As filed with the Securities and Exchange Commission on October 25, 2006

Registration No. 333-          

 

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

 

 

 

 

FORM S-1

REGISTRATION STATEMENT UNDER THE SECURITIES ACT OF 1933

 

 

 

 

SOURCEFIRE, INC.

(Exact name of registrant as specified in its charter)

 

 

9770 Patuxent Woods Drive

Columbia, Maryland 21046

(410) 290-1616

(Address, including zip code, and telephone number, including area code, of registrant’s principal executive offices)

 

 

 

 

E. Wayne Jackson, III

Chief Executive Officer

Sourcefire, Inc.

9770 Patuxent Woods Drive

Columbia, Maryland 21046

(410) 290-1616

(Name, address, including zip code, and telephone number, including area code, of agent for service)

 

 

 

 

Copies to:

 

 

 

 

 

Approximate date of commencement of proposed sale to the public:  As soon as practicable after this Registration Statement becomes effective.

If any of the securities being registered on this Form are to be offered on a delayed or continuous basis pursuant to Rule 415 under the Securities Act of 1933 check the following box. o

If this Form is filed to register additional securities for an offering pursuant to Rule 462(b) under the Securities Act, check the following box and list the Securities Act registration statement number of the earlier effective registration statement for the same
offering. o _ _

If this Form is a post-effective amendment filed pursuant to Rule 462(c) under the Securities Act, check the following box and list the Securities Act registration statement number of the earlier effective registration statement for the same offering. o _ _

If this Form is a post-effective amendment filed pursuant to Rule 462(d) under the Securities Act, check the following box and list the Securities Act registration statement number of the earlier effective registration statement for the same offering. o _ _

 

 

CALCULATION OF REGISTRATION FEE

 

 

 

The Registrant hereby amends this registration statement on such date or dates as may be necessary to delay its effective date until the Registrant shall file a further amendment which specifically states that this registration statement shall thereafter become effective in accordance with Section 8(a) of the Securities Act of 1933, or until the registration statement shall become effective on such date as the Commission, acting pursuant to said Section 8(a), may determine.

 

PROSPECTUS (Subject to Completion)

Issued October 25, 2006

 

                     Shares

 

 

COMMON STOCK

 

 

 

 

Sourcefire, Inc. is offering           shares of its common stock and the selling stockholders are offering           shares. We will not receive any proceeds from the sale of shares by the selling stockholders. This is our initial public offering and no public market exists for our shares. We anticipate that the initial public offering price will be between $      and $      per share.

 

 

We have applied to list our common stock for quotation on the Nasdaq Global Market under the symbol “FIRE.”

 

 

Investing in our common stock involves risks.  See “Risk Factors” beginning on page 9.

 

 

PRICE $      A SHARE

 

 

 

We and the selling stockholders have granted the underwriters the right to purchase up to an additional           shares of common stock to cover over-allotments.

 

The Securities and Exchange Commission and state securities regulators have not approved or disapproved these securities, or determined if this prospectus is truthful or complete. Any representation to the contrary is a criminal offense.

 

Morgan Stanley & Co.  Incorporated expects to deliver the shares of common stock to purchasers on          , 2007.

 

 

 

 

 

 

 

                    , 2007

 

TABLE OF CONTENTS

 

 

 

You should rely only on the information contained in this prospectus. We have not authorized anyone to provide you with information different from that contained in this prospectus. We are offering to sell, and seeking offers to buy, shares of common stock only in jurisdictions where offers and sales are permitted. The information contained in this prospectus is accurate only as of the date of this prospectus, regardless of the time of delivery of this prospectus or of any sale of shares of common stock.

 

Until and including          , 2007, 25 days after the commencement of this offering, all dealers that buy, sell or trade shares of our common stock, whether or not participating in this offering, may be required to deliver a prospectus. This delivery requirement is in addition to the dealers’ obligation to deliver a prospectus when acting as underwriters and with respect to their unsold allotments or subscriptions.

 

For investors outside the United States.  Neither we nor any of the underwriters have done anything that would permit this offering or possession or distribution of this prospectus in any jurisdiction where action for that purpose is required, other than in the United States. You are required to inform yourselves about, and to observe any restrictions relating to, this offering and the distribution of this prospectus.

 

 

 

 

We operate in an industry in which it is difficult to obtain precise industry and market information. Although we have obtained some industry data from outside sources that we believe to be reliable, in certain cases we have based certain statements contained in this prospectus regarding our industry and our position in the industry on our estimates concerning, among other things, our customers and competitors. These estimates are based on our experience in the industry, conversations with our principal suppliers and customers and our own investigations of market conditions. Unless otherwise noted, the statistical data contained in this prospectus regarding the network security software industry are based on data we obtained from Datamonitor, a business information company specializing in industry analysis, or International Data Corporation, or IDC, a provider of market intelligence for the information technology, telecommunications and consumer technology markets.

 

 

 

 

SOURCEFIRE^®, SNORT^®, the Sourcefire logo, the Snort and Pig logo, SECURITY FOR THE REAL WORLD^tm, SOURCEFIRE DEFENSE CENTER^tm, SOURCEFIRE 3D^tm, RNA^tm and certain other trademarks and logos are trademarks or registered trademarks of Sourcefire, Inc. in the United States and other countries. This prospectus also refers to the products or services of other companies by the trademarks and trade names used and owned by those companies.

 

PROSPECTUS SUMMARY

	•	Discover potential threats and points of vulnerability;
	•	Determine the potential impact of those observations to the network; and
	•	Defend the network through proactive enforcement of security policy.

	•	As we have had operating losses since our inception and we expect operating expenses to increase in the foreseeable future, we may never reach or maintain profitability.
	•	We face intense competition in our market, especially from larger, better-known companies, and we may lack sufficient financial or other resources to maintain or improve our competitive position.
	•	New competitors could emerge or our customers or distributors could internally develop alternatives to our products and either development could impair our sales.

	•	Our quarterly operating results are likely to vary significantly and be unpredictable, in part because of the purchasing and budget practices of our customers, which could cause the trading price of our stock to decline.
	•	The market for network security products is rapidly evolving and the complex technology incorporated in our products makes them difficult to develop. If we do not accurately predict, prepare for and respond to technological and market developments and changing customer needs, our competitive position and prospects will be harmed.
	•	Claims that our products infringe the proprietary rights of others could harm our business and cause us to incur significant costs.

Common stock offered by Sourcefire		shares
Common stock offered by the selling stockholders		shares
Total		shares
Over-allotment option to be offered by Sourcefire		shares
Over-allotment option to be offered by the selling stockholders		shares
Total over-allotment option		shares
Common stock to be outstanding after this offering		shares
Use of proceeds		We intend to use the net proceeds from this offering for working capital and other general corporate purposes. We may also use a portion of the net proceeds to repay our equipment facility or acquire other businesses, products or technologies. However, we do not have agreements or commitments for any specific repayments or acquisitions at this time. We will not receive any proceeds from the sale of common stock by the selling stockholders. See “Use of Proceeds.”
Proposed Nasdaq Global Market symbol		“FIRE”

	•	4,457,866 shares that may be issued upon the exercise of options outstanding as of September 30, 2006 under our stock option plan;
	•	59,998 shares that may be issued upon the exercise of warrants outstanding as of September 30, 2006;
	•	1,044,194 shares that are reserved for issuance pursuant to our stock option plan; and
	•	45,000 shares which are subject to repurchase by us.

	•	an initial public offering price of $     ;
	•	the conversion of all outstanding shares of our preferred stock into shares of our common stock immediately prior to the completion of this offering; and
	•	the underwriters’ over-allotment option to purchase up to an additional           shares of common stock is not exercised.

		Year ended December 31,												Nine months ended September 30,
		2003				2004				2005				2005				2006
														(unaudited)
		(in thousands, except share, per share and other operating data)
Consolidated statement of operations data:
Revenue:
Products		$	8,153			$	12,738			$	23,589			$	14,889			$	18,390
Services			1,328				3,955				9,290				6,335				10,544
Total revenue			9,481				16,693				32,879				21,224				28,934
Cost of revenue:
Products			2,570				4,533				6,610				4,229				4,931
Services			436				872				1,453				981				2,016
Total cost of revenue			3,006				5,405				8,063				5,210				6,947
Gross profit			6,475				11,288				24,816				16,014				21,987
Operating expenses:
Research and development			3,751				5,706				6,831				4,934				6,334
Sales and marketing			9,002				12,585				17,135				12,131				14,512
General and administrative			2,141				2,905				5,120				3,123				3,587
Depreciation and amortization			441				752				1,103				846				912
Total operating expenses			15,335				21,948				30,189				21,034				25,345
Income (loss) from operations			(8,860	)			(10,660	)			(5,373	)			(5,020	)			(3,358	)
Other income (expense), net			16				164				(85	)			(50	)			442
Net loss			(8,844	)			(10,496	)			(5,458	)			(5,070	)			(2,916	)
Accretion of preferred stock			(1,262	)			(2,451	)			(2,668	)			(2,001	)			(2,687	)
Net loss attributable to common stockholders		$	(10,106	)		$	(12,947	)		$	(8,126	)		$	(7,071	)		$	(5,603	)
Net loss attributable to common stockholders per common share:
Basic and diluted		$	(2.89	)		$	(3.06	)		$	(1.56	)		$	(1.38	)		$	(1.03	)
Pro forma (unaudited)(1)											(0.22	)							(0.11	)
Shares used in per common share calculations:
Basic and diluted			3,502,521				4,226,855				5,197,316				5,132,011				5,456,806
Pro forma (unaudited)(1)											25,159,550								26,944,685
Other operating data:
Number of sales in excess of $500,000			2				5				9				4				6
Number of new customers			161				136				149				116				171
Cumulative number of Fortune 100 customers at end of period			10				17				24				22				27
Number of full-time employees at end of period			84				107				135				142				174

						As of September 30,
						2006
										Pro forma
		Actual				Pro forma(2)				As Adjusted(3)
		(unaudited)
		(in thousands)
Consolidated balance sheet data:
Cash and cash equivalents		$	25,137			$	25,137			$
Held-to-maturity investments			1,401				1,401
Total assets			43,854				43,854
Long-term debt			434				434
Total liabilities			18,515				18,515
Total convertible preferred stock			65,615				—
Total stockholders’ equity (deficit)			(40,276	)			25,339

(1)		Pro forma to give effect to the conversion of all outstanding shares of our preferred stock into shares of our common stock immediately prior to the completion of this offering.
(2)		The pro forma balance sheet data reflect the conversion of all outstanding shares of our preferred stock into shares of our common stock immediately prior to the completion of this offering.
(3)		The pro forma as adjusted balance sheet data reflect the conversion of all outstanding shares of our preferred stock into shares of our common stock immediately prior to the completion of this offering and our receipt of estimated net proceeds of $           from our sale of      shares of common stock that we are offering at an assumed public offering price of $      per share, after deducting estimated underwriting discounts and commissions and estimated offering expenses payable by us.

 

Investing in our common stock involves a high degree of risk. You should carefully consider the following risks and all other information contained in this prospectus, including our consolidated financial statements and the related notes, before investing in our common stock. The risks and uncertainties described below are not the only ones we face. Additional risks and uncertainties that we are unaware of, or that we currently believe are not material, also may become important factors that affect us. If any of the following risks materialize, our business, financial condition or results of operations could be materially harmed. In that case, the trading price of our common stock could decline, and you may lose some or all of your investment.

 

Risks Related to Our Business

 

We have had operating losses since our inception and we expect operating expenses to increase in the foreseeable future and we may never reach or maintain profitability.

 

We have incurred operating losses each year since our inception in 2001. Our net loss was approximately $10.5 million for the year ended December 31, 2004, $5.5 million for the year ended December 31, 2005 and $2.9 million for the nine months ended September 30, 2006. Our accumulated deficit as of September 30, 2006 is approximately $40.3 million. Becoming profitable will depend in large part on our ability to generate and sustain increased revenue levels in future periods. Although our revenue has generally been increasing and our losses have generally been decreasing when compared to prior periods, you should not assume that we will become profitable in the near future or at any other time. We may never achieve profitability and, even if we do, we may not be able to maintain or increase our level of profitability. We expect that our operating expenses will continue to increase in the foreseeable future as we seek to expand our customer base, increase our sales and marketing efforts, continue to invest in research and development of our technologies and product enhancements and incur significant new costs associated with becoming a public company. These efforts may be more costly than we expect and we may not be able to increase our revenue enough to offset our higher operating expenses. In addition, if our new products and product enhancements fail to achieve adequate market acceptance, our revenue will suffer. If we cannot increase our revenue at a greater rate than our expenses, we will not become and remain profitable.

 

We face intense competition in our market, especially from larger, better-known companies, and we may lack sufficient financial or other resources to maintain or improve our competitive position.

 

The market for network security monitoring, detection, prevention and response solutions is intensely competitive, and we expect competition to increase in the future. We may not compete successfully against our current or potential competitors, especially those with significantly greater financial resources or brand name recognition. Our chief competitors include large software companies, software or hardware network infrastructure companies, smaller software companies offering relatively limited applications for network and Internet security monitoring, detection, prevention or response and small and large companies offering point solutions that compete with components of our product offerings.

 

Mergers or consolidations among these competitors, or acquisitions of our competitors by large companies, present heightened competitive challenges to our business. For example, Symantec Corporation, Cisco Systems, Inc., McAfee, Inc., 3Com Corporation and Juniper Networks, Inc. have acquired during the past several years smaller companies, which have intrusion detection or prevention technologies and Internet Security Systems, Inc. has recently been acquired by IBM. These acquisitions will make these combined entities potentially more formidable competitors to us if such products and offerings are effectively integrated. Large companies may have advantages over us because of their longer operating histories, greater brand name recognition, larger customer bases or greater financial, technical and marketing resources. As a result, they may be able to adapt more quickly to new or emerging technologies and changes in customer requirements. They also have greater resources to devote to the promotion and sale of their products than we have. In addition, these companies have reduced and could continue to reduce, the price of their security monitoring, detection, prevention and response products and managed security services, which intensifies pricing pressures within our market.

 

Several companies currently sell software products (such as encryption, firewall, operating system security and virus detection software) that our customers and potential customers have broadly adopted. Some of these

companies sell products that perform the same functions as some of our products. In addition, the vendors of operating system software or networking hardware may enhance their products to include functions similar to those that our products currently provide. The widespread inclusion of comparable features to our software in operating system software or networking hardware could render our products less competitive or obsolete, particularly if such features are of a high quality. Even if security functions integrated into operating system software or networking hardware are more limited than those of our products, a significant number of customers may accept more limited functionality to avoid purchasing additional products such as ours.

 

One of the characteristics of open source software is that anyone can offer new software products for free under an open source licensing model in order to gain rapid and widespread market acceptance. Such competition can develop without the degree of overhead and lead time required by traditional technology companies. It is possible for new competitors with greater resources than ours to develop their own open source security solutions, potentially reducing the demand for our solutions. We may not be able to compete successfully against current and future competitors. Competitive pressure and/or the availability of open source software may result in price reductions, reduced revenue, reduced operating margins and loss of market share, any one of which could seriously harm our business.

 

New competitors could emerge or our customers or distributors could internally develop alternatives to our products and either development could impair our sales.

 

We may face competition from emerging companies as well as established companies who have not previously entered the market for network security products. Established companies may not only develop their own network intrusion detection and prevention products, but they may also acquire or establish product integration, distribution or other cooperative relationships with our current competitors. Moreover, our large corporate customers and potential customers could develop network security software internally, which would reduce our potential revenue. New competitors or alliances among competitors may emerge and rapidly acquire significant market share due to factors such as greater brand name recognition, a larger installed customer base and significantly greater financial, technical, marketing and other resources and experience. For example, one of our competitors, Internet Security Systems, Inc., has recently been acquired by IBM and our relationship with IBM may be diminished by this transaction. If these new competitors are successful, we would lose market share and our revenue would likely decline.

 

Our quarterly operating results are likely to vary significantly and be unpredictable, in part because of the purchasing and budget practices of our customers, which could cause the trading price of our stock to decline.

 

Our operating results have historically varied significantly from period to period, and we expect that they will continue to do so as a result of a number of factors, most of which are outside of our control, including:

 

 

 

In particular, the network security technology procurement practices of many of our customers have had a measurable influence on the historical variability of our operating performance. Our prospective customers usually exercise great care and invest substantial time in their network security technology purchasing decisions. Many of our customers have historically finalized purchase decisions in the last weeks or days of a quarter. A delay in even one large order beyond the end of a particular quarter can substantially diminish our anticipated revenue for that quarter. In addition, many of our expenses must be incurred before we generate revenue. As a result, the negative impact on our operating results would increase if our revenue fails to meet expectations in any period.

 

The cumulative effect of these factors will likely result in larger fluctuations and unpredictability in our quarterly operating results than in the operating results of many other software and technology companies. This variability and unpredictability could result in our failing to meet the revenue or operating results expectations of securities industry analysts or investors for any period. If we fail to meet or exceed such expectations for these or any other reasons, the market price of our shares could fall substantially and we could face costly securities class action suits. Therefore, you should not rely on our operating results in any quarter as being indicative of our operating results for any future period, nor should you rely on other expectations, predictions or projections of our future revenue or other aspects of our results of operations.

 

The market for network security products is rapidly evolving and the complex technology incorporated in our products makes them difficult to develop. If we do not accurately predict, prepare for and respond promptly to technological and market developments and changing customer needs, our competitive position and prospects will be harmed.

 

The market for network security products is relatively new and is expected to continue to evolve rapidly. Moreover, many customers operate in markets characterized by rapidly changing technologies and business plans, which require them to add numerous network access points and adapt increasingly complex enterprise networks, incorporating a variety of hardware, software applications, operating systems and networking protocols. In addition, computer hackers and others who try to attack networks employ increasingly sophisticated new techniques to gain access to and attack systems and networks. Customers look to our products to continue to protect their networks against these threats in this increasingly complex environment without sacrificing network efficiency or causing significant network downtime. The software in our products is especially complex because it needs to effectively identify and respond to new and increasingly sophisticated methods of attack, while not impeding the high network performance demanded by our customers. Although the market expects speedy introduction of software to respond to new threats, the development of these products is difficult and the timetable for commercial release of new products is uncertain. Therefore, we may in the future experience delays in the introduction of new products or new versions, modifications or enhancements of existing products. If we do not quickly respond to the rapidly changing and rigorous needs of our customers by developing and introducing on a timely basis new and effective products, upgrades and services that can respond adequately to new security threats, our competitive position and business prospects will be harmed.

 

If our new products and product enhancements do not achieve sufficient market acceptance, our results of operations and competitive position will suffer.

 

We spend substantial amounts of time and money to research and develop new products and enhanced versions of Snort, the Defense Center and our Intrusion Sensors and RNA products to incorporate additional features, improved functionality or other enhancements in order to meet our customers’ rapidly evolving demands for network security in our highly competitive industry. When we develop a new product or an advanced version of an existing product, we typically expend significant money and effort upfront to market, promote and sell the new offering. Therefore, when we develop and introduce new or enhanced products, they must achieve high levels of market acceptance in order to justify the amount of our investment in developing and bringing the products to market.

Our new products or enhancements could fail to attain sufficient market acceptance for many reasons, including:

 

 

If our new products or enhancements (including, but not limited to, version 4.0 of RNA, which we plan to introduce in the next several months) do not achieve adequate acceptance in the market, our competitive position will be impaired, our revenue will be diminished and the effect on our operating results may be particularly acute because of the significant research, development, marketing, sales and other expenses we incurred in connection with the new product.

 

If existing customers do not make subsequent purchases from us or if our relationships with our largest customers are impaired, our revenue could decline.

 

In 2004, 2005 and the nine months ended September 30, 2006, existing customers that purchased additional products and services from us, whether for new locations or additional technology to protect existing networks and locations, generated a majority of our total revenue for each respective period. Part of our growth strategy is to sell additional products to our existing customers and, in particular, to up-sell our RNA products to customers that previously bought our Intrusion Sensor products. We may not be effective in executing this or any other aspect of our growth strategy. Our revenue could decline if our current customers do not continue to purchase additional products from us. In addition, as we deploy new versions of our existing Snort, Intrusion Sensors and RNA products or introduce new products, our current customers may not require the functionality of these products and may not purchase them. We also depend on our installed customer base for future service revenue from annual maintenance fees. If customers choose not to continue their maintenance service, our revenue may decline.

 

If we cannot attract sufficient government agency customers, our revenue and competitive position will suffer.

 

Contracts with the U.S. federal and state and other national and state government agencies accounted for 17% of our total revenue for the year ended December 31, 2004, 16% for the year ended December 31, 2005 and 13% for the nine months ended September 30, 2006. We lost many government agency customers when a foreign company tried unsuccessfully to acquire us in late 2005 and early 2006. Since then, we have been attempting to regain government customers, which subjects us to a number of risks, including:

 

 

 

 

We are subject to risks of operating internationally that could impair our ability to grow our revenue abroad.

 

We market and sell our software in North America, South America, Europe and Asia and we plan to establish additional sales presence in these and other parts of the world. Therefore, we are subject to risks associated with having worldwide operations. Sales to customers located outside of North America accounted for approximately 16% of our total revenue in the year ended December 31, 2004, approximately 17% of our total revenue in the year ended December 31, 2005 and approximately 18% of our total revenue during the nine months ended September 30, 2006. The expansion of our existing operations and entry into additional worldwide markets will require significant management attention and financial resources. We are also subject to a number of risks customary for international operations, including:

 

 

To date, a substantial portion of our sales have been denominated in U.S. dollars, and we have not used risk management techniques or “hedged” the risks associated with fluctuations in foreign currency exchange rates. In the future, if we do not engage in hedging transactions, our results of operations will be subject to losses from fluctuations in foreign currency exchange rates.

 

In the future, we may not be able to secure financing necessary to operate and grow our business as planned.

 

We expect that the net proceeds from this offering together with current cash, cash equivalents, borrowings under our credit facility and short-term investments should be sufficient to meet our anticipated cash needs for working capital and capital expenditures for at least the next 24 months. However, our business and operations may consume resources faster than we anticipate. In the future, we may need to raise additional funds to expand our sales and marketing and research and development efforts or to make acquisitions. Additional financing may not be

available on favorable terms, if at all. If adequate funds are not available on acceptable terms, we may be unable to fund the expansion of our sales and marketing and research and development efforts or take advantage of acquisition or other opportunities, which could seriously harm our business and operating results. If we issue debt, the debt holders would have rights senior to common stockholders to make claims on our assets and the terms of any debt could restrict our operations, including our ability to pay dividends on our common stock. Furthermore, if we issue additional equity securities, stockholders will experience dilution, and the new equity securities could have rights senior to those of our common stock.

 

Our inability to acquire and integrate other businesses, products or technologies could seriously harm our competitive position.

 

In order to remain competitive, we intend to acquire additional businesses, products or technologies. If we identify an appropriate acquisition candidate, we may not be successful in negotiating the terms of the acquisition, financing the acquisition, or effectively integrating the acquired business, product or technology into our existing business and operations. Any acquisitions we are able to complete may not be accretive to earnings. Further, completing a potential acquisition and integrating an acquired business will significantly divert management time and resources.

 

If other parties claim commercial ownership rights to Snort, our reputation, customer relations and results of operations could be harmed.

 

While we created a majority of the current Snort code base, a portion of the current Snort code was created by the combined efforts of the Company and the open source software community and a portion was created solely by the open source community. We believe that the portions of the Snort code base created by anyone other than by us are required to be licensed by us pursuant to the GNU General Public License, or GPL, which is how we currently license Snort. There is a risk, however, that a third party could claim some ownership rights in Snort, and attempt to prevent us from commercially licensing Snort in the future (rather than pursuant to the GPL as it is currently licensed) and claim a right to licensing royalties. Any such claim, regardless of its merit or outcome, could be costly to defend, harm our reputation and customer relations and result in our having to pay substantial compensation to the party claiming ownership.

 

Our products contain third party open source software, and failure to comply with the terms of the underlying open source software licenses could restrict our ability to sell our products.

 

Our products are distributed with software programs licensed to us by third party authors under “open source” licenses, which may include the GPL, the GNU Lesser Public License, or LGPL, the BSD License, the Artistic License and the Apache License. These third party open source programs are typically licensed to us for a minimal fee or no fee at all, but the underlying license agreements may require us to make available to the open source user community the source code for the modifications or derivative works we create based on these third party open source software programs. If this were to occur, our competitors could use these developments and improvements created by us to produce competitive products, which would result in a loss of our product sales. Additionally, if we combine our proprietary software with third party open source software in a certain manner, we could, under the terms of certain of these open source license agreements, be required to release the source code of our proprietary software. This could also allow our competitors to create similar products, which would result in a loss of our product sales. Our ability to commercialize our products by incorporating third party open source software may be restricted because, among other reasons:

 

 

The software program Linux is included in our products and is licensed under the GPL. The GPL is the subject of litigation in the case of The SCO Group, Inc. v. International Business Machines Corp., pending in the United States District Court for the District of Utah. It is possible that the court could rule that the GPL is not enforceable in such litigation. Any ruling by the court that the GPL is not enforceable could have the effect of limiting or preventing us from using Linux as currently implemented.

 

Efforts to assert intellectual property ownership rights in our products could impact our standing in the open source community which could limit our product innovation capabilities.

 

When we undertake actions to protect and maintain ownership and control over our proprietary intellectual property, including patents, copyrights and trademark rights, our standing in the open source community could be diminished which could result in a limitation on our ability to continue to rely on this community as a resource to identify and defend against new viruses, threats and techniques to attack secure networks, explore new ideas and concepts and further our research and development efforts.

 

Our proprietary rights may be difficult to enforce, which could enable others to copy or use aspects of our products without compensating us.

 

We rely primarily on copyright, trademark, patent and trade secrets laws, confidentiality procedures and contractual provisions to protect our proprietary rights. As of the date hereof, we had 19 patent applications pending for examination in the U.S. and foreign jurisdictions. We also hold numerous registered United States and foreign trademarks and have a number of trademark applications pending in the United States and in foreign jurisdictions. Valid patents may not be issued from pending applications, and the claims allowed on any patents may not be sufficiently broad to protect our technology or products. Any issued patents may be challenged, invalidated or circumvented, and any rights granted under these patents may not actually provide adequate protection or competitive advantages to us. Despite our efforts to protect our proprietary rights, unauthorized parties may attempt to copy aspects of our products or to obtain and use information that we regard as proprietary. Policing unauthorized use of our technologies or products is difficult. Our products incorporate open source Snort software, which is readily available to the public. In addition, the laws of some foreign countries do not protect our proprietary rights to as great an extent as do the laws of the United States, and many foreign countries do not enforce these laws as diligently as U.S. government agencies and private parties. It is possible that we may have to resort to litigation to enforce and protect our copyrights, trademarks, patents and trade secrets, which litigation could be costly and a diversion of management resources. If we are unable to protect our proprietary rights to the totality of the features in our software and products (including aspects of our software and products protected other than by patent rights), we may find ourselves at a competitive disadvantage to others who need not incur the additional expense, time and effort required to create the innovative products that have enabled us to be successful to date.

 

We have placed, and in the future may place, source code for our software in escrow, other than the Snort source code which is publicly available. The source code may, under certain circumstances, be made available to certain of our customers and OEM partners. This may increase the likelihood of misappropriation or other misuse of our software.

 

Claims that our products infringe the proprietary rights of others could harm our business and cause us to incur significant costs.

 

Technology products such as ours, which interact with multiple components of complex networks, are increasingly subject to infringement claims as the functionality of products in different industry segments overlaps. In particular, our RNA technology is a new technology for which we have yet be issued a patent. It is possible that other companies have patents with respect to technology similar to our technology, including RNA. In addition, there is at least one company that has filed an application for a patent that, on its face, contains claims that may be construed to be within the scope of the same broad technology area as our RNA technology. Unless and until the U.S. Patent and Trademark Office, or PTO, issues a patent to an applicant, there can be no way to assess a potential patentee’s right to exclude. Depending on the timing and substance of these patents and patent applications, our products, including our RNA technology, may infringe the proprietary rights of others, and we may be subject to litigation with respect to any alleged infringement. The application of patent law to the software industry is particularly uncertain as the PTO has only recently begun to issue software patents in large numbers and there is a

backlog of software related patent applications pending claiming inventions whose priority dates may pre-date development of our own proprietary software. Additionally, in our customer contracts we typically agree to indemnify our customers if they incur losses resulting from a third party claim that their use of our products infringes upon the intellectual property rights of a third party. Any potential intellectual property claims against us, with or without merit, could:

 

 

Royalty or licensing agreements, if required, may not be available on acceptable terms, if at all. A successful claim of infringement against us and our failure or inability to license the infringed or similar technology could prevent us from distributing our products and cause us to incur great expense and delay in developing non-infringing products.

 

We have been sued by a company claiming that we misappropriated its proprietary rights and our defense of these claims is costly, diverts the attention of our management and may be unsuccessful.

 

On April 20, 2006, a lawsuit was filed against us, Martin F. Roesch, our Chief Technology Officer, Inflection Point Ventures, L.P., one of our stockholders, and certain general partners of Inflection Point Ventures, L.P. by PredatorWatch Inc. (now named NetClarity) in the Superior Court for Suffolk County, Massachusetts. The complaint alleges that the defendants: (i) misappropriated the plaintiff’s trade secrets; (ii) breached an oral agreement of confidentiality; (iii) breached a covenant of good faith and fair dealing owed to the plaintiff; (iv) were unjustly enriched; (v) misrepresented certain material facts to the plaintiff, upon which the plaintiff relied to its detriment; and (vi) engaged in unfair and deceptive acts in violation of Massachusetts state law. The plaintiff has sought to recover amounts to be ascertained and established, as well as double and treble damages and attorney’s fees.

 

Litigation is subject to inherent uncertainties, especially in cases like this where sophisticated factual issues must be assessed and complex technical issues must be resolved. In addition, these types of cases involve issues of law that are evolving, presenting further uncertainty. Our defense of this litigation, regardless of the merits of the complaint, has been, and will likely continue to be, time consuming, extremely costly and a diversion of time and attention for our technical and management personnel. Through September 30, 2006, we have spent approximately $174,000 in legal fees and expenses on this litigation and expect to incur substantial additional expenses even if we ultimately prevail. In addition, publicity related to this litigation has in the past, and could likely in the future, have a negative impact on sales of our RNA products.

 

A failure to prevail in the litigation could result in one or more of the following:

 

 

 

Additionally, PredatorWatch has separately notified us that they believe that our RNA technology is covered by claims contained in a pending patent application. This pending patent application has not issued as a patent, but in the event it does issue, PredatorWatch could file an additional complaint to include a patent infringement claim against us.

 

If we are enjoined from selling RNA in its current form, we may be required to redesign RNA to avoid infringing on the intellectual property rights of others. If we are unable to efficiently redesign commercially acceptable products, our sales will decline substantially. This litigation is at a very early stage, so we cannot predict its course or its costs to us. We do, however, expect to continue to incur significant costs in defending against this litigation and these costs could increase substantially if this litigation approaches or enters a trial phase. It is possible that these costs could substantially exceed our expectations in future periods. For a more detailed description of this litigation, please see “Business — Legal Proceedings.”

 

We rely on software licensed from other parties, the loss of which could increase our costs and delay software shipments.

 

We integrate as components of our products various types of software licensed from unaffiliated parties. For example, some of our products incorporate MySQL, a licensed database. Our business would be disrupted if any of the software we license from others or functional equivalents of this software were either no longer available to us or no longer offered to us on commercially reasonable terms. In either case, we would be required to either redesign our products to function with software available from other parties or develop these components ourselves, which would result in increased costs and could result in delays in our product shipments and the release of new product offerings. Furthermore, we might be forced to limit the features available in our current or future products. If we fail to maintain or renegotiate any of these software licenses, we could face significant delays and diversion of resources in attempting to license and integrate a functional equivalent of the software.

 

Defects, errors or vulnerabilities in our software products would harm our reputation and divert resources.

 

Because our products are complex, they may contain defects, errors or vulnerabilities that are not detected until after our commercial release and installation by our customers. We may not be able to correct any errors or defects or address vulnerabilities promptly, or at all. Any defects, errors or vulnerabilities in our products could result in:

 

 

In addition, because our products and services provide and monitor network security and may protect valuable information, we could face claims for product liability, tort or breach of warranty. Anyone who circumvents our security measures could misappropriate the confidential information or other valuable property of customers using our products, or interrupt their operations. If that happens, affected customers or others may sue us. In addition, we

may face liability for breaches of our product warranties, product failures or damages caused by faulty installation of our products. Provisions in our contracts relating to warranty disclaimers and liability limitations may be unenforceable. Some courts, for example, have found contractual limitations of liability in standard computer and software contracts to be unenforceable in some circumstances. Defending a lawsuit, regardless of its merit, could be costly and divert management attention. Our business liability insurance coverage may be inadequate or future coverage may be unavailable on acceptable terms or at all.

 

Our networks, products and services are vulnerable to, and may be targeted by, hackers.

 

Like other companies, our websites, networks, information systems, products and services may be targets for sabotage, disruption or misappropriation by hackers. As a leading network security solutions company, we are a high profile target and our networks, products and services may have vulnerabilities that may be targeted by hackers. Although we believe we have sufficient controls in place to prevent disruption and misappropriation, and to respond to such situations, we expect these efforts by hackers to continue. If these efforts are successful, our operations, reputation and sales could be adversely affected.

 

We utilize a just-in-time contract manufacturing and inventory process, which increases our vulnerability to supply disruption.

 

Our ability to meet our customers’ demand for certain of our products depends upon obtaining adequate hardware platforms on a timely basis, which must be integrated with our software. We purchase hardware platforms through our contract manufacturers from a limited number of suppliers on a just-in-time basis. In addition, these suppliers may extend lead times, limit the supply to our manufacturers or increase prices due to capacity constraints or other factors. Although we work closely with our manufacturers and suppliers to avoid shortages, we may encounter these problems in the future. Our results of operations would be adversely affected if we were unable to obtain adequate supplies of hardware platforms in a timely manner or if there were significant increases in the costs of hardware platforms or problems with the quality of those hardware platforms.

 

We depend on a single source to manufacture our enterprise class intrusion sensor product; if that sole source were to fail to satisfy our requirements, our sales revenue would decline and our reputation would be harmed.

 

We rely on one manufacturer, Bivio Networks, to build the hardware platform for two models of our intrusion sensor products that are used by our enterprise class customers. These enterprise class intrusion sensor products are purchased directly by customers for their internal use and are also utilized by third party managed security service providers to provide services to their customers. Revenue resulting from sales of these enterprise class intrusion sensor products accounted for approximately 3.8% of our product revenue in the year ended December 31, 2005 and approximately 18% of our product revenue during the nine months ended September 30, 2006. The unexpected termination of our relationship with Bivio Networks would be disruptive to our business and our reputation which could result in a decline in our revenue as well as shipment delays and possible increased costs as we seek and implement production with an alternate manufacturer.

 

Our inability to hire and retain key personnel would slow our growth.

 

Our business is dependent on our ability to hire, retain and motivate highly qualified personnel, including senior management, sales and technical professionals. In particular, we intend to expand the size of our direct sales force domestically and internationally and to hire additional customer support and professional services personnel. However, competition for qualified services personnel is intense, and if we are unable to attract, train or retain the number of highly qualified sales and services personnel that our business needs, our reputation, customer satisfaction and potential revenue growth could be seriously harmed. To the extent we hire personnel from competitors, we may be subject to allegations that they have been improperly solicited or divulged proprietary or other confidential information.

 

Our future success will depend to a significant extent on the continued services of Martin Roesch, our founder and Chief Technology Officer, and E. Wayne Jackson, III, our Chief Executive Officer. The loss of the services of

either of these or other individuals could adversely affect our business and could divert other senior management time in searching for their replacements.

 

We depend on resellers and distributors for our sales; if they fail to perform as expected, our revenue will suffer.

 

Part of our business strategy involves entering into additional agreements with resellers and distributors that permit them to resell our products and service offerings. Revenue resulting from our resellers and distributors accounted for approximately 46% of our total revenue in the year ended December 31, 2004, approximately 48% of our total revenue in the year ended December 31, 2005 and approximately 48% of our total revenue during the nine months ended September 30, 2006. There is a risk that our pace of entering into such agreements may slow, or that our existing agreements may not produce as much business as we anticipate. There is also a risk that some or all of our resellers or distributors may be acquired, may change their business models or may go out of business, any of which could have an adverse effect on our business.

 

If we do not continue to establish and effectively manage our OEM relationships, our revenue could decline.

 

Our ability to sell our network security software products in new markets and to increase our share of existing markets will be impaired if we fail to expand our indirect distribution channels. Our sales strategy involves the establishment of multiple distribution channels domestically and internationally through strategic resellers, system integrators and OEMs. We have alliances with OEMs such as IBM and Nokia and we cannot predict the extent to which these companies will be successful in marketing or selling our software. These agreements could be terminated on short notice and they do not prevent our OEMs, systems integrators, strategic resellers or other distributors from selling the network security software of other companies, including our competitors. IBM and Nokia or any other OEM, system integrator, strategic reseller or distributor could give higher priority to other companies’ software or to their own software than they give to ours, which could cause our revenue to decline.

 

Our inability to effectively manage our expected headcount growth and expansion and our additional obligations as a public company could seriously harm our ability to effectively run our business.

 

Our historical growth has placed, and our intended future growth is likely to continue to place, a significant strain on our management, financial, personnel and other resources. We will likely not continue to grow at our historical pace due to limits on our resources. We have grown from 84 employees at December 31, 2003 to 174 employees at September 30, 2006. Since January 1, 2005, we have opened additional sales offices and have significantly expanded our operations. This rapid growth has strained our facilities and required us to lease additional space at our headquarters. In several recent quarters, we have not been able to hire sufficient personnel to keep pace with our growth. In addition to managing our expected growth, we will have substantial additional obligations and costs as a result of being a public company. These obligations include investor relations, preparing and filing periodic SEC reports, developing and maintaining internal controls over financial reporting and disclosure controls, compliance with corporate governance rules, Regulation FD and other requirements imposed on public companies by the SEC and the Nasdaq Global Market. Fulfilling these additional obligations will make it more difficult to operate a growing company. Any failure to effectively manage growth or fulfill our obligations as a public company could seriously harm our ability to respond to customers, the quality of our software and services and our operating results. To effectively manage growth and operate a public company, we will need to implement additional management information systems, improve our operating, administrative, financial and accounting systems and controls, train new employees and maintain close coordination among our executive, engineering, accounting, finance, marketing, sales and operations organizations.

 

Risks Related to Your Investment

 

The price of our common stock may be subject to wide fluctuations and may trade below the initial public offering price.

 

Before this offering, there has not been a public market for our common stock. The initial public offering price of our common stock will be determined by negotiations between us and representatives of the underwriters, based on numerous factors, including those that we discuss under “Underwriters.” This price may not be indicative of the market price of our common stock after this offering. We cannot assure you that an active public market for our common stock will develop or be sustained after this offering. The market price of our common stock also could be

subject to significant fluctuations. As a result, you may not be able to sell your shares of our common stock quickly or at prices equal to or greater than the price you paid in this offering.

 

Among the factors that could affect our common stock price are the risks described in this “Risk Factors” section and other factors, including:

 

 

Stock markets in general have experienced extreme volatility that has often been unrelated to the operating performance of a particular company. These broad market fluctuations may adversely affect the trading price of our common stock, regardless of our operating performance.

 

Sales of substantial amounts of our common stock in the public markets, or the perception that they might occur, could reduce the price that our common stock might otherwise attain and may dilute your voting power and your ownership interest in us.

 

After the completion of this offering, we will have          outstanding shares of common stock (            shares of common stock if the underwriters exercise in full their option to purchase additional shares). This number is comprised of all the shares of our common stock that we are selling in this offering, which may be resold immediately in the public market. Subject to certain exceptions described under the caption “Underwriters,” we and all of our directors and executive officers and certain of our stockholders and option holders have agreed not to offer, sell or agree to sell, directly or indirectly, any shares of common stock without the permission of the underwriters for a period of 180 days from the date of this prospectus. When this period expires we and our locked-up stockholders will be able to sell our shares in the public market. Sales of a substantial number of such shares upon expiration, or early release, of the lock-up (or the perception that such sales may occur) could cause our share price to fall.

 

Sales of substantial amounts of our common stock in the public market following our initial public offering, or the perception that such sales could occur, could adversely affect the market price of our common stock and may make it more difficult for you to sell your common stock at a time and price that you deem appropriate.

 

We also may issue our shares of common stock from time to time as consideration for future acquisitions and investments. If any such acquisition or investment is significant, the number of shares that we may issue may in turn be significant. In addition, we may also grant registration rights covering those shares in connection with any such acquisitions and investments.

 

Investors purchasing common stock in this offering will experience immediate and substantial dilution.

 

The assumed initial public offering price of our common stock is substantially higher than the net tangible book value per outstanding share of our common stock immediately after this offering. As a result, you will pay a price per share that substantially exceeds the book value of our tangible assets after subtracting our liabilities. Purchasers of our common stock in this offering will incur immediate and substantial dilution of $      per share in the net tangible book value of our common stock from the assumed initial public offering price of $      per share, which is the mid-point of the estimated range set forth on the cover of this prospectus. If the underwriters exercise in

full their option to purchase additional shares, there will be an additional dilution of $      per share in the net tangible book value of our common stock, assuming the same public offering price.

 

As a result of becoming a public company, we will be obligated to develop and maintain proper and effective internal controls over financial reporting and will be subject to other requirements that will be burdensome and costly. We may not complete our analysis of our internal controls over financial reporting in a timely manner, or these internal controls may not be determined to be effective, which may adversely affect investor confidence in our company and, as a result, the value of our common stock.

 

We will be required, pursuant to Section 404 of the Sarbanes-Oxley Act of 2002 (Section 404), to furnish a report by management on, among other things, the effectiveness of our internal control over financial reporting for the first fiscal year beginning after the effective date of this offering. This assessment will need to include disclosure of any material weaknesses identified by our management in our internal control over financial reporting, as well as a statement that our auditors have issued an attestation report on our management’s assessment of our internal controls.

 

We are just beginning the costly and challenging process of compiling the system and processing documentation before we perform the evaluation needed to comply with Section 404. We may not be able to complete our evaluation, testing and any required remediation in a timely fashion. During the evaluation and testing process, if we identify one or more material weaknesses in our internal control over financial reporting, we will be unable to assert that our internal control is effective. If we are unable to assert that our internal control over financial reporting is effective, or if our auditors are unable to attest that our management’s report is fairly stated or they are unable to express an opinion on the effectiveness of our internal control, we could lose investor confidence in the accuracy and completeness of our financial reports, which would have a material adverse effect on the price of our common stock. Failure to comply with the new rules might make it more difficult for us to obtain certain types of insurance, including director and officer liability insurance, and we might be forced to accept reduced policy limits and coverage and/or incur substantially higher costs to obtain the same or similar coverage. The impact of these events could also make it more difficult for us to attract and retain qualified persons to serve on our board of directors, on committees of our board of directors, or as executive officers.

 

In addition, as a public company, we will incur significant additional legal, accounting and other expenses that we did not incur as a private company, and our administrative staff will be required to perform additional tasks. For example, in anticipation of becoming a public company, we will need to create or revise the roles and duties of our board committees, adopt disclosure controls and procedures, retain a transfer agent, adopt an insider trading policy and bear all of the internal and external costs of preparing and distributing periodic public reports in compliance with our obligations under the securities laws. In addition, changing laws, regulations and standards relating to corporate governance and public disclosure, and related regulations implemented by the Securities and Exchange Commission and the Nasdaq Global Market, are creating uncertainty for public companies, increasing legal and financial compliance costs and making some activities more time consuming. These laws, regulations and standards are subject to varying interpretations, in many cases due to their lack of specificity, and, as a result, their application in practice may evolve over time as new guidance is provided by regulatory and governing bodies. We intend to invest resources to comply with evolving laws, regulations and standards, and this investment may result in increased general and administrative expenses and a diversion of management’s time and attention from revenue-generating activities to compliance activities. If our efforts to comply with new laws, regulations and standards differ from the activities intended by regulatory or governing bodies due to ambiguities related to practice, regulatory authorities may initiate legal proceedings against us and our business may be harmed.

Anti-takeover provisions in our charter documents and under Delaware law could make an acquisition of us, which may be beneficial to our stockholders, more difficult and may prevent attempts by our stockholders to replace or remove our current management.

 

We intend to amend and restate our certificate of incorporation and bylaws, both of which will become effective upon the completion of this offering, to add provisions that may delay or prevent an acquisition of us or a change in our management. These provisions include a classified board of directors, a prohibition on actions by written consent of our stockholders, and the ability of our board of directors to issue preferred stock without stockholder approval. In addition, because we are incorporated in Delaware, we are governed by the provisions of Section 203 of the Delaware General Corporation Law, which prohibits stockholders owning in excess of 15% of our outstanding voting stock from merging or combining with us. Although we believe these provisions collectively provide for an opportunity to receive higher bids by requiring potential acquirors to negotiate with our board of directors, they would apply even if the offer may be considered beneficial by some stockholders. In addition, these provisions may frustrate or prevent attempts by our stockholders to replace or remove our current management by making it more difficult for stockholders to replace members of our board of directors, which is responsible for appointing the members of our management.

 

This prospectus contains both historical and forward-looking statements. All statements other than statements of historical fact are, or may be deemed to be, forward-looking statements. For example, statements concerning projections, predictions, expectations, estimates or forecasts and statements that describe our objectives, plans or goals are or may be forward-looking statements. These forward-looking statements reflect management’s current expectations concerning future results and events and generally can be identified by use of expressions such as “may,” “will,” “should,” “could,” “would,” “predict,” “potential,” “continue,” “expect,” “anticipate,” “future,” “intend,” “plan,” “foresee,” “believe,” “estimate,” and similar expressions, as well as statements in future tense. These forward-looking statements include, but are not limited to, the following:

 

 

The forward-looking statements included in this prospectus are made only as of the date of this prospectus. We expressly disclaim any intent or obligation to update any forward-looking statements to reflect subsequent events or circumstances.

 

Forward-looking statements involve known and unknown risks, uncertainties and other factors that may cause our actual results, performance or achievements to be different from any future results, performance and achievements expressed or implied by these statements. These risks and uncertainties include, but are not limited to, the following:

 

 

 

Assuming an initial public offering price of $      per share, we estimate that we will receive net proceeds from this offering of approximately $      million, after deducting underwriting discounts and commissions and other estimated expenses of $      million payable by us. If the underwriters’ option to purchase additional shares in this offering is exercised in full we estimate that our net proceeds will be approximately $     million. We will not receive any proceeds from the sale of shares of our common stock by the selling stockholders.

 

We intend to use the net proceeds to us from this offering for working capital and other general corporate purposes, including financing our growth, developing new products and funding capital expenditures. In addition, we may choose to repay our credit facility with Silicon Valley Bank or expand our current business through acquisitions of other businesses, products or technologies. However, we do not have agreements or commitments for any specific repayments or acquisitions at this time.

 

Pending any use, as described above, we plan to invest the net proceeds in short-term, interest-bearing investment grade securities.

 

A $1.00 increase (decrease) in the assumed initial public offering price of $      per share would increase (decrease) the net proceeds to us from this offering by $     , assuming the number of shares offered by us, as set forth on the cover page of this prospectus, remains the same and after deducting the estimated underwriting discounts and commissions and estimated expenses payable by us.

 

We intend to retain all future earnings, if any, for use in the operation of our business and to fund future growth. We have never declared or paid any dividend on our capital stock and do not anticipate paying any dividends for the foreseeable future and the loan and security agreement governing our working capital line of credit restricts our ability to pay dividends or other distributions on our capital stock. The decision whether to pay dividends will be made by our board of directors in light of conditions then existing, including factors such as our results of operations, financial condition and requirements, business conditions and covenants under any applicable contractual arrangements.

 

The following table sets forth our cash and cash equivalents and our capitalization as of September 30, 2006:

 

 

The numbers of shares of common stock shown as issued and outstanding exclude:

 

 

You should read this table in conjunction with the consolidated financial statements and the related notes, “Management’s Discussion and Analysis of Financial Condition and Results of Operations,” and “Description of Capital Stock” included elsewhere in this prospectus.

 

Dilution is the amount by which the offering price paid by the purchasers of the common stock sold in the offering exceeds the net tangible book value per share of common stock after the offering. Net tangible book value per share is determined at any date by subtracting our total liabilities from the total book value of our tangible assets and dividing the difference by the number of shares of common stock deemed to be outstanding at that date.

 

Our pro forma net tangible book value as of September 30, 2006 was $25.3 million, or $0.88 per share, which gives effect to the conversion of all outstanding shares of our preferred stock into 23,226,683 shares of our common stock immediately prior to the completion of this offering. After giving effect to the receipt and our intended use of approximately $        million of estimated net proceeds from our sale of           shares of common stock in this offering at an assumed offering price of $        per share, our pro forma as adjusted net tangible book value as of September 30, 2006 would have been approximately $        million, or $        per share. This represents an immediate increase in pro forma net tangible book value of $        per share to existing stockholders and an immediate dilution of $        per share to new investors purchasing shares of common stock in the offering. The following table illustrates this substantial and immediate per share dilution to new investors:

 

 

A $1.00 increase (decrease) in the assumed initial public offering price of $      per share would increase (decrease) our pro forma net tangible book value per share before this offering, by $     , the as adjusted pro forma net tangible book value per share after this offering by $      and the dilution per share to new investors in this offering by $     , assuming the number of shares offered by us, as set forth on the cover page of this prospectus, remains the same and after deducting the estimated underwriting discounts and commissions and estimated offering expenses payable by us.

 

The following table summarizes on an as adjusted pro forma basis as of September 30, 2006.

 

 

A $1.00 increase (decrease) in the assumed initial public offering price of $      per share would increase (decrease) total consideration paid by new investors and the average price per share by $      and $     , respectively, assuming the number of shares offered by us, as set forth on the cover page of this prospectus, remains the same, and without deducting the estimated underwriting discounts and commissions and estimated expenses payable by us.

 

The tables and calculations above assume no exercise of:

 

 

To the extent any of these options are exercised, there will be further dilution to new investors.

 

The consolidated statement of operations data for the five years ended December 31, 2005 and the consolidated balance sheet data as of December 31, 2001, 2002, 2003, 2004 and 2005 have been derived from our audited consolidated financial statements. The statement of operations data for the nine months ended September 30, 2005 and 2006 and the balance sheet data as of September 30, 2006 were derived from our unaudited consolidated financial statements and related notes, which are included in this prospectus. The unaudited interim consolidated financial statements include, in the opinion of management, all adjustments that management considers necessary for the fair presentation of the financial information set forth in those statements. The selected consolidated financial data set forth below should be read in conjunction with “Management’s Discussion and Analysis of Financial Condition and Results of Operations” set forth below and our consolidated financial statements and related notes included elsewhere in this prospectus. The historical results are not necessarily indicative of the results to be expected in any future period and the results for the nine months ended September 30, 2006 should not be considered indicative of results expected for the full year.

 

 

 

 

The following discussion and analysis of our financial condition and results of operations should be read in conjunction with our consolidated financial statements and related notes that appear elsewhere in this prospectus. In addition to historical consolidated financial information, the following discussion contains forward-looking statements that reflect our plans, estimates and beliefs. Our actual results could differ materially from those discussed in the forward-looking statements. Factors that could cause or contribute to these differences include those discussed below and elsewhere in this prospectus, particularly in “Risk Factors.”

 

Overview

 

Sourcefire is a leading provider of intelligence driven, open source network security solutions that enable our customers to protect their computer networks in an effective, efficient and highly automated manner. We apply a comprehensive Discover, Determine and Defend, or 3D, approach to network security through which we: 1) discover potential threats and vulnerabilities, 2) determine the potential impact of those observations to the network and 3) defend the network through aggressive enforcement of security policies. We sell our security solutions to a diverse customer base that includes over 25 of the Fortune 100 companies and over half of the 30 largest U.S. government agencies. We also manage one of the security industry’s leading open source initiatives, Snort.

 

Our Sourcefire 3D approach is comprised of three key components:

 

RNA.  At the heart of the Sourcefire 3D security solution is Real-time Network Awareness, or RNA, our network intelligence product that provides persistent visibility into the composition, behavior, topology (the relationship of network components) and risk profile of the network. This information provides a platform for the Defense Center’s automated decision-making and network policy compliance enforcement. The ability to continuously discover characteristics and vulnerabilities of network assets, or endpoint intelligence, enables our Intrusion Prevention products to more precisely identify and block threatening traffic and to more efficiently classify threatening and/or suspicious behavior than products lacking network intelligence.

 

Intrusion Sensors.  The Intrusion Sensors utilize open source Snort^® and our proprietary technology to monitor network traffic. These sensors compare observed traffic to a set of “Rules”, or a set of network traffic characteristics, which can be indicative of malicious activity. Once the Intrusion Sensors match a Rule to the observed traffic, they block malicious traffic and/or send an alert to the Defense Center for further analysis, prioritization and possible action.

 

Defense Center.  The Defense Center aggregates, correlates and prioritizes network security events from RNA Sensors and Intrusion Sensors to synthesize multipoint event correlation and policy compliance analysis. The Defense Center’s policy and response subsystems are designed to leverage existing IT infrastructure such as firewalls, routers, trouble ticketing, and patch management systems for virtually any task, including alerting, blocking and initiating corrective measures.

 

Historical Development of our Business

 

We were organized as a Delaware corporation and began operations in January 2001, and we sold our first commercial product, a Sourcefire Intrusion Sensor, in the summer of 2001. In 2002, we released the first version of the Defense Center product, closed our first round of institutional financing, raising approximately $7.5 million from the sale of Series A convertible preferred stock, and hired senior executives including our CEO, COO, VP of Sales and VP of Business Development. In 2003, we closed our second round of institutional financing, raising $11 million from the sale of Series B convertible preferred stock, released our RNA product and hired our CFO and VP of Engineering. In 2004, we completed our third round of institutional financing, raising $15 million from the sale of Series C convertible preferred stock, exceeded 100 total employees, hired our chief marketing officer and introduced the Sourcefire 3D suite of products. In 2005, we leased approximately 40,000 square feet of office space for our corporate headquarters including a 4,000 square foot state-of-the-art security lab, received NSS gold certification for our intrusion detection product, released our enterprise class intrusion sensor product and entered

into a definitive merger agreement to be acquired by Check Point Software Technologies Ltd. for $225 million. In 2006, we mutually terminated the merger agreement with Check Point, closed our fourth round of institutional financing, raising $23 million from the sale of Series D convertible preferred stock, and achieved our first quarter of cash flow positive results.

 

Key Financial Metrics and Trends

 

Pricing and Discounts

 

We maintain a standard price list for all our products and we have not changed our list pricing during the past. Additionally, we have a corporate policy that governs the level of discounting our sales organization may offer on our products based on factors such as transaction size, volume of products, federal or state programs, reseller or distributor involvement and the level of technical support commitment. Our total product revenue and the resulting cost of revenue and gross profit percentage are directly affected by our ability to manage our product pricing policy. Although we have not experienced pressure to reduce our prices, competition is increasing and, in the future, we may be forced to reduce our prices to remain competitive.

 

Revenue

 

We currently derive revenue from product sales and services. Product revenue is principally derived from the sale of our network security solutions. Our network security solutions include a perpetual software license bundled with a third-party hardware platform. Services revenue is principally derived from technical support and professional services. We typically sell technical support to complement our network security solutions. Technical support entitles a customer to product updates, new Rules releases and both telephone and web assistance for using our products. Our professional services revenue includes optional on-site network security deployment consulting, and classroom and online training for managing a network security solution.

 

Product sales are typically recognized as revenue at shipment of the product to the customer, whether sold directly or through resellers. For sales made through distributors and original equipment manufacturers, or OEMs, we do not recognize revenue until we receive the monthly sales report which indicates the sell-through volume to end user customers. Revenue from services is recognized when the services are performed. For technical support services, revenue is recognized ratably over the term of the support arrangement, which is usually a 12-month agreement providing for payment in advance and automatic renewals.

 

We sell our network security solutions globally. However, over 80% of our revenue for was generated by sales to U.S.-based customers. We expect that our revenue from customers based outside of the United States will increase in amount and as a percentage of total revenue as we execute our strategy to strengthen our international presence. We also expect that our revenue from sales through OEMs and distributors will increase in amount and as a percentage of total revenue as we execute our strategy to expand such relationships. We manage our operations on a consolidated basis for purposes of assessing performance and making operating decisions. Accordingly, our business does not have reportable segments.

 

Revenue from product sales has been highly seasonal, with more than one-third of our total product revenue in recent fiscal years generated in the fourth quarter. The timing of our year-end shipments could materially affect our fourth quarter product revenue in any fiscal year and sequential quarterly comparisons. Revenue from our government customers has occasionally been influenced by the September 30th fiscal year-end of the U.S. federal government, which has historically resulted in our revenue from government customers being highest in the third quarter. Although we do not expect these general seasonal patterns to change substantially in the future, our revenue within a particular quarter is often affected significantly by the unpredictable procurement patterns of our customers. Our prospective customers usually spend a long time evaluating and making purchase decisions for network security solutions. Historically, many of our customers have not finalized their purchasing decisions until the final weeks or days of a quarter. We expect these purchasing patterns to continue in the future. Therefore, a delay in even one large order beyond the end of the quarter could materially reduce our anticipated revenue for a quarter. Because many of our expenses must be incurred before we expect to generate revenue, delayed orders could negatively impact our results of operations for the period and cause us to fail to meet the financial performance expectations of securities industry research analysts or investors.

Cost of Revenue

 

Cost of product revenue includes the cost of the hardware platform bundled into our network security solution, royalties for third-party software included in our network security solution, materials and labor that go into the quality assurance of our products, logistics, warranty, shipping and handling costs and depreciation and amortization. For the nine months ended September 30, 2006 and for the year ended December 31, 2005, cost of product revenue was 27% and 28% of total product revenue, respectively. Hardware costs, which are our most significant cost items, generally have not fluctuated materially as a percentage of revenue in recent years because competition among hardware platform suppliers has remained strong and, therefore, our hardware cost has remained consistent. Because of the competition among hardware suppliers and our outsourcing of the manufacture of our products to four separate domestic contract manufacturers, we currently have no reason to expect that our cost of product revenue as a percentage of total product revenue will change significantly in the foreseeable future due to hardware pricing increases. However, hardware or other costs of manufacturing may increase in the future. We incur labor and associated overhead expenses, such as occupancy costs and fringe benefits costs, as part of managing the manufacturing process. These costs are included as a component of our cost of product revenue, but they have not been material.

 

Cost of service revenue includes the direct labor costs of professionals and outside consultants engaged to furnish those services, as well as their travel and associated direct material costs. Additionally, we include in cost of service revenue an allocation of overhead expenses such as occupancy costs, fringe benefits and supplies. For the nine months ended September 30, 2006 and for the year ended December 31, 2005, cost of service revenue was 19% and 16% of total service revenue, respectively, and, although we anticipate incurring additional costs in the future for increased personnel to support and service our growing customer base, we do not expect the cost of service revenue as a percentage of service revenue to change materially in the future.

 

Gross Profit

 

Our gross profit is affected by a variety of factors, including competition, the mix and average selling prices of our products, our pricing policy, technical support and professional services, new product introductions, the cost of hardware platforms, the cost of labor to generate such revenue and the mix of distribution channels through which our products are sold. Although we have not had to reduce the prices of our products or vary our pricing policy in recent years, our gross profit would be adversely affected by price declines if we are unable to reduce costs on existing products and to continue to introduce new products with higher margins. Currently, product sales typically have a lower gross profit as a percentage of revenue than our services due to the cost of the hardware platform. Our gross profit for any particular quarter could be adversely affected if we do not complete sales of higher margin products by the end of the quarter. As discussed above, many of our customers do not finalize purchasing decisions until the final weeks or days of a quarter, so a delay in even one large order of a higher-margin product could reduce our total gross profit percentage for that quarter. For the nine months ended September 30, 2006 and for the year ended December 31, 2005, gross profit was 76% and 75% of total revenue, respectively. Based on current market conditions, we do not expect these percentages to change significantly in the foreseeable future, although unexpected pricing pressures or an increase in hardware or other costs would cause our gross profit percentage to decline.

 

Operating Expenses

 

Research and Development.  Research and development expenses consist primarily of payroll, benefits and related costs for our engineers, occupancy costs and other overhead, costs for sophisticated components used in product and prototype development and costs of test equipment used during product development.

 

We have significantly expanded our research and development capabilities and expect to continue to expand these capabilities in the future. All of our research and development is performed in the United States. We are committed to increasing the level of innovative design and development of new products as we strive to enhance our ability to serve our existing commercial and federal government markets as well as new markets for security solutions. To meet the changing requirements of our customers, we will need to fund investments in several development projects in parallel. Accordingly, we anticipate that our research and development expenses will

continue to increase in absolute dollars for the foreseeable future, but should decline moderately as a percentage of total revenue as we expect to grow our sales more rapidly than our research and development expenditures. For the nine months ended September 30, 2006, and for the year ended December 31, 2005, research and development expense was $6.3 million and $6.8 million, or 22% and 21% of total revenue, respectively.

 

Sales and Marketing.  Sales and marketing expenses consist primarily of salaries, incentive compensation, benefits and related costs for: sales and marketing personnel; trade show, advertising, marketing and other brand-building costs; marketing consultants and other professional services; training, seminars and conferences; travel and related costs; and occupancy and other overhead costs.

 

As we focus on increasing our market penetration, expanding internationally and continuing to build brand awareness, we anticipate that selling and marketing expenses will continue to increase in absolute dollars, but decrease as a percentage of our revenue, in the future.

 

For the nine months ended September 30, 2006, and for the year ended December 31, 2005, sales and marketing expense was $14.5 million and $17.1 million, or 50% and 52% of total revenue, respectively.

 

General and Administrative.  General and administrative expenses consist primarily of: salaries, incentive compensation, benefits and related costs for executive, finance, information system and administrative personnel; legal, accounting and tax preparation and advisory fees; travel and related costs; information systems and infrastructure costs; and occupancy and other overhead costs.

 

We expect our general and administrative expenses to increase due to our preparations to become and to operate as a public company, including costs associated with compliance with Section 404 of the Sarbanes-Oxley Act, directors’ and officers’ liability insurance, increased professional services and a new investor relations function.

 

For the nine months ended September 30, 2006, and for the year ended December 31, 2005, general and administrative expense was $3.6 million and $5.1 million, or 13% and 16% of total revenue, respectively.

 

Stock-Based Compensation.  Prior to January 1, 2006, our stock-based compensation expense consisted primarily of the amortization of unearned compensation related to grants of restricted shares of our common stock to certain officers and employees in 2002 and 2003, as well as the modification of certain fixed stock option awards subsequent to their grant date. Total stock-based compensation expenses recorded in our statements of operations for 2003, 2004 and 2005 were $72,000, $177,000 and $470,000, respectively.

 

Effective January 1, 2006, the Company adopted the fair value recognition provisions of the Financial Accounting Standards Board’s SFAS No. 123(R), “Share-Based Payment,” using the prospective transition method, which requires the Company to apply its provisions only to awards granted, modified, repurchased or cancelled after the effective date. Under this transition method, stock-based compensation expense recognized beginning January 1, 2006 is based on the grant date fair value of stock awards granted or modified after January 1, 2006.

 

As a result of adopting SFAS No. 123(R) on January 1, 2006, based on the estimated grant-date fair value of employee stock options subsequently granted or modified, the Company recognized aggregate stock-based compensation expense of $239,000 for the nine months ended September 30, 2006. The Company uses the Black-Scholes option pricing model to estimate the calculated value of granted stock options. The use of option valuation models requires the input of highly subjective assumptions, including the expected term and the expected stock price volatility.

 

The grant date fair value of options not yet recognized as expense as of September 30, 2006 aggregated approximately $761,000, net of estimated forfeitures, which will be recognized over a weighted-average period of approximately four years. We expect to record aggregate amortization of stock-based compensation of approximately $98,000 in the fourth quarter of 2006 from these outstanding awards, subject to continued vesting. In addition, we expect to record aggregate amortization of stock-based compensation of approximately $308,000, $217,000, $128,000, and $10,000 during fiscal years 2007, 2008, 2009 and 2010, respectively, from these outstanding awards, subject to continued vesting.

Critical Accounting Policies and Estimates

 

Our consolidated financial statements are prepared in accordance with accounting principles generally accepted in the United States of America. The preparation of these consolidated financial statements requires us to make estimates and assumptions that affect the reported amounts of assets, liabilities, revenue, costs and expenses and related disclosures. We evaluate our estimates and assumptions on an ongoing basis. Our actual results may differ from these estimates.

 

We believe that, of our significant accounting policies, which are described in Note 2 to the notes to our consolidated financial statements, the following accounting policies involve a greater degree of judgment and complexity. Accordingly, we believe that the following accounting policies are the most critical to aid in fully understanding and evaluating our consolidated financial condition and results of operations.

 

Revenue Recognition.  The Company recognizes substantially all of its revenue in accordance with Statement of Position No. 97-2, “Software Revenue Recognition,” or SOP 97-2, as amended by SOP 98-4 and SOP 98-9. We establish persuasive evidence of an arrangement for each type of revenue transaction based on:

 

 

For each arrangement, we defer revenue recognition until all of the following criteria have been met:

 

 

We allocate the total value of the arrangement among each deliverable based on its fair value as determined by vendor-specific objective evidence, such as standard product discount levels, daily service rates and consistent support level renewal pricing. If vendor-specific objective evidence of fair value does not exist for each of the deliverables, all revenue from the arrangement is further deferred until the earlier of the point at which sufficient vendor-specific objective evidence of fair value can be determined or all elements of the arrangement have been delivered. However, if the only undelivered elements are technical support and/or professional services, elements for which we currently have established vendor specific objective evidence of fair value, we recognize revenue for the delivered elements using the residual method. Changes in judgments and estimates about these assumptions could materially impact the timing of revenue recognition.

 

Accounting for Stock-Based Compensation.  Prior to January 1, 2006, the Company accounted for stock-based compensation using the intrinsic value method prescribed in Accounting Principles Board Opinion No. 25, “Accounting for Stock Issued to Employees,” or APB No. 25, and related interpretations. Accordingly, compensation cost for stock options generally was measured as the excess, if any, of the estimated fair value of the Company’s common stock over the amount an employee must pay to acquire the common stock on the date that both the exercise price and the number of shares to be acquired pursuant to the option are fixed. The Company had adopted the disclosure-only provisions of SFAS No. 123, “Accounting for Stock-Based Compensation,” and SFAS No. 148, “Accounting for Stock-Based Compensation — Transition and Disclosure,” which was released in December 2002 as an amendment to SFAS No. 123, and used the minimum value method of valuing stock options as allowed for non-public companies.

In December 2004, the Financial Accounting Standards Board issued SFAS No. 123(R), “Share-Based Payment,” which revised SFAS No. 123 and supersedes APB No. 25. SFAS 123(R) focuses primarily on transactions in which an entity obtains employee services in exchange for share-based payments. Under SFAS 123(R), an entity is generally required to measure the cost of employee services received in exchange for an award of equity instruments based on the grant-date fair value of the award, with such cost recognized over the applicable requisite service period. In addition, SFAS 123(R) requires an entity to provide certain disclosures in order to assist in understanding the nature of share-based payment transactions and the effects of those transactions on the financial statements. The provisions of SFAS No. 123(R) are required to be applied as of the beginning of the first interim or annual reporting period of the entity’s first fiscal year that begins after December 15, 2005.

 

Effective January 1, 2006, the Company adopted the fair value recognition provisions of SFAS No. 123(R) using the prospective transition method, which requires the Company to apply the provisions of SFAS No. 123(R) only to awards granted, modified, repurchased or cancelled after the effective date. Under this transition method, stock-based compensation expense recognized beginning January 1, 2006 is based on the grant date fair value of stock awards granted or modified after January 1, 2006. As the Company had used the minimum value method for valuing its stock options under the disclosure requirements of SFAS 123, all options granted prior to January 1, 2006 continue to be accounted for under APB No. 25.

 

We have historically granted stock options at exercise prices equivalent to the fair value of our common stock as estimated by our board of directors, with input from management, as of the date of grant. Prior to April 2006, our management and board of directors determined the fair value of our common stock using a contemporaneous preferred stock transaction approach which applied discounts for valuation differences due to: conversion privileges, dividends, control, and seniority and liquidation preferences. We also considered the impact of operating and financial performance and the achievement of corporate milestones for grants made in the period between independent preferred stock transactions. These valuations yielded values ranging from $0.20 per share in January 2003 to $5.15 in December 2005.

 

In early April 2006, we engaged an independent valuation specialist to perform a contemporaneous valuation of our common stock as of March 31, 2006. On April 27, 2006, the independent valuation specialist delivered a report stating that the fair value of our common stock as of March 31, 2006 was $3.24 per share. In August 2006, we engaged an independent valuation specialist to perform a contemporaneous valuation of our common stock as of August 25, 2006. On August 29, 2006, the independent valuation specialist delivered a report stating that the fair value of our common stock as of August 25, 2006 was $4.70 per share.

 

The Company uses the Black-Scholes option pricing model to estimate the calculated value of granted stock options. The use of option valuation models requires the input of highly subjective assumptions, including the expected term and the expected stock price volatility. Additionally, the recognition of expense requires the estimation of the number of options that will ultimately vest and the number of options that will ultimately be forfeited. Accordingly, the use of different estimates and assumptions can have a significant impact on the amount of stock-based compensation that is measured and recognized.

 

Accounting for Income Taxes.  Deferred taxes are determined based on the difference between the financial statement and tax basis of assets and liabilities using enacted tax rates in effect in the years in which the differences are expected to reverse. Valuation allowances are provided if, based upon the weight of available evidence, it is more likely than not that some or all of the deferred tax assets will not be realized.

 

To date, for U.S. federal income tax purposes, we have operated in a loss position. We have $26.6 million of net operating loss carry-forwards as of December 31, 2005, although the use of these net operating loss carry-forwards may be significantly limited by changes in our ownership. As of December 31, 2005, we recorded a full valuation allowance against net deferred tax assets, including deferred tax assets generated by net operating loss carry-forwards. These carry-forwards will begin to expire in 2022. We expect that, to the extent we have taxable income in years before their expiration, these net operating loss carry-forwards will impact our effective tax rate.

 

Warranty.  We provide a one-year warranty against defects in materials and workmanship and will either repair the goods or provide replacement products at no charge to the customer. We record estimated warranty costs, currently at approximately 2.4% of product revenue, based on historical experience by product, at the time we

recognize product revenue. As the complexity of our products increases, we could experience higher warranty claims relative to sales than we have previously experienced, and we may need to increase these estimated warranty reserves.

 

Bad Debt Reserve.  We have historically used a rate of 1.0% of outstanding accounts receivable to estimate our reserve for bad debts based on analysis of past due balances and historical experiences of write-offs. As we expand our business, we expect our accounts receivable balance to grow. If our future experience of actual write-offs for bad debts exceeds 1.0% of our accounts receivable balance, we will have to increase our reserve accordingly.

 

Inventory Valuation.  We outsource our manufacturing and our products are generally drop-shipped directly to our customers by the manufacturers. Therefore, we usually carry relatively little inventory. The inventory on our balance sheet primarily includes products that we use for demonstration purposes at customer locations. We value our inventory at the lower of the actual cost of our inventory or its current estimated market value. We write down inventory for obsolescence or lack of marketability based upon condition of the inventory and our view about future demand and market conditions. Because of the seasonality of our product sales, obsolescence of technology and product life cycles, we generally write down inventory to net realizable value based on forecasted product demand. Actual demand and market conditions may be lower than those that we project and this difference could have a material adverse effect on our gross profit if inventory write-downs beyond those initially recorded become necessary.

 

Results of Operations

 

The following table sets forth our results of operations for the periods shown:

 

The following table sets forth our results of operations as a percentage of total revenue for the periods shown: