e10vk
UNITED STATES SECURITIES AND EXCHANGE COMMISSION
Washington, D.C. 20549
 
 
 
 
Form 10-K
 
     
(Mark One)    
þ
  ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934
    For the fiscal year ended December 31, 2009
     
o
  TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934
    For the transition period from          to          
 
 
Commission File Number
1-33350
 
 
 
 
SOURCEFIRE, INC.
(Exact name of Registrant as Specified in its Charter)
 
     
Delaware
  52-2289365
(State or Other Jurisdiction of
Incorporation or Organization)
  (I.R.S. Employer
Identification No.)
9770 Patuxent Woods Drive
Columbia, Maryland
(Address of Principal Executive Offices)
  21046
(Zip Code)
 
 
Registrant’s telephone number, including area code:
(410) 290-1616
 
Securities registered pursuant to Section 12(b) of the Act:
 
 
     
Title of Each Class
 
Name of Exchange on Which Registered
 
Common Stock, $0.001 par value, including associated Series A Junior Participating Preferred Stock Purchase Rights
  Nasdaq Global Market
 
 
Securities registered pursuant to Section 12(g) of the Act: none
 
 
 
 
Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act.  Yes o     No þ
 
Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act.  Yes o     No þ
 
Indicate by check mark whether the registrant: (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days.  Yes þ     No o
 
Indicate by check mark whether the registrant has submitted electronically and posted on its corporate Web site, if any, every Interactive Data File required to be submitted and posted pursuant to Rule 405 of Regulation S-T (§ 232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit and post such files).  Yes o     No o
 
Indicate by check mark if disclosure of delinquent filers pursuant to Item 405 of Regulation S-K is not contained herein, and will not be contained, to the best of registrant’s knowledge, in definitive proxy or information statements incorporated by reference in Part III of this Form 10-K or any amendment to this Form 10-K.  o
 
Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, or a smaller reporting company. See the definitions of “large accelerated filer,” “accelerated filer” and “smaller reporting company” in Rule 12b-2 of the Exchange Act. (Check one):
 
Large accelerated filer o Accelerated filer þ Non-accelerated filer o Smaller reporting company o
(Do not check if a smaller reporting company)
 
Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act).  Yes o     No þ
 
As of June 30, 2009, the aggregate market value of the registrant’s Common Stock held by non-affiliates, based upon the closing sale price of the Common Stock on the Nasdaq Global Market on such date, was approximately $304.1 million.
 
As of March 5, 2010, there were outstanding 27,307,225 shares of the registrant’s Common Stock.
 
DOCUMENTS INCORPORATED BY REFERENCE
 
Certain portions of the definitive Proxy Statement to be used in connection with the registrant’s 2010 Annual Meeting of Stockholders are incorporated by reference into Part III of this Form 10-K to the extent stated. That Proxy Statement will be filed within 120 days of registrant’s fiscal year ended December 31, 2009.


 

 
SOURCEFIRE, INC.
Form 10-K

TABLE OF CONTENTS
 
             
PART I
Item 1.
  Business     4  
Item 1A.
  Risk Factors     13  
Item 1B.
  Unresolved Staff Comments     25  
Item 2.
  Properties     25  
Item 3.
  Legal Proceedings     25  
Item 4.
  Reserved     26  
 
PART II
Item 5.
  Market for Registrant’s Common Equity, Related Stockholder Matters and Issuer Purchases of Equity Securities     26  
Item 6.
  Selected Financial Data     29  
Item 7.
  Management’s Discussion and Analysis of Financial Condition and Results of Operations     30  
Item 7A.
  Quantitative and Qualitative Disclosures About Market Risk     45  
Item 8.
  Financial Statements and Supplementary Data     45  
Item 9.
  Changes In and Disagreements With Accountants and Financial Disclosures     45  
Item 9A.
  Controls and Procedures     45  
Item 9B.
  Other Information     48  
 
PART III
Item 10.
  Directors, Executive Officers and Corporate Governance     48  
Item 11.
  Executive Compensation     48  
Item 12.
  Security Ownership of Certain Beneficial Owners and Management and Related Stockholder Matters     48  
Item 13.
  Certain Relationships and Related Transactions, and Director Independence     48  
Item 14.
  Principal Accountant Fees and Services     48  
 
PART IV
Item 15.
  Exhibits and Financial Statement Schedules     48  
Signatures
        49  


2


 

References in this Annual Report on Form 10-K to “Sourcefire,” “we,” “us”, “our” or “the Company” refer to Sourcefire, Inc. and its subsidiaries, taken as a whole, unless a statement specifically refers to Sourcefire, Inc.
 
FORWARD-LOOKING STATEMENTS
 
This annual report contains both historical and forward-looking statements. All statements other than statements of historical fact are, or may be deemed to be, forward-looking statements. For example, statements concerning projections, predictions, expectations, estimates or forecasts and statements that describe our objectives, plans or goals are or may be forward-looking statements. These forward-looking statements reflect management’s current expectations concerning future results and events and generally can be identified by use of expressions such as “may,” “will,” “should,” “could,” “would,” “predict,” “potential,” “continue,” “expect,” “anticipate,” “future,” “intend,” “plan,” “foresee,” “believe,” “estimate,” and similar expressions, as well as statements in future tense. These forward-looking statements include, but are not limited to, the following:
 
  •  expected growth in the markets for network security products;
 
  •  our plans to continue to invest in and develop innovative technology and products for our existing markets and other network security markets;
 
  •  the timing of expected introductions of new or enhanced products;
 
  •  our expectation of growth in our customer base and increasing sales to existing customers;
 
  •  our plans to increase revenue through more relationships with resellers, distributors, managed security service providers, government integrators and other partners;
 
  •  our plans to grow international sales;
 
  •  our plans to acquire and integrate new businesses and technologies;
 
  •  our plans to hire more network security professionals and broaden our knowledge base; and
 
  •  our plans to hire additional sales personnel and the additional revenue we expect them to generate.
 
The forward-looking statements included in this annual report are made only as of the date of this annual report. We expressly disclaim any intent or obligation to update any forward-looking statements to reflect subsequent events or circumstances. Forward-looking statements involve known and unknown risks, uncertainties and other factors that may cause our actual results, performance or achievements to be different from any future results, performance and achievements expressed or implied by these statements. These risks and uncertainties include, but are not limited to, those discussed in Item 1A. Risk Factors of this annual report.
 
 
 
 
We operate in an industry in which it is difficult to obtain precise industry and market information. Although we have obtained some industry data from outside sources that we believe to be reliable, in certain cases we have based statements contained in this annual report regarding our industry and our position in the industry on our estimates concerning, among other things, our customers and competitors. These estimates are based on our experience in the industry, conversations with our principal suppliers and customers and our own investigations of market conditions. The statistical data contained in this annual report regarding the network security software industry are our statements, which are based on data we obtained from industry sources.
 
 
 
 
SOURCEFIRE®, SNORT®, the Sourcefire logo, the Snort and Pig logo, SECURITY FOR THE REAL WORLDtm, SOURCEFIRE DEFENSE CENTER®, SOURCEFIRE 3D®, RNA®, RUAtm, DAEMONLOGGERtm, ClamAV®, SOURCEFIRE SOLUTIONS NETWORKtm and certain other trademarks and logos are trademarks or registered trademarks of Sourcefire, Inc. in the United States and other countries. This annual report also refers to the products or services of other companies or persons by the trademarks and trade names used and owned by those companies or persons.


3


 

 
PART I
 
Item 1.   BUSINESS
 
Overview
 
We are a leading provider of intelligent cybersecurity solutions for information technology, or IT, environments of commercial enterprises, including healthcare, financial services, manufacturing, energy, education, retail and telecommunications companies, and federal, state and local government organizations worldwide. Our solutions are comprised of multiple hardware and software product and service offerings, enabling a comprehensive, intelligent approach to network security. Our security solutions provide customers with an efficient and effective network security defense of assets and applications before, during and after an attack.
 
Since our founding in 2001, we have garnered a reputation in the network security industry of being a staunch advocate for open source solutions. Over the years, this has developed into a key competitive distinction for Sourcefire as we now manage two of the security industry’s leading open source initiatives, Snort® and ClamAV®. First published in 1998 by Sourcefire founder and Chief Technology Officer, Martin Roesch, open source Snort has rapidly become the de facto standard for intrusion detection and prevention. With over 270,000 registered users, an increase of more than 20% in 2009, nearly 4 million downloads, and embraced by more than 100 network security providers, more organizations use Snort than any other intrusion prevention system, or IPS, engine in the world. Because of its wide availability, Snort is also the standard intrusion technology used in colleges and universities worldwide to teach network security.
 
Sourcefire embraces open source security as a foundation, but extends that foundation by adding enterprise-class features, manageability, scalability, and performance. Many Sourcefire customers, for example, start out using open source Snort, but upgrade to Sourcefire’s commercial offerings to gain more efficient and effective network security capabilities. By incorporating open source security as a foundation in Sourcefire’s commercial product offerings, Sourcefire can:
 
  •  seed the market with high-quality, low-cost network security solutions while providing a migration path for customers that require enterprise-class features, manageability, scalability and performance;
 
  •  ensure product quality with the help of the open source community as well as Sourcefire’s internal developers to inspect the open code base that forms the foundation for Sourcefire commercial product offerings;
 
  •  maximize protection, as Snort rules are provided by Sourcefire and a variety of third-party sources, allowing customers to create their own custom rules and signatures; and
 
  •  embrace a “community” of open source evangelists willing to contribute time and effort in inspecting, evaluating, and ultimately using Sourcefire’s open source security solutions.
 
Sourcefire sells its network security solutions to a diverse customer base that includes Global 2000 companies, global enterprises, U.S. and international government agencies and small and mid-size businesses. For the years ended December 31, 2009, 2008 and 2007, we generated approximately 77%, 76% and 75% of our revenue from customers in the United States and 23%, 24% and 25% from customers outside of the United States, respectively. We have expanded our international and indirect distribution channels and, in the future, we expect to increase sales outside of the United States and to generate an increasing portion of product revenues through resellers, distributors and other partners. We increased our total revenue from $75.7 million in 2008 to $103.5 million in 2009, representing an annual growth rate of 37%. For the year ended December 31, 2009, product revenue and services revenue represented 60% and 40% of our total revenue, respectively. We manage our operations on a consolidated basis for purposes of assessing performance and making operating decisions. Accordingly, we do not have reportable segments of our business.
 
Our Industry
 
According to Gartner, Inc., an independent IT market research firm, the enterprise security infrastructure market is forecasted to generate $20.0 billion in 2010. Gartner also estimates that the core intrusion prevention


4


 

market was approximately $1.2 billion in 2009 and is projected to grow to $1.9 billion in 2012, representing a compound annual growth rate of approximately 17%. We expect that demand for security solutions will continue to rise as organizations seek to address various growing and evolving security challenges, including:
 
Greater Sophistication, Severity and Frequency of Network Attacks.  The growing use of the Internet as a business tool has required organizations to increase the number of access points to their networks, which has made vast amounts of critical information more vulnerable to attack. Theft of sensitive information for financial gain motivates network attackers, who derive profit through identity theft, credit card fraud, money laundering, extortion, intellectual property theft and other illegal means. These profit-motivated attackers, in contrast to the hobbyist hackers of the past, are employing much more sophisticated tools and techniques to generate profits for themselves and their well-organized and well-financed sponsors. Their attacks are increasingly difficult to detect and their tools often establish footholds on compromised network assets with little or no discernible effect, facilitating future access to the assets and the networks on which they reside.
 
Increasing Risks from Unknown Vulnerabilities.  Vulnerabilities in computer software that are discovered by network attackers before they are discovered by security and software vendors represent a tremendous risk. These uncorrected flaws can leave networks largely defenseless and open to exploitation. According to the Computer Emergency Response Team Coordination Center, or CERT-CC, the trends in the rate of vulnerability disclosure are particularly alarming, with the National Vulnerability Database showing a Common Vulnerabilities and Exposures, or CVE, count of over 40,000 in early 2010.
 
Diverse Demands on Security Administrators.  The proliferation of targeted security solutions such as firewalls, intrusion prevention systems, URL filters, spam filters and anti-spyware solutions, while critical to enhancing network security, create significant administrative burdens on personnel who must manage numerous disparate technologies that are seldom integrated and often difficult to use. Most network security products require manual, labor-intensive incident response and investigation by security administrators, especially when “false positive” results are generated. Compounding these resource constraint issues, many organizations are increasingly challenged by the loss of key personnel as the demand for security experts has risen dramatically in traditional corporate settings, government agencies and a growing number of start-up security companies.
 
Heightened Government and Industry Regulation.  Rapidly growing government regulation mandates compliance with increased requirements for network security, escalating demand for security solutions that both meet compliance requirements and reduce the burden of compliance reporting and enforcement. These regulations include the Payment Card Industry Data Security Standard, or PCI DSS, the Health Insurance Portability and Accountability Act of 1996, or HIPAA, California’s SB1386 and the Gramm-Leach-Bliley Act, or GLBA, each of which protects personal data, as well as the Sarbanes-Oxley Act of 2002 for risk management and the Federal Information Security Management Act, or FISMA, which is designed to protect national defense initiatives. Ensuring continuous compliance across multiple regulatory standards can be overwhelming and very costly for organizations.
 
Increasing Visibility of Negligence Lawsuits.  Faced with an ever-growing list of laws and regulations, organizations can no longer “plead ignorance” when defending corporate negligence lawsuits resulting from internal and external security breaches. Today’s enterprises must comply with a series of government and industry regulations defining best practices for network security. Achieving compliance with all manner of regulations is a complex and costly issue for nearly every organization.
 
Our Products
 
Sourcefire’s commercial hardware and software products are marketed and sold as components of a comprehensive Intrusion Detection and Prevention System:
 
Sourcefire Defense Center® — The Defense Center unifies critical network security functions including event monitoring, correlation, and prioritization with network and user intelligence for forensic analysis, trends analysis, reporting and alerting. Defense Center is highly extensible, providing application programming interfaces, or APIs, to interoperate with a variety of third-party systems, such as firewalls, routers, log


5


 

management, Security Information Event Management, or SIEMs, trouble ticketing, patch management systems and other technologies. Using Defense Center, customers can control multiple Sourcefire 3D Sensors from a single management console while aggregating and analyzing security and compliance events from across the organization.
 
Sourcefire Intrusion Detection and Prevention Sensors — With processing speeds ranging from 5 megabytes per second, or Mbps, to 10 gigabytes per second, or Gbps, Sourcefire Sensors are highly scalable, fault-tolerant appliances responsible for detecting, blocking and analyzing network traffic. The Sensors are available with a variety of copper and fiber interfaces to meet the connectivity needs of virtually any organization.
 
  •  Sourcefire IPS® (Intrusion Prevention System) — Built on the foundation of Snort, Sourcefire IPS uses a rules-based language — a powerful combination of signature-, protocol-, and vulnerability-based inspection methods — to examine network packets for threats. Sourcefire IPS allows users to create, edit, and view detection rules, and full packet payloads are logged for every event so users can see exactly what threatening traffic has been detected. Sourcefire Sensors equipped with Sourcefire IPS software can be placed in passive intrusion detection, or IDS, mode to notify users of network traffic or in inline IPS mode to block threats.
 
  •  Sourcefire RNAtm (Real-time Network Awareness) — At the heart of Sourcefire’s IPS is our network intelligence capability that provides persistent visibility into the composition, behavior, topology (the relationship of network components) and risk profile of the network. Network intelligence feeds the Defense Center’s automated decision-making and network policy enforcement. The ability to continuously discover characteristics and vulnerabilities of virtually any computing device communicating on a network enables Sourcefire IPS to more precisely identify and block threatening traffic and to more efficiently classify threatening and/or suspicious behavior.
 
  •  Sourcefire RUAtm (Real-time User Awareness) — Sourcefire user awareness enables customers to link user identity to security and network violation events. It leverages Active Directory or Lightweight Directory Access Protocol systems by pairing usernames with host IP addresses involved in security and compliance events. This enables Sourcefire customers to resolve security and compliance events more quickly and easily.
 
  •  Sourcefire NetFlow Analysis — Sourcefire NetFlow Analysis aggregates data from Cisco routers and switches, thus extending the reach of Sourcefire’s network behavior analysis, or NBA, solution to corners of the network where Sourcefire technology has not yet been employed. The combination of network awareness and NetFlow functionality provides customers with the ability to baseline “normal” network traffic across the enterprise, enabling security analysts to detect suspicious deviations, such as worm propagation, from established baselines. Further, the ability to analyze NetFlow also provides network managers with the network usage intelligence required to identify performance bottlenecks and/or areas of the network where too much bandwidth has been allocated.
 
Sourcefire Intrusion Agent for Snort — Many Sourcefire commercial customers start out as open source Snort users. To initiate the migration from Snort to the more scalable and manageable Sourcefire commercial offering, Sourcefire offers Intrusion Agent software that can be placed on open source Snort Sensors. This enables customers to aggregate and analyze intrusion events from both open source Snort Sensors and commercial Sourcefire Intrusion Detection and Prevention Sensors.
 
Sourcefire VRT (Vulnerability Research Team) Subscriptions — The power of Sourcefire’s intelligence to detect and block threats is the VRT. The VRT is a team of experienced network security professionals responsible for identifying network threats and writing, testing and publishing Snort rules to defend against both known and zero-day exploits. The VRT provide protection updates automatically, giving users the latest in detection and prevention capability. Open source Snort users can either subscribe on an annual basis to the VRT Certified Snort rules for real-time availability or access them at no charge on a 30-day delayed basis. The


6


 

Certified VRT rules are always available on a real-time basis to Sourcefire commercial IPS customers as part of their customer support agreement.
 
Our Open Source Projects
 
In addition to our products, we manage the following open source projects:
 
Snort® — The traffic inspection engine used in our intrusion prevention system is the open source technology called Snort. Martin Roesch, our founder and Chief Technology Officer, created Snort in 1998 and assigned all of his rights in the software to Sourcefire upon our incorporation. Our employees, including Mr. Roesch, have authored all major components of Snort, and we maintain control over the Snort project, including the principal Snort community forum, Snort.org. Snort, which has become a de facto industry standard for intrusion prevention, has been downloaded nearly 4 million times. We believe that most Fortune 100 companies and 30 of the largest U.S. government agencies use Snort technology to monitor network traffic and that Snort is the most widely deployed intrusion prevention technology worldwide. The ubiquitous nature of the Snort user community represents a significant opportunity to sell our proprietary products to customers that require a complete enterprise solution.
 
ClamAV® — Founded in 2001, and acquired by Sourcefire in 2007, ClamAV is one of the most commonly-used open source anti-malware products in the world. More than 1.4 million unique IP addresses download ClamAV updates daily from 121 mirror servers located in 43 countries. Renowned for its speed and accuracy, ClamAV has been adopted by network security solution and service providers worldwide and is currently integrated within leading enterprise solutions to identify deeply embedded threats such as viruses, trojans, spyware and other forms of malware. Like Snort, ClamAV’s cutting edge security technology is a product of our open source model. In addition to continual innovations to the ClamAV anti-virus engine, the ClamAV core team and ClamAV community deliver daily signature updates to its growing virus database of over 700,000 signatures.
 
Our Services
 
In addition to our commercial product offerings and open source projects, we also offer the following services to aid our customers with installing and supporting our solutions:
 
Sourcefire Customer Support — Sourcefire’s customer support is designed to ensure customer satisfaction with Sourcefire products. Sourcefire’s comprehensive support services include online technical support, over-the-phone support, hardware repair/advanced replacement, and ongoing software updates to Sourcefire products.
 
Sourcefire Professional Services — Sourcefire offers a variety of professional services solutions to provide customers with best practices for planning, installing, configuring and managing all components of the Sourcefire security system. The Sourcefire Professional Services Team provides customers with individualized, highly concentrated attention that gives organizations a “running start” and lasting knowledge transfer.
 
Sourcefire Education & Certification — Sourcefire offers a variety of training programs to help security professionals using Sourcefire commercial or open source security solutions get the most out of their investment. Sourcefire training includes instructor-led and custom classes delivered at various locations around the world, onsite at customer premises, and online. In addition, Sourcefire provides a path for interested candidates to distinguish themselves through a certification program. Professionals can achieve certifications for proprietary Sourcefire products as well as open source Snort, including an expert-level exam for those security professionals who want to obtain certification on both proprietary and open source technologies. Through training and testing, certification provides customers and their employees with an understanding of individual skills and experience with Sourcefire products and Snort.


7


 

Our Competitive Strengths
 
We are a leading provider of intelligence driven, open source network security solutions that enable our customers to protect their computer networks in an effective, efficient and highly automated manner. Our competitive strengths include:
 
Comprehensive Network and User Intelligence.  Our innovative network security solution incorporates real-time network awareness, which provides persistent visibility into the composition, behavior, topology and risk profile of the network and serves as a platform for automated decision-making and network security policy enforcement. This passive, or non-disruptive, network discovery enables network behavior analysis and real-time compositional cataloging of network assets, including their configuration, thereby significantly increasing the network intelligence available to IT and security administrators. This capability also provides the foundation for Sourcefire’s innovative Adaptive IPS strategy, which maximizes efficiency and effectiveness of the IPS by ensuring Snort rules are consistently enabled to protect actual network assets present on the protected network. With our real-time awareness capability, Sourcefire is the first network security provider to incorporate user identity as a part of a comprehensive IPS solution. By pairing usernames with host IP addresses, Sourcefire customers can evaluate and mitigate security and compliance events in less time than it takes with an IP address alone.
 
Real-Time Approach to Network Security.  Our approach to network security enables our customers to secure their networks by providing real-time defense against both known and unknown threats. Our solution is designed to support a continuum of network security functions that span pre-attack hardening of assets, high fidelity attack identification and disruption and real-time compromise detection and incident response. In addition, our ability to confidently classify and prioritize threats in network traffic and determine the composition, behavior and relationships of network devices, or endpoints, allows us to reliably automate what are otherwise manual, time-intensive processes.
 
The Open Source Community.  The open source Snort user community, which has over 270,000 registered users and has downloaded the software nearly 4 million times to date, has enabled us to establish a strong market footprint. We believe that most of the Fortune 100 companies and 30 of the largest U.S. government agencies use Snort technology to monitor network traffic and that Snort is the most widely deployed intrusion prevention technology worldwide. We believe that the combined user communities of both Snort and ClamAV provide us with significant benefits, including a broad threat awareness network, significant research and development leverage, and a large pool of security experts that are skilled in the use of our technologies. These communities enable us to more cost-effectively test new algorithms and concepts on a vast number of diverse networks and significantly expedite the process of product innovation. We believe that the broad acceptance of Snort and ClamAV makes us one of the most trusted sources of network security solutions.
 
Leading-Edge Performance.  Our solutions are built to maintain high performance across the network while also providing high levels of network security. Specifically, our high-end solutions have the ability to process up to 10 Gbps of traffic with latency in the microseconds. Our IPS technology incorporates advanced traffic processing functionality, including packet acquisition, protocol normalization and target-based traffic inspection, which yields increased inspection precision and efficiency and enables more granular inspection of network traffic. The Defense Center supports event loads as high as 1,300 events per second, which we believe meets or exceeds the requirements of the most demanding enterprise customers.
 
Security Industry Intelligence.  The Sourcefire VRT is a group of leading edge network security experts who proactively discover, assess and respond to the latest trends in hacking activities, intrusion attempts and vulnerabilities. Some of the most renowned security professionals in the industry, including the authors of several standard security reference books, are members of the Sourcefire VRT. This team is also supported by the vast resources of the open source Snort and ClamAV communities, making it the largest group dedicated to advances in the network security industry. The VRT’s research and insights into network security are published on http://vrt-sourcefire.blogspot.com/.


8


 

Broad Industry Recognition.  We have received numerous industry awards and certifications, including recognition as a “leader” in the network IPS market, supporting our position as one of a select few companies that best combines “completeness of vision” with “ability to execute.” We hold the Network Intrusion Prevention certification from ICSA Labs, and our real-time network awareness product has received the NSS Gold award, which is awarded by The NSS Group to only those products that are distinguished in terms of advanced or unique features, and which offer outstanding value. In addition, our technology has achieved Common Criteria Evaluation Assurance Level 2, or EAL2, which is an international evaluation standard for information technology security products sanctioned by, among others, the International Standards Organization, the National Security Agency and the National Institute for Standards and Technology.
 
Our Growth Strategy
 
Our goal is to become the preeminent provider of open source and commercial network security solutions on a global basis by:
 
  •  Accelerating our leadership in network security solutions; Continuing to develop innovative network security technology; Evaluating selective adjacent market technologies for partnering or potential acquisition.  We intend to maintain and enhance our technological leadership position in network security. We will continue to invest significantly in internal development and product enhancements and to recruit, train, develop and retain experienced network security professionals to broaden our proprietary knowledge base. We believe that our platform is capable of expanding into new markets such as security for virtualized environments, data leakage prevention, or DLP, log and security management, network security monitoring, or NSM, next generation firewalls, network behavior analysis and compliance management and, over time, we expect to penetrate these markets with innovative products and technologies. By leveraging the intelligence from the open source community we believe that we have more visibility into threats worldwide, and that we will be able to continue our leadership position in providing users access to the latest information on current threats and ways to protect their organizations against them.
 
  •  Evolving our go-to-market strategy into a more leveraged model by expanding relationships with resellers, distributors, MSSPs and government integrators.  We intend to expand our indirect sales channel, both internationally and domestically. We also intend to utilize our relationships with managed security service providers, or MSSPs, such as Symantec, BT Counterpane, SecureWorks and VeriSign, to derive incremental revenue. In 2009, we generated approximately 29% of our revenue from governmental organizations and, in the future, we believe we will generate an increasing amount of revenue from government integrators who resell our products to government agencies.
 
Awards and Certifications
 
We have received numerous industry awards and certifications since January 1, 2009, including:
 
  •  Gartner Magic Quadrant.  Sourcefire announced it was recognized by Gartner, Inc. as being a ‘Leader’ in the April 2009 Magic Quadrant for Network Intrusion Prevention System Appliances report.
 
  •  SC Award for ‘Best Intrusion Detection/Prevention Solution’ by SC Magazine.  Snort was honored with the ’Reader Trust Award’ for best-in-class intrusion detection and prevention.
 
  •  Top ‘Recommend’  rating in Network Intrusion Prevention System Comparative Test Report, NSS Labs Inc. December 2009
 
  •  ‘2009 Best of Tests Winner’ by Network World.  The sole winner in the security category, the Sourcefire 3D System was recognized for its ability to make network protection easier and more effective.
 
  •  ‘Open Source Hall of Fame’ by InfoWorld.  Snort was recognized as one of the greatest open source software projects of all time and for propelling the open source movement into the spotlight.
 
  •  ‘Network Intrusion Prevention System Certification’ by ICSA Labs.  Sourcefire’s full IPS product line was certified by ICSA Labs, reaffirming Sourcefire’s commitment to providing best-in-class protection against today’s most menacing threats.


9


 

 
Customers
 
We provide products and services to a variety of end users worldwide. Our customers represent a broad spectrum of organizations within diverse sectors, including some of the world’s largest financial institutions, defense contractors, health care providers, IT companies, telecommunication companies and retailers, as well as U.S. and other national, state and local government agencies. We view our primary customers as enterprises generally having annual revenue exceeding $500 million, though we are increasingly pursuing the sale of products and services to the mid-tier market, targeting organizations with annual revenue ranging from $250-$500 million.
 
For the years ended December 31, 2009 and 2008, a distributor of our products to the U.S. government, immixTechnology, accounted for 20% and 11%, respectively, of total revenue. For the year ended December 31, 2007 we had no significant customers that accounted for greater than 10% of revenue recognized during such periods.
 
Sales and Marketing
 
We market and sell our appliances, software and services directly to our customers through our direct sales organization and indirectly through our resellers, distributors, MSSPs, government integrators and other partners.
 
Sales.  Our sales organization is organized into two geographic regions: the Americas and International. We maintain sales offices in North America, Europe and Asia. Our sales personnel are responsible for market development, including managing our relationships with resellers and distributors, assisting them in winning and supporting key customer accounts and acting as liaisons between the end customers and our marketing and product development organizations. We are also investing in the capacity of our international sales and channel personnel to provide expanded levels of support throughout Europe, Latin America, and the Asia/Pacific region.
 
Each sales organization is supported by experienced security engineers who are responsible for providing pre-sales technical support and technical training for the sales team and for our resellers, distributors and other partners. All of our sales personnel are responsible for lead follow-up and account management. Our sales personnel have quota requirements and are compensated with a combination of base salary and earned commissions.
 
Our indirect sales channel, comprised primarily of resellers and distributors, is supported by our sales force, including dedicated channel managers, with substantial experience in selling network security products to, and through, resellers and distributors. We maintain a global network of value-added resellers and distributors. Our arrangements with our resellers and distributors are non-exclusive, generally cover all of our products and services, and provide for appropriate discounts based on a variety of factors, including their transaction volume. We also provide our resellers and distributors with marketing assistance, technical training and support.
 
Strategic Relationships.  We have established commercial relationships with several MSSPs, including BT Counterpane, SecureWorks, Symantec, VeriSign and Verizon Business, to provide alternative distribution channels for our products.
 
Marketing.  Our marketing activities consist primarily of product marketing, product management and sales support programs. Marketing also includes advertising, our corporate website, trade shows, direct marketing and public relations. Our marketing program is designed to build the Sourcefire, Snort and ClamAV brands, increase customer awareness, generate leads and communicate our product advantages. We also use our marketing program to support the sale of our products through new channels and to new markets.
 
Research and Development
 
Our research and development efforts are focused both on improving and enhancing our existing network security products and on developing new products, features and functionality. We communicate with our customers and the open source community when considering product improvements and enhancements, and we regularly release new versions of our products incorporating these improvements and enhancements.
 
Research & Development Team.  Our research and development team is comprised of highly skilled and experienced security and network experts. The team encompasses the full lifecycle of product ideation, design, development, integration, quality assurance testing, deployment, maintenance and support. Our development


10


 

experts focus on the Sourcefire security products, as well as manage the administration and testing of the open source Snort and Clam AV initiatives. The development is performed in the domestic United States.
 
Vulnerability Research Team.  Our VRT is comprised of leading network security experts working to proactively discover, assess and respond to the latest trends in network threats and security vulnerabilities. By gathering and analyzing this information, our VRT creates and updates Snort rules, ClamAV signatures, and security tools that are designed to identify, characterize and defeat attacks.
 
This team operates from our corporate headquarters in Columbia, Maryland. Our VRT participates in extensive collaboration with hundreds of network security professionals in the open source Snort community to learn of new vulnerabilities and exploits. The VRT also coordinates and shares information with other security authorities such as The SANS Institute, CERT-CC, iDefense (Verisign), SecurityFocus (Bugtraq; Symantec) and Common Vulnerabilities and Exposures (Mitre). Because of the knowledge and experience of our VRT personnel, as well as its extensive coordination with the open source community, we believe that we have access to one of the largest and most sophisticated groups of IT security experts researching vulnerability and threats on a real-time basis.
 
Our research and development expense was $16.3 million, $12.6 million and $11.9 million for the years ended December 31, 2009, 2008 and 2007, respectively.
 
Manufacturing and Suppliers
 
We typically hold limited inventory, relying primarily on a just-in-time manufacturing philosophy. We utilize two principal contract equipment manufacturers to source components, assemble, integrate and test our appliances and to ship those appliances to our customers. In addition, we utilize a third contract manufacturer to design and integrate some of our software and hardware components for use in select high-performance models of our appliances. Our agreements with these contract manufacturers are non-exclusive and subject to expiration at the end of terms ranging from one to three years. We would be faced with the burden, cost and delay of having to qualify and contract with a new supplier if any of these agreements expire or terminate for any reason.
 
Intellectual Property
 
To protect our intellectual property, both domestically and abroad, we rely primarily on patent, trademark, copyright and trade secret laws. We hold seven issued patents and have 34 patent applications pending for examination in the U.S. and foreign jurisdictions. The claims for which we have sought patent protection relate to methods and systems we have developed for intrusion detection and prevention used in our solutions. In addition, we utilize contractual provisions, such as non-disclosure and non-compete agreements with our employees and consultants, and confidentiality procedures to strengthen our protection.
 
Despite our efforts to protect our intellectual property, unauthorized parties may attempt to copy aspects of our products or obtain and use information that we regard as proprietary. While we cannot determine the extent to which piracy of our software products occurs, we expect software piracy to be a persistent problem. In addition, the laws of some foreign countries do not protect our proprietary rights to as great an extent as do the laws of the United States, and many foreign countries do not enforce these laws as diligently as U.S. government agencies and private parties.
 
Seasonality
 
Our business is subject to seasonal fluctuations. For a discussion of seasonality affecting our business, see “Management’s Discussion and Analysis of Financial Condition and Results of Operations — Results of Operations — Seasonality.”


11


 

Competition
 
The market for network security monitoring, detection, prevention and response solutions is intensely competitive and we expect strong competition to continue in the future. Our chief competitors generally fall within the following categories:
 
  •  large companies, including Cisco Systems, Inc., IBM Corporation, Juniper Networks, Inc., 3Com Corporation, Check Point Software Technologies, Ltd. and McAfee, Inc., that sell competitive products and offerings, as well as other large software companies that have the technical capability and resources to develop competitive products;
 
  •  software or hardware network infrastructure companies, including Cisco Systems, Inc., 3Com Corporation and Juniper Networks, Inc., that could integrate features that are similar to our products into their own products;
 
  •  smaller software companies offering applications for network and Internet security monitoring, detection, prevention or response; and
 
  •  small and large companies offering point solutions that compete with components of our product offerings.
 
Large companies may have advantages over us because of their longer operating histories, greater brand name recognition, larger customer bases or greater financial, technical and marketing resources. As a result, they may be able to adapt more quickly to new or emerging technologies and changes in customer requirements. They also have greater resources to devote to the promotion and sale of their products. In addition, these companies have reduced and could continue to reduce, the price of their security monitoring, detection, prevention and response products and managed security services, which intensifies pricing pressures within our market.
 
Several companies currently sell security software products, such as encryption, firewall, operating system security and virus detection software, that our customers and potential customers have broadly adopted. Some of these companies sell products that perform the same functions as some of our products. In addition, the vendors of operating system software or networking hardware may enhance their products to include functions similar to those that our products currently provide.
 
We believe that the principal competitive factors affecting the market for information security solutions include security effectiveness, manageability, technical features, performance, ease of use, price, scope of product offerings, professional services capabilities, distribution relationships and customer service and support. We believe that our solutions generally compete favorably with respect to such factors.
 
Employees
 
As of December 31, 2009, we had 307 employees, of whom 85 were engaged in product research and development and 124 were engaged in sales and marketing. Our current employees are not represented by a labor union and are not the subject of a collective bargaining agreement. We believe that we have good relations with our employees.
 
Corporate Information
 
We were incorporated in Delaware in January 2001. We completed our initial public offering in March 2007. Our executive offices are located at 9770 Patuxent Woods Drive, Columbia, Maryland 21046, and our main telephone number is (410) 290-1616.
 
Available Information
 
Our internet address is www.sourcefire.com. We provide free of charge on the Investor Relations page of our corporate web site access to our annual report on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K and amendments to those reports filed or furnished pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of 1934, as amended, as soon as reasonably practicable after they are electronically filed with or furnished to the Securities and Exchange Commission, or SEC. Information appearing on our website is not incorporated by reference in and is not a part of this annual report.


12


 

Item 1A.   RISK FACTORS
 
Set forth below and elsewhere in this Annual Report on Form 10-K and in other documents we file with the SEC are risks and uncertainties that could cause actual results to differ materially from the results contemplated by the forward-looking statements contained in this Annual Report on Form 10-K. Because of the following factors, as well as other variables affecting our operating results, past financial performance should not be considered as a reliable indicator of future performance, and investors should not use historical trends to anticipate results or trends in future periods.
 
Risks Relating to Our Business, Operations and Industry
 
Economic, market and political conditions, including the global recession, may adversely affect our revenue and results of operations.
 
Our business depends significantly on a range of factors that are beyond our control. These include:
 
  •  general economic and business conditions;
 
  •  the overall demand for network security products and services; and
 
  •  constraints on budgets and changes in spending priorities of corporations and government agencies.
 
The global financial recession has resulted in the significant weakening of the U.S. and global economies, the lack of availability of credit, the reduction in business confidence and activity, and other factors that may affect one or more of the industries to which we sell our products and services. Our customers include, but are not limited to, financial institutions, defense contractors, health care providers, information technology companies, telecommunications companies and retailers. These customers may suffer from reduced operating budgets, which could cause them to defer or forego purchases of our products or services. In addition, negative effects on the financial condition of our resellers and distributors could affect their ability or willingness to market our product and service offerings; negative effects on the financial condition of our product manufacturers could affect their ability to manufacture our products; and declines in economic and market conditions could impair our short-term investment portfolio. Any of these developments could adversely affect our revenue and results of operations.
 
We face intense competition in our market, especially from larger, better-known companies, and we may lack sufficient financial or other resources to maintain or improve our competitive position.
 
The market for network security monitoring, detection, prevention and response solutions is intensely competitive, and we expect competition to increase in the future. We may not compete successfully against our current or potential competitors, especially those with significantly greater financial resources or brand name recognition. Our chief competitors include: large software companies; software or hardware network infrastructure companies; smaller software companies offering applications for network and Internet security monitoring, detection, prevention or response; and small and large companies offering point solutions that compete with components of our product offerings.
 
For example, Cisco Systems, Inc., IBM Corporation, Juniper Networks, Inc., 3Com Corporation, Check Point Software Technologies, Ltd. and McAfee, Inc., have intrusion detection or prevention technologies that compete with our product offerings. Large companies may have advantages over us because of their longer operating histories, greater brand name recognition, larger customer bases or greater financial, technical and marketing resources. As a result, they may be able to adapt more quickly to new or emerging technologies and changes in customer requirements. They also have greater resources to devote to the promotion and sale of their products than we have. In addition, in some cases our competitors have aggressively reduced, and could continue to reduce, the price of their security monitoring, detection, prevention and response products, managed security services, and maintenance and support services which intensifies pricing pressures within our market.
 
Several companies currently sell software products (such as encryption, firewall, operating system security and virus detection software) that our customers and potential customers have broadly adopted. Some of these companies sell products that perform functions comparable to some of our products. In addition, the vendors of operating system software or networking hardware may enhance their products to include functions similar to those


13


 

that our products currently provide. The widespread inclusion of features comparable to our software in operating system software or networking hardware could render our products less competitive or obsolete, particularly if such features are of a high quality. Even if security functions integrated into operating system software or networking hardware are more limited than those of our products, a significant number of customers may accept more limited functionality to avoid purchasing additional products such as ours.
 
One of the characteristics of open source software is that anyone can offer new software products for free under an open source licensing model in order to gain rapid and widespread market acceptance. Such competition can develop without the degree of overhead and lead time required by traditional technology companies. It is possible for new competitors with greater resources than ours to develop their own open source security solutions, potentially reducing the demand for our solutions. We may not be able to compete successfully against current and future competitors. Competitive pressure and/or the availability of open source software may result in price reductions, reduced revenue, reduced operating margins and loss of market share, any one of which could seriously harm our business.
 
New competitors could emerge and could impair our sales.
 
New sources of competition for sales of our products could emerge. These include:
 
  •  emerging companies as well as larger companies who have not previously entered the market for network security products;
 
  •  established companies that develop their own network intrusion detection and prevention products, or acquire or establish product integration, distribution or other cooperative relationships with our current competitors; and
 
  •  new competitors or alliances among competitors that emerge and rapidly acquire significant market share due to factors such as greater brand name recognition, a larger installed customer base and significantly greater financial, technical, marketing and other resources and experience.
 
We achieved profitability on an annual basis for the first time in 2009, which we may not be able to maintain.
 
We incurred operating losses each year from our inception in 2001 through 2008. We achieved profitability on an annual basis for the first time in 2009. Maintaining profitability will depend in large part on our ability to generate and sustain increased revenue levels in future periods. Although our revenue has generally been increasing, there can be no assurances that we will maintain or increase our level of profitability. Our operating expenses may continue to increase as we seek to expand our customer base, increase our sales and marketing efforts and continue to invest in research and development of our technologies and products. These efforts may be more costly than we expect and we may not be able to increase our revenue to offset our operating expenses. If we cannot increase our revenue at a greater rate than our expenses, we will not remain profitable.
 
Our quarterly operating results are likely to vary significantly and be unpredictable, in part because of the purchasing and budget practices of our customers, which could cause the trading price of our stock to decline.
 
Our operating results have historically varied significantly from period to period, and we expect that they will continue to do so as a result of a number of factors, most of which are outside of our control, including:
 
  •  the budgeting cycles, internal approval requirements and funding available to our existing and prospective customers for the purchase of network security products;
 
  •  the timing, size and contract terms of orders received, which have historically been highest in the fourth quarter, but may fluctuate seasonally in different ways;
 
  •  the level of perceived threats to network security, which may fluctuate from period to period;


14


 

 
  •  the level of demand for products sold by resellers, distributors, MSSPs, government integrators and other partners;
 
  •  the market acceptance of open source software solutions;
 
  •  the announcement or introduction of new product offerings by us or our competitors, and the levels of anticipation and market acceptance of those products;
 
  •  price competition;
 
  •  general economic conditions, both domestically and in our foreign markets;
 
  •  the product mix of our sales; and
 
  •  the timing of revenue recognition for our sales.
 
In particular, the network security technology procurement practices of many of our customers have had a measurable influence on the historical variability of our operating performance. Our prospective customers usually exercise great care and invest substantial time in their network security technology purchasing decisions. As a result, our sales cycles are long, generally between six and twelve months or sometimes longer, which further impacts the variability of our results. Additionally, many of our customers have historically finalized purchase decisions in the last weeks or days of a quarter. A delay in even one large order beyond the end of a particular quarter can substantially diminish our anticipated revenue for that quarter. In addition, many of our expenses must be incurred before we generate revenue. As a result, the negative impact on our operating results would increase if our revenue fails to meet expectations in any period.
 
The cumulative effect of these factors may result in larger fluctuations and unpredictability in our quarterly operating results than in the operating results of many other software and technology companies. This variability and unpredictability could result in our failing to meet the revenue or operating results expectations of securities industry analysts or investors for a particular period. If we fail to meet or exceed such expectations for these or any other reasons, the market price of our shares could fall substantially, and we could face costly securities class action suits as a result. Therefore, you should not rely on our operating results in any quarter as being indicative of our operating results for any future period, nor should you rely on other expectations, predictions or projections of our future revenue or other aspects of our results of operations.
 
Federal and state governmental agencies have contributed to our revenue growth and have become important customers for us. If we cannot attract sufficient government agency customers, our revenue and competitive position will suffer.
 
Federal and state governments have become important customers for the network security market and for us. There can be no assurance that we will maintain or grow our revenue from these customers. Contracts with the U.S. federal and state government agencies collectively accounted for 29%, 21% and 11% of our total revenue for the year ended December 31, 2009, 2008 and 2007, respectively. Our reliance on government customers subjects us to a number of risks, including:
 
  •  Procurement.  Contracting with public sector customers is highly competitive and can be expensive and time-consuming, often requiring that we incur significant upfront time and expense without any assurance that we will win a contract;
 
  •  Budgetary Constraints and Cycles.  Demand and payment for our products and services are impacted by public sector budgetary cycles and funding availability. Reductions or delays in funding, including delays caused by continuing resolutions or other temporary funding arrangements, could adversely impact public sector demand for our products;
 
  •  Modification or Cancellation of Contracts.  Public sector customers often have contractual or other legal rights to terminate current contracts for convenience or due to a default. If a contract is cancelled for convenience, which can occur if the customer’s product needs change, we may only be able to collect for products and services delivered prior to termination. If a contract is cancelled because of our default, we may only be able to collect for products and alternative products and services delivered to the customer;


15


 

 
  •  Governmental Audits.  National governments and state and local agencies routinely investigate and audit government contractors’ administrative processes. They may audit our performance and pricing and review our compliance with applicable rules and regulations. If they find that we improperly allocated costs, they may require us to refund those costs or may refuse to pay us for outstanding balances related to the improper allocation. An unfavorable audit could result in a reduction of revenue, and may result in civil or criminal liability if the audit uncovers improper or illegal activities; and
 
  •  Replacing Existing Products.  Many government agencies already have installed network security products of our competitors. It can be very difficult to convince government agencies or other prospective customers to replace their existing network security solutions with our products, even if we can demonstrate the superiority of our products.
 
If we do not continue to establish and effectively manage our indirect distribution channels, or if our resellers, distributors and other partners fail to perform as expected, our revenue could suffer.
 
Our ability to sell our network security software products in new markets and to increase our share of existing markets will be impaired if we fail to manage or expand our indirect distribution channels. Our sales strategy involves the establishment of multiple distribution channels domestically and internationally through strategic resellers, distributors, MSSPs, government integrators and other partners. We have agreements with third parties for the distribution of our products and we cannot predict the extent to which these companies will be successful in marketing or selling our products. There is a risk that our pace of entering into such agreements may slow. In addition, our agreements with these companies could be terminated on short notice, and the agreements do not prevent these companies from selling the network security software of other companies, including our competitors. Any distributor of our products could give higher priority to other companies’ products or to their own products than they give to ours, which could cause our revenue to decline. There is also a risk that some or all of our resellers, distributors and other partners may be acquired, change their business models or go out of business, any of which could adversely affect our business.
 
We are subject to risks of operating internationally that could impair our ability to grow our revenue abroad.
 
We market and sell our software in the United States and internationally, and we plan to increase our international sales presence. Therefore, we are subject to risks associated with having worldwide operations. Sales to customers located outside of the United States accounted for 23%, 24% and 25% of our total revenue for the years ended December 31, 2009, 2008 and 2007, respectively. The expansion of our existing operations and entry into additional worldwide markets will require significant management attention and financial resources. We are also subject to a number of risks customary for international operations, including:
 
  •  economic or political instability in foreign markets;
 
  •  greater difficulty in accounts receivable collection and longer collection periods;
 
  •  unexpected changes in regulatory requirements;
 
  •  difficulties and costs of staffing and managing foreign operations;
 
  •  import and export controls;
 
  •  the uncertainty of protection for intellectual property rights in some countries;
 
  •  costs of compliance with foreign laws and laws applicable to companies doing business in foreign jurisdictions;
 
  •  management communication and integration problems resulting from cultural differences and geographic dispersion;
 
  •  compliance with tax laws in multiple jurisdictions; and
 
  •  foreign currency exchange rate fluctuations.


16


 

 
To date, a substantial portion of our sales have been denominated in U.S. dollars, although the majority of our expenses that we incur in our international operations are denominated in local currencies. To date, we have not used risk management techniques or “hedged” the risks associated with fluctuations in foreign currency exchange rates. As a result, our results of operations are subject to losses from fluctuations in foreign currency exchange rates.
 
The market for network security products is rapidly evolving, and the complex technology incorporated in our products makes them difficult to develop. If we do not accurately predict, prepare for and respond promptly to technological and market developments and changing customer needs, our competitive position and prospects could be harmed.
 
The market for network security products is expected to continue to evolve rapidly. Moreover, many customers operate in markets characterized by rapidly changing technologies and business plans, which require them to add numerous network access points and adapt increasingly complex enterprise networks, incorporating a variety of hardware, software applications, operating systems and networking protocols. In addition, computer hackers and others who try to attack networks employ increasingly sophisticated techniques to gain access to and attack systems and networks. Customers look to our products to continue to protect their networks against these threats in this increasingly complex environment without sacrificing network efficiency or causing significant network downtime. The software in our products is especially complex because it needs to effectively identify and respond to new and increasingly sophisticated methods of attack, without impeding the high network performance demanded by our customers. Although the market expects speedy introduction of software to respond to new threats, the development of these products is difficult and the timetable for commercial release of new products is uncertain. Therefore, in the future we may experience delays in the introduction of new products or new versions, modifications or enhancements of existing products. If we do not quickly respond to the rapidly changing and rigorous needs of our customers by developing and introducing on a timely basis new and effective products, upgrades and services that can respond adequately to new security threats, our competitive position and business prospects will be harmed.
 
If our new products and product enhancements do not achieve sufficient market acceptance, our results of operations and competitive position could suffer.
 
We spend substantial amounts of time and money to research and develop new products and enhance versions of our open source and proprietary commercial products. We incorporate additional features, improve functionality or add other enhancements in order to meet our customers’ rapidly evolving demands for network security in our highly competitive industry. When we develop a new product or an advanced version of an existing product, we typically expend significant money and effort upfront to market, promote and sell the new offering. Therefore, when we develop and introduce new or enhanced products, they must achieve high levels of market acceptance in order to justify the amount of our investment in developing and bringing the products to market.
 
Our new products or enhancements could fail to attain sufficient market acceptance for many reasons, including:
 
  •  delays in introducing new, enhanced or modified products;
 
  •  defects, errors or failures in any of our products;
 
  •  inability to operate effectively with the networks of our prospective customers;
 
  •  inability to protect against new types of attacks or techniques used by hackers;
 
  •  negative publicity about the performance or effectiveness of our network security products;
 
  •  reluctance of customers to purchase products based on open source software; and
 
  •  disruptions or delays in the availability and delivery of our products, including products from our contract manufacturers.
 
If our new products or enhancements do not achieve adequate acceptance in the market, our competitive position could be impaired, our revenue will be diminished and the effect on our operating results may be


17


 

particularly acute because of the significant research, development, marketing, sales and other expenses we incurred in connection with the new product.
 
If existing customers do not make subsequent purchases from us or renew their support arrangements with us, or if our relationships with our largest customers are impaired, our revenue could decline.
 
For the years ended December 31, 2009 and 2008, existing customers that purchased additional products and services from us, whether for new locations or additional technology to protect existing networks and locations, generated a majority of our total revenue. Part of our growth strategy is to sell additional products to our existing customers. We may not be effective in executing this or any other aspect of our growth strategy. Our revenue could decline if our current customers do not continue to purchase additional products from us. In addition, as we deploy new versions of our existing products or introduce new products, our current customers may not require the functionality of these products and may not purchase them.
 
We also depend on our installed customer base for future service revenue from annual maintenance fees. Our maintenance and support agreements typically have durations of one year. If customers choose not to continue their maintenance service or seek to renegotiate the terms of maintenance and support agreements prior to renewing such agreements, our revenue may decline.
 
Defects, errors or vulnerabilities in our products could harm our reputation and business and divert our resources.
 
Because our products are complex, they may contain defects, errors or vulnerabilities that are not detected until after our commercial release and installation by our customers. We may not be able to correct any errors or defects or address vulnerabilities promptly, or at all. Any defects, errors or vulnerabilities in our products could result in:
 
  •  expenditure of significant financial and product development resources in efforts to analyze, correct and eliminate defects, to address and eliminate vulnerabilities or to create alternative solutions;
 
  •  loss of existing or potential customers;
 
  •  delayed or lost revenue;
 
  •  failure to timely attain or maintain market acceptance;
 
  •  increased service, warranty, product replacement and product liability insurance costs; and
 
  •  negative publicity, which could harm our reputation.
 
In addition, because our products and services provide and monitor network security and may protect valuable information, we could face claims for product liability, tort or breach of warranty. Anyone who circumvents our customers’ security measures using our products could misappropriate the confidential information or other valuable property of, or interrupt the operations of our customers. If that happens, affected customers or others could sue us. In addition, we may face liability for breaches of our product warranties or product failures. Provisions in our contracts relating to warranty disclaimers and liability limitations may be deemed by a court to be unenforceable. Some courts, for example, have found contractual limitations of liability in standard computer and software contracts to be unenforceable in some circumstances. Defending a lawsuit, regardless of its merit, could be costly and divert management attention from the operation of our business. Our business liability insurance coverage may be inadequate or future coverage may be unavailable on acceptable terms or at all.
 
Our networks, products and services may be targeted by hackers.
 
Like other companies, our websites, networks, information systems, products and services may be targets for sabotage, disruption or misappropriation by hackers. As a leading network security solutions company, we are a high profile target and our networks, products and services may be targeted by hackers. Although we believe we have sufficient controls in place to prevent disruption and misappropriation, and to respond to such situations, we expect these efforts by hackers to continue. If these efforts are successful, our operations, reputation and sales could be adversely affected.


18


 

We may acquire additional businesses, products or technologies as part of our long-term growth strategy, and such acquisitions may not ultimately be successful or may not result in expected strategic benefits.
 
We may seek to buy or make investments in complementary or competitive businesses, products or technologies as part of our long-term growth strategy. We may not be successful in making these acquisitions. We may face competition for acquisition opportunities from other companies, including larger companies with greater financial resources. We may incur substantial expenses in identifying and negotiating acquisition opportunities, whether or not completed.
 
Acquisitions may not result in the expected strategic benefits, and completed acquisitions, if any, could negatively affect our operating results and financial position because of the following and other factors:
 
  •  we may not effectively integrate an acquired business, product or technology into our existing business and operations;
 
  •  completing a potential acquisition and integrating an acquired business into our existing business could significantly divert management’s time and resources from the operation of our business;
 
  •  a completed acquisition may not be accretive to earnings;
 
  •  acquisitions may result in substantial accounting charges for restructuring and other expenses, write-offs of in-process research and development, amortization of intangible assets and stock-based compensation expense;
 
  •  acquired companies, particularly privately held and non-U.S. companies, may have internal controls, policies and procedures that do not meet the requirements of the Sarbanes-Oxley Act of 2002 and public company accounting standards;
 
  •  we may use a significant portion of our cash resources to fund acquisitions; and
 
  •  we may issue stock to fund acquisitions, which could dilute the interests of our existing stockholders.
 
In the future, we may not be able to secure financing necessary to make acquisitions or to operate and grow our business as planned.
 
In the future, we may need to raise additional funds to make acquisitions or to expand our sales and marketing and research and development efforts. Additional equity or debt financing may not be available on favorable terms, or at all. If adequate funds are not available on acceptable terms, we may be unable to take advantage of acquisition or other opportunities or to fund the expansion of our sales and marketing and research and development efforts, which could seriously harm our business and operating results. If we issue debt, the debt holders could have rights senior to common stockholders to make claims on our assets and the terms of any debt could restrict our operations, including our ability to pay dividends on our common stock. Furthermore, if we issue additional equity securities, stockholders would experience dilution, and the new equity securities could have rights senior to those of our common stock.
 
If other parties claim commercial ownership rights to Snort or ClamAV, our reputation, customer relations and results of operations could be harmed.
 
While we created a majority of the current Snort code base and the current ClamAV code base, a portion of the current code for both Snort and ClamAV was created by the combined efforts of Sourcefire and the open source software community, and a portion was created solely by the open source community. We believe that the portions of the Snort code base and the ClamAV code base created by anyone other than us are required to be licensed by us pursuant to the GNU General Public License, or GPL, which is how we currently license Snort and ClamAV. There is a risk, however, that a third party could claim some ownership rights in Snort or ClamAV, attempt to prevent us from commercially licensing Snort or ClamAV in the future (rather than pursuant to the GPL as currently licensed) or claim a right to licensing royalties. Any such claim, regardless of its merit or outcome, could be costly to defend, harm our reputation and customer relations or result in our having to pay substantial compensation to the party claiming ownership.


19


 

We rely on software licensed from other parties, the loss of which could increase our costs and delay delivery of our products.
 
We utilize various types of software licensed from unaffiliated third parties. For example, we license MySQL database software that we use in our products. Our agreement with Oracle Corporation permits us to distribute MySQL software on our products to our customers worldwide until June 30, 2014. Our agreement with Oracle gives us the unlimited right to distribute MySQL software in exchange for a one-time lump-sum payment. We believe that the MySQL agreement is material to our business because we have spent a significant amount of development resources to allow the MySQL software to function in our products. If we were forced to find replacement database software or replacements for any of the other software we license from others for our products, our business would be disrupted and we could be required to expend significant resources, and there would be no guarantee that we would be able to procure the replacement on the same or similar commercial terms and conditions, or at all.
 
Additionally, we would be required to either redesign our products to function with software available from other parties or develop these components ourselves, which could result in increased costs and could result in delays in our product shipments and the release of new product offerings. Furthermore, we might be forced to limit the features available in our current or future products. If we fail to maintain or renegotiate any of these software licenses, we could face significant delays and diversion of resources in attempting to license and integrate a functional equivalent of the software.
 
Our inability to hire or retain key personnel, or to effectively manage headcount increases, could impair our intended growth.
 
Our business is dependent on our ability to hire, retain, motivate and manage highly qualified personnel, including senior management and sales and technical professionals. In particular, as part of our growth strategy, we intend to expand the size of our sales force domestically and internationally and to hire additional customer support and professional services personnel. However, competition for qualified services personnel is intense, and if we are unable to attract, train or retain the number of highly qualified sales and services personnel that our business needs, our reputation, customer satisfaction and potential revenue growth could be seriously harmed. To the extent that we hire personnel from competitors, we may also be subject to allegations that they have been improperly solicited or divulged proprietary or other confidential information. Our intended future growth may also place a significant strain on our management, financial, personnel and other resources.
 
In addition, our future success will depend to a significant extent on the continued services of our executive officers and senior personnel. Although we have adopted retention plans applicable to certain of these officers, there can be no assurance that we will be able to retain their services. The loss of the services of one or more of these individuals could adversely affect our business and could divert other senior management time in searching for their replacements.
 
Our business is subject to corporate governance, public disclosure, accounting and tax requirements that have increased both our costs and the risk of noncompliance.
 
Because our common stock is publicly traded, we are subject to the rules and regulations of federal, state and financial market exchange entities, such as the Public Company Accounting Oversight Board, the SEC, and the Nasdaq stock exchange, that are charged with the protection of investors and the oversight of companies whose securities are publicly traded. Our efforts to comply with these rules and regulations have resulted in, and are likely to continue resulting in, increased general and administrative expenses and diversion of management time and attention from revenue-generating activities to compliance activities.
 
We completed our evaluation of our internal controls over financial reporting for the fiscal year ended December 31, 2009 as required by the Sarbanes-Oxley Act of 2002. Although our assessment, testing and evaluation resulted in our conclusion that as of December 31, 2009, our internal controls over financial reporting were effective, we cannot predict the outcome of our testing in future periods. If our internal controls are ineffective in future periods, our business and reputation could be harmed. We may incur additional expenses and commitment of management’s time in connection with further evaluations, either of which could materially increase our operating expenses.


20


 

Because new and modified laws, regulations and standards are subject to varying interpretations in many cases due to their lack of specificity, their application in practice may evolve over time as new guidance is provided by regulatory and governing bodies. This evolution may result in continuing uncertainty regarding compliance matters and additional costs necessitated by ongoing revisions to our disclosure and governance practices.
 
Any material disruption or problem with the operation of our information systems may adversely impact our business, operating processes and internal controls.
 
The efficient operation of our business is dependent on the successful operation of our information systems. In particular, we rely on our information systems to process financial information, manage inventory and administer our sales transactions. In recent years, we have experienced a considerable growth in transaction volume and headcount, and we are increasingly relying upon international resources in our operations. Our information systems need to be sufficiently scalable to support the continued growth of our operations and the efficient management of our business. In an effort to improve the efficiency of our operations, achieve greater automation and support the growth of our business, we have implemented an enterprise resource planning, or ERP, system and a customer resource management, or CRM, system.
 
These information systems may not work as we currently intend. Any material disruption or similar problems with the operation of our information systems could have a material negative effect on our business and results of operations. In addition, if our information system resources are inadequate, we may be required to undertake costly modifications and the growth of our business could be harmed.
 
Potential uncertainty resulting from unsolicited acquisition proposals and related matters may adversely affect our business.
 
In the past we have received, and in the future we may receive, unsolicited proposals to acquire our company or our assets. The review and consideration of acquisition proposals and related matters could require the expenditure of significant management time and personnel resources. Such proposals may also create uncertainty for our employees, customers and business partners. Any such uncertainty could make it more difficult for us to retain key employees and hire new talent, and could cause our customers and business partners to not enter into new arrangements with us or to terminate existing arrangements. Additionally, we and members of our board of directors could be subject to future lawsuits related to unsolicited proposals to acquire us. Any such future lawsuits could become time consuming and expensive. These matters, alone or in combination, may harm our business.
 
Risks Relating to Our Intellectual Property and Litigation
 
Our products contain open source software, and failure to comply with the terms of the underlying open source software licenses could restrict our ability to sell our products.
 
Like many other software companies, we use and distribute “open source” software in order to expedite development of new products and features. Open source software is generally licensed by its authors or other third parties under “open source” licenses, including, for example, the GNU General Public License, or GPL, the GNU Lesser Public License, or LGPL, the BSD License and the Apache License. This open source software includes, without limitation, Snort, ClamAV, Linux, Apache, OpenSSL, Etheral, IPTables, Tcpdump and Tripwire. These license terms may be ambiguous, in many instances have not been interpreted by the courts and could be interpreted in a manner that results in unanticipated obligations regarding our products. Depending upon how the open source software is deployed by our developers and the underlying licenses are interpreted by the courts, we could be required to offer our products that use the open source software for no cost, make available the source code for modifications or derivative works, or secure an additional license to the underlying patent rights. Any of these obligations could have an adverse impact on our intellectual property rights and revenue from products incorporating the open source software.
 
Our use of open source code could also result in us developing and selling products that infringe third-party intellectual property rights. It may be difficult for us to accurately determine the developers of the open source code and whether the code incorporates proprietary software or otherwise infringes another party’s intellectual property rights (including patent rights). We have processes and controls in place that are designed to address these risks and


21


 

concerns, including a review process for screening requests from our development organizations for the use of open source. However, we cannot be sure that all open source is submitted for approval prior to use in our products.
 
We also have processes and controls in place to review the use of open source in the products developed by companies that we may acquire. Even if we conduct due diligence prior to completing an acquisition, the acquired products or technologies may nonetheless include open source software that was not identified during the initial due diligence. Our ability to commercialize products or technologies of any companies we may acquire that incorporate open source software or to otherwise fully realize the anticipated benefits of any such acquisition may be restricted in the same manner as if the open source software had been incorporated into our own software.
 
Our intellectual property rights may be difficult to enforce, which could enable others to compete with us or to copy or use aspects of our products without compensating us.
 
We rely primarily on a combination of copyright, trademark, patent and trade secret laws, confidentiality procedures and contractual provisions to establish and protect our proprietary rights in our technology. However, the steps we have taken to protect our proprietary rights and technology may not deter its misuse, theft or misappropriation. Competitors may independently develop technologies or products that are substantially equivalent or superior to our products or that inappropriately incorporate our proprietary technology into their products. Our products incorporate open source Snort software, which is readily available to the public. To the extent that our proprietary software is included by others in what are purported to be open source products, it may be difficult and expensive to enforce our intellectual property rights in such software. Competitors also may hire our former employees who may misappropriate our proprietary technology.
 
In addition, from time to time, we become aware that users of our security products may not have paid adequate license, technical support, or subscription fees to us. However, some jurisdictions may not provide an adequate legal infrastructure for effective protection or enforcement of our intellectual property rights. Furthermore, changing legal interpretations of liability for unauthorized use of our software or lessened sensitivity by corporate, government or institutional users to refraining from intellectual property piracy or other infringements of intellectual property could also harm our business.
 
In limited instances we have agreed to place, and in the future may agree to place, source code for our proprietary software in escrow. In most cases, the escrowed source code may be made available to certain of our customers and partners in the event that we were to file for bankruptcy or materially fail to support our products in the future. Release of our source code upon any such event would increase the likelihood of misappropriation or other misuse of our software. We have rarely agreed to source code escrow arrangements in the past and usually only in connection with prospective customers considering a significant purchase of our products and services.
 
If we acquire technology to include in our products from third parties, our exposure to infringement actions may increase because we must rely upon these third parties to verify the origin and ownership of such technology. Similarly, we face exposure to infringement actions if we hire software engineers who were previously employed by competitors and those employees inadvertently or deliberately incorporate proprietary technology of our competitors into our products despite efforts by our competitors and us to prevent such infringement.
 
Efforts to assert intellectual property ownership rights in our products could impact our standing in the open source community, which could limit our product innovation capabilities.
 
If we were to undertake actions to protect and maintain ownership and control over our intellectual property rights, our standing in the open source community could be diminished. This could in turn limit our ability to rely on this community as a resource to identify and defend against new viruses, threats and techniques to attack secure networks, explore new ideas and concepts and further our research and development efforts.


22


 

Claims that our products infringe the proprietary rights of others could harm our business and cause us to incur significant costs.
 
If we are unable to protect our intellectual property rights in our technologies, we may find ourselves at a competitive disadvantage to others who need not incur the additional expense, time and effort required to create competitive technologies. As a result, litigation may be necessary to enforce and protect our intellectual property rights.
 
Similarly, the security technology industry has increasingly been subject to patent and other intellectual property rights litigation, particularly from special purpose entities that seek to monetize their intellectual property rights by asserting claims against others. We expect this trend to continue and accelerate and expect that we may from time to time be required to defend against this type of litigation. For example, as described under “Legal Proceedings” below, we and nine other network security companies have been named as defendants in a patent infringement lawsuit. Third party asserted claims or initiated litigation can include claims against us or our customers, end-users, manufacturers, suppliers, partners or distributors, alleging infringement of intellectual property rights with respect to our existing or future products or components of those products. The litigation process can be costly and is subject to inherent uncertainties, so we may not prevail in litigation matters regardless of the merits of our position. In addition to the expense and distraction associated with litigation, adverse determinations could cause us to lose our proprietary rights, prevent us from manufacturing or selling our products, require us to obtain licenses to patents or other intellectual property rights that our products are alleged to infringe, which licenses may not be available on reasonable commercial terms or at all, and subject us to significant liabilities including indemnities to our customers and others for losses resulting from such claims.
 
Future litigation could have a material adverse impact on our results of operations, financial condition and liquidity.
 
From time to time we have been, and may be in the future, subject to litigation, including stockholder derivative actions. Risks associated with legal liability are difficult to assess and quantify, and their existence and magnitude can remain unknown for significant periods of time. While we maintain director and officer insurance, the amount of insurance coverage may not be sufficient to cover a claim, and there can be no assurance as to the continued availability of this insurance. We may in the future be the target of additional proceedings, with or without merit, and these proceedings may result in substantial costs and divert management’s attention and resources.
 
Risks Relating to Manufacturing
 
We primarily utilize a just-in-time contract manufacturing and inventory process and depend on a limited number of manufacturers of our hardware products, which increases our vulnerability to supply disruption.
 
We primarily utilize a just-in-time contract manufacturing and inventory process. Therefore, our ability to meet our customers’ demand for our products depends upon obtaining adequate hardware platforms on a timely basis and integrating them with our software. We purchase hardware platforms from a limited number of contract manufacturers. The unexpected termination of our relationship with any of these manufacturers would be disruptive to our business and our reputation, and could result in a material decline in our revenue as well as shipment delays and possible increased costs as we seek and implement production with an alternative manufacturer.
 
In addition, we rely on our contract manufacturers to source the components for our hardware platforms and they in turn obtain materials from a limited number of suppliers. These suppliers may extend lead times, limit the supply to our manufacturers or increase prices due to capacity constraints or other factors. Although we work closely with our manufacturers and suppliers to avoid shortages, we may encounter these problems in the future. Our results of operations would be adversely affected if we were unable to obtain adequate supplies of hardware platforms in a timely manner or if there were significant increases in the costs of hardware platforms or problems with the quality of those hardware platforms.


23


 

In some cases, we purchase products from contract manufacturers and hold them in inventory pending sale to our customers. If demand for these products does not meet our expectations, or if these products become obsolete, we could be required to write down the value of our inventory, which could adversely affect our results of operations.
 
Although we primarily utilize a just-in-time contract manufacturing and inventory process, in some cases we purchase products from contract manufacturers based on our expectations of future demand. We then hold these products in inventory pending sale to our customers. Demand for these products may not meet our expectations as a result of a number of factors, including weakness in general economic conditions, reductions in our customers’ purchasing budgets, discounting of prices on competitive products, defects or perceived defects in the products or the introduction by us or our competitors of new or enhanced products. In the past, we have recognized expenses related to inventory write-offs and, in the future, if we reduce our estimate of future demand for our products held in inventory, or if our inventory becomes obsolete, we may be required to record additional inventory write-offs, which could negatively impact our gross margin and results of operations.
 
Risks Relating to Our Common Stock
 
The price of our common stock may be subject to wide fluctuations.
 
Since the time of our initial public offering in March 2007, the market price of our common stock has been subject to significant fluctuations, and we expect this volatility to continue for the foreseeable future. For example, during the year ended December 31, 2009, our stock traded between a high of $27.80 per share and a low of $5.12 per share. Among the factors that could affect our common stock price are the risks described in this “Risk Factors” section and other factors, including:
 
  •  quarterly variations in our operating results compared to market expectations;
 
  •  changes in expectations as to our future financial performance, including financial estimates or reports by securities analysts;
 
  •  changes in market valuations of similar companies or of our competitors;
 
  •  liquidity and activity in the market for our common stock;
 
  •  actual or expected sales of our common stock by our stockholders;
 
  •  strategic moves by us or our competitors, such as acquisitions or restructurings;
 
  •  general market conditions; and
 
  •  domestic and international economic, legal and regulatory factors unrelated to our performance.
 
Stock markets in general, and the stocks of technology companies in particular, have experienced extreme volatility that has often been unrelated to the operating performance of a particular company. These broad market fluctuations may adversely affect the trading price of our common stock, regardless of our operating performance.
 
Sales of substantial amounts of our common stock in the public markets, or the perception that they might occur, could reduce the price that our common stock might otherwise attain.
 
As of March 5, 2010, we had 27,307,225 outstanding shares of common stock. This number includes shares held by institutional investors who own a significant majority of our common stock. This number also includes shares held by directors and officers who may sell such shares at their discretion, subject to volume limitations contained in federal securities laws. Sales of substantial amounts of our common stock in the public market, or the perception that such sales could occur, could adversely affect the market price of our common stock and may make it more difficult for you to sell your common stock at a time and price that you deem appropriate.


24


 

Anti-takeover provisions in our charter documents and under Delaware law and our adoption of a stockholder rights plan could make an acquisition of our company, which may be beneficial to our stockholders, more difficult and may prevent attempts by our stockholders to replace or remove our current management.
 
Our certificate of incorporation and our bylaws contain provisions that may delay or prevent an acquisition of our company or a change in our management. These provisions include a classified board of directors, a prohibition on actions by written consent of our stockholders and our ability to issue preferred stock without stockholder approval. In addition, because we are incorporated in Delaware, we are governed by the provisions of Section 203 of the Delaware General Corporation Law, which generally prohibits stockholders owning in excess of 15% of our outstanding voting stock from engaging in specified acquisition transactions with us. Furthermore, we have adopted a stockholder rights plan under which we would issue preferred stock rights upon specified events, which could substantially dilute the stock ownership of a person or group attempting to take us over without the approval of our board of directors. Although we believe these provisions of our certificate of incorporation, bylaws, Delaware corporate law and our stockholder rights plan collectively provide for an opportunity to receive higher bids by requiring potential acquirers to negotiate with us, they would apply even if stockholders consider the offer to be beneficial. In addition, these provisions may frustrate or prevent attempts by our stockholders to replace or remove our current management by making it more difficult for stockholders to replace members of our board of directors, which is responsible for appointing the members of our management.
 
Item 1B.   UNRESOLVED STAFF COMMENTS
 
Not applicable.
 
Item 2.   PROPERTIES
 
Our corporate headquarters and principal executive offices are located in Columbia, Maryland under a lease that expires in May 2015. Significant leased locations include offices in Vienna, Virginia; Livonia, Michigan; Wokingham, United Kingdom; Tokyo, Japan; and Singapore. We also lease other sales offices in multiple locations worldwide. We believe that our facilities are generally suitable to meet our needs for the foreseeable future; however, we will continue to seek additional space as needed in accordance with our growth.
 
Item 3.   LEGAL PROCEEDINGS
 
On May 29, 2009 and August 3, 2009, Enhanced Security Research, LLC, or ESR, filed two nearly identical complaints in the United States District Court for the District of Delaware against 10 defendants, including Cisco Systems, Inc., International Business Machines Corporation, Check Point Software Technologies, Ltd., Check Point Software Technologies, Inc., SonicWALL, Inc., 3Com Corporation, Nokia Corporation, Nokia, Inc., Fortinet, Inc., and us. The only significant difference between the first and second complaints is the addition of Security Research Holdings LLC as a plaintiff. The complaints allege, among other things, that our network security appliances and software infringe two U.S. patents. Plaintiffs seek unspecified damages, enhancement of those damages, an attorney’s fee award and an injunction against further infringement. We believe that the allegations of infringement against us are without merit, and we intend to defend this case vigorously on that basis. The United States Patent and Trademark Office recently agreed to reexamine one of the two patents in this litigation, and rejected all claims in that patent as not patentable. The patent owner has filed a response arguing that the claims are patentable. The United States Patent and Trademark Office has not yet issued its final decision. Given the inherent unpredictability of litigation and jury trials, we cannot at this early stage of the matter estimate the possible outcome of this litigation. Because patent litigation is time consuming and costly to defend, we may incur significant costs related to this matter in future periods. In addition, an unfavorable outcome in this matter could have a material adverse effect on our future results of operations or cash flows.


25


 

Item 4.   RESERVED
 
PART II
 
Item 5.   MARKET FOR REGISTRANT’S COMMON EQUITY, RELATED STOCKHOLDER MATTERS AND ISSUER PURCHASES OF EQUITY SECURITIES
 
Market Information
 
Our common stock is publicly traded on the Nasdaq Global Market under the symbol “FIRE.” The following table sets forth, for the periods indicated, the high and low sales prices of our common stock as reported by the Nasdaq Global Market.
 
                 
    High   Low
 
Year ended December 31, 2008:
               
First Quarter
  $ 7.47     $ 3.89  
Second Quarter
  $ 8.15     $ 6.51  
Third Quarter
  $ 8.37     $ 5.81  
Fourth Quarter
  $ 8.49     $ 4.96  
Year ended December 31, 2009:
               
First Quarter
  $ 7.94     $ 5.12  
Second Quarter
  $ 13.53     $ 7.13  
Third Quarter
  $ 22.74     $ 11.18  
Fourth Quarter
  $ 27.80     $ 18.38  
 
As of March 5, 2010, there were approximately 122 holders of record of our common stock. The number of holders of record of our common stock does not reflect the number of beneficial holders whose shares are held by depositories, brokers or other nominees.
 
Dividend Policy
 
We have never declared or paid any cash dividends on our common stock. We currently intend to retain all available funds and any future earnings for use in the operation and expansion of our business and do not anticipate paying any cash dividends in the foreseeable future.


26


 

Stock Performance Graph
 
The following graph illustrates a comparison of the total cumulative stockholder return on our common stock since March 9, 2007, the date our stock commenced public trading, through December 31, 2009 to two indices: the Russell 2000 Index and the RDG Software Composite Index. The graph assumes an initial investment of $100 on March 9, 2007 in Sourcefire common stock and on February 28, 2007 in each of the two indices. The comparisons in the graph are required by the Securities and Exchange Commission and are not intended to forecast or be indicative of possible future performance of our common stock.
 
COMPARISON OF 33 MONTH CUMULATIVE TOTAL RETURN*
Among Sourcefire, Inc., The Russell 2000 Index
And The RDG Software Composite Index
 
(PERFORMANCE GRAPH)
 
* $100 invested on 3/9/07 in stock & 2/28/07 in index-including reinvestment of dividends.
Fiscal year ending December 31.


27


 

Use of Proceeds
 
In March 2007, we completed the initial public offering of shares of our common stock. Our portion of the net proceeds from the initial public offering was approximately $83.9 million after deducting underwriting discounts and commissions of $6.5 million and $2.4 million in offering expenses.
 
We intend to use the net proceeds from the offering for working capital and other general corporate purposes, including financing our growth, developing new products and funding capital expenditures. Pending such usage, we have invested the net proceeds primarily in short-term, interest-bearing investment grade securities.
 
Repurchases of Equity Securities During 2009
 
The following table provides information about purchases by us during the fiscal quarter ending December 31, 2009 of equity securities that are registered by us pursuant to Section 12 of the Securities Act.
 
Repurchases are made under the terms of our 2007 Stock Incentive Plan. Under this plan, we may award shares of restricted stock to our employees and directors. These shares of restricted stock typically are subject to a lapsing right of repurchase by us. We may exercise this right of repurchase in the event that a restricted stock recipient’s service to us is terminated. If we exercise this right, we are required to repay the purchase price paid by or on behalf of the recipient for the repurchased restricted shares, which typically is the par value per share of $0.001. Repurchased shares are returned to the 2007 Stock Incentive Plan and are available for future awards under the terms of that plan.
 
These were the only repurchases of equity securities made by us during 2009. We do not have a stock repurchase program.
 
                                 
            Total
   
            Number of
  Maximum
            Shares
  Number of
            Purchased
  Shares that
            as Part of
  May Yet Be
    Total
      Publicly
  Purchased
    Number of
  Average
  Announced
  Under the
    Shares
  Price Paid
  Plans or
  Plans or
Period
  Purchased   per Share   Programs   Programs
 
12/1/09 - 12/31/09
    3,902 (1)   $ 0.001            —            —  
 
 
(1) Reflects the repurchase of restricted stock from employees and directors that was unvested at the time of termination of employment or service on our board of directors. The purchase price represents the original price paid for the shares by the employee or director, which is equal to the par value of our common stock.


28


 

 
Item 6.   SELECTED FINANCIAL DATA
 
The consolidated statement of operations data for the three years ended December 31, 2009 and the consolidated balance sheet data as of December 31, 2008 and 2009 have been derived from our audited consolidated financial statements appearing elsewhere in this report. The consolidated statement of operations data for the years ended December 31, 2005 and 2006 and the consolidated balance sheet data as of December 31, 2005, 2006 and 2007 have been derived from our audited consolidated financial statements that do not appear in this report. The selected consolidated financial data set forth below should be read in conjunction with “Management’s Discussion and Analysis of Financial Condition and Results of Operations” set forth below and our consolidated financial statements and related notes included elsewhere in this report. The historical results are not necessarily indicative of the results to be expected in any future period.
 
                                         
    Year Ended December 31,  
    2009     2008     2007     2006     2005  
    (In thousands, except share and per share data)  
 
Consolidated statement of operations data:
                                       
Revenue:
                                       
Products
  $ 62,585     $ 45,245     $ 34,332     $ 30,219     $ 23,589  
Services
    40,880       30,428       21,527       14,707       9,290  
                                         
Total revenue
    103,465       75,673       55,859       44,926       32,879  
Cost of revenue:
                                       
Products
    15,641       12,408       9,523       8,440       6,610  
Services
    6,379       4,952       3,360       2,632       1,453  
                                         
Total cost of revenue
    22,020       17,360       12,883       11,072       8,063  
                                         
Gross profit
    81,445       58,313       42,976       33,854       24,816  
Operating expenses:
                                       
Research and development
    16,256       12,620       11,902       8,612       6,831  
Sales and marketing
    36,498       33,169       25,860       20,652       17,135  
General and administrative
    16,761       18,713       10,599       5,017       5,120  
Depreciation and amortization
    3,647       2,627       1,649       1,230       1,103  
In-process research and development
                2,947              
                                         
Total operating expenses
    73,162       67,129       52,957       35,511       30,189  
                                         
Income (loss) from operations
    8,283       (8,816 )     (9,981 )     (1,657 )     (5,373 )
Other income (expense), net
    926       3,064       4,604       792       (85 )
                                         
Income (loss) before income taxes
    9,209       (5,752 )     (5,377 )     (865 )     (5,458 )
Provision for income taxes
    331       319       244       67        
                                         
Net income (loss)
    8,878       (6,071 )     (5,621 )     (932 )     (5,458 )
Accretion of preferred stock
                (870 )     (3,819 )     (2,668 )
                                         
Net income (loss) attributable to common stockholders
  $ 8,878     $ (6,071 )   $ (6,491 )   $ (4,751 )   $ (8,126 )
                                         
Net income (loss) attributable to common stockholders per common share:
                                       
Basic
  $ 0.34     $ (0.24 )   $ (0.32 )   $ (1.40 )   $ (2.54 )
Diluted
    0.32       (0.24 )     (0.32 )     (1.40 )     (2.54 )
                                         
Shares used in per common share calculations:
                                       
Basic
    26,458,273       25,379,791       20,434,792       3,389,527       3,200,318  
Diluted
    27,987,115       25,379,791       20,434,792       3,389,527       3,200,318  
                                         


29


 

Consolidated Balance Sheet Data
 
                                         
    As of December 31,
    2009   2008   2007   2006   2005
    (In thousands)
 
Cash and cash equivalents
  $ 53,071     $ 39,768     $ 33,071     $ 13,029     $ 1,106  
Investments
    70,149       61,800       73,956       13,293       2,005  
Working capital
    103,055       99,017       101,302       25,852       4,135  
Total assets
    174,167       146,305       141,678       49,952       21,250  
Deferred revenue
    34,177       24,108       21,027       14,115       10,595  
Long-term debt
                      1,312       990  
Total liabilities
    45,678       37,264       32,484       22,104       16,340  
Total convertible preferred stock
                      66,747       40,007  
Total stockholders’ equity (deficit)
    128,489       109,041       109,194       (38,899 )     (35,097 )
 
Item 7.   MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS OF OPERATIONS
 
Introduction
 
Management’s discussion and analysis of financial condition, changes in financial condition and results of operations is provided as a supplement to the accompanying consolidated financial statements and notes to help provide an understanding of our financial condition and results of operations. This discussion is organized as follows:
 
  •  Overview.  This section provides a general description of our business, the key financial metrics that we use in assessing our performance, and anticipated trends that we expect to affect our financial condition and results of operations.
 
  •  Results of Operations.  This section provides an analysis of our results of operations for the three years in the period ended December 31, 2009.
 
  •  Non-GAAP Financial Measures.  This section discusses non-GAAP financial results that we use in evaluating the operating performance of our business. These measures should be considered in addition to results prepared in accordance with United States generally accepted accounting principles, or GAAP, but should not be considered a substitute for, or superior to, GAAP results. The non-GAAP measures discussed have been reconciled to the nearest GAAP measure in a table included in this section.
 
  •  Liquidity and Capital Resources.  This section provides an analysis of our cash flows for the year ended December 31, 2009 and a discussion of our capital requirements and the resources available to us to meet those requirements.
 
  •  Critical Accounting Policies and Estimates.  This section discusses accounting policies that are considered important to our financial condition and results of operations, require significant judgment or require estimates on our part in applying them. Our significant accounting policies, including those considered to be critical accounting policies, are summarized in Note 2 to the accompanying consolidated financial statements.
 
Overview
 
We are a leading provider of intelligent cybersecurity solutions for information technology, or IT, environments of commercial enterprises, including healthcare, financial services, manufacturing, energy, education, retail and telecommunications companies, and federal, state and local government organizations worldwide. Our solutions are comprised of multiple hardware and software product and service offerings, enabling a comprehensive, intelligent approach to network security. Our security solutions provide customers with an efficient and effective network security defense of assets and applications before, during and after an attack.


30


 

We sell our network security solutions to a diverse customer base that includes Global 2000 companies, global enterprises, U.S. and international government agencies and small and mid-size businesses. We also manage two of the security industry’s leading open source initiatives, Snort® and ClamAV®.
 
Key Financial Metrics and Trends
 
Our financial results are affected by a number of factors, including general economic conditions in the United States and globally, the amount and type of technology spending of our customers, and the financial condition of our customers and other entities in the industries and geographic areas that we serve. During the second half of 2008 and continuing in 2009, the industries and geographic areas that we serve experienced weakness as macroeconomic conditions, credit market conditions and levels of business confidence and activity deteriorated. We are continuing to monitor economic conditions and their potential effect on our customers and on us. An additional economic downturn could adversely affect our customers’ financial condition and the levels of business activity. This could reduce demand and depress pricing for our products and services, which could have a material adverse effect on our results of operations or financial condition.
 
During the year ended December 31, 2009, a significant portion of our revenue growth resulted from sales of our products and services to U.S. federal and state government agencies. Contracts with the U.S. federal and state government agencies collectively accounted for 29%, 21% and 11% of our total revenue for the years ended December 31, 2009, 2008 and 2007, respectively. We expect sales to U.S. federal and state government agencies to continue to account for a significant portion of our total revenue in 2010. A reduction in the amount of U.S. government purchases of our products could have a material adverse effect on our results of operations or financial condition.
 
We evaluate our performance on the basis of several key financial metrics, including revenue, cost of revenue, gross profit, and operating expenses. We compare these key performance indicators, on a quarterly basis, to both target amounts established by management and to our performance for prior periods. We also evaluate performance on the basis of adjusted net income, which is a non-GAAP financial measure. Information regarding our adjusted net income and a reconciliation to GAAP net income is provided under “Non-GAAP Financial Measures” below.
 
Revenue
 
We currently derive revenue from product sales and services. Product revenue is principally derived from the sale of our network security solutions. Our network security solutions include a perpetual software license bundled with a third-party hardware platform. Services revenue is principally derived from technical support and professional services. We typically sell technical support to complement our network security product solutions. Technical support entitles a customer to product updates, new rule releases and both telephone and web-based assistance for using our products. Our professional services revenue includes optional installation, configuration and tuning, which we refer to collectively as network security deployment services. These services typically occur on-site after delivery has occurred.
 
Product sales are typically recognized as revenue upon shipment of the product to the customer. For sales through resellers and distributors, we recognize revenue upon the shipment of the product only if those resellers and distributors provide us, at the time of placing their order, with the identity of the end-user customer to whom the product has been sold. We recognize revenue from services when the services are performed. For technical support services, we recognize revenue ratably over the term of the support arrangement, which is generally 12 months. Our support agreements generally provide for payment in advance.
 
We sell our network security solutions globally. However, 77%, 76% and 75% of our revenue for the years ended December 31, 2009, 2008 and 2007, respectively, was generated by sales to U.S.-based customers. We expect that our revenue from customers based outside of the United States will increase in absolute dollars and as a percentage of revenue as we strengthen our international presence. We also expect that our revenue from sales through our indirect sales channel, comprised of resellers, distributors, managed security service providers, or MSSPs, government integrators and other partners, will increase in amount and as a percentage of total revenue as we expand our current relationships and establish new relationships with these third parties.


31


 

We continue to generate a majority of our product revenue through sales to existing customers, both for new locations and for additional technology to protect existing networks and locations. Product sales to existing customers accounted for 78%, 65% and 60% of total product revenue for the years ended December 31, 2009, 2008 and 2007, respectively. We expect product sales to existing customers to continue to account for a significant portion of our product revenue in 2010.
 
Historically, our product revenue has been seasonal, with a significant portion of our total product revenue in recent fiscal years generated in the third and fourth quarters. Revenue from our government customers has been influenced by the September 30th fiscal year-end of the U.S. federal government, which has historically resulted in our revenue from government customers being highest in the second half of the year. While we expect these historical trends to continue, they could be affected by a number of factors, including another decline in general economic conditions, changes in the timing or amounts of U.S. government spending and our planned international expansion. Notwithstanding these general seasonal patterns, our revenue within a particular quarter is often affected significantly by the unpredictable procurement patterns of our customers. Our prospective customers usually spend a long time evaluating and making purchase decisions for network security solutions. Historically, many of our customers have not finalized their purchasing decisions until the final weeks or days of a quarter. We expect these purchasing patterns to continue in the future. Therefore, a delay in even one large order beyond the end of the quarter could materially reduce our anticipated revenue for a quarter. In addition, because we typically recognize revenue upon shipment, the timing of our quarter-end and year-end shipments could materially affect our reported product revenue for a given quarter or year. Because many of our expenses are incurred before we recognize revenue, delayed orders could negatively impact our results of operations and cash flows for a particular period and could therefore cause us to fail to meet the financial performance expectations of financial and industry research analysts or investors.
 
Cost of Revenue
 
Cost of product revenue includes the cost of the hardware platform, royalties for third-party software, materials and labor, logistics, warranty, shipping and handling costs, expense for inventory excess and obsolescence and depreciation in the instances where we lease our network security solutions to our customers. We allocate overhead costs, including facilities, supplies, communication and information systems and employee benefits, to the cost of product revenue. Overhead costs are reflected in each cost of revenue and operating expense category. As our product volume increases, we anticipate incurring an increased amount of both direct and overhead expenses to supply and manage the increased volume. Hardware unit costs, our most significant cost item, have generally remained constant on a per unit basis; however, hardware unit costs or other costs of manufacturing could increase in the future.
 
Cost of services revenue includes the direct labor costs of our employees and outside consultants engaged to furnish those services, as well as their travel and associated direct material costs. Additionally, we include in cost of services revenue an allocation of overhead costs, as well as the cost of time and materials to service or repair the hardware component of our products covered under a renewed support arrangement beyond the manufacturer’s warranty and the expense for advance replacement unit inventory excess and obsolescence. As our customer base continues to grow, we anticipate incurring an increasing amount of these service and repair costs, as well as costs for additional personnel to provide support and service to our customers.
 
Gross Profit
 
Our gross profit is affected by a variety of factors, including competition, the mix and average selling prices of our products, our pricing policy, technical support and professional services, new product introductions, the cost of hardware platforms, expense for inventory excess and obsolescence, warranty expense, the cost of labor to generate revenue and the mix of distribution channels through which our products are sold. Our gross profit would be adversely affected by price declines or pricing discounts if we are unable to reduce costs on existing products and fail to introduce new products with higher margins. Currently, product sales typically have a lower gross profit as a percentage of revenue than our services due to the cost of the hardware platform. Our gross profit for any particular quarter could be adversely affected if we do not complete a sufficient level of sales of higher-margin products by the end of the quarter. As discussed above, many of our customers do not finalize purchasing decisions until the final weeks or days of a quarter, so a delay in even one large order of a high-margin product could reduce our total gross profit percentage for that quarter.


32


 

Operating Expenses
 
Research and Development.  Research and development expenses consist primarily of salaries, incentive compensation and allocated overhead costs for our engineers; costs for professional services to design, test and certify our products; and costs associated with data used by us in our product development.
 
We have expanded our research and development capabilities and expect to continue to expand these capabilities in the future. We are committed to increasing the level of innovative design and development of new products as we strive to enhance our ability to serve our existing commercial and federal government markets as well as new markets for security solutions. To meet the changing requirements of our customers, we will need to fund investments in several development projects in parallel. Accordingly, we anticipate that our research and development expenses will continue to increase in absolute dollars for the foreseeable future; however, we expect these expenses to remain flat or decline slightly as a percentage of revenue.
 
Sales and Marketing.  Sales and marketing expenses consist primarily of salaries, incentive compensation and allocated overhead costs for sales and marketing personnel; trade show, advertising, marketing and other brand-building costs; marketing consultants and other professional services; training, seminars and conferences; and travel and related costs.
 
As we continue to focus on increasing our market penetration, expanding internationally, increasing our indirect sales channel and building brand awareness, we anticipate that selling and marketing expenses will continue to increase in absolute dollars but remain relatively flat as a percentage of our revenue.
 
General and Administrative.  General and administrative expenses consist primarily of salaries, incentive compensation and allocated overhead costs for executive, legal, finance, information technology, human resources and administrative personnel; corporate development expenses and professional fees related to legal, audit, tax and regulatory compliance; travel and related costs; and corporate insurance. We anticipate that general and administrative expenses will increase in absolute dollars.
 
Stock-Based Compensation.  Stock-based compensation expense is based on the grant date fair value of stock awards granted or modified after January 1, 2006 using the prospective transition method.
 
We use the Black-Scholes option pricing model to estimate the fair value of stock options granted and employee stock purchases. For a prior option award that contained a market condition relating to our stock price achieving specified levels, we used a Lattice option pricing model. The use of option valuation models requires the input of highly subjective assumptions, including the expected term and the expected stock price volatility. Based on the estimated grant date fair value of stock-based awards, we recognized aggregate stock-based compensation expense of $6.2 million, $4.5 million and $2.6 million for the years ended December 31, 2009, 2008 and 2007, respectively.
 
Results of Operations
 
Revenue.  The following table shows products and technical support and professional services revenue (in thousands):
 
                                                                 
    Year Ended
          Year Ended
       
    December 31,     Variance     December 31,     Variance  
    2009     2008     $     %     2008     2007     $     %  
 
Products
  $ 62,585     $ 45,245     $ 17,340       38 %   $ 45,245     $ 34,332     $ 10,913       32 %
Percentage of total revenue
    60 %     60 %                     60 %     61 %                
Technical support and professional services
    40,880       30,428       10,452       34 %     30,428       21,527       8,901       41 %
Percentage of total revenue
    40 %     40 %                     40 %     39 %                
                                                                 
Total revenue
  $ 103,465     $ 75,673     $ 27,792       37 %   $ 75,673     $ 55,859     $ 19,814       35 %
                                                                 


33


 

The increase in our product revenue for the year ended December 31, 2009, as compared to the prior year, was primarily due to higher volume demand for our sensor products, mainly our higher performance products. For 2009, sensor product revenue increased $17.4 million over the prior year, including a $15.1 million increase in revenue from our higher performance products. The increase in our services revenue for 2009, as compared to the prior year, resulted from an increase in our installed customer base due to new product sales in which associated support was purchased, as well as technical support renewals by our existing customers.
 
The increase in our product revenue for the year ended December 31, 2008, as compared to the prior year, was mostly driven by higher volume demand for our sensor products, primarily our higher performance products. For 2008, sensor product revenue increased $9.6 million over the prior year, including a $4.5 million increase in our higher performance products. The increase in our services revenue for 2008, as compared to the prior year, resulted from an increase in our installed customer base due to new product sales in which associated support was purchased, as well as support renewals by our existing customers.
 
Cost of revenue.  The following table shows products and technical support and professional services cost of revenue (in thousands):
 
                                                                 
    Year Ended
          Year Ended
       
    December 31,     Variance     December 31,     Variance  
    2009     2008     $     %     2008     2007     $     %  
 
Products
  $ 15,641     $ 12,408     $ 3,233       26 %   $ 12,408     $ 9,523     $ 2,885       30 %
Percentage of total revenue
    15 %     16 %                     16 %     17 %                
Technical support and professional services
    6,379       4,952       1,427       29 %     4,952       3,360       1,592       47 %
Percentage of total revenue
    6 %     7 %                     7 %     6 %                
                                                                 
Total cost of revenue
  $ 22,020     $ 17,360     $ 4,660       27 %   $ 17,360     $ 12,883     $ 4,477       35 %
                                                                 
Percentage of total revenue
    21 %     23 %                     23 %     23 %                
 
The increase in our product cost of revenue for the year ended December 31, 2009, as compared to the prior year, was primarily due to higher volume demand for our sensor products, for which we must procure and provide the hardware platform to our customers, and a write-down of $1.4 million for excess and obsolete inventory as a result of the introduction of new products.
 
The increase in our product cost of revenue for the year ended December 31, 2008, as compared to the prior year, was primarily due to higher volume demand for our sensor products, for which we must procure and provide the hardware platform to our customers.
 
The increases in our services cost of revenue for 2009 compared to 2008 and 2008 compared to 2007 were attributable to increased hardware service expense related to support renewal contracts and our hiring of additional personnel to both service our larger installed customer base and to provide training and professional services to our customers.


34


 

Gross profit.  The following table shows products and technical support and professional services gross profit (in thousands):
 
                                                                 
    Year Ended
          Year Ended
       
    December 31,     Variance     December 31,     Variance  
    2009     2008     $     %     2008     2007     $     %  
 
Products
  $ 46,944     $ 32,837     $ 14,107       43 %   $ 32,837     $ 24,809     $ 8,028       32 %
Product gross margin
    75 %     73 %                     73 %     72 %                
Technical support and professional services
    34,501       25,476       9,025       35 %     25,476       18,167       7,309       40 %
Technical support and professional services gross margin
    84 %     84 %                     84 %     84 %                
                                                                 
Total gross profit
  $ 81,445     $ 58,313     $ 23,132       40 %   $ 58,313     $ 42,976     $ 15,337       36 %
                                                                 
Total gross margin
    79 %     77 %                     77 %     77 %                
 
Product gross margin for the year ended December 31, 2009 increased compared to the prior year, as higher margins on product revenue, primarily due to the product mix sold favoring products with higher gross margins, were partially offset by a write-down of $1.4 million for excess and obsolete inventory as a result of the introduction of new products. Technical support and professional services gross margin for 2009, as compared to the prior year, remained flat.
 
Product gross margin and technical support and professional services gross margin remained relatively flat for 2008 compared to 2007.
 
Operating expenses.  The following table shows our operating expenses (in thousands):
 
                                                                 
    Year Ended
          Year Ended
       
    December 31,     Variance     December 31,     Variance  
    2009     2008     $     %     2008     2007     $     %  
 
Research and development
  $ 16,256     $ 12,620     $ 3,636       29 %   $ 12,620     $ 11,902     $ 718       6 %
Percentage of total revenue
    16 %     17 %                     17 %     22 %                
Sales and marketing
    36,498       33,169       3,329       10 %     33,169       25,860       7,309       28 %
Percentage of total revenue
    35 %     44 %                     44 %     46 %                
General and administrative
    16,761       18,713       (1,952 )     (10 )%     18,713       10,599       8,114       77 %
Percentage of total revenue
    16 %     25 %                     25 %     19 %                
Depreciation and amortization
    3,647       2,627       1,020       39 %     2,627       1,649       978       59 %
Percentage of total revenue
    4 %     3 %                     3 %     3 %                
In-process research and development
                      0 %           2,947       (2,947 )     (100 )%
Percentage of total revenue
    0 %     0 %                     0 %     5 %                
                                                                 
Total operating expenses
  $ 73,162     $ 67,129     $ 6,033       9 %   $ 67,129     $ 52,957     $ 14,172       27 %
                                                                 
Percentage of total revenue
    71 %     89 %                     89 %     95 %                
 
Research and development expenses for the year ended December 31, 2009 increased over the prior year, primarily due to an increase of $1.4 million in salaries, incentive compensation, benefits and allocated overhead costs as a result of additional personnel and increased overhead costs, an increase of $2.1 million in consulting and professional fees and an increase of $260,000 in stock-based compensation expense.
 
Research and development expenses for the year ended December 31, 2008 increased over the prior year, primarily due to an increase of $1.4 million in salaries, incentive compensation, benefits and allocated overhead costs as a result of the hiring of additional personnel and an increase in stock-based compensation expense of


35


 

$327,000, partially offset by a one-time expense of $1.0 million in 2007 in connection with the ClamAV acquisition for the completion of additional source code.
 
Sales and marketing expenses for the year ended December 31, 2009 increased over the prior year, primarily due to an increase of $2.7 million in salaries, commissions and incentive compensation, benefits and allocated overhead costs as a result of additional sales and marketing personnel, increased revenue and increased overhead costs, an increase of $608,000 in consulting fees and an increase of $531,000 in stock-based compensation expense, partially offset by a decrease of $199,000 in advertising, promotion, partner-marketing programs and trade show expenses and a decrease of $423,000 in travel and travel-related expenses.
 
Sales and marketing expenses for the year ended December 31, 2008 increased over the prior year, primarily due to an increase of $6.1 million in salaries, commissions and incentive compensation and benefit expenses as a result of additional sales and marketing personnel and increased revenue, an increase of $501,000 in travel and travel-related expenses, an increase of $412,000 in advertising, promotion, partner-marketing programs and trade show expenses in support of our network security solutions and an increase of $379,000 in stock-based compensation expense.
 
General and administrative expenses for the year ended December 31, 2009 decreased from the prior year, primarily due to a decrease of $2.7 million in professional fees related to legal, accounting, information technology, audit, tax services and regulatory compliance and corporate development expenses, a decrease of $449,000 for the one-time charge in 2008 from the acceleration of vesting of equity awards granted to our former CEO, a decrease of $339,000 in director attendance, retainer and other board-related fees and a decrease of $742,000 for a one-time charge in 2008 associated with our CEO transition, partially offset by an increase of $1.7 million in salaries, incentive compensation, benefits and allocated overhead costs for personnel hired in our accounting, information technology, human resources and legal departments and increased overhead costs, and an increase of $1.2 million in stock-based compensation expense, excluding the one-time charge taken in 2008 for accelerated vesting resulting from our CEO transition. The increase in stock-based compensation expense for 2009 included $193,000 in expense from the accelerated vesting of stock options due to the market price of our stock achieving specified levels in 2009. These stock options were issued in connection with the hiring of our CEO in 2008.
 
General and administrative expenses for the year ended December 31, 2008 increased over the prior year, primarily due to an increase of $2.9 million in corporate development expenses and professional fees related to legal, audit, tax services and regulatory compliance, an increase of $2.4 million in salaries, incentive compensation and benefit expenses for personnel hired in our executive, accounting, information technology, human resources and legal departments, an increase of $172,000 in director attendance, retainer and other board-related fees, one-time costs associated with our CEO transition of $742,000, stock-based compensation expense of $449,000 from the acceleration of vesting of equity awards granted to our former CEO and an additional increase of $633,000 in stock-based compensation expense for general and administrative personnel.
 
Depreciation and amortization expense for the year ended December 31, 2009 increased over the prior year, primarily due to the depreciation associated with our new enterprise resource planning, or ERP, system implemented in the second half of 2008, as well as the depreciation of additional lab and testing equipment purchased for our engineering department and computers purchased for new personnel. In the fourth quarter of 2009, we recorded an impairment charge of $349,000 to write off the carrying value of our marketing-related intangible assets related to the ClamAV acquisition.
 
Depreciation and amortization expense for the year ended December 31, 2008 increased over the prior year, primarily due to the depreciation of additional lab and testing equipment purchased for our engineering department and computers purchased for new personnel, as well as the depreciation associated with the newly implemented ERP system.
 
In-process research and development for the year ended December 31, 2007 was attributable to the August 2007 acquisition of certain assets of ClamAV for which technological feasibility had not yet been reached and no alternative future use existed.


36


 

Other income, net and provision for income taxes.  The following table shows our other income, net and provision for income taxes (in thousands):
 
                                                                 
    Year Ended
      Year Ended
   
    December 31,   Variance   December 31,   Variance
    2009   2008   $   %   2008   2007   $   %
 
Other income, net
  $ 926     $ 3,064     $ (2,138 )     (70 )%   $ 3,064     $ 4,604     $ (1,540 )     (33 )%
Percentage of total revenue
    1 %     4 %                     4 %     8 %                
Provision for income taxes
  $ 331       319     $ 12       4 %   $ 319     $ 244     $ 75       31 %
Percentage of total revenue
    0 %     0 %                     0 %     0 %                
 
The decreases in other income, net for 2009 compared to 2008 and 2008 compared to 2007 were attributable to a decrease in interest and investment income as a result of lower average interest rates on invested cash balances.
 
Our provision for income taxes for the year ended December 31, 2009 was $331,000, which resulted in an annual effective tax rate of 4%. Our effective tax rate differs from the U.S. federal statutory rate of 34% primarily due to the reversal of the valuation allowance on certain deferred tax assets, state income taxes and foreign income taxed at different rates. The provision for income taxes for the year ended December 31, 2009 consisted of $204,000 of U.S. income tax expense and $127,000 of foreign income tax expense. Our provision for income taxes for the year ended December 31, 2008 was $319,000, which resulted in an annual effective tax rate of (6)%. Our annual effective tax rate for the year ended December 31, 2008 differed from the U.S. federal statutory rate of 34% primarily due to the increase of the valuation allowance on certain deferred tax assets, state income taxes and the foreign income taxed at different rates. The provision for income taxes for the year ended December 31, 2008, consisted of approximately $46,000 of U.S. income tax expense and approximately $273,000 of foreign income tax expense.
 
We continue to assess the realizability of our deferred tax assets, which primarily consists of net operating loss, or NOL, carry-forwards, stock-based compensation expense and deferred revenue. In assessing the realizability of these deferred tax assets, management considers whether it is more likely than not that some portion or all of the deferred tax assets will be realized. As of December 31, 2009 and 2008, our deferred tax assets were fully reserved except for foreign deferred tax assets of $63,000 and $71,000, respectively, expected to be available to offset foreign tax liabilities in the future.
 
If our recent trend of profitability continues, we may determine that there is sufficient positive evidence to support a reversal of, or decrease in, the valuation allowance. If we were to reverse all or some part of our valuation allowance and recognize all or part of our deferred tax assets, we would likely record an increase in assets on our consolidated balance sheet in the period of reversal and a corresponding tax benefit in our consolidated statement of operations for the amount of the reversal. Such amounts could be material to our financial statements.
 
Seasonality
 
Our product revenue has tended to be seasonal, with a significant portion generated in the third and fourth quarters. Revenue from our government customers has been influenced by the September 30th fiscal year-end of the U.S. federal government, which has historically resulted in our revenue from government customers being highest in the second half of the year. In the fourth quarter, revenues have historically been strong due to purchases by North American enterprise customers, who operate on a calendar year budget and often wait until the fourth quarter to make their most significant capital equipment purchases. In addition, increased fourth quarter sales in Europe have historically resulted in higher fourth quarter revenues following a decline in sales in the summer months due to vacation practices in Europe and the resulting delay in capital purchase activities until the fall. While we expect these historical trends to continue, they could be affected by a number of factors, including another decline in general economic conditions, changes in the timing or amounts of U.S. government spending, and our planned international expansion. The timing of transactions could materially affect our quarterly or annual product revenue.
 
Quarterly Timing
 
On a quarterly basis, we have usually generated the majority of our sales in the final month of the quarter. We believe this occurs for two reasons. First, many customers wait until the end of the quarter to extract favorable


37


 

pricing terms from their vendors, including Sourcefire. Second, our sales personnel, who have a strong incentive to meet quarterly sales targets, have tended to increase their sales activity as the end of a quarter nears, while their participation in sales management review and planning activities is typically scheduled at the beginning of a quarter. The timing of our quarter-end and year-end shipments also affects our quarterly and annual product revenue, since we typically recognize revenue upon shipment of the product.
 
Non-GAAP Financial Measures
 
In evaluating the operating performance of our business, we exclude certain charges and credits that are required by GAAP. We believe these non-GAAP results provide useful information to us and investors by excluding (i) stock-based compensation, which does not involve the expenditure of cash, and (ii) items that we believe may not be indicative of our operating performance, because either they are unusual and we do not expect them to recur in the ordinary course of our business or they are unrelated to the ongoing operation of the business in the ordinary course. These measures should be considered in addition to results prepared in accordance with GAAP, but should not be considered a substitute for, or superior to, GAAP results.
 
The following table shows a reconciliation of GAAP to our non-GAAP financial measures (in thousands):
 
                         
    Year Ended December 31,  
    2009     2008     2007  
 
Reconciliation to adjusted net income (loss):
                       
GAAP Net income (loss)
  $ 8,878     $ (6,071 )   $ (5,621 )
Stock-based compensation expense
    6,171       4,037       2,646  
Stock-based compensation expense related to CEO transition
          449        
CEO transition costs
          742        
Expenses related to ClamAV acquisition
                1,042  
In-process research and development
                2,947  
                         
Adjusted net income (loss)
  $ 15,049     $ (843 )   $ 1,014  
                         
Adjusted net income (loss) per share — basic
  $ 0.57     $ (0.03 )   $ 0.05  
Adjusted net income (loss) per share — diluted
    0.54       (0.03 )     0.04  
                         
Weighted average number of shares — basic
    26,458,273       25,379,791       20,434,792  
Weighted average number of shares — diluted
    27,987,115       25,379,791       22,553,430  
                         
 
Liquidity and Capital Resources
 
Cash Flows
 
The following table summarizes our cash flow activities for the periods indicated (in thousands):
 
                         
    Year Ended December 31,  
    2009     2008     2007  
 
Cash and cash equivalents:
                       
Provided by (used in) operating activities
  $ 20,159     $ (1,140 )   $ 2,928  
(Used in) provided by investing activities
    (11,504 )     6,855       (66,934 )
Provided by financing activities
    4,648       982       84,048  
                         
Increase
    13,303       6,697       20,042  
Net cash at beginning of period
    39,768       33,071       13,029  
                         
Net cash at end of period
    53,071       39,768       33,071  
Investments
    70,149       61,800       73,956  
                         
Total cash, cash equivalents and investments
  $ 123,220     $ 101,568     $ 107,027  
                         


38


 

Operating Activities.  Cash provided by operating activities for the year ended December 31, 2009 is the result of our net income of $8.9 million adjusted for a net cash inflow of $9.8 million for net non-cash revenues and expenses and a net cash inflow of $1.5 million for changes in our operating assets and liabilities. Cash used in operating activities for the year ended December 31, 2008 is the result of our net loss of $6.1 million adjusted for a net cash inflow of $6.1 million for net non-cash revenues and expenses and a net cash outflow of $1.2 million for changes in our operating assets and liabilities. Cash provided by operating activities for the year ended December 31, 2007 is the result of our net loss of $5.6 million adjusted for a net cash inflow of $5.7 million for net non-cash revenues and expenses and a net cash inflow of $2.8 million for changes in our operating assets and liabilities.
 
Investing Activities.  Cash used in investing activities for the year ended December 31, 2009 was primarily the result of purchases of investments of $87.9 million and capital expenditures of $2.5 million, offset by maturities of investments of $78.9 million. Cash provided by investing activities for the year ended December 31, 2008 was primarily the result of maturities and sales of investments of $108.0 million, offset by purchases of investments of $94.5 million and capital expenditures of $6.7 million. Capital expenditures in 2008 included $3.2 million of capitalized costs associated with the implementation of our ERP system. Cash used in investing activities for the year ended December 31, 2007 was primarily the result of purchases of investments of $125.2 million, $4.6 million related to our acquisition of ClamAV and capital expenditures of $3.1 million, offset by maturities of investments of $65.9 million.
 
Financing Activities.  Cash provided by financing activities for the years ended December 31, 2009 and 2008 was primarily the result of proceeds from the issuance of common stock under our employee stock-based plans. Net cash provided by financing activities of $84.0 million for the year ended December 31, 2007 was primarily comprised of $84.9 million of net cash proceeds of our IPO, offset by a $1.4 million debt repayment.
 
Liquidity Requirements
 
We manufacture our products through contract manufacturers and other third parties. This approach provides us with the advantage of relatively low capital expenditure requirements and significant flexibility in scheduling production and managing inventory levels. The majority of our products are delivered to our customers directly from our contract manufacturers. Accordingly, our contract manufacturers are responsible for purchasing and stocking the components required to produce our products, and they invoice us when the finished goods are shipped. By leasing our office facilities, we also minimize the cash needed for expansion. Our capital spending is generally limited to leasehold improvements, computers, office furniture and lab and test equipment.
 
Our short-term liquidity requirements through December 31, 2010 consist primarily of the funding of working capital requirements and capital expenditures. We expect to meet these short-term requirements primarily through cash flow from operations. To the extent that cash flow from operations is not sufficient to meet these requirements, we expect to fund these amounts through the use of existing cash and investment resources. As of December 31, 2009, we had cash, cash equivalents and investments of $123.2 million and working capital of $103.1 million.
 
As described above, our product sales are, and are expected to continue to be, highly seasonal. We believe that our current cash reserves are sufficient for any short-term needs arising from the seasonality of our business.
 
Our long-term liquidity requirements consist primarily of obligations under our operating leases. We expect to meet these long-term requirements primarily through cash flow from operations.
 
In addition, we may utilize existing cash resources, equity financing or debt financing to fund acquisitions or investments in complementary businesses, technologies or product lines.


39


 

Contractual Obligations
 
The following table describes our commitments to settle contractual obligations in cash as of December 31, 2009 (in thousands):
 
                                 
    Payments Due by Period
        Less than
       
    Total   One Year   1-3 Years   3-5 Years
 
Capital lease obligations
  $ 4     $ 3     $ 1     $  
Operating lease obligations
    5,329       1,472       2,702       1,155  
Purchase commitments(1)
    4,842       4,842              
 
 
(1) We purchase components from a variety of suppliers and use contract manufacturers to provide manufacturing services for our products. During the normal course of business, in order to manage manufacturing lead times and help ensure adequate component supply, we enter into agreements with contract manufacturers and suppliers that allow them to procure inventory based upon information provided by us. In certain instances, these agreements allow us the option to cancel, reschedule, and adjust our requirements based on our business needs prior to firm orders being placed. Consequently, a portion of our reported purchase commitments arising from these agreements are firm, non-cancelable and unconditional commitments. As of December 31, 2009, we had total purchase commitments for inventory of approximately $4.8 million.
 
Critical Accounting Policies and Estimates
 
Our consolidated financial statements are prepared in accordance with accounting principles generally accepted in the United States of America. The preparation of these consolidated financial statements requires us to make estimates and assumptions that affect the reported amounts of assets, liabilities, revenue, costs and expenses and related disclosures. We evaluate our estimates and assumptions on an ongoing basis. Our actual results may differ from these estimates.
 
We believe that, of our significant accounting policies, which are described in Note 2 to the consolidated financial statements contained in this report, the following accounting policies involve a greater degree of judgment and complexity. Accordingly, we believe that the following accounting policies are the most critical to aid in fully understanding and evaluating our consolidated financial condition and results of operations.
 
Revenue Recognition.  We derive revenue from arrangements that include products with embedded software, software licenses and royalties, technical support, and professional services. Revenue from products in the accompanying consolidated statements of operations consists primarily of sales of software-based appliances, but also includes fees and royalties for the license of our technology in a software-only format and subscriptions to receive rules released by the VRT that are used to update the appliances for current exploits and vulnerabilities. Technical support, which generally has a contractual term of 12 months, includes telephone and web-based support, software updates, and rights to software upgrades on a when-and-if-available basis. Professional services include training and consulting.
 
For each arrangement, we recognize revenue when: (a) persuasive evidence of an arrangement exists (e.g., a signed contract); (b) delivery of the product has occurred and there are no remaining obligations or substantive customer acceptance provisions; (c) the fee is fixed or determinable; and (d) collection of the fee is deemed probable.
 
We allocate the total arrangement fee among each deliverable based on the fair value of each of the deliverables, determined based on vendor-specific objective evidence. If vendor-specific objective evidence of fair value does not exist for each of the deliverables, all revenue from the arrangement is deferred until the earlier of the point at which sufficient vendor-specific objective evidence of fair value can be determined for any undelivered elements or all elements of the arrangement have been delivered. If the only undelivered elements are elements for which we currently have vendor-specific objective evidence of fair value, we recognize revenue for the delivered elements based on the residual method.


40


 

We have established vendor-specific objective evidence of fair value for our technical support based upon actual renewals of each type of technical support that is offered and for each customer class. Technical support and technical support renewals are currently priced based on a percentage of the list price of the respective product or software and historically have not varied from a narrow range of values in the substantial majority of our arrangements. Revenue related to technical support is deferred and recognized ratably over the contractual period of the technical support arrangement, which is generally 12 months. The vendor-specific objective evidence of fair value of our other services is based on the price for these same services when they are sold separately. Revenue for professional services that are sold either on a stand-alone basis or included in multiple element arrangements is deferred and recognized as the services are performed.
 
All amounts billed or received in excess of the revenue recognized are included in deferred revenue. In addition, we defer all direct costs associated with revenue that has been deferred. These amounts are included in either prepaid expenses and other current assets or inventory in the accompanying balance sheets, depending on the nature of the costs and the reason for the deferral.
 
For sales through resellers and distributors, we recognize revenue upon the shipment of the product only if those resellers and distributors provide us, at the time of placing their order, with the identity of the end-user customer to whom the product has been sold. To the extent that a reseller or distributor requests an inventory or stock of products, we defer revenue on that product until we receive notification that it has been sold through to an identified end-user.
 
Changes in our judgments and estimates about these assumptions could materially impact the timing of our revenue recognition.
 
Accounting for Stock-Based Compensation.  Stock-based awards granted include stock options, restricted stock awards, restricted stock units and stock purchased under our Amended and Restated 2007 Employee Stock Purchase Plan, or ESPP. Stock-based compensation expense is measured at the grant date, based on the fair value of the awards, and is recognized as expense over the requisite service period, net of estimated forfeitures.
 
We use the Black-Scholes option pricing model for estimating the fair value of stock options granted and for employee stock purchases under our ESPP. For a prior award that contained a market condition relating to our stock price achieving specified levels, we used a Lattice option pricing model. The use of option valuation models requires the input of highly subjective assumptions, including the expected term and the expected price volatility. Additionally, the recognition of expense requires the estimation of the number of options that will ultimately vest and the number of options that will ultimately be forfeited. The fair value of stock-based awards is recognized as expense over the requisite service period, net of estimated forfeitures. We rely on historical experience of employee turnover to estimate our expected forfeitures.
 
Average risk-free interest rate — This is the average U.S. Treasury rate, with a term that most closely resembles the expected life of the option, as of the grant date.
 
Expected dividend yield — We use an expected dividend yield of zero, as we have never declared or paid dividends on our common stock and do not anticipate paying dividends in the foreseeable future.
 
Expected life — This is the period of time that the stock options granted under our equity incentive plans and employee purchases under the ESPP are expected to remain outstanding.
 
We have elected to use the simplified method of determining the expected term of stock options. This estimate is derived from the average midpoint between the weighted-average vesting period and the contractual term. In future periods, we expect to begin to incorporate our own data in estimating the expected life as we develop appropriate historical experience of employee exercise and post-vesting termination behavior considered in relation to the contractual life of the option.
 
For purchases under the ESPP, the expected life is the plan period.


41


 

Expected volatility — Volatility is a measure of the amount by which a financial variable such as a share price has fluctuated (historical volatility) or is expected to fluctuate (expected volatility) during a period.
 
Given our limited historical stock data from our IPO in March 2007, we have used a blended volatility to estimate expected volatility. The blended volatility includes a weighting of our historical volatility from the date of our IPO to the respective grant date and an average of our peer group historical volatility consistent with the expected life of the option. Our peer group historical volatility includes the historical volatility of companies that are similar in revenue size, in the same industry or are competitors. We expect to continue to use a larger proportion of our historical volatility in future periods as we develop additional historical experience of our own stock price fluctuations considered in relation to the expected life of the option.
 
For purchases under the ESPP, we use our historical volatility since we have historical data available since our IPO, which is consistent with the expected life.
 
If we were to employ different assumptions for estimating stock-based compensation expense in future periods, or if we were to decide to use a different valuation model, the amount of expense recorded in future periods could differ significantly from what we have recorded in recent periods.
 
The Black-Scholes option pricing model was developed for use in estimating the fair value of traded options that have no vesting restrictions and are fully transferable, which are characteristics that are not present in our option grants. Existing valuation models, including the Black-Scholes and Lattice models, may not provide reliable measures of the fair values of our stock-based compensation awards. Consequently, there is a risk that our estimates of the fair values of our stock-based compensation awards on the grant dates may be significantly different than the actual values upon the exercise, expiration, early termination or forfeiture of those stock-based payments in the future. Certain stock-based payments, such as employee stock options, may expire worthless or otherwise result in zero intrinsic value as compared to the fair values originally estimated on the grant date and reported in our financial statements. Alternatively, values may be realized from these instruments that are significantly higher than the fair values originally estimated on the grant date and reported in our financial statements.
 
The application of these principles may be subject to further interpretation and refinement over time. There are significant differences among valuation models, and there is a possibility that we will adopt different valuation models in the future. This may result in a lack of consistency between past and future periods and materially affect the fair value estimate of stock-based payments. It may also result in a lack of comparability with other companies that use different models, methods, and assumptions.
 
Accounting for Income Taxes.  We account for income taxes using the liability method, which requires the recognition of deferred tax assets or liabilities for the temporary differences between financial reporting and tax bases of our assets and liabilities and for tax carry-forwards at enacted statutory tax rates in effect for the years in which the differences are expected to reverse.
 
We continue to assess the realizability of our deferred tax assets, which primarily consists of net operating loss, or NOL, carry-forwards, stock-based compensation expense and deferred revenue. In assessing the realizability of these deferred tax assets, management considers whether it is more likely than not that some portion or all of the deferred tax assets will be realized. As of December 31, 2009 and 2008, our deferred tax assets were fully reserved except for foreign deferred tax assets of $63,000 and $71,000, respectively, expected to be available to offset foreign tax liabilities in the future. Our provision for income taxes for the year ended December 31, 2009 consists principally of U.S. state and foreign income tax expense. Our provision for income taxes for the year ended December 31, 2008 consists principally of foreign income tax expense.
 
If our recent trend of profitability continues, we may determine that there is sufficient positive evidence to support a reversal of, or decrease in, the valuation allowance. If we were to reverse all or some part of our valuation allowance and recognize all or part of our deferred tax assets, we would likely record an increase in assets on our consolidated balance sheet in the period of reversal and a corresponding tax benefit in our consolidated statement of operations for the amount of the reversal. Such amounts could be material to our financial statements.


42


 

With respect to foreign earnings, it is our policy to invest the earnings of foreign subsidiaries indefinitely outside the U.S. With respect to stock-based compensation expense, the benefit of the deferred tax asset is being recognized as the related stock options are exercised. The excess tax benefit from the exercise of stock options is recorded in additional paid-in-capital in the consolidated balance sheets to the extent that cash taxes payable are reduced.
 
We have determined that there are no material uncertain tax positions that would require a reserve as of December 31, 2009.
 
Because tax laws are complex and subject to different interpretations, significant judgment is required. As a result, we make certain estimates and assumptions in (i) calculating our provision for income taxes, deferred tax assets and deferred tax liabilities, (ii) determining any valuation allowance recorded against deferred tax assets and (iii) evaluating the amount of unrecognized tax benefits, if any, as well as the interest and penalties related to such uncertain tax positions. Our estimates and assumptions may differ significantly from tax benefits ultimately realized.
 
Allowance for Doubtful Accounts and Sales Return Allowance.  We make estimates regarding the collectability of our accounts receivable. When we evaluate the adequacy of our allowance for doubtful accounts, we consider multiple factors, including historical write-off experience, the need for specific customer reserves, the aging of our receivables, customer creditworthiness and changes in customer payment cycles. Historically, our allowance for doubtful accounts has been adequate based on actual results. If any of the factors used to calculate the allowance for doubtful accounts change or if the allowance does not reflect our future ability to collect outstanding receivables, additional provisions for doubtful accounts may be needed, and our future results of operations could be materially affected. As of December 31, 2009 and 2008, the allowance for doubtful accounts was $777,000 and $538,000, respectively.
 
We also use our judgment to make estimates regarding potential future product returns related to reported product revenue in each period. We analyze factors such as our historical return experience, current product sales volumes, and changes in product warranty claims when evaluating the adequacy of the sales returns allowance. If any of the factors used to calculate the sales return allowance were to change, we may experience a material difference in the amount and timing of our product revenue for any given period. As of December 31, 2009, the sales return allowance was $380,000. There was no sales return allowance as of December 31, 2008.
 
Inventories.  Inventories consist of hardware and related component parts and are stated at the lower of cost on a first-in, first-out basis, or market, except for evaluation and advance replacement units, which are stated at the lower of cost, on a specific identification basis, or market. Evaluation units are used for customer testing and evaluation and are predominantly located at the customers’ premises. Advance replacement units, which include replacement units and spare parts, are used to provide replacement units under technical support arrangements if a customer’s unit is not functioning. In prior periods, advance replacement units were included in other assets and depreciated using the straight-line method. In the third quarter of 2009, we reclassified these assets to inventory to better reflect the nature of the assets. We make estimates of forecasted demand for our products, and inventory that is obsolete or in excess of our estimated demand is written down to its estimated net realizable value based on historical usage, expected demand, the timing of new product introductions and age. It is reasonably possible that our estimate of future demand for our products could change in the near term and result in additional inventory write-downs, which would negatively impact our gross margin.
 
Inventory write-downs, mostly related to evaluation units and excess and obsolete inventory, are reflected as cost of revenue and amounted to approximately $2.4 million, $1.0 million and $363,000 for the years ended December 31, 2009, 2008 and 2007, respectively.
 
Investments.  We determine the appropriate classification of our investments at the time of purchase and reevaluate such classification as of each balance sheet date. Our investments are comprised of money market funds, corporate debt investments, commercial paper, government-sponsored enterprise securities, government securities and certificates of deposit. These investments have been classified as available-for-sale. Available-for-sale investments are stated at fair value, with the unrealized gains and losses, net of tax, reported in accumulated other comprehensive income. The amortization of premiums and accretion of discounts to maturity are computed


43


 

using the effective interest method. Amortization is included in interest and investment income. Interest on securities classified as available-for-sale is also included in interest and investment income.
 
We evaluate our investments on a regular basis to determine whether an other-than-temporary decline in fair value has occurred. If an investment is in an unrealized loss position and we have the intent to sell the investment, or it is more likely than not that we will have to sell the investment before recovery of its amortized cost basis, the decline in value is deemed to be other-than-temporary and is charged against earnings for the period. For investments that we do not intend to sell or it is more likely than not that we will not have to sell the investment, but we expect that we will not fully recover the amortized cost basis, the credit component of the other-than-temporary impairment is charged against earnings for the applicable period and the non-credit component of the other-than-temporary impairment is recognized in other comprehensive income on our statement of stockholders’ equity. Unrealized losses entirely caused by non-credit related factors related to investments for which we expect to fully recover the amortized cost basis are recorded in accumulated other comprehensive income.
 
Recent Accounting Pronouncements
 
In April 2009, the FASB issued new accounting guidance requiring disclosures about the fair value of financial instruments during interim reporting periods. This guidance is effective for interim and annual periods ended after June 15, 2009. The adoption of this guidance did not have a material impact on our consolidated financial statements.
 
In April 2009, the FASB issued guidance related to the recognition and presentation of other-than-temporary impairments. This guidance amends the other-than-temporary impairment guidance for debt securities to make the guidance more operational and to improve the presentation and disclosure of other-than-temporary impairments on debt and equity securities. This guidance is effective for interim and annual periods ended after June 15, 2009. The adoption of this guidance did not have a material impact on our consolidated financial statements.
 
In April 2009, the FASB issued guidance for determining fair value of an asset or liability when the volume and level of activity for the asset or liability have significantly decreased and for identifying transactions that are not orderly. This guidance is effective for interim and annual periods ended after June 15, 2009. The adoption of this guidance did not have a material impact on our consolidated financial statements.
 
In May 2009, the FASB issued guidance related to subsequent events. This guidance is intended to establish general standards of accounting for and disclosure of events that occur after the balance sheet date but before financial statements are issued or are available to be issued. This guidance is effective for fiscal years and interim periods ended after June 15, 2009. The adoption of this guidance did not have a material impact on our consolidated financial statements.
 
In June 2009, the FASB established the FASB Accounting Standards Codification as the single source of authoritative U.S. GAAP to be applied by nongovernmental entities. This guidance is effective for financial statements issued for interim and annual periods ended after September 15, 2009. The adoption of this guidance, while it impacts the way we refer to accounting pronouncements in our disclosures, did not have an effect on our consolidated financial statements.
 
In October 2009, the FASB clarified the accounting guidance for sales of tangible products containing both software and hardware elements and issued new guidance that amends the criteria for evaluating the individual items in a multiple deliverable revenue arrangement and how to allocate the consideration received to the individual items. The guidance is effective for revenue arrangements entered into or materially modified in fiscal years beginning on or after June 15, 2010, with early adoption permitted. We believe this literature is applicable to our revenue arrangements. However, we are currently evaluating the impact this guidance will have on our consolidated financial statements.
 
Off-Balance Sheet Arrangements
 
We have no off-balance sheet arrangements.


44


 

Item 7A.   QUANTITATIVE AND QUALITATIVE DISCLOSURES ABOUT MARKET RISK
 
Foreign Currency Risk
 
Nearly all of our revenue is derived from transactions denominated in U.S. dollars, even though we maintain sales and business operations in foreign countries. As such, we have exposure to adverse changes in exchange rates, particularly the Euro, British Pound and Japanese Yen, associated with operating expenses of, and cash held in, our foreign operations. However, we believe this exposure is immaterial at this time. As we grow our international operations, our exposure to foreign currency risk could become more significant. We do not currently engage in currency hedging activities to limit the risk of exchange rate fluctuations.
 
Interest Rate Sensitivity
 
We had cash, cash equivalents and investments totaling approximately $123.2 million at December 31, 2009. The cash equivalents are held for working capital purposes while investments, made in accordance with our low-risk investment policy, take advantage of higher interest income yields. In accordance with our investment policy, we do not enter into investments for trading or speculative purposes. Some of the securities in which we invest, however, may be subject to market risk. This means that a change in prevailing interest rates may cause the fair value of the investment to fluctuate. To minimize this risk in the future, we intend to maintain our portfolio of cash equivalents, short- and long-term investments in a variety of securities, including commercial paper, money market funds, debt securities and certificates of deposit. Due to the nature of these investments, we believe that we do not have any material exposure to changes in the fair value of our investment portfolio as a result of changes in interest rates.
 
Credit Market Risk
 
We invest our cash in accordance with an established internal policy and our investments are comprised of money market funds, corporate debt investments, commercial paper, government-sponsored enterprise securities, government securities and certificates of deposit, that historically have been highly liquid and have matured at their full par values. Therefore, we believe our credit market risk to be immaterial at this time. However, as a result of the recent adverse conditions in the global credit markets, there is a risk that we may incur other-than-temporary impairment charges with respect to our investments.
 
Item 8.   FINANCIAL STATEMENTS AND SUPPLEMENTARY DATA
 
Our consolidated financial statements are submitted on pages F-1 through F-23 of this report.
 
Item 9.   CHANGES IN AND DISAGREEMENTS WITH ACCOUNTANTS ON ACCOUNTING AND FINANCIAL DISCLOSURES
 
None.
 
Item 9A.   CONTROLS AND PROCEDURES
 
Evaluation of Disclosure Controls and Procedures.  We maintain “disclosure controls and procedures,” as defined in Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934, as amended (the “Exchange Act”), which are controls and other procedures that are designed to ensure that information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is recorded, processed, summarized and reported, within the time periods specified in the SEC’s rules and forms. Disclosure controls and procedures include, without limitation, controls and procedures designed to ensure that information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is accumulated and communicated to the company’s management, including its principal executive and principal financial officers, as appropriate to allow timely decisions regarding required disclosure. Management recognizes that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving their objectives and management necessarily applies its judgment in evaluating the cost-benefit relationship of possible controls and procedures. In addition, the design of any system of controls also is based in part upon certain assumptions about the likelihood of future events, and there can be no assurance that any design will succeed in achieving its


45


 

stated goals under all potential future conditions; over time, controls may become inadequate because of changes in conditions, or the degree of compliance with policies or procedures may deteriorate. Because of the inherent limitations in a control system, misstatements due to error or fraud may occur and not be detected.
 
Under the supervision and with the participation of our management, including our Chief Executive Officer and Chief Financial Officer, we evaluated the effectiveness of the design and operation of our disclosure controls and procedures as of the end of the period covered by this report. Based on this evaluation, our Chief Executive Officer and Chief Financial Officer have concluded that, as of December 31, 2009, our disclosure controls and procedures were effective at the reasonable assurance level.
 
Changes in Internal Control Over Financial Reporting.  No change in our internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act) occurred during the fiscal quarter ended December 31, 2009 that has materially affected, or is reasonably likely to materially affect, our internal control over financial reporting.
 
Management’s Report on Internal Control Over Financial Reporting
 
Our management is responsible for establishing and maintaining adequate internal control over financial reporting, as such term is defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act. Internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with U.S. generally accepted accounting principles. A company’s internal control over financial reporting includes those policies and procedures that (i) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (ii) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (iii) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company’s assets that could have a material effect on our consolidated financial statements.
 
There are inherent limitations in the effectiveness of any internal control over financial reporting, including the possibility of human error and the circumvention or overriding of controls. Accordingly, even effective internal control over financial reporting can provide only reasonable assurance with respect to financial statement preparation and may not prevent or detect all misstatements. Further, because of changes in conditions, effectiveness of internal control over financial reporting may vary over time. Our internal control system was designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with U.S. generally accepted accounting principles.
 
Under the supervision and with the participation of our management, including our Chief Executive Officer and Chief Financial Officer, we conducted an evaluation of the effectiveness of our internal control over financial reporting based on the framework in Internal Control — Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (the COSO criteria). Based on this evaluation, our management concluded that our internal control over financial reporting was effective as of December 31, 2009 to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with U.S. generally accepted accounting principles.
 
The effectiveness of our internal control over financial reporting as of December 31, 2009 has been audited by Ernst & Young LLP, independent registered public accounting firm, as stated in their report which is included herein.


46


 

Report of Independent Registered Public Accounting Firm on
Internal Control Over Financial Reporting
 
The Board of Directors and Stockholders of Sourcefire, Inc.:
 
We have audited Sourcefire, Inc. and subsidiaries’ internal control over financial reporting as of December 31, 2009, based on criteria established in Internal Control — Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (the COSO criteria). Sourcefire, Inc. and subsidiaries’ management is responsible for maintaining effective internal control over financial reporting, and for its assessment of the effectiveness of internal control over financial reporting included in the accompanying Management’s Report on Internal Control Over Financial Reporting. Our responsibility is to express an opinion on the company’s internal control over financial reporting based on our audit.
 
We conducted our audit in accordance with the standards of the Public Company Accounting Oversight Board (United States). Those standards require that we plan and perform the audit to obtain reasonable assurance about whether effective internal control over financial reporting was maintained in all material respects. Our audit included obtaining an understanding of internal control over financial reporting, assessing the risk that a material weakness exists, testing and evaluating the design and operating effectiveness of internal control based on the assessed risk, and performing such other procedures as we considered necessary in the circumstances. We believe that our audit provides a reasonable basis for our opinion.
 
A company’s internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. A company’s internal control over financial reporting includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of the company’s assets that could have a material effect on the financial statements.
 
Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.
 
In our opinion, Sourcefire, Inc. and subsidiaries maintained, in all material respects, effective internal control over financial reporting as of December 31, 2009, based on the COSO criteria.
 
We also have audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States), the consolidated balance sheets of Sourcefire, Inc. and subsidiaries as of December 31, 2009 and 2008, and the related consolidated statements of operations, changes in convertible preferred stock and stockholders’ equity, and cash flows for each of the three years in the period ended December 31, 2009 of Sourcefire, Inc., and our report dated March 12, 2010 expressed an unqualified opinion thereon.
 
/s/  Ernst & Young LLP
 
Baltimore, Maryland
March 12, 2010


47


 

 
Item 9B.   OTHER INFORMATION
 
On March 10, 2010, we entered into a Manufacturing and Supply Agreement with Premio, Inc. Under this agreement, Premio will serve as a non-exclusive contract manufacturer pursuant to which it will (i) purchase component parts on our behalf, (ii) manufacture, assemble and test our products and (iii) package, ship and deliver the products it manufactures to our customers. This agreement expires on March 10, 2013.
 
The foregoing description of the Manufacturing and Supply Agreement is not complete and is qualified in its entirety by reference to the agreement, which is filed as Exhibit 10.22 to this annual report.
 
PART III
 
Item 10.   DIRECTORS, EXECUTIVE OFFICERS AND CORPORATE GOVERNANCE
 
The information required by this item will be set forth under the headings “Election of Directors,” “Information Regarding the Board of Directors and Corporate Governance,” “Executive Officers” and “Section 16(a) Beneficial Ownership Reporting Compliance” in the definitive Proxy Statement for our 2010 Annual Meeting of Stockholders (the “Proxy Statement”) and is incorporated into this report by reference.
 
Item 11.   EXECUTIVE COMPENSATION
 
The information required by this item will be set forth under the heading “Executive Compensation” in the Proxy Statement and is incorporated into this report by reference.
 
Item 12.   SECURITY OWNERSHIP OF CERTAIN BENEFICIAL OWNERS AND MANAGEMENT AND RELATED STOCKHOLDER MATTERS
 
The information required by this item will be set forth under the headings “Security Ownership of Certain Beneficial Owners and Management” and “Equity Compensation Plan Information” in the Proxy Statement and is incorporated into this report by reference.
 
Item 13.   CERTAIN RELATIONSHIPS AND RELATED TRANSACTIONS, AND DIRECTOR INDEPENDENCE
 
The information required by this item will be set forth under the headings “Certain Relationships and Related Transactions” and “Information Regarding the Board of Directors and Corporate Governance — Independence of the Board of Directors” in the Proxy Statement and is incorporated into this report by reference.
 
Item 14.   PRINCIPAL ACCOUNTANT FEES AND SERVICES
 
The information required by this item will be set forth under the heading “Ratification of Selection of Independent Auditors” in the Proxy Statement and is incorporated into this report by reference.
 
PART IV
 
Item 15.   EXHIBITS AND FINANCIAL STATEMENT SCHEDULES
 
(a)
 
(1) Financial Statements.
 
The list of consolidated financial statements and schedules set forth in the accompanying Index to Consolidated Financial Statements at page F-1 of this annual report is incorporated herein by reference. Such consolidated financial statements and schedules are filed as part of this annual report.
 
(3) Exhibits.
 
The exhibits listed on the accompanying Exhibit Index are filed or incorporated by reference as part of this annual report and such Exhibit Index is incorporated herein by reference. Exhibits 10.2-10.19 listed on the accompanying Exhibit Index identify management contracts or compensatory plans or arrangements required to be filed as exhibits to this annual report, and such listing is incorporated herein by reference.


48


 

 
SIGNATURES
 
Pursuant to the requirements of Section 13 or 15(d) of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned, thereunto duly authorized, on March 12, 2010.
 
SOURCEFIRE, INC.
 
By:
/s/  John C. Burris
John C. Burris
Chief Executive Officer
 
Pursuant to the requirements of the Securities Exchange Act of 1934, this report has been signed below by the following persons on behalf of the registrant and in the capacities and on the dates indicated. Each person whose signature appears below constitutes and appoints Todd P. Headley and Douglas W. McNitt, and each of them, as attorneys-in-fact, each with the power of substitution, for him in any and all capacities, to sign any amendment to this Annual Report on Form 10-K and to file the same, with exhibits thereto and other documents in connection therewith, with the Commission, granting to said attorneys-in-fact, full power and authority to do and perform each and every act and thing requisite and necessary to be done in connection therewith, as fully to all intents and purposes as he might or could do in person, hereby ratifying and confirming all that the said attorney-in-fact, or his substitute or substitutes, may lawfully do or cause to be done by virtue hereof.
 
             
Signature
 
Title
 
Date
 
         
/s/  John C. Burris

John C. Burris
  Chief Executive Officer and Director (principal executive officer)   March 12, 2010
         
/s/  Todd P. Headley

Todd P. Headley
  Chief Financial Officer and Treasurer (principal financial and accounting officer)   March 12, 2010
         
/s/  Martin F. Roesch

Martin F. Roesch
  Chief Technology Officer and Director   March 12, 2010
         
/s/  John C. Becker

John C. Becker
  Director   March 12, 2010
         
/s/  Michael Cristinziano

Michael Cristinziano
  Director   March 12, 2010
         
/s/  Tim A. Guleri

Tim A. Guleri
  Director   March 12, 2010
         
/s/  Steven R. Polk

Steven R. Polk
  Director   March 12, 2010


49


 

INDEX TO CONSOLIDATED FINANCIAL STATEMENTS
 
         
    Page
 
Report of Independent Registered Public Accounting Firm
    F-2  
Consolidated Balance Sheets at December 31, 2009 and 2008
    F-3  
Consolidated Statements of Operations for the years ended December 31, 2009, 2008 and 2007
    F-4  
Consolidated Statements of Changes in Convertible Preferred Stock and Stockholders’ Equity for the years ended December 31, 2009, 2008 and 2007
    F-5  
Consolidated Statements of Cash Flows for the years ended December 31, 2009, 2008 and 2007
    F-6  
Notes to Consolidated Financial Statements
    F-7  


F-1


 

 
REPORT OF INDEPENDENT REGISTERED PUBLIC ACCOUNTING FIRM
 
The Board of Directors and Stockholders of Sourcefire, Inc.
 
We have audited the accompanying consolidated balance sheets of Sourcefire, Inc. and subsidiaries as of December 31, 2009 and 2008, and the related consolidated statements of operations, changes in convertible preferred stock and stockholders’ equity, and cash flows for each of the three years in the period ended December 31, 2009. These financial statements are the responsibility of the Company’s management. Our responsibility is to express an opinion on these financial statements based on our audits.
 
We conducted our audits in accordance with the standards of the Public Company Accounting Oversight Board (United States). Those standards require that we plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement. An audit includes examining, on a test basis, evidence supporting the amounts and disclosures in the financial statements. An audit also includes assessing the accounting principles used and significant estimates made by management, as well as evaluating the overall financial statement presentation. We believe that our audits provide a reasonable basis for our opinion.
 
In our opinion, the financial statements referred to above present fairly, in all material respects, the consolidated financial position of Sourcefire, Inc. and subsidiaries at December 31, 2009 and 2008, and the consolidated results of their operations and their cash flows for each of the three years in the period ended December 31, 2009, in conformity with U.S. generally accepted accounting principles.
 
We also have audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States), Sourcefire, Inc.’s internal control over financial reporting as of December 31, 2009, based on criteria established in Internal Control-Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission and our report dated March 12, 2010 expressed an unqualified opinion thereon.
 
/s/  Ernst & Young LLP
 
Baltimore, Maryland
March 12, 2010


F-2


 

SOURCEFIRE, INC.
 
CONSOLIDATED BALANCE SHEETS
 
                 
    December 31,
    December 31,
 
    2009     2008  
    (In thousands, except par value and share amounts)  
 
ASSETS
Current assets:
               
Cash and cash equivalents
  $ 53,071     $ 39,768  
Short-term investments
    49,074       59,343  
Accounts receivable, net of allowances of $1,157 as of December 31, 2009 and $538 as of December 31, 2008
    32,771       27,864  
Inventory
    4,414       4,521  
Prepaid expenses and other current assets
    4,428       2,115  
                 
Total current assets
    143,758       133,611  
Property and equipment, net
    7,447       8,341  
Investments
    21,075       2,457  
Other assets
    1,887       1,896  
                 
Total assets
  $ 174,167     $ 146,305  
                 
 
LIABILITIES AND STOCKHOLDERS’ EQUITY
Current liabilities:
               
Accounts payable
  $ 2,846     $ 4,505  
Accrued compensation and related expenses
    5,074       4,229  
Other accrued expenses
    3,025       3,558  
Current portion of deferred revenue
    29,294       21,513  
Other current liabilities
    464       789  
                 
Total current liabilities
    40,703       34,594  
Deferred revenue, less current portion
    4,883       2,595  
Other long-term liabilities
    92       75  
                 
Total liabilities
  $ 45,678     $ 37,264  
                 
Commitments and contingencies
               
Stockholders’ equity:
               
Preferred stock, $0.001 par value; 19,700,000 shares authorized; no shares issued or outstanding
           
Series A junior participating preferred stock, $0.001 par value; 300,000 shares authorized; no shares issued or outstanding
           
Common stock, $0.001 par value; 240,000,000 shares authorized; 27,117,051 and 25,917,519 shares issued and outstanding as of December 31, 2009 and December 31, 2008, respectively
    26       25  
Additional paid-in capital
    170,157       159,306  
Accumulated deficit
    (41,716 )     (50,594 )
Accumulated other comprehensive income
    22       304  
                 
Total stockholders’ equity
    128,489       109,041  
                 
Total liabilities and stockholders’ equity
  $ 174,167     $ 146,305  
                 
 
See accompanying notes to consolidated financial statements.


F-3


 

SOURCEFIRE, INC.
 
CONSOLIDATED STATEMENTS OF OPERATIONS
 
                         
    Year Ended December 31,  
    2009     2008     2007  
    (In thousands, except share and per share amounts)  
 
Revenue:
                       
Products
  $ 62,585     $ 45,245     $ 34,332  
Technical support and professional services
    40,880       30,428       21,527  
                         
Total revenue
    103,465       75,673       55,859  
                         
Cost of revenue:
                       
Products
    15,641       12,408       9,523  
Technical support and professional services
    6,379       4,952       3,360  
                         
Total cost of revenue
    22,020       17,360       12,883  
                         
Gross profit
    81,445       58,313       42,976  
Operating expenses:
                       
Research and development
    16,256       12,620       11,902  
Sales and marketing
    36,498       33,169       25,860  
General and administrative
    16,761       18,713       10,599  
Depreciation and amortization
    3,647       2,627       1,649  
In-process research and development
                2,947  
                         
Total operating expenses
    73,162       67,129       52,957  
                         
Income (loss) from operations
    8,283       (8,816 )     (9,981 )
Other income, net:
                       
Interest and investment income
    1,033       3,139       4,665  
Interest expense
    (16 )     (51 )     (35 )
Other expense, net
    (91 )     (24 )     (26 )
                         
Total other income, net
    926       3,064       4,604  
                         
Income (loss) before income taxes
    9,209       (5,752 )     (5,377 )
Provision for income taxes
    331       319       244  
                         
Net income (loss)
    8,878       (6,071 )     (5,621 )
Accretion of preferred stock
                870  
                         
Net income (loss) attributable to common stockholders
  $ 8,878     $ (6,071 )   $ (6,491 )
                         
Net income (loss) attributable to common stockholders per share:
                       
Basic
  $ 0.34     $ (0.24 )   $ (0.32 )
                         
Diluted
    0.32       (0.24 )     (0.32 )
                         
Weighted average shares outstanding used in computing per share amounts:
                       
Basic
    26,458,273       25,379,791       20,434,792  
                         
Diluted
    27,987,115       25,379,791       20,434,792  
                         
 
See accompanying notes to consolidated financial statements.


F-4


 

 
SOURCEFIRE, INC.
 
CONSOLIDATED STATEMENT OF CHANGES IN CONVERTIBLE PREFERRED STOCK AND STOCKHOLDERS’ EQUITY
 
                                                                                                                                 
                Warrants to
                                                                               
                Purchase
                                                                               
                Series A
                                                                Accumulated
             
    Series A Convertible
    Convertible
    Series B Convertible
    Series C Convertible
    Series D Convertible
                Additional
          Other
             
    Preferred Stock     Preferred
    Preferred Stock     Preferred Stock     Preferred Stock     Common Stock     Paid-in
    Accumulated
    Comprehensive
             
    Shares     Amount     Stock     Shares     Amount     Shares     Amount     Shares     Amount     Shares     Amount     Capital     Deficit     Income     Total        
    (In thousands, except share amounts)  
 
Balance at January 1, 2007
    2,475,410     $ 10,308     $ 25       7,132,205     $ 14,265       5,404,043     $ 18,270       3,264,449     $ 23,879       3,491,764     $ 3     $     $ (38,902 )   $     $ (38,899 )        
Exercise of common stock options
                                                          305,077       1       332                   333          
Exercise of common stock warrant
                                                          30,543                                        
Issuance of restricted common stock
                                                          329,882                                        
Cancellation of restricted common stock
                                                          (2,389 )                                      
Stock-based compensation expense
                                                                      2,646                   2,646          
Excess tax benefits relating to share-based payments
                                                                      106                   106          
Issuance of common stock in IPO, net of issuance costs of $8,901
                                                          6,185,500       6       83,876                   83,882          
Accretion of convertible preferred stock to redemption value
            140                   186             237             307                   (870 )                 (870 )        
Conversion of preferred stock to common stock
    (2,475,410 )     (10,448 )     (25 )     (7,132,205 )     (14,451 )     (5,404,043 )     (18,507 )     (3,264,449 )     (24,186 )     14,302,056       14       67,603                   67,617          
Net loss for 2007
                                                                            (5,621 )             (5,621 )        
                                                                                                                                 
Balance at December 31, 2007
                                                          24,642,433       24       153,693       (44,523 )         $ 109,194          
Exercise of common stock options
                                                          704,824       1       858                   859          
Issuance of common stock under employee stock purchase plan
                                                          80,201             391                   391          
Issuance of restricted common stock
                                                          524,550                                        
Repurchase of common stock
                                                          (34,489 )           (140 )                 (140 )        
Stock-based compensation expense
                                                                      4,486                   4,486          
Excess tax benefit relating to share-based payments
                                                                      18                   18          
Comprehensive loss:
                                                                                                                               
Net loss for 2008
                                                                            (6,071 )           (6,071 )        
Net unrealized gain on investments
                                                                                  304       304          
                                                                                                                                 
Total comprehensive loss
                                                                                        (5,767 )        
                                                                                                                                 
Balance at December 31, 2008
                                                          25,917,519       25       159,306       (50,594 )     304       109,041          
Exercise of common stock options
                                                          1,079,232       1       3,909                   3,910          
Issuance of common stock under employee stock purchase plan
                                                          82,955             554                   554          
Issuance of restricted common stock
                                                          56,538                                        
Cancellation of restricted common stock
                                                          (19,193 )                                      
Stock-based compensation expense
                                                                      6,171                   6,171          
Excess tax benefit relating to share-based payments
                                                                      217                   217          
Comprehensive income:
                                                                                                                               
Net income for 2009
                                                                            8,878             8,878          
Net unrealized loss on investments
                                                                                  (282 )     (282 )        
                                                                                                                                 
Total comprehensive income
                                                                                        8,596          
                                                                                                                                 
Balance at December 31, 2009
        $     $           $           $           $       27,117,051     $ 26     $ 170,157     $ (41,716 )   $ 22     $ 128,489          
                                                                                                                                 
 
See accompanying notes to consolidated financial statements.


F-5


 

 
SOURCEFIRE, INC.
 
CONSOLIDATED STATEMENTS OF CASH FLOWS
 
                         
    Year Ended December 31,  
    2009     2008     2007  
    (In thousands)  
 
Operating activities
                       
Net income (loss)
  $ 8,878     $ (6,071 )   $ (5,621 )
Adjustments to reconcile net income (loss) to net cash provided by (used in) operating activities:
                       
Depreciation and amortization
    3,423       2,663       1,678  
Non-cash stock-based compensation
    6,171       4,486       2,646  
Excess tax benefits related to share-based payments
    (217 )     (18 )     (106 )
Amortization of premium (discount) on investments
    374       (1,033 )     (1,441 )
Loss on disposal of assets
          7        
Realized gain from sales of investments
          (23 )      
Write-off of acquired in-process research and development costs
                2,947  
Changes in operating assets and liabilities:
                       
Accounts receivable, net
    (4,907 )     (7,175 )     (4,182 )
Inventory
    746       343       (2,764 )
Prepaid expenses and other assets
    (2,973 )     (80 )     (2,027 )
Accounts payable
    (1,659 )     (1,425 )     2,849  
Accrued expenses
    529       4,196       1,620  
Deferred revenue
    10,069       3,081       6,912  
Other liabilities
    (275 )     (91 )     417  
                         
Net cash provided by (used in) operating activities
    20,159       (1,140 )     2,928  
                         
Investing activities
                       
Purchase of property and equipment
    (2,500 )     (6,661 )     (3,131 )
Purchase of investments
    (87,929 )     (94,477 )     (125,154 )
Proceeds from maturities of investments
    78,925       104,763       65,932  
Proceeds from sales of investments
          3,230        
Cash paid for acquisition of ClamAV, including direct acquisition costs of $81
                (3,581 )
Cash held in escrow related to acquisition of ClamAV
                (1,000 )
                         
Net cash (used in) provided by investing activities
    (11,504 )     6,855       (66,934 )
                         
Financing activities
                       
Borrowings of long-term debt
                113  
Repayments of long-term debt and capital lease obligations
    (33 )     (146 )     (1,425 )
Proceeds from issuance of common stock, net of underwriters’ discount of $6,495
                86,288  
Proceeds from employee stock-based plans
    4,464       1,250       333  
Repurchase of common stock
          (140 )      
Excess tax benefits related to share-based payments
    217       18       106  
Payment of equity offering costs
                (1,367 )
                         
Net cash provided by financing activities
    4,648       982       84,048  
                         
Net increase in cash and cash equivalents
    13,303       6,697       20,042  
Cash and cash equivalents at beginning of period
    39,768       33,071       13,029  
                         
Cash and cash equivalents at end of period
  $ 53,071     $ 39,768     $ 33,071  
                         
Supplemental cash flow information
                       
Cash paid for interest
  $ 16     $ 16     $ 35  
Cash paid for income taxes
    209       143       106  
Assets acquired through capital leases
          183        
 
See accompanying notes to consolidated financial statements.


F-6


 

 
SOURCEFIRE, INC.
 
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS
 
1.   Description of Business and Basis of Presentation
 
Organization and Description of Business
 
Founded in January 2001, we are a leading provider of intelligent cybersecurity for information technology, or IT, environments of commercial enterprises, including healthcare, financial services, manufacturing, energy, education, retail and telecommunications companies, and federal and state and local government organizations worldwide. Our solutions are comprised of multiple hardware and software product and service offerings, enabling a comprehensive, intelligent approach to network security. Our security solutions provide our customers with an efficient and effective network security defense of assets and applications before, during and after an attack.
 
We are also the creator of Snort® and the owner of ClamAV®. Snort is an open source intrusion prevention technology that is incorporated into the IPS software component of our comprehensive Intrusion Detection and Prevention System. ClamAV is an open source anti-virus and anti-malware project.
 
In addition to our commercial and open source network security products, we offer a variety of services to help our customers install and support our solutions. Available services include Customer Support, Education, Professional Services and Vulnerability Research Team, or VRT, and Snort rule subscriptions.
 
Basis of Presentation
 
The consolidated financial statements include the accounts of Sourcefire, Inc. and our wholly-owned subsidiaries after elimination of all intercompany accounts and transactions.
 
2.   Summary of Significant Accounting Policies
 
Use of Estimates
 
The preparation of financial statements in conformity with accounting principles generally accepted in the United States requires us to make estimates and assumptions that affect the amounts reported in the consolidated financial statements and accompanying notes. Actual results could differ materially from those estimates.
 
On an ongoing basis, we evaluate our estimates, including those related to the accounts receivable allowance, sales return allowance, warranty reserve, reserve for excess and obsolete inventory, useful lives of long-lived assets (including intangible assets), income taxes, and our assumptions used for the purpose of determining stock-based compensation, among other things. We base our estimates on historical experience and on various other assumptions that are believed to be reasonable, the results of which can affect the reported amounts of assets and liabilities as of the date of the consolidated financial statements, as well as the reported amounts of revenue and expenses during the periods presented.
 
Cash and Cash Equivalents
 
We consider all highly liquid investments with maturities of three months or less when purchased to be cash equivalents.
 
Investments
 
We determine the appropriate classification of our investments at the time of purchase and reevaluate such classification as of each balance sheet date. Our investments are comprised of money market funds, corporate debt investments, commercial paper, government-sponsored enterprise securities, government securities and certificates of deposit. These investments have been classified as available-for-sale. Available-for-sale investments are stated at fair value, with the unrealized gains and losses, net of tax, reported in accumulated other comprehensive income. The amortization of premiums and accretion of discounts to maturity are computed using the effective interest method. Amortization is included in interest and investment income. Interest on securities classified as available-


F-7


 

 
SOURCEFIRE, INC.
 
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS — (Continued)
 
for-sale is also included in interest and investment income. See Note 3 for further discussion of the classification of our investments.
 
We evaluate our investments on a regular basis to determine whether an other-than-temporary decline in fair value has occurred. If an investment is in an unrealized loss position and we have the intent to sell the investment, or it is more likely than not that we will have to sell the investment before recovery of its amortized cost basis, the decline in value is deemed to be other-than-temporary and is charged against earnings for the period. For investments that we do not intend to sell or it is more likely than not that we will not have to sell the investment, but we expect that we will not fully recover the amortized cost basis, the credit component of the other-than-temporary impairment is charged against earnings for the applicable period and the non-credit component of the other-than-temporary impairment is recognized in other comprehensive income on our statement of stockholders’ equity. Unrealized losses entirely caused by non-credit related factors related to investments for which we expect to fully recover the amortized cost basis are recorded in accumulated other comprehensive income.
 
Fair Value of Financial Instruments
 
Our financial instruments consist primarily of cash and cash equivalents, investments, accounts receivable, cash surrender value on our split-dollar life insurance policy, accounts payable and deferred revenue. The fair value of these financial instruments approximates their carrying amounts reported in the consolidated balance sheets. The fair value of available-for-sale investments is determined using quoted market prices for those investments.
 
Allowance for Doubtful Accounts and Sales Return Allowance
 
We make estimates regarding the collectability of our accounts receivable. When we evaluate the adequacy of our allowance for doubtful accounts, we consider multiple factors, including historical write-off experience, the need for specific customer reserves, the aging of our receivables, customer creditworthiness and changes in customer payment cycles. Historically, our allowance for doubtful accounts has been adequate based on actual results. If any of the factors used to calculate the allowance for doubtful accounts change or if the allowance does not reflect our future ability to collect outstanding receivables, additional provisions for doubtful accounts may be needed, and our future results of operations could be materially affected. As of December 31, 2009 and 2008, the allowance for doubtful accounts was $777,000 and $538,000, respectively.
 
We also use our judgment to make estimates regarding potential future product returns related to reported product revenue in each period. We analyze factors such as our historical return experience, current product sales volumes, and changes in product warranty claims when evaluating the adequacy of the sales returns allowance. If any of the factors used to calculate the sales return allowance were to change, we may experience a material difference in the amount and timing of our product revenue for any given period. As of December 31, 2009, the sales return allowance was $380,000. There was no sales return allowance as of December 31, 2008.
 
Inventories
 
Inventories consist of hardware and related component parts and are stated at the lower of cost on a first-in, first-out basis, or market, except for evaluation and advance replacement units which are stated at the lower of cost, on a specific identification basis, or market. Evaluation units are used for customer testing and evaluation and are predominantly located at the customers’ premises. Advance replacement units, which include replacement units and spare parts, are used to provide replacement units under technical support arrangements if a customer’s unit is not functioning. In prior periods, advance replacement units were included in other assets and depreciated using the straight-line method. In the third quarter of 2009, we reclassified these assets to inventory to better reflect the nature of the assets. We make estimates of forecasted demand for our products, and inventory that is obsolete or in excess of our estimated demand is written down to its estimated net realizable value based on historical usage, expected demand, the timing of new product introductions and age. It is reasonably possible that our estimate of future


F-8


 

 
SOURCEFIRE, INC.
 
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS — (Continued)
 
demand for our products could change in the near term and result in additional inventory write-downs, which would negatively impact our gross margin.
 
Inventory consisted of the following (in thousands):
 
                 
    As of December 31,  
    2009     2008  
 
Finished goods
  $ 2,850     $ 3,436  
Evaluation units
    733       1,085  
Advance replacement units
    831        
                 
Total
  $ 4,414     $ 4,521  
                 
 
Inventory write-downs, mostly related to evaluation units and excess and obsolete inventory, are reflected as cost of revenues and amounted to approximately $2.4 million, $1.0 million and $363,000 for the years ended December 31, 2009, 2008 and 2007, respectively.
 
Property and Equipment
 
Property and equipment is reported at cost. Depreciation is computed using the straight-line method over estimated useful lives of the assets, which is generally three years for computer equipment and software, five to seven years for furniture, fixtures and office equipment, five years for our enterprise resource planning system and the lesser of the useful life of the asset or the remaining term of the lease for leasehold improvements and capital leases.
 
Property and equipment consists of the following (in thousands):
 
                 
    As of December 31,  
    2009     2008  
 
Computer equipment
  $ 9,201     $ 7,973  
Software
    5,483       4,510  
Furniture, fixtures and office equipment
    1,388       1,368  
Leasehold improvements
    2,145       2,041  
                 
      18,217       15,892  
Less accumulated depreciation and amortization
    (10,770 )     (7,551 )
                 
Total
  $ 7,447     $ 8,341  
                 
 
Depreciation and lease amortization expense for the years ended December 31, 2009, 2008 and 2007 was $3.3 million, $2.5 million and $1.6 million, respectively.
 
Accrued Compensation and Related Expenses
 
Accrued compensation and related expenses consists of the following (in thousands):
 
                 
    As of December 31,  
    2009     2008  
 
Accrued incentive compensation
  $ 3,975     $ 3,430  
Accrued leave
    618       530  
Other related expenses
    481       269  
                 
Total
  $ 5,074     $ 4,229  
                 


F-9


 

 
SOURCEFIRE, INC.
 
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS — (Continued)
 
Revenue Recognition
 
We derive revenue from arrangements that include products with embedded software, software licenses and royalties, technical support, and professional services. Revenue from products in the accompanying consolidated statements of operations consists primarily of sales of software-based appliances, but also includes fees and royalties for the license of our technology in a software-only format and subscriptions to receive rules released by the VRT that are used to update the appliances for current exploits and vulnerabilities. Technical support, which generally has a contractual term of 12 months, includes telephone and web-based support, software updates, and rights to software upgrades on a when-and-if-available basis. Professional services include training and consulting.
 
For each arrangement, we recognize revenue when: (a) persuasive evidence of an arrangement exists (e.g., a signed contract); (b) delivery of the product has occurred and there are no remaining obligations or substantive customer acceptance provisions; (c) the fee is fixed or determinable; and (d) collection of the fee is deemed probable.
 
We allocate the total arrangement fee among each deliverable based on the fair value of each of the deliverables, determined based on vendor-specific objective evidence. If vendor-specific objective evidence of fair value does not exist for each of the deliverables, all revenue from the arrangement is deferred until the earlier of the point at which sufficient vendor-specific objective evidence of fair value can be determined for any undelivered elements or all elements of the arrangement have been delivered. If the only undelivered elements are elements for which we currently have vendor-specific objective evidence of fair value, we recognize revenue for the delivered elements based on the residual method.
 
We have established vendor-specific objective evidence of fair value for our technical support based upon actual renewals of each type of technical support that is offered and for each customer class. Technical support and technical support renewals are currently priced based on a percentage of the list price of the respective product or software and historically have not varied from a narrow range of values in the substantial majority of our arrangements. Revenue related to technical support is deferred and recognized ratably over the contractual period of the technical support arrangement, which is generally 12 months. The vendor-specific objective evidence of fair value of our other services is based on the price for these same services when they are sold separately. Revenue for professional services that are sold either on a stand-alone basis or included in multiple element arrangements is deferred and recognized as the services are performed.
 
All amounts billed or received in excess of the revenue recognized are included in deferred revenue. In addition, we defer all direct costs associated with revenue that has been deferred. These amounts are included in either prepaid expenses and other current assets or inventory in the accompanying balance sheets, depending on the nature of the costs and the reason for the deferral.
 
For sales through resellers and distributors, we recognize revenue upon the shipment of the product only if those resellers and distributors provide us, at the time of placing their order, with the identity of the end-user customer to whom the product has been sold. To the extent that a reseller or distributor requests an inventory or stock of products, we defer revenue on that product until we receive notification that it has been sold through to an identified end-user.
 
We record taxes collected on revenue-producing activities on a net basis.
 
For the years ended December 31, 2009 and 2008, a distributor of our products to the U.S. government, immixTechnology, accounted for 20% and 11%, respectively, of total revenue. For the year ended December 31, 2007 we had no customers that accounted for greater than 10% of revenue recognized. As of December 31, 2009, a distributor of our products to the U.S. government, immixTechnology, accounted for 31% of our accounts receivable. As of December 31, 2008 we had no customers that accounted for greater than 10% of our accounts receivable.


F-10


 

 
SOURCEFIRE, INC.
 
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS — (Continued)
 
Warranty
 
Under our standard warranty arrangement, we warrant that our software will perform in accordance with its documentation for a period of 90 days from the date of shipment. Similarly, we warrant that the hardware will perform in accordance with its documentation for a period of one year from date of shipment. We further agree to repair or replace software or products that do not conform to those warranties. The one year warranty on hardware coincides with the hardware warranty that we obtain from the manufacturer. We estimate the additional costs, if any, that may be incurred under our warranties outside of the warranties supplied by the manufacturer and record a liability at the time product revenue is recognized. Factors that affect our warranty liability include the number of units sold, historical and anticipated rates of warranty claims and the estimated cost per claim. We periodically assess the adequacy of our recorded warranty liability and adjust the amounts as necessary. While actual warranty costs have historically been within our cost estimations, it is possible that warranty rates could increase in the future due to new hardware introductions, general hardware component cost and availability, among other factors.
 
Commissions
 
We record commission expense for orders that include products in the same period in which the product revenue is recognized. We record commission expense for arrangements that consist solely of service in the period in which the non-cancelable order for the services is received.
 
Shipping and Handling Costs
 
All amounts billed to customers related to shipping and handling are included in product revenues and all costs of shipping and handling are included in cost of product revenue.
 
Research and Development Costs
 
Costs for the development of new software products and substantial enhancements to existing software products are expensed as research and development costs as incurred until technological feasibility has been established. After technological feasibility has been established, any additional development costs are capitalized until the product is available for general release to customers. We define the establishment of technological feasibility as the completion of a working model of the software product that has been tested to be consistent with the product design specifications and that is free of any uncertainties related to known high-risk development issues. During the years ended December 31, 2009, 2008 and 2007, we did not capitalize any software development costs.
 
Advertising Costs
 
We expense advertising costs as incurred. Advertising expense totaled $46,000, $158,000 and $220,000 for the years ended December 31, 2009, 2008 and 2007, respectively.
 
Foreign Currency Translation
 
The functional currency of our foreign subsidiaries in the United Kingdom and Japan is the U.S. dollar. Accordingly, all assets and liabilities of these foreign subsidiaries are remeasured into U.S. dollars using the exchange rates in effect at each balance sheet date, except for certain non-monetary items, which are remeasured into U.S. dollars at historical rates. Revenue and expenses of these foreign subsidiaries are remeasured into U.S. dollars at the average rates in effect during the year. Any differences resulting from the remeasurement of assets, liabilities and operations of the United Kingdom and Japan subsidiaries are recorded within other expense, net in the consolidated statements of operations. During the years ended December 31, 2009, 2008 and 2007, remeasurement adjustments resulted in net expense of $90,000, $17,000 and $10,000, respectively.


F-11


 

 
SOURCEFIRE, INC.
 
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS — (Continued)
 
Income Taxes
 
We account for income taxes using the liability method, which requires the recognition of deferred tax assets or liabilities for the temporary differences between financial reporting and tax bases of our assets and liabilities and for tax carry-forwards at enacted statutory tax rates in effect for the years in which the differences are expected to reverse.
 
We continue to assess the realizability of our deferred tax assets, which primarily consists of net operating loss, or NOL, carry-forwards, stock-based compensation expense and deferred revenue. In assessing the realizability of these deferred tax assets, we consider whether it is more likely than not that some portion or all of the deferred tax assets will be realized. As of December 31, 2009, the deferred tax asset balance was $12.4 million, of which $11.7 million is offset by a valuation allowance.
 
With respect to foreign earnings, it is our policy to invest the earnings of foreign subsidiaries indefinitely outside the U.S. With respect to stock-based compensation expense, the benefit of the deferred tax asset is being recognized as the related stock options are exercised. The excess tax benefit from the exercise of stock options is recorded in additional paid-in-capital in the consolidated balance sheets to the extent that cash taxes payable are reduced.
 
We have determined there are no material uncertain tax positions that would require a reserve as of December 31, 2009.
 
Because tax laws are complex and subject to different interpretations, significant judgment is required. As a result, we make certain estimates and assumptions, in (i) calculating our provision for income taxes, deferred tax assets and deferred tax liabilities, (ii) determining any valuation allowance recorded against deferred tax assets and (iii) evaluating the amount of unrecognized tax benefits, as well as the interest and penalties related to such uncertain tax positions. Our estimates and assumptions may differ significantly from tax benefits ultimately realized.
 
Intangible Assets
 
Intangible assets that are not considered to have an indefinite life are amortized over their useful lives and included in depreciation and amortization in the consolidated statements of operations. On a periodic basis, we evaluate the estimated remaining useful life of purchased intangible assets and whether events or changes in circumstances warrant a revision to the remaining period of amortization. The carrying amounts of these assets are periodically reviewed for impairment whenever events or changes in circumstances indicate that the carrying value of these assets may not be recoverable. Recoverability of these assets is measured by comparison of the carrying amount of each asset to the future undiscounted cash flows the asset is expected to generate. In the event that we determine certain assets are not fully recoverable, we will incur an impairment charge for those assets or portion thereof during the quarter in which the determination is made based on the difference between the carrying value of the asset and its fair value. Amortization expense for the years ended December 31, 2009, 2008 and 2007 was $116,000, $127,000 and $42,000, respectively.
 
We acquired marketing-related intangible assets in 2007 that were included in other assets in the consolidated balance sheet and were being amortized over an estimated useful life of 5 years. During the fourth quarter of 2009, we concluded that the carrying value of our marketing-related intangible assets exceeded the sum of the undiscounted future cash flows expected to result from the use of the assets. Based on our internal analysis, we determined that the fair value of the assets was $0 and recorded an impairment charge of $349,000 to eliminate the carrying value of the assets. This impairment charge is included in depreciation and amortization in the consolidated statement of operations.


F-12


 

 
SOURCEFIRE, INC.
 
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS — (Continued)
 
Stock-Based Compensation
 
Stock-based awards granted include stock options, restricted stock awards, restricted stock units and stock purchased under our Amended and Restated 2007 Employee Stock Purchase Plan, or ESPP. Stock-based compensation expense is measured at the grant date, based on the fair value of the awards, and is recognized as expense over the requisite service period, net of estimated forfeitures.
 
We use the Black-Scholes option pricing model for estimating the fair value of stock options granted and for employee stock purchases under the ESPP. For a prior option award that contained a market condition relating to our stock price achieving specified levels, we use a Lattice option pricing model. The use of option valuation models requires the input of highly subjective assumptions, including the expected term and the expected stock price volatility. Additionally, the recognition of expense requires the estimation of the number of options that will ultimately vest and the number of options that will ultimately be forfeited. See Note 5 for additional discussion of stock-based compensation.
 
Net Income (Loss) Attributable to Common Stockholders Per Share
 
Basic net income (loss) attributable to common stockholders per share is computed on the basis of the weighted-average number of shares of common stock outstanding during the period. Diluted net income (loss) attributable to common stockholders per share is computed on the basis of the weighted-average number of shares of common stock plus the effect of dilutive potential common shares outstanding during the period using the treasury stock method. Dilutive potential common shares include outstanding stock options and restricted stock units. See Note 7 for additional discussion of our net income (loss) per share.
 
Recent Accounting Pronouncements
 
In April 2009, the FASB issued new accounting guidance requiring disclosures about the fair value of financial instruments during interim reporting periods. This guidance is effective for interim and annual periods ended after June 15, 2009. The adoption of this guidance did not have a material impact on our consolidated financial statements.
 
In April 2009, the FASB issued guidance related to the recognition and presentation of other-than-temporary impairments. This guidance amends the other-than-temporary impairment guidance for debt securities to make the guidance more operational and to improve the presentation and disclosure of other-than-temporary impairments on debt and equity securities. This guidance is effective for interim and annual periods ended after June 15, 2009. The adoption of this guidance did not have a material impact on our consolidated financial statements.
 
In April 2009, the FASB issued guidance for determining fair value of an asset or liability when the volume and level of activity for the asset or liability have significantly decreased and for identifying transactions that are not orderly. This guidance is effective for interim and annual periods ended after June 15, 2009. The adoption of this guidance did not have a material impact on our consolidated financial statements.
 
In May 2009, the FASB issued guidance related to subsequent events. This guidance is intended to establish general standards of accounting for and disclosure of events that occur after the balance sheet date but before financial statements are issued or are available to be issued. This guidance is effective for fiscal years and interim periods ended after June 15, 2009. The adoption of this guidance did not have a material impact on our consolidated financial statements.
 
In June 2009, the FASB established the FASB Accounting Standards Codification as the single source of authoritative U.S. GAAP to be applied by nongovernmental entities. This guidance is effective for financial statements issued for interim and annual periods ended after September 15, 2009. The adoption of this guidance, while it impacts the way we refer to accounting pronouncements in our disclosures, did not have an effect on our consolidated financial statements.


F-13


 

 
SOURCEFIRE, INC.
 
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS — (Continued)
 
In October 2009, the FASB clarified the accounting guidance for sales of tangible products containing both software and hardware elements and issued new guidance that amends the criteria for evaluating the individual items in a multiple deliverable revenue arrangement and how to allocate the consideration received to the individual items. The guidance is effective for revenue arrangements entered into or materially modified in fiscal years beginning on or after June 15, 2010, with early adoption permitted. We believe this literature is applicable to our revenue arrangements. However, we are currently evaluating the impact this guidance will have on our consolidated financial statements.
 
Reclassifications
 
Certain reclassifications have been made to the prior year Consolidated Financial Statements to conform with the current year presentation.
 
3.   Investments
 
We determine the appropriate classification of investments at the time of purchase and reevaluate such designation as of each balance sheet date. The following is a summary of available-for-sale investments as of December 31, 2009 (in thousands):
 
                                 
          Gross
    Gross
       
    Amortized
    Unrealized
    Unrealized
    Estimated
 
    Cost     Gains     Losses     Fair Value  
 
Money market funds
  $ 17,617     $     $     $ 17,617  
Corporate debt investments
    17,715       15       (17 )     17,713  
Commercial paper
    7,543       2             7,545  
Government-sponsored enterprises
    39,218       41       (27 )     39,232  
Government securities
    1,995       8             2,003  
Certificate of deposit
    4,905                   4,905  
                                 
Total investments
    88,993     $ 66     $ (44 )     89,015  
                                 
Amounts classified as cash equivalents*
    (18,866 )                     (18,866 )
                                 
Total available-for-sale investments
  $ 70,127                     $ 70,149  
                                 
                                 
Due in one year or less
  $ 49,030     $ 48     $ (4 )   $ 49,074  
Due after one year through five years
    21,097       18       (40 )     21,075  
                                 
    $ 70,127     $ 66     $ (44 )   $ 70,149  
                                 
 
 
* Does not include cash held in our bank accounts


F-14


 

 
SOURCEFIRE, INC.
 
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS — (Continued)
 
 
The following is a summary of available-for-sale investments as of December 31, 2008 (in thousands):
 
                                 
          Gross
    Gross
       
    Amortized
    Unrealized
    Unrealized
    Estimated
 
    Cost     Gains     Losses     Fair Value  
 
Money market funds
  $ 26,686     $     $     $ 26,686  
Corporate debt investments
    12,137       23       (26 )     12,134  
Asset-backed securities
    801             (4 )     797  
Commercial paper
    18,875       93             18,968  
Government-sponsored enterprises
    26,178       218             26,396  
Government securities
    1,500                   1,500  
Certificate of deposit
    2,005                   2,005  
                                 
Total investments
    88,182     $ 334     $ (30 )     88,486  
                                 
Amounts classified as cash equivalents*
    (26,686 )                     (26,686 )
                                 
Total available-for-sale investments
  $ 61,496                     $ 61,800  
                                 
                                 
Due in one year or less
  $ 59,076     $ 295     $ (28 )   $ 59,343  
Due after one year through five years
    2,420       39       (2 )     2,457  
                                 
    $ 61,496     $ 334     $ (30 )   $ 61,800  
                                 
 
 
* Does not include cash held in our bank accounts
 
The following tables show the gross unrealized losses and fair value of our investments as of December 31, 2009 with unrealized losses that are not deemed to be other-than-temporarily impaired, aggregated by investment category and length of time that individual securities have been in a continuous unrealized loss position (in thousands):
 
                                                 
    Less Than 12 Months   12 Months or More   Total
        Gross
      Gross
      Gross
    Fair
  Unrealized
  Fair
  Unrealized
  Fair
  Unrealized
    Value   Losses   Value   Losses   Value   Losses
 
Corporate debt investments
  $ 9,578     $ 17     $     $     $ 9,578     $ 17  
Government-sponsored enterprises
    13,029       27                   13,029       27  
 
As of December 31, 2009, the net unrealized gain on available-for-sale securities included in accumulated other comprehensive income totaled $22,000. We have evaluated our investments and have determined there were no other-than-temporary impairments as of December 31, 2009. There are ten corporate debt investments and seven government-sponsored enterprise investments with unrealized losses that have existed for less than one year. The unrealized losses related to these investments are entirely caused by non-credit related factors. We do not have the intent to sell these securities and we expect to fully recover the amortized cost basis of these investments. For the year ended December 31, 2009, the deferred tax benefit recorded in other comprehensive income was fully offset by the increase of the valuation allowance we recorded for related deferred tax assets.


F-15


 

 
SOURCEFIRE, INC.
 
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS — (Continued)
 
 
4.   Income Taxes
 
The provisions for income taxes are as follows (in thousands):
 
                         
    Year Ended December 31,  
    2009     2008     2007  
 
Current:
                       
Federal
  $     $     $  
State
    204       46       63  
Foreign
    118       315       209  
Deferred:
                       
Federal
    3,404       (1,627 )     (1,804 )
State
    (139 )     (256 )     (526 )
Foreign
    9       (42 )     (29 )
                         
Total provision for (benefit from) income taxes before valuation allowance
    3,596       (1,564 )     (2,087 )
Change in valuation allowance
    (3,265 )     1,883       2,331  
                         
Total provision for income taxes
  $ 331     $ 319     $ 244  
                         
 
The significant components of our deferred tax assets and liabilities are as follows (in thousands):
 
                 
    As of December 31,  
    2009     2008  
 
Deferred tax assets:
               
Net operating loss carry-forward
  $ 4,053     $ 9,782  
Accrued expenses
    215       168  
Deferred rent
    82       139  
Deferred revenue
    1,869       969  
Allowance for doubtful accounts
    298       126  
Stock-based compensation
    3,181       2,407  
In-process research and development
    982       1,002  
Property and equipment
    303       249  
Other
    1,406       495  
                 
Total deferred tax assets
    12,389       15,337  
                 
Deferred tax liabilities:
               
Prepaid expenses
    (661 )     (337 )
                 
Total deferred tax liabilities
    (661 )     (337 )
                 
Net future income tax benefit
    11,728       15,000  
Valuation allowance for deferred tax assets
    (11,665 )     (14,929 )
                 
Net deferred tax asset
  $ 63     $ 71  
                 
 
We reported a consolidated net loss for the period from inception through December 31, 2008, which was principally related to our domestic operations. The domestic loss did not result in a reportable tax benefit because of a corresponding increase in the valuation allowance against the deferred tax assets for which future realization cannot be determined. Our provision for income taxes for the year ended December 31, 2009 consists primarily of


F-16


 

 
SOURCEFIRE, INC.
 
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS — (Continued)
 
U.S. state income taxes related to domestic operations and foreign income taxes related to international operations. Our provision for income taxes for the years ended December 31, 2008 and 2007 consists primarily of foreign income taxes related to international operations. The net deferred tax assets of $63,000 and $71,000 reported above as of December 31, 2009 and 2008, respectively, relate to foreign tax benefits, and are expected to be available to offset foreign tax liabilities in the future.
 
Cumulative undistributed earnings of our foreign operations aggregated approximately $306,000 as of December 31, 2009. Deferred income taxes were not provided on these undistributed earnings because such undistributed earnings are expected to be indefinitely reinvested outside of the United States.
 
At December 31, 2009, we had federal net operating loss carry-forwards of approximately $10.6 million that will begin to expire in 2022. The utilization of the federal net operating loss carry-forwards is subject to Internal Revenue Code Section 382 as a result of certain ownership changes, including the issuance of equity securities. The $10.6 million of net operating loss carry-forwards reflect a reduction of $455,000 that we determined will expire prior to use as a result of the limitations. At December 31, 2009, we had state net operating loss carry-forwards that will begin to expire in 2022. The utilization of state net operating loss carry-forwards will be limited in a manner similar to the federal net operating loss carry-forwards and are subject to state apportionment when utilized. We have established a full valuation allowance with respect to these federal and state net operating loss carry-forwards and other net deferred tax assets due to uncertainties surrounding their realization.
 
At December 31, 2009, we had $19.6 million in cumulative tax deductions on stock option exercises and restricted stock vesting, the benefit of which will be recorded to paid-in-capital when realized. Since we were able to reduce our actual cash taxes for U.S. state and foreign jurisdictions as a result of the tax deductions, the realization of $217,000 of tax savings was recognized as a benefit to additional paid-in capital for the year ended December 31, 2009.
 
We have analyzed our current tax return compliance positions and have determined that no uncertain tax positions have been taken that require recognition. Accordingly, we have omitted the tabular summary analysis.
 
A reconciliation of the reported provision for income taxes to the amount that would result by applying the U.S. federal statutory rate to the net income (loss) for the years ended December 31 is as follows (in thousands):
 
                         
    Year Ended December 31,  
    2009     2008     2007  
 
Tax benefit at U.S. statutory rate of 34%
  $ 3,151     $ (1,883 )   $ (1,828 )
Effect of permanent differences
    66       138       64  
State income taxes, net of federal benefit
    43       (157 )     42  
Foreign taxes and rate differentials
    96       45       20  
Other
    240       293        
Effect of change in valuation allowance for deferred tax assets
    (3,265 )     1,883       1,946  
                         
Total
  $ 331     $ 319     $ 244  
                         
 
We file income tax returns in the U.S. federal jurisdiction and various state and foreign jurisdictions. The following table summarizes the tax years in our major tax jurisdictions that remain subject to income tax examinations by tax authorities as of December 31, 2009. Due to NOL carry-forwards, in some cases, the tax years continue to remain subject to examination with respect to such NOLs:
 
         
    Years Subject to
Tax Jurisdiction
  Income Tax Examination
 
U.S. federal
    2002 — Present  
Maryland
    2002 — Present  
United Kingdom
    2007 — Present  


F-17


 

 
SOURCEFIRE, INC.
 
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS — (Continued)
 
 
5.   Stock-Based Compensation
 
In March 2007, our Board of Directors and stockholders approved the Sourcefire, Inc. 2007 Stock Incentive Plan, or 2007 Plan, which provides for the granting of equity-based awards, including stock options, restricted or unrestricted stock awards, and stock appreciation rights to employees, officers, directors, and other individuals as determined by the Board of Directors. As of December 31, 2008, we had reserved an aggregate of 4,128,149 shares of common stock for issuance under the 2007 Plan. On January 1, 2009, under the terms of the 2007 Plan, the aggregate number of shares reserved for issuance under the 2007 Plan was increased by an amount equal to 4% of our outstanding common stock as of December 31, 2008, or 1,036,701 shares. Therefore, as of December 31, 2009, we have reserved an aggregate of 5,164,850 shares of common stock for issuance under the 2007 Plan. Prior to adoption of the 2007 Plan, we granted stock options and restricted stock awards under the Sourcefire, Inc. 2002 Stock Incentive Plan, or 2002 Plan.
 
The 2002 Plan and the 2007 Plan are administered by the Compensation Committee of our Board of Directors. The vesting period for awards under the plans is generally between three and five years. Options granted have a maximum term of 10 years. The exercise price of stock option awards is equal to at least the fair value of the common stock on the date of grant. The fair value of our common stock is determined by reference to the closing trading price of the common stock on the Nasdaq Global Market on the date of grant.
 
Valuation of Stock-Based Compensation
 
We use the Black-Scholes option pricing model for estimating the fair value of stock options granted and for employee stock purchases under the ESPP. For a prior option award that contained a market condition relating to our stock price achieving specified levels, we used a Lattice option pricing model. The use of option valuation models requires the input of highly subjective assumptions, including the expected term and the expected stock price volatility. Additionally, the recognition of expense requires the estimation of the number of options that will ultimately vest and the number of options that will ultimately be forfeited. The fair value of stock-based awards is recognized as expense over the requisite service period, net of estimated forfeitures. We rely on historical experience of employee turnover to estimate our expected forfeitures.
 
The following are the weighted-average assumptions and fair values used in the Black-Scholes option valuation of stock options granted under the 2002 Plan and the 2007 Plan and employee stock purchases under the ESPP.
 
                         
    Year Ended December 31,
    2009   2008   2007
 
Stock Options:
                       
Average risk-free interest rate
    2.6 %     3.2 %     4.6 %
Expected dividend yield
    0.0 %     0.0 %     0.0 %
Expected life (years)
    6.25       6.25       6.25  
Expected volatility
    63.5 %     63.7 %     74.8 %
Weighted-average fair value per grant
  $ 9.69     $ 4.14     $ 8.63  
Employee stock purchase plan:
                       
Average risk-free interest rate
    0.2 %     1.8 %      
Expected dividend yield
    0.0 %     0.0 %      
Expected life (years)
    0.5       0.38        
Expected volatility
    67.1 %     62.1 %      
Weighted-average fair value per purchase
  $ 4.71     $ 1.71        


F-18


 

 
SOURCEFIRE, INC.
 
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS — (Continued)
 
Average risk-free interest rate — This is the average U.S. Treasury rate, with a term that most closely resembles the expected life of the option, as of the grant date.
 
Expected dividend yield — We use an expected dividend yield of zero, as we have never declared or paid dividends on our common stock and do not anticipate paying dividends in the foreseeable future.
 
Expected life — This is the period of time that the stock options granted under our equity incentive plans and employee purchases under the ESPP are expected to remain outstanding.
 
We have elected to use the simplified method of determining the expected term of stock options. This estimate is derived from the average midpoint between the weighted-average vesting period and the contractual term. In future periods, we expect to begin to incorporate our own data in estimating the expected life as we develop appropriate historical experience of employee exercise and post-vesting termination behavior considered in relation to the contractual life of the option.
 
For purchases under the ESPP, the expected life is the plan period.
 
Expected volatility — Volatility is a measure of the amount by which a financial variable such as a share price has fluctuated (historical volatility) or is expected to fluctuate (expected volatility) during a period.
 
Given our limited historical stock data from our IPO in March 2007, we have used a blended volatility to estimate expected volatility. The blended volatility includes a weighting of our historical volatility from the date of our IPO to the respective grant date and an average of our peer group historical volatility consistent with the expected life of the option. Our peer group historical volatility includes the historical volatility of companies that are similar in revenue size, in the same industry or are competitors. We expect to continue to use a larger proportion of our historical volatility in future periods as we develop additional historical experience of our own stock price fluctuations considered in relation to the expected life of the option.
 
For purchases under the ESPP, we use our historical volatility since we have historical data available since our IPO, which is consistent with the expected life.
 
During the third quarter of 2008, we granted an option to purchase 99,924 shares of common stock to our new Chief Executive Officer. The option vests based on the price of our common stock achieving specified levels. The Lattice option pricing model was used for the valuation of this option because the valuation of this award cannot be reasonably estimated using the Black-Scholes option pricing model. The weighted-average assumptions using the Lattice option pricing model included a volatility of 65%, an average risk-free interest rate of 3.5%, a dividend yield of 0% and a strike price of $6.77.
 
If we had made different assumptions about the stock price volatility rates, expected life, expected forfeitures and other assumptions, the related stock-based compensation expense and net income could have been significantly different.


F-19


 

 
SOURCEFIRE, INC.
 
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS — (Continued)
 
The following table summarizes stock-based compensation expense included in the accompanying consolidated statements of operations (in thousands):
 
                         
    Year Ended December 31,  
    2009     2008     2007  
 
Product cost of revenue
  $ 84     $ 39     $ 22  
Services cost of revenue
    171       104       69  
                         
Stock-based compensation expense included in cost of revenue
    255       143       91  
                         
Research and development
    995       735       408  
Sales and marketing
    1,921       1,390       1,011  
General and administrative
    3,000       2,218       1,136  
                         
Stock-based compensation expense included in operating expenses
    5,916       4,343       2,555  
                         
Total stock-based compensation expense
  $ 6,171     $ 4,486     $ 2,646  
                         
 
Stock Options
 
The following table summarizes stock option activity under the 2002 Plan and the 2007 Plan for the year ended December 31, 2009 (in thousands, except share and per share data):
 
                                         
                      Weighted
       
                      Average
       
                Weighted-
    Remaining
    Aggregate
 
    Number of
    Range of
    Average
    Contractual
    Intrinsic
 
    Shares     Exercise Prices     Exercise Price     Term     Value  
 
Outstanding at December 31, 2008
    3,296,322     $ 0.24 to 15.49     $ 5.26             $ 5,878  
Granted
    475,200       5.58 to 23.31       16.03                  
Exercised
    (1,079,232 )     0.24 to 15.49       3.62                  
Forfeited
    (150,252 )     2.03 to 19.11       8.82                  
                                         
Outstanding at December 31, 2009
    2,542,038     $ 0.24 to 23.31     $ 7.75