---

---

---

•	the evolution of the threat landscape facing our customers and prospects;

•	our ability to educate the market regarding the advantages of our virtual machine-based security solution;

•	our ability to maintain an adequate rate of revenue growth;

•	our future financial and operating results;

•	our business plan and our ability to effectively manage our growth and associated investments;

•	beliefs and objectives for future operations;

•	our ability to expand our leadership position in advanced network security;

•	our ability to attract and retain customers;

•	our ability to further penetrate our existing customer base;

•	our expectations concerning renewal rates for subscriptions and services by existing customers;

•	our ability to maintain our competitive technological advantages against new entrants in our industry;

•	our ability to timely and effectively scale and adapt our existing technology;

•	our ability to innovate new products and bring them to market in a timely manner;

•	our ability to maintain, protect, and enhance our brand and intellectual property;

•	our ability to expand internationally;

•	the reorganization of our corporate structure and intercompany relationships and our ability to improve our overall effective tax rate;

•	the effects of increased competition in our market and our ability to compete effectively;

•	cost of revenue, including changes in costs associated with production, manufacturing and customer support;

•	operating expenses, including changes in research and development, sales and marketing, and general and administrative expenses;

•	anticipated income tax rates;

•	sufficiency of cash to meet cash needs for at least the next 12 months;

•	our ability to maintain our good standing with the United States and international governments and capture new contracts;

•	costs associated with defending intellectual property infringement and other claims, such as those claims discussed in “Business—Legal Proceedings”;

•	our expectations concerning relationships with third parties, including channel partners and logistics providers;

•	the release of new products;

•	economic and industry trends or trend analysis;

•	the attraction and retention of qualified employees and key personnel;

•	future acquisitions of or investments in complementary companies, products, subscriptions or technologies; and

•	the effects of seasonal trends on our results of operations.

---

---

•

First, Mandiant provided endpoint-based advanced threat detection and response solutions, and we have continued to develop Mandiant’s endpoint technology as part of our comprehensive advanced security platform. The integration of threat intelligence from our endpoint products with our web, email, file and mobile platforms enables security teams to enhance their visibility and make faster, more accurate decisions about potential security incidents occurring across an organization’s network and endpoints.

•

Second, Mandiant brings significant depth in intelligence on next-generation attacks and threat actors, which is continually gathered from ongoing monitoring of more than four million endpoints and by incident response and remediation teams that serve on the front lines combating the most advanced attacks. When this depth of threat intelligence is paired with the breadth of the FireEye real-time threat intelligence gathered from more than nine million virtual machines, organizations will have robust detection and contextual information about attempted attacks, including the level of risk, the identity of the attackers, and the intended target of the attacks.

•

Third, Mandiant’s team of highly skilled incident response experts has performed hundreds of incident response investigations across numerous industries at some of the largest organizations in the world. In addition, Mandiant brings its Managed Defense monitoring service to FireEye. The addition of these skills and expertise significantly expands our ability to offer value-added services to our customers.

---

•	Threat Prevention Platform. Our Threat Prevention Platform consists of vector-specific appliance solutions that provide comprehensive next-generation threat protection, from network to endpoint, for both inbound and outbound network traffic

---

•

Network Threat Prevention Platform (NX Series). Our Network Security NX Series appliances are deployed in-line at enterprise Internet access points to analyze all web traffic. Utilizing our MVX engine, these appliances identify and block next-generation threats deeply embedded inside web traffic, create real-time protection descriptors from the identified threats, and capture potential multi-protocol outbound communication data from threats that may already be inside the network. Our MVX engine detects advanced attacks exploiting unknown vulnerabilities as well as malicious code embedded in common Web and multimedia content. Our MVX engine executes suspicious software against a range of browsers, plug-ins, applications, and operating environments that are instrumental in tracking malicious actions. As potential threats can sometimes enter the network via user devices and may have been resident in the network previously, our MVX engine also analyzes outbound traffic for threats that may attempt to extract sensitive information or enable control of devices within the network by communicating with servers. Using our MVX engine, our Network Security platform confirms zero-day attacks, generates real-time security intelligence and captures dynamic callback destinations to defend against attacks. In September 2013, we introduced the NX 10000, a multi-gigabit throughput appliance that can be deployed in-line at Internet egress points to block Web exploits and outbound multi-protocol callbacks. In December 2013, we introduced our NX 900 to enable threat protection at various remote and branch offices as well as at the homes of an organization’s executive officers and key personnel. In June 2014, we introduced the Network Threat Prevention Platform with IPS to consolidate advanced threat prevention with traditional security. This optimizes spend, reduces false positives illuminating attacks hidden in noise, and enables compliance while driving security across known and unknown threats. In September 2014, we introduced the NX 7500 with support for Windows and Mac OSX on the same appliance.

•

Email Threat Prevention Platform (EX Series). Our Email Threat Prevention EX Series appliances detect and stop advanced attacks that exploit unknown operating system, browser, and application vulnerabilities as well as malicious code embedded in email content. Using our MVX engine, these appliances analyze email content as well as all email attachments, including all common file and archive formats. In particular, these appliances secure networks against spear phishing emails, which bypass traditional anti-spam and reputation-based technologies. Spear phishing attacks use individually targeted content to trick users into clicking on a malicious link or opening a document, and are frequently used by cybercriminals to extract sensitive information such as user IDs and passwords. Our MVX engine actively executes, and is able to quickly identify, links to compromised websites and malicious attachments and blocks spear-phishing emails.

•

Endpoint Threat Prevention Platform (HX Series). Our Endpoint Threat Prevention Platform is an appliance and endpoint agent-based system that equips security organizations to detect, analyze and resolve security incidents on desktops, laptops and other end-user devices using the threat detection algorithms of the MVX engine. Threat intelligence and alerts are correlated between our Network Threat Prevention and Endpoint Threat Prevention platforms to provide visibility across an organization and enable rapid containment. Additionally, the HX agent collects forensic data necessary for investigation and analysis of attacks. Our Endpoint Threat Prevention can be configured to sweep for indicators of compromise at regular intervals to identify new attacks and compromised devices and is a component of our FireEye as a Service offering.

•

File Content Security (FX Series). Our FX Series appliances analyze network file servers to detect and quarantine malicious software brought into the network by users within the organization through technologies, such as online file sharing and associated collaboration tools, which bypass traditional network security solutions. These appliances analyze files using our MVX engine and detect malicious code embedded in common file types, including PDF, Microsoft Office documents, archived files, and multimedia content such as QuickTime and other video, audio and image files. Our FX Series appliances perform recursive, scheduled, and on-demand scanning of accessible network file servers to continuously identify and quarantine resident threats.

•

Mobile Threat Prevention (MX Series). Our Mobile Threat Prevention product allows organizations to identify malicious mobile apps and assess risk levels for other apps for Android and Apple devices. Using our MVX technology, we have threat intelligence from more than seven million mobile applications and assigned security and privacy risk levels for each. Our Mobile Threat Prevention platform includes a downloadable app and a management solution that can integrate with a number of the major mobile device management solutions. The management solution is available as an on-premise appliance or a cloud-based solution.

•	Security Management Products

•	Central Management System. Our Central Management System, or CMS, unifies reporting, configuration, and threat intelligence sharing and manages the overall deployment of the components of our Threat Prevention Platform. CMS appliances distribute threat intelligence from the DTI cloud and provide cross-enterprise threat data correlation to identify

---

•

Threat Analytics Platform (TAP). Our Threat Analytics Platform, or TAP, is a cloud-based solution that enables security teams to identify and effectively respond to cyber threats by correlating enterprise-generated security event data from any security product with real-time threat intelligence from FireEye. The platform is designed to scale by keeping as much data online and searchable as business needs demand. Search results can be exported from the user interface for use in other incident response management tools as needed.

•	Security Forensics Products

•

Forensic Analysis System (AX Series). Our Forensic Analysis System provides powerful auto-configured test environments to allow forensics teams to manually execute and inspect advanced malware, zero-day, and other advanced cyber-attacks embedded in files, email attachments, and Web objects. The Forensic Analysis System inspects single files or batches of files for malware and tracks outbound connection attempts across multiple protocols. In virtual execution mode, the Forensic Analysis System analyzes the execution path of a particular malware sample to generate a dynamic and anonymized profile that can be distributed to other FireEye appliances on the network. Malware attack profiles include identifiers of malware code, exploit URLs, and other sources of infections and attacks. To fully analyze the behavior of every unknown file, the Forensic Analysis System provides full malware life cycle analysis. Larger customers typically purchase the product to enable advanced and deeper analysis of potential malicious software outside of the real-time traffic scanning done by our Threat Prevention appliances.

•

Network Forensics Platform (PX Series). Our Network Forensics Platform appliances complement our Threat Prevention Platform by capturing and indexing full packets at extremely rapid speeds to allow organizations to investigate and resolve security incidents. Using our Network Forensics Platform in conjunction with our Threat Prevention Platform, security analysts can detect threats and view specific packets and sessions before, during, and after the attack to confirm what may have triggered a malware download or callback. This information can be used for rapid response and to develop future protective strategies.

•

Investigation Analysis System (AI Series). Our Investigative Analysis System provides a centralized, easy-to-use analytical interface to the Network Forensics Platform to provide data visualization and in-depth analytics to security analysts in a single centralized dashboard. Our Investigation Analysis System supports a number of configurations for single node and distributed architectures to optimize bandwidth and performance of metadata aggregation, queries, and analytics.

•	Product Subscriptions

•	Threat Intelligence Subscriptions

---

•	Security-as-a-Service Offerings

•	Customer Support and Consulting Services

•

Incident response and related consulting services. We have a team of cyber security experts to quickly respond to customers that have experienced a breach and help them understand the scope of the incident and quickly remediate the attack. Our cyber security experts will inform customers who is behind the attack (i.e., organized crime, nation state or malicious insider) and how much damage was done, and will work with them to recover from the incident while minimizing the impact of the event on the organization. We have performed hundreds of successful security investigations across all industries, organization sizes and technical environments. As part of our services, we can help customers scope their own security programs, provide litigation support and forensics, and assist with threat and vulnerability assessments. These consulting services are marketed under the Mandiant brand.

•

Training and professional services. We offer training services to our customers and channel partners through our training department and authorized training partners. These services are designed to provide education regarding implementation, use and functionality, and maintenance and support of our products. We also provide training on managing the stages of our sales cycle for our channel partners. We offer professional services to customers for large implementations where expert technical resources are required. We provide professional services both directly to our customers, and indirectly through our authorized partners, who provide similar services to the end-customer.

•

Customer Support and Maintenance Services. We offer technical support on our products and subscriptions. We provide multiple levels of support and have regional support centers located across the globe to help customers solve technical challenges that they may encounter. In addition to post-sales support activities, our support organization works with our product management and engineering teams to ensure the attainment of defined pre-requisite quality levels for our products and services prior to release. Like our subscription services, our support and maintenance contracts have terms of either one or three years.

---

•	Automatically investigate alerts from network- devices. Create IOCs automatically from alerts generated in network devices. Confirm threat alerts at all endpoints to identify critical issues and investigate tens or hundreds of thousands of endpoints in a matter of minutes.

•	Agent Anywhere. Investigate any endpoint even when they’re not on your network.

---

•	Easy to understand interface. Transform front-line analysts into investigators by making it simple and straightforward to quickly interpret data and follow up appropriately.

•	Unified endpoint dashboard. In addition, our Endpoint Threat Prevention platform provides a unified dashboard that allows administrators to view malicious activity both on conventional endpoints like PCs as well as mobile devices.

---

•	large networking vendors such as Cisco and Juniper that may emulate or integrate features similar to ours into their own products;

•	large companies such as Intel, IBM and HP that have acquired large IT security specialist vendors in recent years and have the technical and financial resources to bring competitive solutions to the market;

•	independent security vendors such as Palo Alto Networks and Trend Micro that offer products that claim to perform similar functions to our platform;

•	small and large companies, including new entrants, that offer point solutions that compete with some of the features present in our platform;

•	providers of traditional IT security solutions, such as Symantec, that we may compete with in the future; and

•	other providers of incident response services.

---

•	ability to deliver the combination of technology, intelligence and expertise necessary to combat the current threat landscape;

•	ability to detect next-generation threats by overcoming the limitations of signature-based approaches;

•	efficacy of the virtual machine technology in terms of detecting the maximum number of threats;

•	scalability, throughput and overall performance of the virtual machine technology;

•	visibility into all stages of an attack, especially the exploit phase;

•	ability to achieve low false-positive rates;

•	solutions that help detect, prevent, analyze and respond to the most advanced threats;

•	breadth and richness of the shared threat data the appliances have access to;

•	ability to process all data entering a network on premise;

•	brand awareness and reputation;

•	strength of sales and marketing efforts;

•	product extensibility and ability to integrate with other technology infrastructures;

•	price and total cost of ownership; and

•	ability to provide a comprehensive solution of products and services for detecting, preventing and resolving advanced cybersecurity threats.

---

---

•	effectively attracting, training and integrating a large number of new employees, particularly members of our sales and management teams;

•	further improving our key business applications, processes and IT infrastructure, including our data centers, to support our business needs;

•	enhancing our information and communication systems to ensure that our employees and offices around the world are well coordinated and can effectively communicate with each other and our growing base of channel partners and customers;

•	improving our internal control over financial reporting and disclosure controls and procedures to ensure timely and accurate reporting of our operational and financial results; and

•	appropriately documenting and testing our IT systems and business processes.

•	maintain and expand our customer base and the ways in which customers use our products and services;

•	expand revenue from existing customers through increased or broader use of our products and services within their organizations;

•	convince customers to allocate a fixed portion of their annual IT budgets to our products and services;

•	improve the performance and capabilities of our platform through research and development;

•	effectively expand our business domestically and internationally, which will require that we rapidly expand our sales force and service professionals and fill key management positions, particularly internationally; and

•	successfully compete with other companies that currently provide, or may in the future provide, solutions like ours that protect against next-generation advanced cyber attacks.

---

•	a loss of existing or potential customers or channel partners;

•	delayed or lost revenue and harm to our financial condition and results of operations;

•	a delay in attaining, or the failure to attain, market acceptance;

•	the expenditure of significant financial and product development resources in efforts to analyze, correct, eliminate, or work around errors or defects, to address and eliminate vulnerabilities, or to identify and ramp up production with alternative third-party manufacturers;

•	an increase in warranty claims, or an increase in the cost of servicing warranty claims, either of which would adversely affect our gross margins;

•	harm to our reputation or brand; and

•	litigation, regulatory inquiries, or investigations that may be costly and further harm our reputation.

---

•	diversion of management time and focus from operating our business to addressing acquisition integration challenges;

•	coordination of research and development and sales and marketing functions;

•	integration of product and service offerings;

•	retention of key employees from the acquired company;

•	changes in relationships with strategic partners as a result of product acquisitions or strategic positioning resulting from the acquisition;

•	cultural challenges associated with integrating employees from the acquired company into our organization;

•	integration of the acquired company’s accounting, management information, human resources and other administrative systems;

•	the need to implement or improve controls, procedures, and policies at a business that prior to the acquisition may have lacked sufficiently effective controls, procedures and policies;

•	financial reporting, revenue recognition or other financial or control deficiencies of the acquired company that we don’t adequately address and that cause our reported results to be incorrect;

•	liability for activities of the acquired company before the acquisition, including intellectual property infringement claims, violations of laws, commercial disputes, tax liabilities and other known and unknown liabilities;

•	unanticipated write-offs or charges; and

•	litigation or other claims in connection with the acquired company, including claims from terminated employees, customers, former stockholders or other third parties.

---

•	our ability to attract new and retain existing customers;

•	the budgeting cycles, seasonal buying patterns and purchasing practices of customers;

•	the timing of shipments of our products and length of our sales cycles;

•	changes in customer or reseller requirements or market needs;

•	changes in the growth rate of the IT security market, particularly the market for threat protection solutions like ours that target next-generation advanced cyber attacks;

•	the timing and success of new product and service introductions by us or our competitors or any other change in the competitive landscape of the IT security market, including consolidation among our customers or competitors;

•	the level of awareness of IT security threats, particularly advanced cyber attacks, and the market adoption of our platform;

•	deferral of orders from customers in anticipation of new products or product enhancements announced by us or our competitors;

•	our ability to successfully expand our business domestically and internationally;

•	reductions in customer renewal rates for our subscriptions;

•	decisions by organizations to purchase IT security solutions from larger, more established security vendors or from their primary IT equipment vendors;

•	changes in our pricing policies or those of our competitors;

•	any disruption in, or termination of, our relationship with channel partners;

•	our inability to fulfill our customers’ orders due to supply chain delays or events that impact our manufacturers or their suppliers;

•	insolvency or credit difficulties confronting our customers, affecting their ability to purchase or pay for our products, subscriptions and services, or confronting our key suppliers, particularly our sole source suppliers, which could disrupt our supply chain;

•	the cost and potential outcomes of existing and future litigation, including, without limitation, the purported stockholder class action lawsuits described under the "Litigation" subheading in Note 9 Commitments and Contingencies contained in the "Notes to Condensed Consolidated Financial Statements" in Item 8 of Part II of this Annual Report on Form 10-K;

•	seasonality in our business;

•	general economic conditions, both domestic and in our foreign markets;

•	future accounting pronouncements or changes in our accounting policies or practices;

---

•	the amount and timing of operating costs and capital expenditures related to the expansion of our business;

•	a change in our mix of products, subscriptions and services; and

•	increases or decreases in our expenses caused by fluctuations in foreign currency exchange rates.

•	research and development related to our platform, including investments in our research and development team;

•	sales and marketing, including a significant expansion of our sales organization, particularly in international markets;

•	international expansion of our business;

•	expansion of our professional services organization; and

•	general administration expenses, including legal and accounting expenses related to being a public company.

---

•	greater name recognition, longer operating histories and larger customer bases;

•	larger sales and marketing budgets and resources;

•	broader distribution and established relationships with channel and distribution partners and customers;

•	greater customer support resources;

•	greater resources to make acquisitions;

•	lower labor and research and development costs;

•	larger and more mature intellectual property portfolios; and

•	substantially greater financial, technical and other resources.

---

---

---

•	increased purchasing power and leverage held by large customers in negotiating contractual arrangements with us;

•	more stringent or costly requirements imposed upon us in our support service contracts with such customers, including stricter support response times and penalties for any failure to meet support requirements;

•	more complicated implementation processes;

•	longer sales cycles and the associated risk that substantial time and resources may be spent on a potential customer that ultimately elects not to purchase our platform or purchases less than we hoped;

•	closer relationships with, and dependence upon, large technology companies who offer competitive products; and

•	more pressure for discounts and write-offs.

---

---

---

•	selling to governmental agencies can be highly competitive, expensive and time consuming, often requiring significant upfront time and expense without any assurance that such efforts will generate a sale;

•	government certification requirements applicable to our products may change and, in doing so, restrict our ability to sell into the U.S. federal government sector until we have attained the revised certification;

•	government demand and payment for our products and services may be impacted by public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our products and services;

•	we sell our platform to governmental agencies through our indirect channel partners, and these agencies may have statutory, contractual or other legal rights to terminate contracts with our distributors and resellers for convenience or due to a default, and any such termination may adversely impact our future results of operations;

•	governments routinely investigate and audit government contractors’ administrative processes, and any unfavorable audit could result in the government refusing to continue buying our platform, which would adversely impact our revenue and results of operations, or institute fines or civil or criminal liability if the audit were to uncover improper or illegal activities; and

•	governments may require certain products to be manufactured in the United States and other relatively high-cost manufacturing locations, and we may not manufacture all products in locations that meet these requirements, affecting our ability to sell these products to governmental agencies.

---

---

---

•	develop or enhance our products and subscriptions;

•	continue to expand our sales and marketing and research and development organizations;

•	acquire complementary technologies, products or businesses;

•	expand operations, in the United States or internationally;

•	hire, train and retain employees; or

•	respond to competitive pressures or unanticipated working capital requirements.

---

•	greater difficulty in enforcing contracts and managing collections, as well as longer collection periods;

•	higher costs of doing business internationally, including costs incurred in establishing and maintaining office space and equipment for our international operations;

•	fluctuations in exchange rates between the U.S. dollar and foreign currencies in markets where we do business;

•	management communication and integration problems resulting from cultural and geographic dispersion;

•	risks associated with trade restrictions and foreign legal requirements, including any importation, certification, and localization of our platform that may be required in foreign countries;

•	greater risk of unexpected changes in regulatory practices, tariffs, and tax laws and treaties;

•	compliance with anti-bribery laws, including, without limitation, compliance with the U.S. Foreign Corrupt Practices Act of 1977, as amended, the U.S. Travel Act and the UK Bribery Act 2010, violations of which could lead to significant fines, penalties and collateral consequences for our company;

•	heightened risk of unfair or corrupt business practices in certain geographies and of improper or fraudulent sales arrangements that may impact financial results and result in restatements of, or irregularities in, financial statements;

•	the uncertainty of protection for intellectual property rights in some countries;

•	general economic and political conditions in these foreign markets;

•	foreign exchange controls or tax regulations that might prevent us from repatriating cash earned outside the United States;

•	political and economic instability in some countries; and

•	double taxation of our international earnings and potentially adverse tax consequences due to changes in the tax laws of the United States or the foreign jurisdictions in which we operate.

---

---

---

•	announcements of new products, services or technologies, commercial relationships, acquisitions or other events by us or our competitors;

•	changes in how customers perceive the effectiveness of our platform in protecting against advanced cyber attacks or other reputational harm;

•	publicity concerning cyber attacks in general or high profile cyber attacks against specific organizations;

•	price and volume fluctuations in the overall stock market from time to time;

•	significant volatility in the market price and trading volume of technology and/or growth companies in general and of companies in the IT security industry in particular;

•	fluctuations in the trading volume of our shares or the size of our public float;

•	actual or anticipated changes or fluctuations in our results of operations;

•	whether our results of operations, and in particular, our revenue growth rates, meet the expectations of securities analysts or investors;

•	actual or anticipated changes in the expectations of investors or securities analysts, whether as a result of our forward-looking statements, our failure to meet such expectation or otherwise;

•	litigation involving us, our industry, or both;

•	regulatory developments in the United States, foreign countries or both;

•	general economic conditions and trends;

•	major catastrophic events;

•	sales of large blocks of our common stock; or

•	departures of key personnel.

---

---

•	a classified board of directors with three-year staggered terms, which could delay the ability of stockholders to change the membership of a majority of our board of directors;

•	the ability of our board of directors to issue shares of preferred stock and to determine the price and other terms of those shares, including preferences and voting rights, without stockholder approval, which could be used to significantly dilute the ownership of a hostile acquiror;

•	the exclusive right of our board of directors to elect a director to fill a vacancy created by the expansion of our board of directors or the resignation, death or removal of a director, which prevents stockholders from being able to fill vacancies on our board of directors;

•	a prohibition on stockholder action by written consent, which forces stockholder action to be taken at an annual or special meeting of our stockholders;

•	the requirement that a special meeting of stockholders may be called only by our board of directors, the chairperson of our board of directors, our chief executive officer or our president (in the absence of a chief executive officer), which could delay the ability of our stockholders to force consideration of a proposal or to take action, including the removal of directors;

•

the requirement for the affirmative vote of holders of at least 66 2/3% of the voting power of all of the then outstanding shares of the voting stock, voting together as a single class, to amend the provisions of our amended and restated certificate of incorporation relating to the management of our business (including our classified board structure) or certain provisions of our amended and restated bylaws, which may inhibit the ability of an acquiror to effect such amendments to facilitate an unsolicited takeover attempt;

•	the ability of our board of directors to amend the bylaws, which may allow our board of directors to take additional actions to prevent an unsolicited takeover and inhibit the ability of an acquiror to amend the bylaws to facilitate an unsolicited takeover attempt; and

•	advance notice procedures with which stockholders must comply to nominate candidates to our board of directors or to propose matters to be acted upon at a stockholders’ meeting, which may discourage or deter a potential acquiror from conducting a solicitation of proxies to elect the acquiror’s own slate of directors or otherwise attempting to obtain control of us.

---

---

---

---

(1)	Under our 2008 Stock Plan, certain participants may exercise options prior to vesting, subject to a right of a repurchase by us. All shares in the above table were shares repurchased as a result of us exercising this right and not pursuant to a publicly announced plan or program.

---

---

---

---

---

---

•	Product revenue. Our product revenue is generated from sales of our appliances which we recognize at the time of shipment, provided that all other revenue recognition criteria have been met.

•

Subscription and services revenue. Subscription and services revenue is generated primarily from our DTI cloud, FireEye-as-a-Service, support and maintenance services and other professional services. Our DTI cloud subscription is determined as a percentage of the price of the related appliance. We recognize revenue from subscriptions and support and maintenance services over the one or three year contract term, as applicable. Professional services revenue, which includes incident response, are generally offered on a time-and-material basis and are recognized as the services are delivered.

•	Cost of product revenue. Cost of product revenue primarily consists of costs paid to our third-party contract manufacturers for our appliances and personnel and other costs in our manufacturing operations department. Our cost of product revenue also

---

•	Cost of subscription and services revenue. Cost of subscription and services revenue consists of personnel costs for our global customer support organization and allocated costs. We expect our cost of subscription and services revenue to increase as our customer base grows and as we hire additional professional services personnel.

•

Research and development. Research and development expense consists primarily of personnel costs and allocated overhead. Research and development expense also includes prototype related expenses. We expect research and development expense to continue to increase in absolute dollars as we continue to invest in our research and product development efforts to enhance our product capabilities, address new threat vectors and access new customer markets, although such expense may fluctuate as a percentage of total revenue.

•

Sales and marketing. Sales and marketing expense consists primarily of personnel costs, incentive commission costs and allocated overhead. We expense commission costs as incurred. Sales and marketing expense also includes costs for market development programs, promotional and other marketing activities, travel, office equipment, depreciation of proof-of-concept evaluation units and outside consulting costs. We expect sales and marketing expense to continue to increase in absolute dollars as we increase the size of our sales and marketing organizations and expand our international operations, although such expense may fluctuate as a percentage of total revenue.

•

General and administrative. General and administrative expense consists of personnel costs, professional services and allocated overhead. General and administrative personnel include our executive, finance, human resources, facilities and legal organizations. Professional services consist primarily of legal, auditing, accounting and other consulting costs. We expect general and administrative expense to continue to increase in absolute dollars as we have recently incurred, and expect to continue to incur, additional general and administrative expenses as we grow our operations and comply with public company regulations, including higher legal, corporate insurance, and accounting expenses.

---

---

---

---

---

---

---

---

---

---

---

---

---

---

•	Fair Value of Common Stock. Because our common stock was not publicly traded until September 20, 2013, we were required to estimate the fair value of common stock for grants made prior to that date, as discussed in “Common Stock Valuations” below.

•	Risk-Free Interest Rate. We base the risk-free interest rate used in the Black-Scholes option-pricing model on the implied yield available on U.S. Treasury zero-coupon issues with a remaining term equivalent to that of the options for each option group.

•	Expected Term. The expected term represents the period that our stock-based awards are expected to be outstanding. We base the expected term assumption on our historical exercise behavior combined with estimates of the post-vesting holding period.

•

Volatility. We determine the price volatility factor based on the historical volatilities of our publicly traded peer group as we do not have a trading history for our common stock. Industry peers consist of several public companies in the technology industry that are similar to us in size, stage of life cycle, and financial leverage. We used the same set of peer group companies in all the relevant valuation estimates. We did not rely on implied volatilities of traded options in our industry peers’ common stock because the volume of activity was relatively low. We intend to continue to consistently apply this process using the same or similar public companies until a sufficient amount of historical information regarding the volatility of our own common stock share price becomes available, or unless circumstances change such that the identified companies are no longer similar to us, in which case, more suitable companies whose share prices are publicly available would be utilized in the calculation.

•	Dividend Yield. The expected dividend assumption is based on our current expectations about our anticipated dividend policy. Consequently, we used an expected dividend yield of zero.

---

---

---

---

---

---

---

---

---

---

---

---

---

---

•	Persuasive Evidence of an Arrangement Exists. We rely upon non-cancelable sales agreements and purchase orders to determine the existence of an arrangement.

•	Delivery has Occurred. We use shipping documents or transmissions of service contract registration codes to verify delivery.

•	The Fee is Fixed or Determinable. We assess whether the fee is fixed or determinable based on the payment terms associated with the transaction.

•	Collectability is Reasonably Assured. We assess collectability based on credit analysis and payment history.

---

---

•	Level 1: Observable inputs that reflect quoted prices (unadjusted) for identical assets or liabilities in active markets.

---

•

Level 2: Inputs that reflect quoted prices for identical assets or liabilities in less active markets; quoted prices for similar assets or liabilities in active markets; benchmark yields, reported trades, broker/dealer quotes, inputs other than quoted prices that are observable for the assets or liabilities; or inputs that are derived principally from or corroborated by observable market data by correlation or other means.

•	Level 3: Unobservable inputs that reflect our own assumptions incorporated in valuation techniques used to measure fair value. These assumptions are required to be consistent with market participant assumptions that are reasonably available.

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---