0	%

Net income (loss)		(19	)%		2	%		(18	)%		(10	)%

Comparison of Three Months Ended September 30, 2007 and 2006

Revenue. Total revenue increased 36% to $14.8 million in the three months ended September 30, 2007 from $10.9 million in the three months ended September 30, 2006. Product revenue increased to $9.4 million in the three months ended September 30, 2007 from $6.9 million in the three months ended September 30, 2006. We did not ship any new products that had a material effect on revenue during the three months ended September 30, 2007, nor did we change the prices of our products significantly during the three months ended September 30, 2007. The increase in product revenue was driven primarily due to higher demand for our sensor products which increased $2.6 million and additional royalty sales which increased $400,000. These increases were offset by a decrease in sales of our RNA Host License products of $520,000. Our services revenue increased 37% to $5.4 million in the three months ended September 30, 2007 from $3.9 million in the three months ended September 30, 2006. The increase in service revenue was attributable primarily to the fact that our support services are being provided to a larger installed customer base comprised of new customers as well as current customers who have renewed their maintenance subscriptions.

Cost of Revenue. Total cost of revenue increased 37% to $3.5 million in the three months ended September 30, 2007, compared to $2.5 million in the three months ended September 30, 2006. Product cost of revenue was $2.7 million for the three months ended September 30, 2007 and $1.8 million for the three months ended September 30, 2006. The increase in product cost of revenue was driven primarily due to higher volume demand for our sensor products for which we must procure and provide the hardware platform to our customers. During the three months ended September 30, 2007, we did not experience a material increase in our cost per unit of hardware platforms, which is the largest component of our product cost of revenue. Our services cost of revenue increased 10% to $800,000 in the three months ended September 30, 2007, compared to $725,000 in the three months ended September 30, 2006. This increase was attributable to our hiring of additional personnel to both service our larger installed customer base and to provide training and professional services to our customers.

Gross Profit. Gross profit increased $3.0 million, or 36%, to $11.3 million in the three months ended September 30, 2007, from $8.3 million in the three months ended September 30, 2006. Gross profit as a percentage of total revenue was 77% for the three months ended September 30, 2007 and September 30, 2006. Our service revenue gross margin increased as service revenues grew at a higher rate than our service expenses. This was offset, however, by a decrease in our product revenue gross margin as we incurred additional hardware platform costs primarily due to the product mix sold being more appliance based. This resulted in the gross margin percentage between periods remaining flat.

Research and Development. Research and development expenses increased 39% to $2.9 million, or 20% of total revenue, in the three months ended September 30, 2007 from $2.1 million, or 19% of total revenue, in the three months ended September 30, 2006. The increase in the amount of research and development expenses was primarily due to an increase in payroll, benefits and overhead expenses of $547,000, an increase of consulting expenses of $142,000 and an increase in stock-based compensation expense of $68,000 all of which resulted from adding personnel in our research and development department to support the release of updates and enhancements to our 3D products.

Sales and Marketing. Sales and marketing expenses increased 37% to $6.7 million, or 46% of total revenue, in the three months ended September 30, 2007 from $4.9 million, or 46% of total revenue, in the three months ended September 30, 2006. The increase in the amount of sales and marketing expenses was primarily due to an increase of $632,000 in payroll and benefit expenses for additional sales and marketing personnel, an increase of $111,000 in sales travel and entertainment expenses, an increase of $245,000 for stock-based compensation expense and an increase in $234,000 for advertising, promotion, partner marketing programs and trade show expenses in support of our network security solutions.

General and Administrative. General and administrative expenses increased 130% to $2.5 million, or 16% of total revenue in the three months ended September 30, 2007 from $1.1 million, or 10% of total revenue in the three months ended September 30, 2006. This increase in general and administrative expense was primarily due to increase of payroll and benefits of $409,000 for personnel hired in our accounting, information technology, human resources and legal departments, an increase of $215,000 for stock-based compensation expense, an increase of $403,000 in consultant fees related to audit, tax and regulatory compliance, and an increase of $136,000 in insurance premiums primarily due to an increase in our D&O insurance coverage.

Depreciation and Amortization. Depreciation and amortization expenses increased 40% to $427,000 in the three months ended September 30, 2007 from $306,000 in the three months ended September 30, 2006. These expenses increased principally due to amortization of leasehold improvements to our UK office, additional lab and testing equipment purchased for the engineering department and personal computers purchased for personnel hired since September 30, 2006.

Acquired in-process research and development costs. For the three month period ended September 30, 2007 charges for in-process research and development totaled $2.9 million with no corresponding expense during the same period in 2006. The charge in 2007 is attributable to the August 2007 acquisition of certain assets of ClamAV for which technological feasibility had not yet been reached and no alternative future use existed.

Other income (expense). Other income (expense) increased $1.1 million to $1.4 million during the three months ended September 30, 2007 from $296,000 in the three months ended September 30, 2006. The increase was primarily due to an increase in interest and investment income as a result of higher cash balances resulting from our March 2007 IPO.

Provision for income taxes. The provision for income taxes was $50,000 for the three months ended September 30, 2007 as compared to no provision for the three months ended September 30, 2006. We record a valuation allowance to reduce our deferred tax assets to the amount of future tax benefit that is more likely than not to be realized. At September 30, 2007 and 2006, our net deferred tax assets were fully reserved. The provision for income taxes of $50,000 for the three months ended September 30, 2007 principally relates to foreign income taxes.

Comparison of Nine Months Ended September 30, 2007 and 2006

Revenue. Total revenue increased 26% to $36.5 million in the nine months ended September 30, 2007 from $28.9 million in the nine months ended September 30, 2006. Product revenue increased 15% to $21.1 million in the nine months ended September 30, 2007 from $18.4 million in the nine months ended September 30, 2006. We did not ship any new products that had a material effect on revenue during the nine months ended September 30, 2007, nor did we change the prices of our products significantly during the nine months ended September 30, 2007. The increase in product revenue was driven primarily due to higher demand for our defense center and sensor products which increased $2.3 million and royalty sales which increased $661,000; these increases were offset by a decrease in sales of our RNA Host License products of $433,000. Our services revenue increased 46% to $15.4 million in the nine months ended September 30, 2007 from $10.5 million in the nine months ended September 30, 2006. The increase in service revenue was attributable primarily to the fact that our support services are being provided to a larger installed customer base comprised of new customers as well as current customers who have renewed their maintenance subscriptions.

Cost of Revenue. Total cost of revenue increased 16% to $8.1 million in the nine months ended September 30, 2007, compared to $6.9 million in the nine months ended September 30, 2006. Product cost of revenue increased 18% to $5.8 million in the nine months ended September 30, 2007, compared to $4.9 million in the nine months ended September 30, 2006. The increase in product cost of revenue was primarily due to higher volume demand for our sensor and defense center products for which we must procure and provide the hardware platform to our customers. During the nine months ended September 30, 2007, we did not experience a material increase in our overall cost per unit of hardware platforms, which is the largest component of our product cost of revenue. Our services cost of revenue increased 13% to $2.3 million in the nine months ended September 30, 2007, compared to $2.0 million in the nine months ended September 30, 2006. This increase was attributable to our hiring of additional personnel to both service our larger installed customer base and to provide training and professional services to our customers.

Gross Profit. Gross profit increased $6.4 million, or 29%, to $28.4 million in the nine months ended September 30, 2007, from $22.0 million in the nine months ended September 30, 2006. Gross profit as a percentage of total revenue increased to 78% in the nine months ended September 30, 2007, from 76% in the nine months ended September 30, 2006. The increase in the gross profit percentage was due primarily to our service revenue growing at a higher rate than our service expenses.

Research and Development. Research and development expenses increased 28% to $8.1 million, or 22% of total revenue, in the nine months ended September 30, 2007 from $6.3 million, or 22% of total revenue, in the nine months ended September 30, 2006. The increase in the amount of research and development expenses was primarily due to an increase in payroll and benefits of $1.3 million, an increase in facility overhead of $311,000 and an increase in stock-based compensation expense of $214,000 all of which resulted from adding personnel in our research and development department to support the release of updates and enhancements to our 3D products. These increases were offset by a reduction in consulting expenses of $77,000.

Sales and Marketing. Sales and marketing expenses increased 28% to $18.6 million, or 51% of total revenue, in the nine months ended September 30, 2007 from $14.5 million, or 50% of total revenue, in the nine months ended September 30, 2006. The increase in the amount of sales and marketing expenses was primarily due to an increase of $1.9 million in salary and benefit expenses for additional sales and marketing personnel, an increase of $636,000 for stock-based compensation expense, an increase of $350,000 in sales travel and entertainment expenses and an increase in $558,000 for advertising, promotion, partner marketing programs and trade show expenses in support of our network security solutions.

General and Administrative. General and administrative expenses increased 103% to $7.3 million, or 20% of total revenue in the nine months ended September 30, 2007 from $3.6 million, or 13% of total revenue in the nine months ended September 30, 2006. This increase in general and administrative expense was primarily due to an increase in payroll and benefits of $928,000 for personnel hired in our accounting, information technology, human resources and legal departments, an increase of $713,000 for stock-based compensation expense, an increase of $703,000 in consultant fees related to audit, tax and regulatory compliance, and an increase of $334,000 in insurance premiums primarily due to an increase in our D&O insurance coverage.

Depreciation and Amortization. Depreciation and amortization expenses increased 29% to $1.2 million in the nine months ended September 30, 2007 from $912,000 in the nine months ended September 30, 2006. These expenses increased principally due to amortization of leasehold improvements to our UK office, additional lab and testing equipment purchased for the engineering department and personal computers purchased for personnel hired since September 30, 2006.

Acquired in-process research and development costs. For the nine month period ended September 30, 2007 charges for in-process research and development totaled $2.9 million with no corresponding expense during the same period in 2006. The charge in 2007 is attributable to the August 2007 acquisition of certain assets of ClamAV for which technological feasibility had not yet been reached and no alternative future use existed.

Other income (expense). Other income (expense) increased $2.9 million to $3.3 million during the nine months ended September 30, 2007 from $442,000 in the nine months ended September 30, 2006. The increase was primarily due to an increase in interest and investment income as a result of higher cash and investment balances resulting from our March 2007 IPO.

Provision for income taxes. The provision for income taxes was $120,000 for the nine months ended September 30, 2007. We did not record a provision for the nine months ended September 30, 2006. We record a valuation allowance to reduce our deferred tax assets to the amount of future tax benefit that is more likely than not to be realized. At September 30, 2007 and 2006, our net deferred tax assets were fully reserved. The provision for income taxes of $120,000 for the nine months ended September 30, 2007 principally relates to foreign income taxes.

Seasonality

Our product revenue has tended to be seasonal. In our third quarter, we have historically benefited from the Federal government’s fiscal year end purchasing activity. This increase has been partially offset by European sales, which have tended to decline significantly in the summer months due to the practice of many Europeans taking extended vacation time and delaying capital purchase activities until their return in the fall. We have historically generated a significant portion of product revenue in the fourth quarter due to the combination of increased activity in Europe coupled with North American enterprise customers who often wait until the fourth quarter to extract favorable pricing terms from their vendors, including Sourcefire. The timing of these shipments could materially affect our year-end product revenue. Currently, we do not see any indication that these seasonal patterns will change significantly in the foreseeable future.

Quarterly Timing of Revenue

On a quarterly basis, we have usually generated the majority of our product revenue in the final month of each quarter. We believe this occurs for two reasons. First, many customers wait until the end of the quarter to extract favorable pricing terms from their vendors, including Sourcefire. Second, our sales personnel, who have a strong incentive to meet quarterly sales targets, have tended to increase their sales activity as the end of a quarter nears, while their participation in sales management review and planning activities are typically scheduled at the beginning of a quarter.

Liquidity and Capital Resources

At September 30, 2007 our principal sources of liquidity were cash and cash equivalents of $27.2 million, held-to-maturity investments of $76.1 million and accounts receivable of $13.9 million. At September 30, 2007, we had working capital of approximately $98.3 million.

Prior to our IPO in March 2007, we funded our operations primarily through private sales of our convertible preferred stock and collections from our customers and, to a lesser extent, borrowings under a credit facility. In March 2007, we completed our IPO which provided us with aggregate net proceeds of $83.9 million.

We manufacture and distribute our products through contract manufacturers and OEMs. We believe that this approach gives us the advantages of relatively low capital investment and significant flexibility in scheduling production and managing inventory levels. By leasing our office facilities, we also minimize the cash needed for expansion. Our capital spending is generally limited to leasehold improvements, computers, office furniture and product-specific test equipment. The majority of our products are delivered to our customers directly from our contract manufacturers. Accordingly, our contract manufacturers are responsible for purchasing and stocking the components required for the production of our products and they invoice us when the finished goods are shipped.

Our product sales are, and are expected to continue to be, highly seasonal. This seasonality typically results in a significant amount of cash provided by our operating activities during the first half of the year with lower to negative cash flow during the second half of the year. We believe that our current cash reserves are sufficient for any short-term cash needs resulting from the seasonality of our business.

Operating Activities

The decrease of $2.6 million in net cash provided by operating activities during the nine months ended September 30, 2007, as compared to the same period in 2006, was primarily due to an increase of cash used to purchase inventory of long lead time items, an increase of our net loss and an increase in pre-payments by us for service contracts, licensing agreements and marketing events. These uses of cash were offset partially by cash provided by an increase in deferred revenue, an increase in stock-based compensation expense and the write-off of acquired in-process research and development costs due to the ClamAV acquisition.

Investing Activities

The increase of $68.8 million in net cash used in investing activities during the nine months ended September 30, 2007, as compared to the same period in 2006, was primarily due to an increase in purchases of short and long-term held-to-maturity investments, the cash paid for the ClamAV acquisition, an increase in leasehold improvements for our office space in the U.K. and computer and network equipment for additional personnel.

Financing Activities

The increase of $61.5 million in net cash provided by financing activities during the nine months ended September 30, 2007, as compared to the same period in 2006, was primarily due to the $83.9 million net cash proceeds of our IPO, offset by the retirement of indebtedness in 2007 in the amount of $1.4 million and proceeds received from a private equity financing of $23.0 million in May and June of 2006.

Working Capital and Capital Expenditure Needs

We believe that the anticipated net proceeds from our future operations, together with our cash balance at September 30, 2007 will be sufficient to fund our projected operating requirements for at least the next 12 months. Except as disclosed in the Contractual Obligations table below, we currently have no material cash commitments, except for normal recurring trade payables and expense accruals. In addition, we do not currently anticipate significant investment in property, plant and equipment, and we believe that our outsourced approach to manufacturing provides us with significant flexibility in both managing inventory levels and financing our inventory. In the event that our revenue plan does not meet our expectations, we may be required to eliminate or curtail expenditures to mitigate the impact on our working capital. Our future capital requirements will depend on many factors, including our rate of revenue growth, the expansion of our marketing and sales activities, the timing and extent of spending to support product development efforts, the timing of introductions of new products and enhancements to existing products, the acquisition of new capabilities or technologies, and the continuing market acceptance of our products and services. Moreover, to the extent that existing cash, cash equivalents, held-to-maturity investments and cash from operations are insufficient to fund our future activities, we may need to raise additional funds through public or private equity or debt financing.

Although we are currently not a party to any binding commitments with respect to potential investments in, or acquisitions of, businesses, services or technologies, we may enter into these types of arrangements in the future, which could also require us to seek additional equity or debt financing. Additional funds may not be available on terms favorable to us or at all.

Contractual Obligations

Our principal commitments consist of obligations under our equipment facility, leases for office space and minimum contractual obligations for services. The following table describes our commitments to settle contractual obligations in cash as of September 30, 2007 (in thousands):


	Payments Due by Period
			Less than
	Total		One Year		1-3 Years		3-5 Years
Operating Leases	$	4,802	$	1,516	$	2,509	$	777
Purchase Commitments⁽¹⁾		6,140		6,140		—		—


⁽¹⁾		We entered into a purchase commitment with a hardware manufacturing vendor with whom we have a current arrangement. Under the terms of this commitment, we have agreed to purchase a fixed quantity of inventory over an 18-month period. The value of the purchase commitment is approximately $800,000 of which $160,000 has been purchased to date. Additionally, we purchase components from a variety of suppliers and use several contract manufacturers to provide manufacturing services for our products. During the normal course of business, in order to manage manufacturing lead times and help ensure adequate component supply, we enter into agreements with contract manufacturers and suppliers that allow them to procure inventory based upon information provided by us. In certain instances, these agreements allow us the option to cancel, reschedule, and adjust our requirements based on our business needs prior to firm orders being placed. Consequently, a portion of our reported purchase commitments arising from these agreements are firm, non-cancelable, and unconditional commitments. As of September 30, 2007, we had total purchase commitments for inventory of approximately $5.2 million, exclusive of the commitments described above.

Recent Accounting Pronouncements

In June 2006, the Financial Accounting Standards Board (“FASB”) issued Interpretation No. 48, Accounting for Uncertainty in Income Taxes, an interpretation of FAS 109, Accounting for Income Taxes (“FIN 48”), to create a single model to address accounting for uncertainty in tax positions. FIN 48 clarifies the accounting for income taxes by prescribing a minimum recognition threshold a tax position is required to meet before being recognized in the financial statements. FIN 48 also provides guidance on derecognition, measurement, classification, interest and penalties, accounting in interim periods, disclosure and transition. FIN 48 is effective for fiscal years beginning after December 15, 2006. As of January 1, 2007, we adopted FIN 48. The adoption of FIN 48 did not have an impact on our financial position and results of operations.

In September 2006, FASB issued Statement of Financial Accounting Standards No. 157, Fair Value Measurements (“SFAS No. 157”). This statement defines fair value and provides guidance for measuring fair value and the necessary disclosures. SFAS No. 157 does not require any new fair value measurements, but rather applies to all other accounting pronouncements that require or permit fair value measurements. SFAS No. 157 will be effective for our fiscal year ending December 31, 2008. We do not currently expect any material impact from adoption of this new accounting pronouncement on our financial statements.

ITEM 3. QUANTITATIVE AND QUALITATIVE DISCLOSURES ABOUT MARKET RISK

Foreign Currency Risk

Nearly all of our revenue is derived from transactions denominated in U.S. dollars, even though we maintain sales and business operations in foreign countries. As such, we have exposure to adverse changes in exchange rates associated with operating expenses of, and cash held in, our foreign operations, but we believe this exposure to be immaterial at this time. As we grow our international operations, our exposure to foreign currency risk could become more significant.

Interest Rate Sensitivity

We had unrestricted cash, cash equivalents and held-to-maturity investments totaling $103.3 million at September 30, 2007. The unrestricted cash and cash equivalents are held for working capital purposes while investments, made in accordance with our low-risk investment policy, take advantage of higher interest income yields. In accordance with our investment policy, we do not enter into investments for trading or speculative purposes. Some of the securities in which we invest, however, may be subject to market risk. This means that a change in prevailing interest rates may cause the principal amount of the investment to fluctuate. To minimize this risk in the future, we intend to maintain our portfolio of cash equivalents and long-term investments in a variety of securities, including commercial paper, money market funds, debt securities and certificates of deposit. Due to the nature of these investments, we believe that we do not have any material exposure to changes in the fair value of our investment portfolio as a result of changes in interest rates.

ITEM 4. CONTROLS AND PROCEDURES

Evaluation of Sourcefire’s Disclosure Controls and Internal Controls. Our management, with the participation of our principal executive officer and principal financial officer, has evaluated the effectiveness of our disclosure controls and procedures (as such term is defined in Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934, as amended (the “Exchange Act”)) pursuant to Rule 13a-15(c) under the Exchange Act as of the end of the period covered by this Quarterly Report on Form 10-Q. Based on this evaluation, our Chief Executive Officer and Chief Financial Officer have concluded that, as of such date, our disclosure controls and procedures are effective to provide reasonable assurance that information required to be disclosed by us in reports that we file or submit under the Exchange Act is recorded, processed, summarized and reported within the time periods specified in applicable SEC rules and forms and is accumulated and communicated to our management, including Chief Executive Officer and Chief Financial Officer, as appropriate to allow timely decisions regarding required disclosure.

Limitations. A control system, no matter how well designed and operated, can provide only reasonable, not absolute, assurance that the control system’s objectives will be met. Further, the design of a control system must reflect the fact that there are resource constraints, and the benefits of controls must be considered relative to their costs. Because of the inherent limitations in all control systems, no evaluation of controls can provide absolute assurance that all control issues and instances of fraud, if any, within the Company have been detected. These inherent limitations include the realities that judgments in decision-making can be faulty, and that breakdowns can occur because of simple errors or mistakes. Controls can also be circumvented by the individual acts of some persons, by collusion of two or more people, or by management override of the controls. The design of any system of controls is based in part upon certain assumptions about the likelihood of future events, and there can be no assurance that any design will succeed in achieving its stated goals under all potential future conditions. Over time, controls may become inadequate because of changes in conditions or deterioration in the degree of compliance with our policies or procedures. Because of the inherent limitations in a cost-effective control system, misstatements due to error or fraud may occur and not be detected. We continuously evaluate our internal controls and make changes to improve them.

Changes in Internal Controls Over Financial Reporting. There was no change in our internal controls over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act) that occurred during the period covered by this Quarterly Report on Form 10-Q that has materially affected, or is reasonably likely to materially affect, our internal control over financial reporting.

PART II. OTHER INFORMATION

ITEM 1. LEGAL PROCEEDINGS

Securities Class Action Lawsuits

ITEM 1A. RISK FACTORS

Set forth below and elsewhere in this Quarterly Report on Form 10-Q, and in other documents we file with the Securities and Exchange Commission, are risks and uncertainties that could cause actual results to differ materially from the results contemplated by the forward-looking statements contained in this Quarterly Report on Form 10-Q. Because of the following factors, as well as other variables affecting our operating results, past financial performance should not be considered as a reliable indicator of future performance and investors should not use historical trends to anticipate results or trends in future periods.

We have had operating losses since our inception and we expect operating expenses to increase in the foreseeable future and we may never reach or maintain profitability.

We have incurred operating losses each year since our inception in 2001. Our net loss was approximately $2.9 million for the nine months ended September 30, 2006 and $6.4 million for the nine months ended September 30, 2007. Our accumulated deficit as of September 30, 2007 is approximately $45.3 million. Becoming profitable will depend in large part on our ability to generate and sustain increased revenue levels in future periods. Although our revenue has generally been increasing and our losses have generally been decreasing when compared to prior periods, there can be no assurances that we will become profitable in the near future or at any other time. We may never achieve profitability and, even if we do, we may not be able to maintain or increase our level of profitability. We expect that our operating expenses will continue to increase in the foreseeable future as we seek to expand our customer base, increase our sales and marketing efforts, continue to invest in research and development of our technologies and product enhancements and incur significant new costs associated with becoming a public company. These efforts may be more costly than we expect and we may not be able to increase our revenue enough to offset our higher operating expenses. In addition, if our new products and product enhancements fail to achieve adequate market acceptance, our revenue will suffer. If we cannot increase our revenue at a greater rate than our expenses, we will not become and remain profitable.

We face intense competition in our market, especially from larger, better-known companies, and we may lack sufficient financial or other resources to maintain or improve our competitive position.

The market for network security monitoring, detection, prevention and response solutions is intensely competitive, and we expect competition to increase in the future. We may not compete successfully against our current or potential competitors, especially those with significantly greater financial resources or brand name recognition. Our chief competitors include large software companies, software or hardware network infrastructure companies, smaller software companies offering relatively limited applications for network and Internet security monitoring, detection, prevention or response and small and large companies offering point solutions that compete with components of our product offerings.

Mergers or consolidations among these competitors, or acquisitions of our competitors by large companies, present heightened competitive challenges to our business. For example, Symantec Corporation, Cisco Systems, Inc., McAfee, Inc., 3Com Corporation and Juniper Networks, Inc. have acquired, during the past several years, smaller companies, which have intrusion detection or prevention technologies, and IBM closed its acquisition of Internet Security Systems, Inc. in the fourth quarter of 2006. These acquisitions will make these combined entities potentially more formidable competitors to us if such products and offerings are effectively integrated. Large companies may have advantages over us because of their longer operating histories, greater brand name recognition, larger customer bases or greater financial, technical and marketing resources. As a result, they may be able to adapt more quickly to new or emerging technologies and changes in customer requirements. They also have greater resources to devote to the promotion and sale of their products than we have. In addition, these companies have reduced and could continue to reduce, the price of their security monitoring, detection, prevention and response products and managed security services, which intensifies pricing pressures within our market.

Several companies currently sell software products (such as encryption, firewall, operating system security and virus detection software) that our customers and potential customers have broadly adopted. Some of these companies sell products that perform the same functions as some of our products. In addition, the vendors of operating system software or networking hardware may enhance their products to include functions similar to those that our products currently provide. The widespread inclusion of comparable features to our software in operating system software or networking hardware could render our products less competitive or obsolete, particularly if such features are of a high quality. Even if security functions integrated into operating system software or networking hardware are more limited than those of our products, a significant number of customers may accept more limited functionality to avoid purchasing additional products such as ours.

One of the characteristics of open source software is that anyone can offer new software products for free under an open source licensing model in order to gain rapid and widespread market acceptance. Such competition can develop without the degree of overhead and lead time required by traditional technology companies. It is possible for new competitors with greater resources than ours to develop their own open source security solutions, potentially reducing the demand for our solutions. We may not be able to compete successfully against current and future competitors. Competitive pressure and/or the availability of open source software may result in price reductions, reduced revenue, reduced operating margins and loss of market share, any one of which could seriously harm our business.

New competitors could emerge or our customers or distributors could internally develop alternatives to our products and either development could impair our sales.

We may face competition from emerging companies as well as established companies who have not previously entered the market for network security products. Established companies may not only develop their own network intrusion detection and prevention products, but they may also acquire or establish product integration, distribution or other cooperative relationships with our current competitors. Moreover, our large corporate customers and potential customers could develop network security software internally, which would reduce our potential revenue. New competitors or alliances among competitors may emerge and rapidly acquire significant market share due to factors such as greater brand name recognition, a larger installed customer base and significantly greater financial, technical, marketing and other resources and experience. For example, one of our competitors, Internet Security Systems, Inc., has recently been acquired by IBM and the combined company, if successfully integrated, could become a formidable competitor to us. In addition, the acquisition could result in a loss of our current sales to IBM if IBM were to discontinue reselling our products and services. If these new competitors are successful, we would lose market share and our revenue would likely decline.

Our quarterly operating results are likely to vary significantly and be unpredictable, in part because of the purchasing and budget practices of our customers, which could cause the trading price of our stock to decline.

Our operating results have historically varied significantly from period to period, and we expect that they will continue to do so as a result of a number of factors, most of which are outside of our control, including:

	•		the budgeting cycles, internal approval requirements and funding available to our existing and prospective customers for the purchase of network security products;

	•		the timing, size and contract terms of orders received, which have historically been highest in the fourth quarter (representing more than one-third of our total revenue in recent years), but may fluctuate seasonally in different ways;

	•		the level of perceived threats to network security, which may fluctuate from period to period;

	•		the level of demand for products sold by original equipment manufacturers, or OEMs, resellers and distributors that incorporate and resell our technologies;

	•		the market acceptance of open-source software solutions;

	•		the announcement or introduction of new product offerings by us or our competitors, and the levels of anticipation and market acceptance of those products;

	•		price competition;

	•		general economic conditions, both domestically and in our foreign markets;

	•		the product mix of our sales; and

	•		the timing of revenue recognition for our sales.

In particular, the network security technology procurement practices of many of our customers have had a measurable influence on the historical variability of our operating performance. Our prospective customers usually exercise great care and invest substantial time in their network security technology purchasing decisions. As a result, our sales cycles are long, generally between six and twelve months and often longer, which further impacts the variability of our results. Additionally, many of our customers have historically finalized purchase decisions in the last weeks or days of a quarter. A delay in even one large order beyond the end of a particular quarter can substantially diminish our anticipated revenue for that quarter. In addition, many of our expenses must be incurred before we generate revenue. As a result, the negative impact on our operating results would increase if our revenue fails to meet expectations in any period.

The cumulative effect of these factors will likely result in larger fluctuations and unpredictability in our quarterly operating results than in the operating results of many other software and technology companies. This variability and unpredictability could result in our failing to meet the revenue or operating results expectations of securities industry analysts or investors for any period. If we fail to meet or exceed such expectations for these or any other reasons, the market price of our shares could fall substantially and we could face costly securities class action suits. Therefore, you should not rely on our operating results in any quarter as being indicative of our operating results for any future period, nor should you rely on other expectations, predictions or projections of our future revenue or other aspects of our results of operations.

The market for network security products is rapidly evolving and the complex technology incorporated in our products makes them difficult to develop. If we do not accurately predict, prepare for and respond promptly to technological and market developments and changing customer needs, our competitive position and prospects will be harmed.

The market for network security products is relatively new and is expected to continue to evolve rapidly. Moreover, many customers operate in markets characterized by rapidly changing technologies and business plans, which require them to add numerous network access points and adapt increasingly complex enterprise networks, incorporating a variety of hardware, software applications, operating systems and networking protocols. In addition, computer hackers and others who try to attack networks employ increasingly sophisticated new techniques to gain access to and attack systems and networks. Customers look to our products to continue to protect their networks against these threats in this increasingly complex environment without sacrificing network efficiency or causing significant network downtime. The software in our products is especially complex because it needs to effectively identify and respond to new and increasingly sophisticated methods of attack, while not impeding the high network performance demanded by our customers. Although the market expects speedy introduction of software to respond to new threats, the development of these products is difficult and the timetable for commercial release of new products is uncertain. Therefore, we may in the future experience delays in the introduction of new products or new versions, modifications or enhancements of existing products. If we do not quickly respond to the rapidly changing and rigorous needs of our customers by developing and introducing on a timely basis new and effective products, upgrades and services that can respond adequately to new security threats, our competitive position and business prospects will be harmed.

If our new products and product enhancements do not achieve sufficient market acceptance, our results of operations and competitive position will suffer.

We spend substantial amounts of time and money to research and develop new products and enhanced versions of Snort, the Defense Center and our Intrusion Sensors and RNA products to incorporate additional features, improved functionality or other enhancements in order to meet our customers’ rapidly evolving demands for network security in our highly competitive industry. When we develop a new product or an advanced version of an existing product, we typically expend significant money and effort upfront to market, promote and sell the new offering. Therefore, when we develop and introduce new or enhanced products, they must achieve high levels of market acceptance in order to justify the amount of our investment in developing and bringing the products to market.

Our new products or enhancements could fail to attain sufficient market acceptance for many reasons, including:

	•		delays in introducing new, enhanced or modified products;

	•		defects, errors or failures in any of our products;

	•		inability to operate effectively with the networks of our prospective customers;

	•		inability to protect against new types of attacks or techniques used by hackers;

	•		negative publicity about the performance or effectiveness of our intrusion prevention or other network security products;

	•		reluctance of customers to purchase products based on open source software; and

	•		disruptions or delays in the availability and delivery of our products, which problems are more likely due to our just-in-time manufacturing and inventory practices.

If our new products or enhancements do not achieve adequate acceptance in the market, our competitive position will be impaired, our revenue will be diminished and the effect on our operating results may be particularly acute because of the significant research, development, marketing, sales and other expenses we incurred in connection with the new product.

If existing customers do not make subsequent purchases from us or if our relationships with our largest customers are impaired, our revenue could decline.

In 2004, 2005 and 2006, existing customers that purchased additional products and services from us, whether for new locations or additional technology to protect existing networks and locations, generated a majority of our total revenue for each respective period. Part of our growth strategy is to sell additional products to our existing customers and, in particular, to up-sell our RNA products to customers that previously bought our Intrusion Sensor products. We may not be effective in executing this or any other aspect of our growth strategy. Our revenue could decline if our current customers do not continue to purchase additional products from us. In addition, as we deploy new versions of our existing Snort, Intrusion Sensors and RNA products or introduce new products, our current customers may not require the functionality of these products and may not purchase them.

We also depend on our installed customer base for future service revenue from annual maintenance fees. Our maintenance and support agreements typically have durations of one year. No single customer contributed greater than 10% of our recurring maintenance and support revenues in 2005 or 2006. For the nine months ended September 30, 2007, one customer accounted for 10% of our support revenue recognized. If customers choose not to continue their maintenance service, our revenue may decline.

If we cannot attract sufficient government agency customers, our revenue and competitive position will suffer.

Contracts with the U.S. federal and state and other national and state government agencies accounted for 13% and 12% of our total revenue for the nine months ended September 30, 2006 and September 30, 2007, respectively. We lost many government agency customers when a foreign company tried unsuccessfully to acquire us in late 2005 and early 2006. Since then, we have been attempting to regain government customers, which subjects us to a number of risks, including:

	•		Procurement. Contracting with public sector customers is highly competitive and can be expensive and time-consuming, often requiring that we incur significant upfront time and expense without any assurance that we will win a contract;

	•		Budgetary Constraints and Cycles. Demand and payment for our products and services are impacted by public sector budgetary cycles and funding availability, with funding reductions or delays adversely impacting public sector demand for our products, including delays caused by continuing resolutions or other temporary funding arrangements resulting from the current congressional transition;

	•		Modification or Cancellation of Contracts. Public sector customers often have contractual or other legal rights to terminate current contracts for convenience or due to a default. If a contract is cancelled for convenience, which can occur if the customer’s product needs change, we may only be able to collect for products and services delivered prior to termination. If a contract is cancelled because of default, we may only be able to collect for products and alternative products and services delivered to the customer;

	•		Governmental Audits. National governments and other state and local agencies routinely investigate and audit government contractors’ administrative processes. They may audit our performance and pricing and review our compliance with applicable rules and regulations. If they find that we improperly allocated costs, they may require us to refund those costs or may refuse to pay us for outstanding balances related to the improper allocation. An unfavorable audit could result in a reduction of revenue, and may result in civil or criminal liability if the audit uncovers improper or illegal activities.

	•		Replacing Existing Products. After we announced in October 2005 that we had agreed to be acquired by a foreign company, many government agencies were unwilling to buy products from us and instead purchased and installed products sold by our competitors. The proposed acquisition was terminated in April 2006 following objections from the Committee on Foreign Investment in the United States. Since that time, we have been attempting to retain government agency customers. Many government agencies, however, already have installed network security products of our competitors. It can be very difficult to convince government agencies or other prospective customers to replace their existing network security solutions with our products, even if we can demonstrate the superiority of our products.

We are subject to risks of operating internationally that could impair our ability to grow our revenue abroad.

We market and sell our software in North America, South America, Europe, Asia and Australia and we plan to establish additional sales presence in these and other parts of the world. Therefore, we are subject to risks associated with having worldwide operations. Sales to customers located outside of the United States accounted for 20% of our total revenue for the nine months ended September 30, 2006 and 23% for the nine months ended September 30, 2007. The expansion of our existing operations and entry into additional worldwide markets will require significant management attention and financial resources. We are also subject to a number of risks customary for international operations, including:

	•		economic or political instability in foreign markets;

	•		greater difficulty in accounts receivable collection and longer collection periods;

	•		unexpected changes in regulatory requirements;

	•		difficulties and costs of staffing and managing foreign operations;

	•		import and export controls;

	•		the uncertainty of protection for intellectual property rights in some countries;

	•		costs of compliance with foreign laws and laws applicable to companies doing business in foreign jurisdictions;

	•		management communication and integration problems resulting from cultural differences and geographic dispersion;

	•		multiple and possibly overlapping tax structures; and

	•		foreign currency exchange rate fluctuations.

To date, a substantial portion of our sales have been denominated in U.S. dollars, and we have not used risk management techniques or “hedged” the risks associated with fluctuations in foreign currency exchange rates. In the future, if we do not engage in hedging transactions, our results of operations will be subject to losses from fluctuations in foreign currency exchange rates.

In the future, we may not be able to secure financing necessary to operate and grow our business as planned.

We expect that the net proceeds from our initial public offering that we completed in March 2007, together with current cash, cash equivalents, borrowings under our credit facility and short-term investments should be sufficient to meet our anticipated cash needs for working capital and capital expenditures for at least the next 12 months. However, our business and operations may consume resources faster than we anticipate. In the future, we may need to raise additional funds to expand our sales and marketing and research and development efforts or to make acquisitions. Additional financing may not be available on favorable terms, if at all. If adequate funds are not available on acceptable terms, we may be unable to fund the expansion of our sales and marketing and research and development efforts or take advantage of acquisition or other opportunities, which could seriously harm our business and operating results. If we issue debt, the debt holders would have rights senior to common stockholders to make claims on our assets and the terms of any debt could restrict our operations, including our ability to pay dividends on our common stock. Furthermore, if we issue additional equity securities, stockholders will experience dilution, and the new equity securities could have rights senior to those of our common stock.

Our inability to acquire and integrate other businesses, products or technologies could seriously harm our competitive position.

In order to remain competitive, we intend to acquire additional businesses, products or technologies. If we identify an appropriate acquisition candidate, we may not be successful in negotiating the terms of the acquisition, financing the acquisition, or effectively integrating the acquired business, product or technology into our existing business and operations. Any acquisitions we are able to complete may not be accretive to earnings or result in the realization of any expected strategic benefits. Further, completing a potential acquisition and integrating an acquired business will significantly divert management time and resources.

If other parties claim commercial ownership rights to Snort, our reputation, customer relations and results of operations could be harmed.

While we created a majority of the current Snort code base, a portion of the current Snort code was created by the combined efforts of the Company and the open source software community and a portion was created solely by the open source community. We believe that the portions of the Snort code base created by anyone other than by us are required to be licensed by us pursuant to the GNU General Public License, or GPL, which is how we currently license Snort. There is a risk, however, that a third party could claim some ownership rights in Snort, and attempt to prevent us from commercially licensing Snort in the future (rather than pursuant to the GPL as it is currently licensed) and claim a right to licensing royalties. Any such claim, regardless of its merit or outcome, could be costly to defend, harm our reputation and customer relations and result in our having to pay substantial compensation to the party claiming ownership.

Our products contain third party open source software, and failure to comply with the terms of the underlying open source software licenses could restrict our ability to sell our products.

Our products are distributed with software programs licensed to us by third party authors under “open source” licenses, which may include the GPL, the GNU Lesser Public License, or LGPL, the BSD License and the Apache License. These open source software programs include, without limitation, Snort(R), Linux, Apache, Openssl, Etheral, IPTables, Tcpdump and Tripwire. These third party open source programs are typically licensed to us for a minimal fee or no fee at all, and the underlying license agreements generally require us to make available to the open source user community the source code for such programs, as well as the source code for any modifications or derivative works we create based on these third party open source software programs. With the exception of Snort, we have not created any modifications or derivative works to any other open source software programs referenced above. We regularly release updates and upgrades to the Snort software program under the terms and conditions of the GNU GPL version 2.

Included with our software and/or appliances are copies of the relevant source code and licenses for the open source programs. Alternatively, we include instructions to users on how to obtain copies of the relevant open source code and licenses. Additionally, if we combine our proprietary software with third party open source software in a certain manner, we could, under the terms of certain of these open source license agreements, be required to release the source code of our proprietary software. This could also allow our competitors to create similar products, which would result in a loss of our product sales. We do not provide end users a copy of the source code to our proprietary software because we believe that the manner in which our proprietary software is aligned with the relevant open source programs does not create a modification or derivative work of that open source program requiring the distribution of our proprietary source code. Our ability to commercialize our products by incorporating third party open source software may be restricted because, among other reasons:

	•		the terms of open source license agreements may be unclear and subject to varying interpretations, which could result in unforeseen obligations regarding our proprietary products;

	•		it may be difficult to determine the developers of open source software and whether such licensed software infringes another party’s intellectual property rights;

	•		competitors will have greater access to information by obtaining these open source products, which may help them develop competitive products; and

	•		open source software potentially increases customer support costs because licensees can modify the software and potentially introduce errors.

The software program Linux is included in our products and is licensed under the GPL. The GPL is the subject of litigation in the case of The SCO Group, Inc. v. International Business Machines Corp., pending in the United States District Court for the District of Utah. It is possible that the court could rule that the GPL is not enforceable in such litigation. Any ruling by the court that the GPL is not enforceable could have the effect of limiting or preventing us from using Linux as currently implemented.

Efforts to assert intellectual property ownership rights in our products could impact our standing in the open source community which could limit our product innovation capabilities.

When we undertake actions to protect and maintain ownership and control over our proprietary intellectual property, including patents, copyrights and trademark rights, our standing in the open source community could be diminished which could result in a limitation on our ability to continue to rely on this community as a resource to identify and defend against new viruses, threats and techniques to attack secure networks, explore new ideas and concepts and further our research and development efforts.

Our proprietary rights may be difficult to enforce, which could enable others to copy or use aspects of our products without compensating us.

We rely primarily on copyright, trademark, patent and trade secrets laws, confidentiality procedures and contractual provisions to protect our proprietary rights. As of the date hereof, we have 1 patent issued and 33 applications pending for examination in the U.S. and foreign jurisdictions. We also hold numerous registered United States and foreign trademarks and have a number of trademark applications pending in the United States and in foreign jurisdictions. Valid patents may not be issued from pending applications, and the claims allowed on any patents may not be sufficiently broad to protect our technology or products. Any issued patents may be challenged, invalidated or circumvented, and any rights granted under these patents may not actually provide adequate protection or competitive advantages to us. Despite our efforts to protect our proprietary rights, unauthorized parties may attempt to copy aspects of our products or to obtain and use information that we regard as proprietary. Policing unauthorized use of our technologies or products is difficult. Our products incorporate open source Snort software, which is readily available to the public. In addition, the laws of some foreign countries do not protect our proprietary rights to as great an extent as do the laws of the United States, and many foreign countries do not enforce these laws as diligently as U.S. government agencies and private parties. It is possible that we may have to resort to litigation to enforce and protect our copyrights, trademarks, patents and trade secrets, which litigation could be costly and a diversion of management resources. If we are unable to protect our proprietary rights to the totality of the features in our software and products (including aspects of our software and products protected other than by patent rights), we may find ourselves at a competitive disadvantage to others who need not incur the additional expense, time and effort required to create the innovative products that have enabled us to be successful to date.

In limited instances we have agreed to place, and in the future may place, source code for our software in escrow, other than the Snort source code which is publicly available. In most cases, the source code may be made available to certain of our customers and OEM partners in the event that we file for bankruptcy or materially fail to support our products. This may increase the likelihood of misappropriation or other misuse of our software. We have agreed to source code escrow arrangements in the past only rarely and usually only in connection with prospective customers considering a significant purchase of our products and services.

Claims that our products infringe the proprietary rights of others could harm our business and cause us to incur significant costs.

Technology products such as ours, which interact with multiple components of complex networks, are increasingly subject to infringement claims as the functionality of products in different industry segments overlaps. In particular, our RNA technology is a new technology for which we have yet be issued a patent. It is possible that other companies have patents with respect to technology similar to our technology, including RNA. Ten of our 33 pending patent applications relate to our RNA technology and were filed in 2003, 2004 and 2005. If others filed patent applications before us, which contain allowable claims within the scope of our RNA technology, then we may be found to infringe on such patents, if and when they are issued. We are aware of at least one company that has filed an application for a patent that, on its face, contains claims that may be construed to be within the scope of the same broad technology area as our RNA technology. That company, NetClarity, previously filed a suit against us for misappropriation and incorporation in our products of its proprietary rights, as well as making claims that our RNA technology and 3D security solutions are covered by claims in its pending patent application. This pending patent application has not issued as a patent. On June 7, 2007, we reached a definitive agreement with NetClarity, Inc. to settle this lawsuit and on June 13, 2007, the Superior Court of Suffolk County, Massachusetts entered a Stipulation of Dismissal with prejudice.

Unless and until the U.S. Patent and Trademark Office, or PTO, issues a patent to an applicant, there can be no way to assess a potential patentee’s right to exclude. Depending on the timing and substance of these patents and patent applications, our products, including our RNA technology, may infringe the proprietary rights of others, and we may be subject to litigation with respect to any alleged infringement. The application of patent law to the software industry is particularly uncertain as the PTO has only recently begun to issue software patents in large numbers and there is a backlog of software related patent applications pending claiming inventions whose priority dates may pre-date development of our own proprietary software. Additionally, in our customer contracts we typically agree to indemnify our customers if they incur losses resulting from a third party claim that their use of our products infringes upon the intellectual property rights of a third party. Any potential intellectual property claims against us, with or without merit, could:

	•		be very expensive and time consuming to defend;

	•		require us to indemnify our customers for losses resulting from such claims;

	•		cause us to cease making, licensing or using software or products that incorporate the challenged intellectual property;

	•		cause product shipment and installation delays;

	•		require us to redesign our products, which may not be feasible;

	•		divert management’s attention and resources; or

	•		require us to enter into royalty or licensing agreements in order to obtain the right to use a necessary product or component.

Royalty or licensing agreements, if required, may not be available on acceptable terms, if at all. A successful claim of infringement against us and our failure or inability to license the infringed or similar technology could prevent us from distributing our products and cause us to incur great expense and delay in developing non-infringing products.

We rely on software licensed from other parties, the loss of which could increase our costs and delay software shipments.

We utilize various types of software licensed from unaffiliated third parties. For example, we license database software from MySQL that we use in our Intrusion Sensors, our RNA Sensors and our Defense Centers. Our Agreement with MySQL permits us to distribute MySQL software on our products to our customers worldwide until December 31, 2010. We amended our MySQL agreement on December 29, 2006 to give us the unlimited right to distribute MySQL software in exchange for a one-time lump-sum payment. We believe that the MySQL agreement is material to our business because we have spent a significant amount of development resources to allow the MySQL software to function in our products. If we were forced to find replacement database software for our products, we would be required to expend resources to implement a replacement database in our products, and there would be no guarantee that we would be able to procure the replacement on the same or similar commercial terms.

In addition to MySQL, we rely on other open source software, such as the Linux operating system, the Apache web server and OpenSSL, a secure socket layer implementation. These open source programs are licensed to us under various open source licenses. For example, Linux is licensed under the GNU General Public License Version 2, while Apache and OpenSSL are licensed under other forms of open source license agreements. If we could no longer rely on these open source programs, the functionality of our products would be impaired and, we would be required to expend significant resources to find suitable alternatives.

Our business would be disrupted if any of the software we license from others or functional equivalents of this software were either no longer available to us, no longer offered to us on commercially reasonable terms or offered to us under different licensing terms and conditions. For example, our business could be disrupted if the widely-used Linux operating system were to be released under the new Version 3 of the GNU General Public License, as we could be required to expend significant resources to ensure that our use of Linux, as well as the manner in which our proprietary and other third party software work with Linux, complies with the new version of the GNU General Public License. Additionally, we would be required to either redesign our products to function with software available from other parties or develop these components ourselves, which would result in increased costs and could result in delays in our product shipments and the release of new product offerings. Furthermore, we might be forced to limit the features available in our current or future products. If we fail to maintain or renegotiate any of these software licenses, we could face significant delays and diversion of resources in attempting to license and integrate a functional equivalent of the software.

Defects, errors or vulnerabilities in our software products would harm our reputation and divert resources.

Because our products are complex, they may contain defects, errors or vulnerabilities that are not detected until after our commercial release and installation by our customers. We may not be able to correct any errors or defects or address vulnerabilities promptly, or at all. Any defects, errors or vulnerabilities in our products could result in:

	•		expenditure of significant financial and product development resources in efforts to analyze, correct, eliminate or work-around errors or defects or to address and eliminate vulnerabilities;

	•		loss of existing or potential customers;

	•		delayed or lost revenue;

	•		delay or failure to attain market acceptance;

	•		increased service, warranty, product replacement and product liability insurance costs; and

	•		negative publicity, which will harm our reputation.

In addition, because our products and services provide and monitor network security and may protect valuable information, we could face claims for product liability, tort or breach of warranty. Anyone who circumvents our security measures could misappropriate the confidential information or other valuable property of customers using our products, or interrupt their operations. If that happens, affected customers or others may sue us. In addition, we may face liability for breaches of our product warranties, product failures or damages caused by faulty installation of our products. Provisions in our contracts relating to warranty disclaimers and liability limitations may be unenforceable. Some courts, for example, have found contractual limitations of liability in standard computer and software contracts to be unenforceable in some circumstances. Defending a lawsuit, regardless of its merit, could be costly and divert management attention. Our business liability insurance coverage may be inadequate or future coverage may be unavailable on acceptable terms or at all.

Our networks, products and services are vulnerable to, and may be targeted by, hackers.

Like other companies, our websites, networks, information systems, products and services may be targets for sabotage, disruption or misappropriation by hackers. As a leading network security solutions company, we are a high profile target and our networks, products and services may have vulnerabilities that may be targeted by hackers. Although we believe we have sufficient controls in place to prevent disruption and misappropriation, and to respond to such situations, we expect these efforts by hackers to continue. If these efforts are successful, our operations, reputation and sales could be adversely affected.

We utilize a just-in-time contract manufacturing and inventory process, which increases our vulnerability to supply disruption.

Our ability to meet our customers’ demand for certain of our products depends upon obtaining adequate hardware platforms on a timely basis, which must be integrated with our software. We purchase hardware platforms through our contract manufacturers from a limited number of suppliers on a just-in-time basis. In addition, these suppliers may extend lead times, limit the supply to our manufacturers or increase prices due to capacity constraints or other factors. Although we work closely with our manufacturers and suppliers to avoid shortages, we may encounter these problems in the future. Our results of operations would be adversely affected if we were unable to obtain adequate supplies of hardware platforms in a timely manner or if there were significant increases in the costs of hardware platforms or problems with the quality of those hardware platforms.

We depend on a single source to manufacture our enterprise class intrusion sensor product; if that sole source were to fail to satisfy our requirements, our sales revenue would decline and our reputation would be harmed.

We rely on one manufacturer, Bivio Networks, to build the hardware platform for two models of our intrusion sensor products that are used by our enterprise class customers. These enterprise class intrusion sensor products are purchased directly by customers for their internal use and are also utilized by third party managed security service providers to provide services to their customers. Revenue resulting from sales of these enterprise class intrusion sensor products accounted for approximately 4% of our product revenue in the year ended December 31, 2005, approximately 21% of our product revenue in the year ended December 31, 2006 and approximately 20% of our product revenue in the nine months ended September 30, 2007. The unexpected termination of our relationship with Bivio Networks would be disruptive to our business and our reputation which could result in a decline in our revenue as well as shipment delays and possible increased costs as we seek and implement production with an alternate manufacturer.

Our inability to hire and retain key personnel would slow our growth.

Our business is dependent on our ability to hire, retain and motivate highly qualified personnel, including senior management, sales and technical professionals. In particular, we intend to expand the size of our direct sales force domestically and internationally and to hire additional customer support and professional services personnel. However, competition for qualified services personnel is intense, and if we are unable to attract, train or retain the number of highly qualified sales and services personnel that our business needs, our reputation, customer satisfaction and potential revenue growth could be seriously harmed. To the extent we hire personnel from competitors, we may be subject to allegations that they have been improperly solicited or divulged proprietary or other confidential information.

Our future success will depend to a significant extent on the continued services of Martin Roesch, our founder and Chief Technology Officer, and E. Wayne Jackson, III, our Chief Executive Officer. The loss of the services of either of these or other individuals could adversely affect our business and could divert other senior management time in searching for their replacements.

We depend on resellers and distributors for our sales; if they fail to perform as expected, our revenue will suffer.

Part of our business strategy involves entering into additional agreements with resellers and distributors that permit them to resell our products and service offerings. Revenue resulting from our resellers and distributors accounted for approximately 46% of our total revenue in the year ended December 31, 2004, approximately 49% of our total revenue in the year ended December 31, 2005, approximately 49% of our total revenue in the year ended December 31, 2006 and approximately 55% of our total revenue in the nine months ended September 30, 2007. For the year ended December 31, 2005 and for the year ended December 31, 2006, no single reseller, distributor, customer or OEM accounted for more than ten percent of our total revenue. There is a risk that our pace of entering into such agreements may slow, or that our existing agreements may not produce as much business as we anticipate. There is also a risk that some or all of our resellers or distributors may be acquired, may change their business models or may go out of business, any of which could have an adverse effect on our business. For example, IBM, our current reseller, completed its acquisition of Internet Security Systems, Inc., one of our competitors, in the fourth quarter of 2006. Sales of our products to IBM or where IBM helped influence the sales process as a percentage of our total revenue were 3.1% and 1.2% for the year ended December 31, 2006 and the year ended December 31, 2005, respectively, and 1.3% for the nine months ended September 30, 2007. While we have received oral assurances from IBM that it does not expect any material change to our reseller relationship solely on account of its acquisition of Internet Security Systems, Inc., we cannot currently anticipate how our relationship with IBM may change. IBM may decide to discontinue reselling our products and services.

If we do not continue to establish and effectively manage our OEM relationships, our revenue could decline.

Our ability to sell our network security software products in new markets and to increase our share of existing markets will be impaired if we fail to expand our indirect distribution channels. Our sales strategy involves the establishment of multiple distribution channels domestically and internationally through strategic resellers, system integrators and OEMs. We have alliances with OEMs such as IBM and Nokia and we cannot predict the extent to which these companies will be successful in marketing or selling our software. These agreements could be terminated on short notice and they do not prevent our OEMs, systems integrators, strategic resellers or other distributors from selling the network security software of other companies, including our competitors. IBM and Nokia or any other OEM, system integrator, strategic reseller or distributor could give higher priority to other companies’ software or to their own software than they give to ours, which could cause our revenue to decline. Additionally, IBM completed its acquisition of Internet Security Systems, Inc., one of our competitors, in the fourth quarter of 2006. Our ability to sell our network security software products through IBM as a reseller or have our product sales influenced by them as a partner could be materially diminished.

Our inability to effectively manage our expected headcount growth and expansion and our additional obligations as a public company could seriously harm our ability to effectively run our business.

Our historical growth has placed, and our intended future growth is likely to continue to place, a significant strain on our management, financial, personnel and other resources. We will likely not continue to grow at our historical pace due to limits on our resources. We have grown from 84 employees at December 31, 2003 to 227 employees at September 30, 2007. Since January 1, 2005, we have opened additional sales offices and have significantly expanded our operations. This rapid growth has strained our facilities and required us to lease additional space at our headquarters. In several recent quarters, we have not been able to hire sufficient personnel to keep pace with our growth. In addition to managing our expected growth, we will have substantial additional obligations and costs as a result of becoming a public company in March 2007. These obligations include investor relations, preparing and filing periodic SEC reports, developing and maintaining internal controls over financial reporting and disclosure controls, compliance with corporate governance rules, Regulation FD and other requirements imposed on public companies by the SEC and the NASDAQ Global Market. Fulfilling these additional obligations will make it more difficult to operate a growing company. Any failure to effectively manage growth or fulfill our obligations as a public company could seriously harm our ability to respond to customers, the quality of our software and services and our operating results. To effectively manage growth and operate a public company, we will need to implement additional management information systems, improve our operating, administrative, financial and accounting systems and controls, train new employees and maintain close coordination among our executive, engineering, accounting, finance, marketing, sales and operations organizations.

The price of our common stock may be subject to wide fluctuations.

Prior to our IPO in March 2007, there was not a public market for our common stock. The market price of our common stock is subject to significant fluctuations. Among the factors that could affect our common stock price are the risks described in this “Risk Factors” section and other factors, including:

	•		quarterly variations in our operating results compared to market expectations;

	•		changes in expectations as to our future financial performance, including financial estimates or reports by securities analysts;

	•		changes in market valuations of similar companies;

	•		liquidity and activity in the market for our common stock;

	•		actual or expected sales of our common stock by our stockholders;

	•		strategic moves by us or our competitors, such as acquisitions or restructurings;

	•		general market conditions; and

	•		domestic and international economic, legal and regulatory factors unrelated to our performance.

Stock markets in general have experienced extreme volatility that has often been unrelated to the operating performance of a particular company. These broad market fluctuations may adversely affect the trading price of our common stock, regardless of our operating performance.

We and certain of our officers and directors have been named as co-defendants in, and are the subject of, certain legal proceedings which may result in substantial costs and divert management’s attention and resources.

As described in “Legal Proceedings” above, multiple federal securities class action lawsuits have been filed naming our company and certain of our officers and directors as co-defendants. We are not able to predict the ultimate outcome of this litigation. It is possible that these matters could be resolved adversely to us, could result in substantial costs and could divert management’s attention and resources, which could harm our business.

Risks associated with legal liability often are difficult to assess or quantify and their existence and magnitude can remain unknown for significant periods of time. While we maintain director and officer insurance, the amount of insurance coverage may not be sufficient to cover a claim and the continued availability of this insurance cannot be assured. We may in the future be the target of additional proceedings, and these proceedings may result in substantial costs and divert management’s attention and resources.

Sales of substantial amounts of our common stock in the public markets, or the perception that they might occur, could reduce the price that our common stock might otherwise attain and may dilute your voting power and your ownership interest in us.

As of November 5, 2007, we had 24,466,816 outstanding shares of common stock. This number includes 6,185,500 shares of our common stock that we sold in our IPO, which has been and may in the future be resold at any time in the public market. This number also includes an aggregate of approximately 10.7 million shares held by directors, officers and venture capital funds that invested in Sourcefire prior to our initial public offering, who may sell such shares at their discretion subject to certain volume limitations. Sales of substantial amounts of our common stock in the public market, as a result of the exercise of registration rights or otherwise, or the perception that such sales could occur, could adversely affect the market price of our common stock and may make it more difficult for you to sell your common stock at a time and price that you deem appropriate.

We also may issue our shares of common stock from time to time as consideration for future acquisitions and investments. If any such acquisition or investment is significant, the number of shares that we may issue may in turn be significant. In addition, we may also grant registration rights covering those shares in connection with any such acquisitions and investments.

As a result of becoming a public company, we are obligated to develop and maintain proper and effective internal controls over financial reporting and are subject to other requirements that will be burdensome and costly. We may not complete our analysis of our internal controls over financial reporting in a timely manner, or these internal controls may not be determined to be effective, which may adversely affect investor confidence in our company and, as a result, the value of our common stock.

Beginning with our Annual Report on Form 10-K for the year ending December 31, 2008, we will be required, pursuant to Section 404 of the Sarbanes-Oxley Act of 2002 (Section 404), to furnish a report by management on, among other things, the effectiveness of our internal control over financial reporting. This assessment will need to include disclosure of any material weaknesses identified by our management in our internal control over financial reporting, as well as a statement that our auditors have issued an attestation report on our management’s assessment of our internal controls.

We are just beginning the costly and challenging process of compiling the system and processing documentation before we perform the evaluation needed to comply with Section 404. We may not be able to complete our evaluation, testing and any required remediation in a timely fashion. During the evaluation and testing process, if we identify one or more material weaknesses in our internal control over financial reporting, we will be unable to assert that our internal control is effective. If we are unable to assert that our internal control over financial reporting is effective, or if our auditors are unable to attest that our internal control over financial reporting is effective, or they are unable to express an opinion on the effectiveness of our internal control, we could lose investor confidence in the accuracy and completeness of our financial reports, which would have a material adverse effect on the price of our common stock. Failure to comply with the new rules might make it more difficult for us to obtain certain types of insurance, including director and officer liability insurance, and we might be forced to accept reduced policy limits and coverage and/or incur substantially higher costs to obtain the same or similar coverage. The impact of these events could also make it more difficult for us to attract and retain qualified persons to serve on our board of directors, on committees of our board of directors, or as executive officers.

In addition, as a public company, we have and will continue to incur significant additional legal, accounting and other expenses that we did not incur as a private company, and our administrative staff has been and will continue to be required to perform additional tasks. For example, we have created and/or revised the roles and duties of our board committees, adopted disclosure controls and procedures, retained a transfer agent and adopted an insider trading policy and bear all of the internal and external costs of preparing and distributing periodic public reports in compliance with our obligations under the securities laws. In addition, changing laws, regulations and standards relating to corporate governance and public disclosure, and related regulations implemented by the Securities and Exchange Commission and the NASDAQ Global Market, are creating uncertainty for public companies, increasing legal and financial compliance costs and making some activities more time consuming. These laws, regulations and standards are subject to varying interpretations, in many cases due to their lack of specificity, and, as a result, their application in practice may evolve over time as new guidance is provided by regulatory and governing bodies. We intend to invest resources to comply with evolving laws, regulations and standards, and this investment may result in increased general and administrative expenses and a diversion of management’s time and attention from revenue-generating activities to compliance activities. If our efforts to comply with new laws, regulations and standards differ from the activities intended by regulatory or governing bodies due to ambiguities related to practice, regulatory authorities may initiate legal proceedings against us and our business may be harmed.

Anti-takeover provisions in our charter documents and under Delaware law could make an acquisition of us, which may be beneficial to our stockholders, more difficult and may prevent attempts by our stockholders to replace or remove our current management.

Our amended and restated certificate of incorporation and our amended and restated bylaws each of which became effective in March 2007 upon completion of our IPO contain provisions that may delay or prevent an acquisition of us or a change in our management. These provisions include a classified board of directors, a prohibition on actions by written consent of our stockholders, and the ability of our board of directors to issue preferred stock without stockholder approval. In addition, because we are incorporated in Delaware, we are governed by the provisions of Section 203 of the Delaware General Corporation Law, which prohibits stockholders owning in excess of 15% of our outstanding voting stock from merging or combining with us. Although we believe these provisions collectively provide for an opportunity to receive higher bids by requiring potential acquirors to negotiate with our board of directors, they would apply even if the offer may be considered beneficial by some stockholders. In addition, these provisions may frustrate or prevent attempts by our stockholders to replace or remove our current management by making it more difficult for stockholders to replace members of our board of directors, which is responsible for appointing the members of our management.

ITEM 2. UNREGISTERED SALES OF EQUITY SECURITIES AND USE OF PROCEEDS

In March 2007, we completed the initial public offering of shares of our common stock. On March 9, 2007, we offered and sold 5,320,000 shares of our common stock, and certain of our stockholders offered and sold an aggregate of 450,000 shares of our common stock at a public offering price of $15.00 per share. The offer and sale of these shares were registered under the Securities Act of 1933, as amended, pursuant to our Registration Statement on Form S-1, as amended (File No. 333-138199), which was declared effective by the SEC on March 8, 2007. The managing underwriters of this offering were Morgan Stanley & Co. Incorporated, Lehman Brothers Inc., UBS Securities LLC and Jefferies & Company. On March 23, 2007, we offered and sold an additional 865,500 shares of our common stock at a price of $15.00 per share pursuant to the underwriters’ exercise in full of their over-allotment option.

Our portion of the net proceeds from the initial public offering was approximately $83.9 million after deducting underwriting discounts and commissions of approximately $1.05 per share, or $6.5 million in the aggregate, and $2.4 million in offering expenses. We did not receive any proceeds for the sale of the 450,000 shares by selling stockholders.

We are using the net proceeds from the offering for working capital and other general corporate purposes, including financing our growth, developing new products and funding capital expenditures. Pending such usage, we have invested the net proceeds in short-term, interest-bearing investment grade securities.

ITEM 3. DEFAULTS UPON SENIOR SECURITIES

Not applicable.

ITEM 4. SUBMISSION OF MATTERS TO A VOTE OF SECURITY HOLDERS

On October 3, 2007, we held an annual meeting of our stockholders to vote on the following proposals.

To elect the following nominees for election as directors:


Nominee	Votes For		Votes Withheld

Mr. E. Wayne Jackson, III		20,647,785		157,401
Mr. Asheem Chandna		20,772,097		32,089

		In addition to Messrs. Jackson and Chandna, each of Martin A. Roesch, Tim A Guleri, Joseph R. Chinnici, Arnold L. Punaro and Steven R. Polk continued as directors of our company after the meeting.

2.		Approval of the 2007 Employee Stock Purchase Plan.

		Vote results, Proposal 2:


For	Against		Abstain		Broker Non-Votes

19,814,504		166,988		90		823,604

		This proposal was approved by the majority of shares voted.

3.		Ratification of the appointment of Ernst & Young LLP as our independent registered public accounting firm for the fiscal year ending December 31, 2007.

		Vote results, Proposal 3:


For	Against	Abstain

20,652,087	145,864	7,235

ITEM 5. OTHER INFORMATION

Not applicable.

ITEM 6. EXHIBITS

Incorporation by Reference

Filed

Exhibit

File

with this

Number

Exhibit Description

Form

Number

Exhibit

File Date

10-Q

3.1

Sixth Amended and Restated Certificate of Incorporation

10-Q

1-33350

3.1

5/4/2007

3.2

Fourth Amended and Restated Bylaws

10-Q

1-33350

3.2

5/4/2007

4.1

Form of stock certificate of common stock

S-1/A

333-138199

4.1

3/6/2007

4.2

2002 Stock Incentive Plan

S-1

333-138199

4.2

10/25/2006

4.3

2007 Stock Incentive Plan

S-1/A

333-138199

4.3

3/1/2007

4.4

Form of Nonstatutory Stock Option Grant Agreement under the 2002 Stock Incentive Plan

S-1/A

333-138199

4.4

10/25/2006

4.5

Form of Notice of Stock Option Award under the 2007 Stock Incentive Plan

S-1/A

333-138199

4.5

3/1/2007

4.6

Form of Notice of Restricted Stock Purchase Award under the 2007 Stock Incentive Plan

S-1/A

333-138199

4.6

3/1/2007

4.7

Form of Notice of Restricted Stock Purchase Award for Non-Employee Directors under the 2007 Stock Incentive Plan

S-1/A

333-138199

4.7

3/1/2007

10.1

Employment Agreement of Douglas W. McNitt

10.2

Separation Agreement of Joseph Boyle

31.1

Certification of Chief Executive Officer pursuant to Section 302 of the Sarbanes-Oxley Act of 2002

31.2

Certification of Chief Financial Officer pursuant to Section 302 of the Sarbanes-Oxley Act of 2002

32.1

Certification of Chief Executive Officer and Chief Financial Officer pursuant to Section 906 of the Sarbanes-Oxley Act of 2002

SIGNATURES

Pursuant to the requirements of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned thereunto duly authorized.


		Sourcefire, Inc.

		By:		/s/ Todd P. Headley

		Name: Todd P. Headley
		Title: Chief Financial Officer and Treasurer

November 6, 2007