UNITED STATES SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

 

 

 

 

Form 10-K

 

 

 

Commission File Number

1-33350

 

 

 

 

SOURCEFIRE, INC.

(Exact name of Registrant as Specified in its Charter)

 

 

 

Registrant’s telephone number, including area code:

(410) 290-1616

 

Securities registered pursuant to Section 12(b) of the Act:

 

 

 

 

Securities registered pursuant to Section 12(g) of the Act: none

 

 

 

 

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act.  Yes o     No þ

 

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act.  Yes o     No þ

 

Indicate by check mark whether the registrant: (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days.  Yes þ     No o

 

Indicate by check mark if disclosure of delinquent filers pursuant to Item 405 of Regulation S-K is not contained herein, and will not be contained, to the best of registrant’s knowledge, in definitive proxy or information statements incorporated by reference in Part III of this Form 10-K or any amendment to this Form 10-K.  o

 

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, or a smaller reporting company. See the definitions of “large accelerated filer,” “accelerated filer” and “smaller reporting company” in Rule 12b-2 of the Exchange Act. (Check one):

 

(Do not check if a smaller reporting company)

 

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act).  Yes o     No þ

 

As of June 30, 2008, the aggregate market value of the registrant’s Common Stock held by non-affiliates, based upon the closing sale price of the Common Stock on the Nasdaq Global Market on such date, was approximately $133.8 million.

 

As of March 5, 2009, there were outstanding 25,927,183 shares of the registrant’s Common Stock.

 

DOCUMENTS INCORPORATED BY REFERENCE

 

Certain portions of the definitive Proxy Statement to be used in connection with the registrant’s 2009 Annual Meeting of Stockholders are incorporated by reference into Part III of this Form 10-K to the extent stated. That Proxy Statement will be filed within 120 days of registrant’s fiscal year ended December 31, 2008.

 

 

SOURCEFIRE, INC.
Form 10-K

TABLE OF CONTENTS

 

References in this Annual Report on Form 10-K to “Sourcefire,” “we,” “us”, “our” or “the Company” refer to Sourcefire, Inc. and its subsidiaries, taken as a whole, unless a statement specifically refers to Sourcefire, Inc.

 

FORWARD-LOOKING STATEMENTS

 

This annual report contains both historical and forward-looking statements. All statements other than statements of historical fact are, or may be deemed to be, forward-looking statements. For example, statements concerning projections, predictions, expectations, estimates or forecasts and statements that describe our objectives, plans or goals are or may be forward-looking statements. These forward-looking statements reflect management’s current expectations concerning future results and events and generally can be identified by use of expressions such as “may,” “will,” “should,” “could,” “would,” “predict,” “potential,” “continue,” “expect,” “anticipate,” “future,” “intend,” “plan,” “foresee,” “believe,” “estimate,” and similar expressions, as well as statements in future tense. These forward-looking statements include, but are not limited to, the following:

 

 

The forward-looking statements included in this annual report are made only as of the date of this annual report. We expressly disclaim any intent or obligation to update any forward-looking statements to reflect subsequent events or circumstances. Forward-looking statements involve known and unknown risks, uncertainties and other factors that may cause our actual results, performance or achievements to be different from any future results, performance and achievements expressed or implied by these statements. These risks and uncertainties include, but are not limited to, those discussed in Item 1A. Risk Factors of this annual report.

 

 

 

 

We operate in an industry in which it is difficult to obtain precise industry and market information. Although we have obtained some industry data from outside sources that we believe to be reliable, in certain cases we have based statements contained in this annual report regarding our industry and our position in the industry on our estimates concerning, among other things, our customers and competitors. These estimates are based on our experience in the industry, conversations with our principal suppliers and customers and our own investigations of market conditions. The statistical data contained in this annual report regarding the network security software industry are our statements, which are based on data we obtained from industry sources.

 

 

 

 

SOURCEFIRE^®, SNORT^®, the Sourcefire logo, the Snort and Pig logo, SECURITY FOR THE REAL WORLD^tm, SOURCEFIRE DEFENSE CENTER^tm, SOURCEFIRE 3D^®, RNA^tm, RUA^tm, ClamAV^®, SOURCEFIRE SOLUTIONS NETWORK^tm and certain other trademarks and logos are trademarks or registered trademarks of Sourcefire, Inc. in the United States and other countries. This annual report also refers to the products or services of other companies or persons by the trademarks and trade names used and owned by those companies or persons.

 

BUSINESS

 

 

Overview

 

We are a leading provider of Enterprise Threat Management, or ETM, intelligent security infrastructure solutions for information technology, or IT, environments of commercial enterprises (such as healthcare, financial services, manufacturing, energy, education, retail and telecommunications) and federal and state government organizations. The Sourcefire 3D^® System — comprised of multiple Sourcefire hardware and software product offerings — provides a comprehensive, intelligent approach to network protection that equips our customers with an efficient and effective layered security defense — protecting computer network assets before, during and after an attack.

 

Since 2001, Sourcefire has garnered a reputation in the network security industry of being a staunch advocate for open source. Over the years, this has developed into a key competitive distinction for Sourcefire as we now manage two of the security industry’s leading open source initiatives, Snort^® and ClamAV^®. First published in 1998 by Sourcefire founder and Chief Technology Officer, Martin Roesch, open source Snort has rapidly become the de facto standard for intrusion detection and prevention. With over 225,000 registered users, an increase of more than 30% in 2008, over 3.7 million downloads, and embraced by more than 100 network security providers, more organizations use Snort than any other intrusion prevention system, or IPS, engine in the world. Because of its wide availability, Snort is also the standard technology used in colleges and universities worldwide to teach network security.

 

Sourcefire embraces open source security as a foundation, but extends that foundation by adding enterprise-class manageability, scalability, and performance. Many Sourcefire 3D System customers, for example, start out using open source Snort, but graduate to Sourcefire’s commercial offerings to gain more efficient and effective network security capabilities. By incorporating open source security as a foundation in Sourcefire’s commercial product offerings, Sourcefire can:

 

 

Sourcefire sells its network security solutions to a diverse customer base that includes Fortune 1000 companies, Global 500 companies, U.S. government agencies and small and mid-size businesses. For the years ended December 31, 2008, 2007 and 2006, we generated approximately 76%, 75% and 81% of our revenue from customers in the United States and 24%, 25% and 19% from customers outside of the United States, respectively. We have expanded our international and indirect distribution channels and, in the future, we expect to increase sales outside of the United States and to generate an increasing portion of product revenues through resellers, distributors and other partners. We increased our total revenue from $55.9 million in 2007 to $75.7 million in 2008, representing a growth rate of 35%. For the year ended December 31, 2008, product revenue and services revenue represented 60% and 40% of our total revenue, respectively. We manage our operations on a consolidated basis for purposes of assessing performance and making operating decisions. Accordingly, we do not have reportable segments of our business.

Our Industry

 

According to a third party IT market research firm, Gartner, the security software and network security equipment markets are forecasted to generate $21.7 billion in 2009. Gartner also estimates that our core intrusion prevention market was approximately $913 million in 2008 and is projected to grow to $1.5 billion in 2011, representing a compound annual growth rate of 14%. We expect that demand for IT security solutions will continue to rise as organizations seek to address various growing and evolving security challenges, including:

 

Greater Sophistication, Severity and Frequency of Network Attacks.  The growing use of the Internet as a business tool has required organizations to increase the number of access points to their networks, which has made vast amounts of critical information more vulnerable to attack. Theft of sensitive information for financial gain motivates network attackers, who derive profit through identity theft, credit card fraud, money laundering, extortion, intellectual property theft and other illegal means. These profit-motivated attackers, in contrast to the hobbyist hackers of the past, are employing much more sophisticated tools and techniques to generate profits for themselves and their well-organized and well-financed sponsors. Their attacks are increasingly difficult to detect and their tools often establish footholds on compromised network assets with little or no discernible effect, facilitating future access to the assets and the networks on which they reside.

 

Increasing Risks from Unknown Vulnerabilities.  Vulnerabilities in computer software that are discovered by network attackers before they are discovered by security and software vendors represent a tremendous risk. These uncorrected flaws can leave networks largely defenseless and open to exploitation. According to the Computer Emergency Response Team Coordination Center, or CERT-CC, the trends in the rate of vulnerability disclosure are particularly alarming, with the National Vulnerability Database, or NVD, showing a Common Vulnerabilities and Exposures, or CVE, count of 35,413 in early 2009.

 

Diverse Demands on Security Administrators.  The proliferation of targeted security solutions such as firewalls, intrusion prevention systems, URL filters, spam filters and anti-spyware solutions, while critical to enhancing network security, create significant administrative burdens on personnel who must manage numerous disparate technologies that are seldom integrated and often difficult to use. Most network security products require manual, labor intensive incident response and investigation by security administrators, especially when “false positive” results are generated. Compounding these resource constraint issues, many organizations are increasingly challenged by the loss of key personnel as the demand for security experts has risen dramatically in traditional corporate settings, government agencies and the growing number of start-up security companies.

 

Heightened Government and Industry Regulation.  Rapidly growing government regulation mandates compliance with increased requirements for network security, escalating demand for security solutions that both meet compliance requirements and reduce the burden of compliance reporting and enforcement. From regulations which protect personal data such as the Payment Card Industry Data Security Standard, or PCI DSS, the Health Insurance Portability and Accountability Act of 1996, or HIPAA, California’s SB1386 and the Gramm-Leach-Bliley Act, or GLBA, to the Sarbanes-Oxley Act of 2002 for risk management and the Federal Information Security Management Act, or FISMA, designed to protect national defense initiatives, ensuring continuous compliance across multiple regulatory standards can be overwhelming and the costs staggering.

 

Increasing Visibility of Negligence Lawsuits.  Faced with an ever-growing list of laws and regulations, organizations can no longer “plead ignorance” when defending corporate negligence lawsuits resulting from internal and external security breaches. Today’s enterprises must comply with a series of government and/or industry regulations defining best practices for network security. Achieving compliance with all manner of regulations is a complex and costly issue for nearly every organization.

 

Our Products

 

Sourcefire’s commercial hardware and software products are marketed and sold as components of the Sourcefire 3D System. Our 3D System is comprised of the following hardware and software product offerings:

 

Sourcefire Defense Center^® — The nerve center of the Sourcefire 3D System, Defense Center unifies critical network security functions including event monitoring, correlation, and prioritization with network

and user intelligence for forensic analysis, trends analysis, reporting and alerting. Defense Center is highly extensible, providing application programming interfaces, or APIs, to interoperate with a variety of third-party systems, such as firewalls, routers, Security Information Event Management, or SIEMs, trouble ticketing and patch management systems. Using Defense Center, customers can control multiple Sourcefire 3D Sensors from a single management console while aggregating and analyzing security and compliance events from across the organization.

 

Sourcefire 3D^® Sensors — With processing speeds ranging from 5 megabytes per second, or Mbps, to 10 gigabytes per second, or Gbps, Sourcefire 3D Sensors are highly scalable, fault-tolerant appliances responsible for processing Sourcefire IPS, RNA, RUA and NetFlow Analysis software applications. Sourcefire 3D Sensors are available with a variety of copper and fiber interfaces to meet the connectivity needs of virtually any organization.

 

 

Sourcefire Vulnerability Research Team Subscriptions — The Sourcefire Vulnerability Research Team, or VRT, is a team of experienced network security professionals responsible for writing, testing and publishing Snort rules to defend against both known and zero-day exploits. Open source Snort users can either subscribe on an annual basis to the VRT Certified Snort rules for real-time availability or access them at no charge on a 30-day delayed basis. The Certified VRT rules are always available on a real-time basis to Sourcefire commercial IPS customers as part of their customer support agreement.

Our Open Source Projects

 

In addition to our products, we manage the following open source projects:

 

Snort^® — The traffic inspection engine used in our intrusion prevention system is the open source technology called Snort. Martin Roesch, our founder and Chief Technology Officer, created Snort in 1998 and assigned all of his rights in the software to Sourcefire upon our incorporation. Our employees, including Mr. Roesch, have authored all major components of Snort, and we maintain control over the Snort project, including the principal Snort community forum, Snort.org. Snort, which has rapidly become a de facto industry standard for intrusion prevention, has been downloaded over 3.7 million times. We believe that a majority of the Fortune 100 companies and all of the 30 largest U.S. government agencies use Snort technology to monitor network traffic and that Snort is the most widely deployed intrusion prevention technology worldwide. The ubiquitous nature of the Snort user community represents a significant opportunity to sell our proprietary products to customers that require a complete enterprise solution.

 

ClamAV^® — Founded in 2001, and acquired by Sourcefire in 2007, ClamAV is one of the most commonly-used open source anti-malware products in the world. More than one million unique IP addresses download ClamAV updates daily from 124 mirror servers located in 44 countries. Renowned for its speed and accuracy, ClamAV has been adopted by network security solution and service providers worldwide and is currently integrated within leading enterprise solutions to identify deeply embedded threats such as viruses, trojans, spyware, and other forms of malware. Like Snort, ClamAV’s cutting edge security technology is a product of our open source model. In addition to continual innovations to the ClamAV anti-virus engine, the ClamAV core team and ClamAV community deliver daily signature updates to its growing virus database of over 500,000 signatures.

 

Our Services

 

In addition to our commercial product offerings and open source projects, we also offer the following services to aid our customers with installing and supporting our ETM solutions:

 

Sourcefire Customer Support — Sourcefire’s customer support is designed to ensure customer satisfaction with Sourcefire products. Sourcefire’s comprehensive support services include online technical support, over-the-phone support, hardware repair/advanced replacement, and ongoing software updates to Sourcefire products.

 

Sourcefire Product Services — Sourcefire offers a variety of professional services solutions to provide customers with best practices for planning, installing, configuring, and managing all components of the Sourcefire 3D System. The Sourcefire Product Services Team provides customers with individualized, highly concentrated attention that gives organizations a “running start” and lasting knowledge transfer.

 

Sourcefire Education & Certification — Sourcefire offers a variety of training programs to help security professionals using Sourcefire commercial or open source security solutions get the most out of their investment. Sourcefire training includes instructor-led and custom classes delivered at various locations around the world, onsite at customer premises, and online. In addition, Sourcefire provides a path for interested candidates to distinguish themselves through a certification program. Certification can be achieved on proprietary Sourcefire products as well as open source Snort, including an expert-level exam for those security professionals who want to obtain certification on both proprietary and open source technologies. Through training and testing, certification provides customers and their employees with an understanding of individual skills and experience with Sourcefire products and Snort.

 

Our Competitive Strengths

 

We are a leading provider of intelligence driven, open source network security solutions that enable our customers to protect their computer networks in an effective, efficient and highly automated manner. We apply the

Sourcefire 3D Systems approach — Discover, Determine, Defend — to network security through our comprehensive family of integrated products. Our competitive strengths include:

 

Comprehensive Network and User Intelligence.  Our innovative network security solution incorporates RNA, which provides persistent visibility into the composition, behavior, topology and risk profile of the network and serves as a platform for automated decision-making and network security policy enforcement. RNA performs passive, or non-disruptive, network discovery. This enables network behavior analysis and real-time compositional cataloging of network assets, including their configuration, thereby significantly increasing the network intelligence available to IT and security administrators. RNA also provides the foundation for Sourcefire’s innovative new Adaptive IPS strategy, which maximizes efficiency and effectiveness of the IPS by ensuring Snort rules are consistently enabled to protect actual network assets present on the protected network. With our RUA offering, Sourcefire is the first network security provider to incorporate user identity as a part of a comprehensive IPS solution. By pairing usernames with host IP addresses, Sourcefire customers can evaluate and mitigate security and compliance events in less time than it takes with an IP address alone.

 

Real-Time Approach to Network Security.  Our approach to network security enables our customers to secure their networks by providing real-time defense against both known and unknown threats. Our solution is designed to support a continuum of network security functions that span pre-attack hardening of assets, high fidelity attack identification and disruption and real-time compromise detection and incident response. In addition, our ability to confidently classify and prioritize threats in network traffic and determine the composition, behavior and relationships of network devices, or endpoints, allows us to reliably automate what are otherwise manual, time-intensive processes.

 

The Open Source Community.  The open source Snort user community, with over 225,000 registered users and over 3.7 million downloads to date, has enabled us to establish a strong market footprint. We believe that a majority of the Fortune 100 companies and all of the 30 largest U.S. government agencies use Snort technology to monitor network traffic and that Snort is the most widely deployed intrusion prevention technology worldwide. We believe that the combined user communities of both Snort and ClamAV provide us with significant benefits, including a broad threat awareness network, significant research and development leverage, and a large pool of security experts that are skilled in the use of our technologies. These communities enable us to more cost-effectively test new algorithms and concepts on a vast number of diverse networks and significantly expedite the process of product innovation. We believe that the broad acceptance of Snort and ClamAV makes us one of the most trusted sources of network security solutions.

 

Leading-Edge Performance.  Our solutions are built to maintain high performance across the network while also providing high levels of network security. Specifically, our solutions have the ability to process up to 10 Gbps of traffic with latency as low as 100 microseconds. Our IPS technology incorporates advanced traffic processing functionality, including packet acquisition, protocol normalization and target-based traffic inspection, which yields increased inspection precision and efficiency and enables more granular inspection of network traffic. The Defense Center supports event loads as high as 1,300 events per second, which we believe meets or exceeds the requirements of the most demanding enterprise customers.

 

Security Industry Intelligence.  The Sourcefire VRT is a group of leading edge network security experts who proactively discover, assess and respond to the latest trends in hacking activities, intrusion attempts and vulnerabilities. Some of the most renowned security professionals in the industry, including the authors of several standard security reference books, are members of the Sourcefire VRT. This team is also supported by the vast resources of the open source Snort and ClamAV communities, making it the largest group dedicated to advances in the network security industry. The VRT’s research and insights into network security are published on http://vrt-sourcefire.blogspot.com.

 

Broad Industry Recognition.  We have received numerous industry awards and certifications including recognition as a “leader” in the network IPS market, supporting our position as one of a select few companies that best combines “completeness of vision” with “ability to execute.” Sourcefire is currently the only major IPS provider to hold Network Intrusion Prevention certification from ICSA Labs, and RNA is one of only five network security products to receive the NSS Gold award, which is awarded by The NSS Group only to those products that are distinguished in terms of advanced or unique features, and which offer outstanding value. In

addition, our technology has achieved Common Criteria Evaluation Assurance Level 2, or EAL2, which is an international evaluation standard for information technology security products sanctioned by, among others, the International Standards Organization, the National Security Agency and the National Institute for Standards and Technology.

 

Our Growth Strategy

 

Our goal is to become the preeminent provider of open source and commercial network security solutions on a global basis by:

 

 

Awards and Certifications

 

We received numerous industry awards and certifications since January 1, 2008, including:

 

 

 

Customers

 

We provide products and services to a variety of end users worldwide. Our customers represent a broad spectrum of organizations within diverse sectors, including some of the world’s largest financial institutions, defense contractors, health care providers, IT companies, telecommunication companies and retailers, as well as U.S. and other national, state and local government agencies. Through December 31, 2008, over 2,100 customers have purchased our products and services. We view our primary customers as enterprises generally having annual revenue exceeding $500 million, though we are increasingly pursuing the sale of products and services to the mid-tier market, targeting organizations with annual revenue ranging from $250-$500 million.

 

For the year ended December 31, 2008, a federal reseller, immixGroup, accounted for 11% of total revenue. For the each of the years ended December 31, 2007 and 2006, no single customer accounted for over 10% of our revenues.

 

Sales and Marketing

 

We market and sell our appliances, software and services directly to our customers through our direct sales organization and indirectly through our resellers, distributors, MSSPs, government integrators and other partners.

 

Sales.  Our sales organization is organized into two geographic regions: North America and International. The North America sales force was divided into four groups: East, West, Federal and Mid-Tier. We maintain sales offices in Columbia, Maryland; Vienna, Virginia; Livonia, Michigan; Wokingham, United Kingdom; Tokyo, Japan; Singapore; Munich, Germany; Courbevoie Cedex, France; Hoofddorp, The Netherlands; Stockholm, Sweden; and Espoo, Finland. Our sales personnel are responsible for market development, including managing our relationships with resellers and distributors, assisting them in winning and supporting key customer accounts and acting as liaisons between the end customers and our marketing and product development organizations. We are also investing in the capacity of our international sales and channel personnel who will provide expanded levels of support to regions throughout Europe, Latin America, and the Asia/Pacific region.

 

Each sales organization is supported by experienced security engineers who are responsible for providing pre-sales technical support and technical training for the sales team and for our resellers, distributors and other partners. All of our sales personnel are responsible for lead follow-up and account management. Our sales personnel have quota requirements and are compensated with a combination of base salary and earned commissions.

 

Our indirect sales channel, comprised primarily of resellers and distributors, is supported by our sales force, including dedicated channel managers, with substantial experience in selling network security products to, and through, resellers and distributors. We maintain a broad network of value-added resellers throughout the United States and Canada, and distributors in Europe, Latin America and Asia/Pacific. Our arrangements with our resellers are non-exclusive, generally cover all of our products and services, and provide for appropriate discounts based on a variety of factors, including their transaction volume. These agreements are generally terminable at will by either party by providing the other party at least 90 days written notice. Our arrangements with distributors also are non-exclusive, are generally territory-specific, and provide discounts generally based upon the annual volume of their orders. We also provide our resellers and distributors with marketing assistance, technical training, and support.

 

Strategic Relationships.  We have established commercial relationships with several MSSPs, including Symantec, BT Counterpane, SecureWorks and VeriSign, to provide alternative distribution channels for our products.

 

Marketing.  Our marketing activities consist primarily of product marketing, product management and sales support programs. Marketing also includes advertising, our corporate website, trade shows, direct marketing and public relations. Our marketing program is designed to build the Sourcefire, Snort and ClamAV brands, increase customer awareness, generate leads and communicate our product advantages. We also use our marketing program to support the sale of our products through new channels and to new markets.

Research and Development

 

Our research and development efforts are focused both on improving and enhancing our existing network security products and on developing new products, features and functionality. We communicate with our customers and the open source community when considering product improvements and enhancements, and we regularly release new versions of our products incorporating these improvements and enhancements.

 

Vulnerability Research Team.  Our VRT is a group of leading edge network security experts working to proactively discover, assess and respond to the latest trends in network threats and security vulnerabilities. By gathering and analyzing this information, our VRT creates and updates Snort rules, ClamAV signatures, and security tools that are designed to identify, characterize and defeat attacks.

 

This team operates from our corporate headquarters in Columbia, Maryland. Our VRT participates in extensive collaboration with hundreds of network security professionals in the open source Snort community to learn of new vulnerabilities and exploits. The VRT also coordinates and shares information with other security authorities such as The SANS Institute, CERT-CC, iDefense (Verisign), SecurityFocus (Bugtraq; Symantec) and Common Vulnerabilities and Exposures (Mitre). Because of the knowledge and experience of our personnel comprising the Vulnerability Research Team, as well as its extensive coordination with the open source community, we believe that we have access to one of the largest and most sophisticated groups of IT security experts researching vulnerability and threats on a real-time basis.

 

Our research and development expense was $12.6 million, $11.9 million and $8.6 million for the years ended December 31, 2008, 2007 and 2006, respectively.

 

Manufacturing and Suppliers

 

We rely primarily on contract equipment manufacturers to assemble, integrate and test our appliances and to ship those appliances to our customers. We typically hold little inventory, relying instead on a just-in-time manufacturing philosophy. We rely on three primary integrators. We have contracted with Patriot Technologies, Inc. and Intelligent Decisions Inc., or IDI, to assemble, integrate and test all our product offerings operating on an Intel platform. Our agreement with Patriot expires on December 12, 2009, and will automatically renew for successive one-year periods unless either we or Patriot notify the other of an intent not to renew at least 90 days prior to expiration. Our agreement with IDI expires on January 31, 2010 and will automatically renew for successive one-year periods unless either party notifies the other party of its intent not to renew at least 30 days prior to the end of the term. Finally, we have contracted with Bivio Networks, Inc. to manufacture select high performance models of our appliances. Bivio is our sole supplier of these high performance models, such as our 3D3800, 3D5800 and 3D9800, which are the highest priced 3D Sensors that we offer. Our agreement with Bivio expires on February 10, 2010. All of these agreements are non-exclusive. We would be faced with the burden, cost and delay of having to qualify and contract with a new supplier if any of these agreements terminate or expire for any reason.

 

Intellectual Property

 

To protect our intellectual property, both domestically and abroad, we rely primarily on patent, trademark, copyright and trade secret laws. We hold four issued patents and have 32 patent applications pending for examination in the U.S. and foreign jurisdictions. The claims for which we have sought patent protection relate to methods and systems we have developed for intrusion detection and prevention used in our RNA, IPS and Defense Center products. In addition, we utilize contractual provisions, such as non-disclosure and non-compete agreements with our employees and consultants, as well as confidentiality procedures to strengthen our protection.

 

Despite our efforts to protect our intellectual property, unauthorized parties may attempt to copy aspects of our products or obtain and use information that we regard as proprietary. While we cannot determine the extent to which piracy of our software products occurs, we expect software piracy to be a persistent problem. In addition, the laws of some foreign countries do not protect our proprietary rights to as great an extent as do the laws of the United States, and many foreign countries do not enforce these laws as diligently as U.S. government agencies and private parties.

Seasonality

 

Our business is subject to seasonal fluctuations. For a discussion of seasonality affecting our business, see “Management’s Discussion and Analysis of Financial Condition and Results of Operations — Results of Operations — Seasonality.”

 

Competition

 

The market for network security monitoring, detection, prevention and response solutions is intensely competitive and we expect strong competition to continue in the future. Our chief competitors generally fall within the following categories:

 

 

Large companies may have advantages over us because of their longer operating histories, greater brand name recognition, larger customer bases or greater financial, technical and marketing resources. As a result, they may be able to adapt more quickly to new or emerging technologies and changes in customer requirements. They also have greater resources to devote to the promotion and sale of their products. In addition, these companies have reduced and could continue to reduce, the price of their security monitoring, detection, prevention and response products and managed security services, which intensifies pricing pressures within our market.

 

Several companies currently sell security software products (such as encryption, firewall, operating system security and virus detection software) that our customers and potential customers have broadly adopted. Some of these companies sell products that perform the same functions as some of our products. In addition, the vendors of operating system software or networking hardware may enhance their products to include functions similar to those that our products currently provide.

 

We believe that the principal competitive factors affecting the market for information security solutions include security effectiveness, manageability, technical features, performance, ease of use, price, scope of product offerings, professional services capabilities, distribution relationships and customer service and support. We believe that our solutions generally compete favorably with respect to such factors.

 

Employees

 

As of December 31, 2008, we had 281 employees, of whom 76 were engaged in product research and development, 125 were engaged in sales and marketing, 20 were engaged in customer service and support, 9 were engaged in professional services and 51 were engaged in administrative functions. Our current employees are not represented by a labor union and are not the subject of a collective bargaining agreement. We believe that we have good relations with our employees.

 

Corporate Information

 

Sourcefire, Inc. was incorporated in Delaware in 2001. We completed our initial public offering in March 2007. Our executive offices are located at 9770 Patuxent Woods Drive, Columbia, Maryland 21046, and our main telephone number is (410) 290-1616.

Available Information

 

Our internet address is www.sourcefire.com. We provide free of charge on the Investor Relations page of our web site access to our annual report on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K and amendments to those reports filed or furnished pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of 1934, as amended, as soon as reasonably practicable after they are electronically filed with or furnished to the Securities and Exchange Commission (“SEC”). Information appearing on our website is not incorporated by reference in and is not a part of this report.

 

 

Set forth below and elsewhere in this Annual Report on Form 10-K and in other documents we file with the Securities and Exchange Commission are risks and uncertainties that could cause actual results to differ materially from the results contemplated by the forward-looking statements contained in this Annual Report on Form 10-K. Because of the following factors, as well as other variables affecting our operating results, past financial performance should not be considered as a reliable indicator of future performance, and investors should not use historical trends to anticipate results or trends in future periods.

 

Economic, market and political conditions, including the current global financial crisis, may adversely affect our revenue and results of operations.

 

Our business depends significantly on a range of factors that are beyond our control. These include:

 

 

The ongoing global financial crisis affecting the banking system and financial and credit markets has resulted in the significant weakening of the economy in the United States and of the global economy, the lack of availability of credit, the reduction in business confidence and activity, and other factors that may affect one or more of the industries to which we sell our products and services. Our customers include, but are not limited to, financial institutions, defense contractors, health care providers, information technology companies, telecommunications companies and retailers. These customers may suffer from reduced operating budgets, which could cause them to defer or forego purchases of our products or services. In addition, negative effects on the financial condition of our resellers and distributors could affect their ability or willingness to market our product and service offerings; negative effects on the financial condition of our product manufacturers could affect their ability to manufacture our products; and declines in economic and market conditions could impair our short-term investment portfolio. Any of these developments would adversely affect our revenue and results of operations.

 

We have had operating losses since our inception, our operating expenses may continue to increase and we may never reach or maintain profitability.

 

We have incurred operating losses each year since our inception in 2001. Becoming profitable will depend in large part on our ability to generate and sustain increased revenue levels in future periods. Although our revenue has generally been increasing, there can be no assurances that we will become profitable in the near future or at any other time. We may never achieve profitability and, even if we do, we may not be able to maintain or increase our level of profitability. Our operating expenses may continue to increase in the future as we seek to expand our customer base, increase our sales and marketing efforts and continue to invest in research and development of our technologies and products. These efforts may be more costly than we expect and we may not be able to increase our revenue to offset our operating expenses. If we cannot increase our revenue at a greater rate than our expenses, we will not become or remain profitable.

 

We face intense competition in our market, especially from larger, better-known companies, and we may lack sufficient financial or other resources to maintain or improve our competitive position.

 

The market for network security monitoring, detection, prevention and response solutions is intensely competitive, and we expect competition to increase in the future. We may not compete successfully against our current or potential competitors, especially those with significantly greater financial resources or brand name recognition. Our chief competitors include: large software companies; software or hardware network infrastructure

companies; smaller software companies offering relatively limited applications for network and Internet security monitoring, detection, prevention or response; and small and large companies offering point solutions that compete with components of our product offerings.

 

For example, Cisco Systems, Inc., McAfee, Inc., 3Com Corporation, Juniper Networks, Inc. and IBM have intrusion detection or prevention technologies that compete with our product offerings. Large companies may have advantages over us because of their longer operating histories, greater brand name recognition, larger customer bases or greater financial, technical and marketing resources. As a result, they may be able to adapt more quickly to new or emerging technologies and changes in customer requirements. They also have greater resources to devote to the promotion and sale of their products than we have. In addition, these companies have aggressively reduced, and could continue to reduce, the price of their security monitoring, detection, prevention and response products, managed security services, and maintenance and support services which intensifies pricing pressures within our market.

 

Several companies currently sell software products (such as encryption, firewall, operating system security and virus detection software) that our customers and potential customers have broadly adopted. Some of these companies sell products that perform functions comparable to some of our products. In addition, the vendors of operating system software or networking hardware may enhance their products to include functions similar to those that our products currently provide. The widespread inclusion of features comparable to our software in operating system software or networking hardware could render our products less competitive or obsolete, particularly if such features are of a high quality. Even if security functions integrated into operating system software or networking hardware are more limited than those of our products, a significant number of customers may accept more limited functionality to avoid purchasing additional products such as ours.

 

One of the characteristics of open source software is that anyone can offer new software products for free under an open source licensing model in order to gain rapid and widespread market acceptance. Such competition can develop without the degree of overhead and lead time required by traditional technology companies. It is possible for new competitors with greater resources than ours to develop their own open source security solutions, potentially reducing the demand for our solutions. We may not be able to compete successfully against current and future competitors. Competitive pressure and/or the availability of open source software may result in price reductions, reduced revenue, reduced operating margins and loss of market share, any one of which could seriously harm our business.

 

New competitors could emerge and could impair our sales.

 

We may face competition from emerging companies as well as established companies who have not previously entered the market for network security products. Established companies may not only develop their own network intrusion detection and prevention products, but they may also acquire or establish product integration, distribution or other cooperative relationships with our current competitors. New competitors or alliances among competitors may emerge and rapidly acquire significant market share due to factors such as greater brand name recognition, a larger installed customer base and significantly greater financial, technical, marketing and other resources and experience.

 

Our quarterly operating results are likely to vary significantly and be unpredictable, in part because of the purchasing and budget practices of our customers, which could cause the trading price of our stock to decline.

 

Our operating results have historically varied significantly from period to period, and we expect that they will continue to do so as a result of a number of factors, most of which are outside of our control, including:

 

 

 

In particular, the network security technology procurement practices of many of our customers have had a measurable influence on the historical variability of our operating performance. Our prospective customers usually exercise great care and invest substantial time in their network security technology purchasing decisions. As a result, our sales cycles are long, generally between six and twelve months and often longer, which further impacts the variability of our results. Additionally, many of our customers have historically finalized purchase decisions in the last weeks or days of a quarter. A delay in even one large order beyond the end of a particular quarter can substantially diminish our anticipated revenue for that quarter. In addition, many of our expenses must be incurred before we generate revenue. As a result, the negative impact on our operating results would increase if our revenue fails to meet expectations in any period.

 

The cumulative effect of these factors may result in larger fluctuations and unpredictability in our quarterly operating results than in the operating results of many other software and technology companies. This variability and unpredictability could result in our failing to meet the revenue or operating results expectations of securities industry analysts or investors for a particular period. If we fail to meet or exceed such expectations for these or any other reasons, the market price of our shares could fall substantially, and we could face costly securities class action suits as a result. Therefore, you should not rely on our operating results in any quarter as being indicative of our operating results for any future period, nor should you rely on other expectations, predictions or projections of our future revenue or other aspects of our results of operations.

 

The market for network security products is rapidly evolving, and the complex technology incorporated in our products makes them difficult to develop. If we do not accurately predict, prepare for and respond promptly to technological and market developments and changing customer needs, our competitive position and prospects will be harmed.

 

The market for network security products is relatively new and is expected to continue to evolve rapidly. Moreover, many customers operate in markets characterized by rapidly changing technologies and business plans, which require them to add numerous network access points and adapt increasingly complex enterprise networks, incorporating a variety of hardware, software applications, operating systems and networking protocols. In addition, computer hackers and others who try to attack networks employ increasingly sophisticated new techniques to gain access to and attack systems and networks. Customers look to our products to continue to protect their networks against these threats in this increasingly complex environment without sacrificing network efficiency or causing significant network downtime. The software in our products is especially complex because it needs to effectively identify and respond to new and increasingly sophisticated methods of attack, without impeding the high network performance demanded by our customers. Although the market expects speedy introduction of software to respond to new threats, the development of these products is difficult and the timetable for commercial release of new products is uncertain. Therefore, we may in the future experience delays in the introduction of new products or new versions, modifications or enhancements of existing products. If we do not quickly respond to the rapidly changing and rigorous needs of our customers by developing and introducing on a timely basis new and effective products, upgrades and services that can respond adequately to new security threats, our competitive position and business prospects will be harmed.

 

If our new products and product enhancements do not achieve sufficient market acceptance, our results of operations and competitive position will suffer.

 

We spend substantial amounts of time and money to research and develop new products and enhance versions of Snort, the Defense Center and our 3D Sensor and RNA products to incorporate additional features, improve

functionality or add other enhancements in order to meet our customers’ rapidly evolving demands for network security in our highly competitive industry. When we develop a new product or an advanced version of an existing product, we typically expend significant money and effort upfront to market, promote and sell the new offering. Therefore, when we develop and introduce new or enhanced products, they must achieve high levels of market acceptance in order to justify the amount of our investment in developing and bringing the products to market.

 

Our new products or enhancements could fail to attain sufficient market acceptance for many reasons, including:

 

 

If our new products or enhancements do not achieve adequate acceptance in the market, our competitive position will be impaired, our revenue will be diminished and the effect on our operating results may be particularly acute because of the significant research, development, marketing, sales and other expenses we incurred in connection with the new product.

 

If existing customers do not make subsequent purchases from us or renew their support arrangements with us, or if our relationships with our largest customers are impaired, our revenue could decline.

 

In each of the years ended December 31, 2008 and 2007, existing customers that purchased additional products and services from us, whether for new locations or additional technology to protect existing networks and locations, generated a majority of our total revenue. Part of our growth strategy is to sell additional products to our existing customers and, in particular, to sell our RNA products to customers that previously bought our Intrusion Sensor products. We may not be effective in executing this or any other aspect of our growth strategy. Our revenue could decline if our current customers do not continue to purchase additional products from us. In addition, as we deploy new versions of our existing Snort, 3D Sensor and RNA products or introduce new products, our current customers may not require the functionality of these products and may not purchase them.

 

We also depend on our installed customer base for future service revenue from annual maintenance fees. Our maintenance and support agreements typically have durations of one year. If customers choose not to continue their maintenance service or seek to renegotiate the terms of maintenance and support agreements prior to renewing such agreements, our revenue may decline.

 

The U.S. government has contributed to our revenue growth and has become an important customer for us. If we cannot attract sufficient government agency customers, our revenue and competitive position will suffer.

 

The U.S. government has become an important customer for the network security market and for us. There can be no assurance that we will maintain or grow our revenue from the U.S. government. Contracts with the U.S. federal and state and other national and state government agencies accounted for 21%, 11% and 11% of our

total revenue for the years ended December 31, 2008, 2007 and 2006, respectively. Our reliance on government customers subjects us to a number of risks, including:

 

 

We are subject to risks of operating internationally that could impair our ability to grow our revenue abroad.

 

We market and sell our software in North America, South America, Europe, Asia and Australia, and we plan to establish additional sales presence in these and other parts of the world. Therefore, we are subject to risks associated with having worldwide operations. Sales to customers located outside of the United States accounted for 24%, 25% and 19% of our total revenue for the years ended December 31, 2008, 2007 and 2006, respectively. The expansion of our existing operations and entry into additional worldwide markets will require significant management attention and financial resources. We are also subject to a number of risks customary for international operations, including:

 

 

To date, a substantial portion of our sales have been denominated in U.S. dollars, and we have not used risk management techniques or “hedged” the risks associated with fluctuations in foreign currency exchange rates. In the future, if we do not engage in hedging transactions, our results of operations will be subject to losses from fluctuations in foreign currency exchange rates.

 

In the future, we may not be able to secure financing necessary to operate and grow our business as planned, or to make acquisitions.

 

In the future, we may need to raise additional funds to expand our sales and marketing and research and development efforts or to make acquisitions. Additional equity or debt financing may not be available on favorable terms, or at all. If adequate funds are not available on acceptable terms, we may be unable to fund the expansion of our sales and marketing and research and development efforts or take advantage of acquisition or other opportunities, which could seriously harm our business and operating results. If we issue debt, the debt holders would have rights senior to common stockholders to make claims on our assets and the terms of any debt could restrict our operations, including our ability to pay dividends on our common stock. Furthermore, if we issue additional equity securities, stockholders would experience dilution, and the new equity securities could have rights senior to those of our common stock.

 

If we are not able to acquire additional businesses, products or technologies, our long-term growth strategy could be harmed; acquisitions could also negatively affect our results of operations and financial condition.

 

We may seek to buy or make investments in complementary or competitive businesses, products or technologies as part of our long-term growth strategy. We may not be successful in making these acquisitions. We may face competition for acquisition opportunities from other companies, including larger companies with greater financial resources. We may incur substantial expenses in identifying and negotiating acquisition opportunities, whether or not completed. Acquisitions may not result in the expected strategic benefits, and completed acquisitions may negatively affect our operating results and financial position because of the following and other factors:

 

 

If other parties claim commercial ownership rights to Snort or ClamAV, our reputation, customer relations and results of operations could be harmed.

 

While we created a majority of the current Snort code base and the current ClamAV code base, a portion of the current code for both Snort and ClamAV was created by the combined efforts of Sourcefire and the open source software community, and a portion was created solely by the open source community. We believe that the portions of the Snort code base and the ClamAV base code created by anyone other than by us are required to be licensed by us pursuant to the GNU General Public License, or GPL, which is how we currently license Snort and ClamAV. There is a risk, however, that a third party could claim some ownership rights in Snort or ClamAV, attempt to prevent

us from commercially licensing Snort or ClamAV in the future (rather than pursuant to the GPL as currently licensed) or claim a right to licensing royalties. Any such claim, regardless of its merit or outcome, could be costly to defend, harm our reputation and customer relations or result in our having to pay substantial compensation to the party claiming ownership.

 

Our products contain third party open source software, and failure to comply with the terms of the underlying open source software licenses could restrict our ability to sell our products.

 

Our products are distributed with software programs licensed to us by third party authors under “open source” licenses, which may include the GPL, the GNU Lesser Public License, or LGPL, the BSD License and the Apache License. These open source software programs include, without limitation, Snort, ClamAV, Linux, Apache, Openssl, Etheral, IPTables, Tcpdump and Tripwire. These third party open source programs are typically licensed to us for a minimal fee or no fee at all, and the underlying license agreements generally require us to make available to the open source user community the source code for such programs, as well as the source code for any modifications or derivative works we create based on these third party open source software programs. With the exception of Snort and ClamAV, we have not created any modifications or derivative works to any other open source software programs referenced above. We regularly release updates and upgrades to the Snort and ClamAV software programs under the terms and conditions of the GNU GPL version 2.

 

Included with our software and/or appliances are copies of the relevant source code and licenses for the open source programs. Alternatively, we include instructions to users on how to obtain copies of the relevant open source code and licenses. Additionally, if we combine our proprietary software with third party open source software in a certain manner, we could, under the terms of certain of these open source license agreements, be required to release the source code of our proprietary software. This could also allow our competitors to create similar products, which would result in a loss of our product sales. We do not provide end users with a copy of the source code to our proprietary software because we believe that the manner in which our proprietary software is provided with the relevant open source programs does not create a modification or derivative work of that open source program requiring the distribution of our proprietary source code. Our ability to commercialize our products by incorporating third party open source software may be restricted because, among other reasons:

 

 

We could be prevented from selling or developing our products if the GNU General Public License and similar licenses under which our products are developed and licensed are not enforceable or are modified so as to become incompatible with other open source licenses.

 

A number of our products and services have been developed and licensed under the GNU General Public License and similar open source licenses. These licenses state that any program licensed under them may be liberally copied, modified and distributed. It is possible that a court would hold these licenses to be unenforceable or that someone could assert a claim for proprietary rights in a program developed and distributed under them.

 

Any ruling by a court that these licenses are not enforceable, or that open source components of our product offerings may not be liberally copied, modified or distributed, may have the effect of preventing us from distributing or developing all or a portion of our products. In addition, licensors of open source software employed in our offerings may, from time to time, modify the terms of their license agreements in such a manner that those license

terms may no longer be compatible with other open source licenses in our offerings or our end user license agreement, and thus could, among other consequences, prevent us from continuing to distribute the software code subject to the modified license.

 

The software program Linux is included in our products and is licensed under the GPL. The GPL is the subject of litigation in the case of The SCO Group, Inc. v. International Business Machines Corp., pending in the United States District Court for the District of Utah. It is possible that the court could rule that the GPL is not enforceable in such litigation. Any ruling by the court that the GPL is not enforceable could have the effect of limiting or preventing us from using Linux as currently implemented.

 

Our proprietary rights may be difficult to enforce, which could enable others to copy or use aspects of our products without compensating us.

 

We rely primarily on copyright, trademark, patent and trade secret laws, confidentiality procedures and contractual provisions to protect our proprietary rights. As of the date hereof, we have four patents issued and 32 applications pending for examination in the U.S. and foreign jurisdictions. We also hold numerous registered United States and foreign trademarks and have a number of trademark applications pending in the United States and in foreign jurisdictions. Valid patents may not be issued from pending applications, and the claims allowed on any patents may not be sufficiently broad to protect our technology or products. Any issued patents may be challenged, invalidated or circumvented, and any rights granted under these patents may not actually provide adequate protection or competitive advantages to us. Despite our efforts to protect our proprietary rights, unauthorized parties may attempt to copy aspects of our products or to obtain and use information that we regard as proprietary. Policing unauthorized use of our technologies or products is difficult. Our products incorporate open source Snort and ClamAV software, which is readily available to the public. To the extent that our proprietary software is included by others in what are purported to be open source products, it may be difficult and expensive to enforce our rights in such software. In addition, the laws of some foreign countries do not protect our proprietary rights to as great an extent as do the laws of the United States, and many foreign countries do not enforce these laws as diligently as U.S. government agencies and private parties. It is possible that we may have to resort to litigation to enforce and protect our copyrights, trademarks, patents and trade secrets, which litigation could be costly and a diversion of management resources. If we are unable to protect our proprietary rights to the totality of the features in our software and products (including aspects of our software and products protected other than by patent rights), we may find ourselves at a competitive disadvantage to others who need not incur the additional expense, time and effort required to create products similar to ours.

 

In limited instances we have agreed to place, and in the future may place, source code for our software in escrow, other than the Snort and ClamAV source code, which are publicly available. In most cases, the source code may be made available to certain of our customers and OEM partners in the event that we file for bankruptcy or materially fail to support our products. Release of our source code may increase the likelihood of misappropriation or other misuse of our software. We have agreed to source code escrow arrangements in the past only rarely and usually only in connection with prospective customers considering a significant purchase of our products and services.

 

Efforts to assert intellectual property ownership rights in our products could impact our standing in the open source community, which could limit our product innovation capabilities.

 

If we were to undertake actions to protect and maintain ownership and control over our proprietary intellectual property, including patents, copyrights, trademark rights and trade secrets, our standing in the open source community could be diminished which could result in a limitation on our ability to continue to rely on this community as a resource to identify and defend against new viruses, threats and techniques to attack secure networks, explore new ideas and concepts and further our research and development efforts.

 

Claims that our products infringe the proprietary rights of others could harm our business and cause us to incur significant costs.

 

Technology products such as ours, which interact with multiple components of complex networks, are increasingly subject to infringement claims as the functionality of products in different industry segments overlaps. Third parties may assert claims or initiate litigation related to exclusive copyright, trademark, patent, trade secret or other intellectual property rights with respect to technologies that are relevant to our business. Third party asserted

claims and/or initiated litigation can include claims against us or our customers, end-users, manufacturers, suppliers, partners or distributors, alleging infringement of intellectual property rights with respect to our existing or future products (or components of those products). Any such intellectual property claims, with or without merit, could:

 

 

The application of patent law to the software industry is particularly uncertain, as the U.S. Patent and Trademark Office, or PTO, has only recently begun to issue software patents in large numbers, and there is a backlog of software-related patent applications pending that claim inventions whose priority dates may pre-date development of our own proprietary technology. As a general matter, until the PTO issues a patent to an applicant, there can be no way to determine whether a product (or any of its components) will infringe a pending patent. In addition, the large number of patents in the Internet, networking, security and software fields may make it impractical to determine in advance whether a product (or any of its components) infringe the patent rights of others. Notwithstanding any such determination by us, we may be subject to claims, with or without merit, that our products infringe on the patent rights of others. It is conceivable that other companies have patents with respect to technology similar to our technology, including RNA and ClamAV. Our RNA technology, which is a new technology for which we have not yet been issued a patent, is the subject of 10 of our 32 pending patent applications which we began filing in 2004. Other companies have been issued patents, and have filed patent applications, that, on their face, contain claims that may be construed to be within the scope of the same broad technology area as our RNA technology. Although we do not believe that any of our products infringe upon the patent claims of others, there can be no assurance that such companies will not bring action against us based upon issued patents, or later on the basis of future patents when, and if, they issue. Similarly, while we have not sought to patent the ClamAV technology, which we acquired in August 2007, it competes with the product offerings of third parties who have extensive portfolios of patents in the same broad technology area as our ClamAV technology.

 

We rely on software licensed from other parties, the loss of which could increase our costs and delay software shipments.

 

We utilize various types of software licensed from unaffiliated third parties. For example, we license database software from MySQL that we use in our 3D Sensors, our RNA Sensors and our Defense Centers. Our Agreement with MySQL permits us to distribute MySQL software on our products to our customers worldwide until December 31, 2010. We amended our MySQL agreement on December 29, 2006 to give us the unlimited right to distribute MySQL software in exchange for a one-time lump-sum payment. We believe that the MySQL agreement is material to our business because we have spent a significant amount of development resources to allow the MySQL software to function in our products. If we were forced to find replacement database software for our products, we would be required to expend resources to implement a replacement database in our products, and there would be no guarantee that we would be able to procure the replacement on the same or similar commercial terms.

 

In addition to MySQL, we rely on other open source software, such as the Linux operating system, the Apache web server and OpenSSL, a secure socket layer implementation. These open source programs are licensed to us under various open source licenses. For example, Linux is licensed under the GNU General Public License Version 2, while Apache and OpenSSL are licensed under other forms of open source license agreements. If we could no longer rely on these open source programs, the functionality of our products would be impaired, and we would be required to expend significant resources to find suitable alternatives.

Our business would be disrupted if any of the software we license from others or functional equivalents of this software were either no longer available to us, no longer offered to us on commercially reasonable terms or offered to us under different licensing terms and conditions. For example, our business could be disrupted if the widely-used Linux operating system were to be released under the new Version 3 of the GNU General Public License, as we could be required to expend significant resources to ensure that our use of Linux, as well as the manner in which our proprietary and other third party software work with Linux, complies with the new version of the GNU General Public License. Additionally, we would be required to either redesign our products to function with software available from other parties or develop these components ourselves, which would result in increased costs and could result in delays in our product shipments and the release of new product offerings. Furthermore, we might be forced to limit the features available in our current or future products. If we fail to maintain or renegotiate any of these software licenses, we could face significant delays and diversion of resources in attempting to license and integrate a functional equivalent of the software.

 

Defects, errors or vulnerabilities in our products would harm our reputation and business and divert resources.

 

Because our products are complex, they may contain defects, errors or vulnerabilities that are not detected until after our commercial release and installation by our customers. We may not be able to correct any errors or defects or address vulnerabilities promptly, or at all. Any defects, errors or vulnerabilities in our products could result in:

 

 

In addition, because our products and services provide and monitor network security and may protect valuable information, we could face claims for product liability, tort or breach of warranty. Anyone who circumvents our security measures could misappropriate the confidential information or other valuable property of customers using our products, or interrupt their operations. If that happens, affected customers or others may sue us. In addition, we may face liability for breaches of our product warranties, product failures or damages caused by faulty installation of our products. Provisions in our contracts relating to warranty disclaimers and liability limitations may be deemed by a court to be unenforceable. Some courts, for example, have found contractual limitations of liability in standard computer and software contracts to be unenforceable in some circumstances. Defending a lawsuit, regardless of its merit, could be costly and divert management attention. Our business liability insurance coverage may be inadequate or future coverage may be unavailable on acceptable terms or at all.

 

Our networks, products and services are vulnerable to, and may be targeted by, hackers.

 

Like other companies, our websites, networks, information systems, products and services may be targets for sabotage, disruption or misappropriation by hackers. As a leading network security solutions company, we are a high profile target and our networks, products and services may have vulnerabilities that may be targeted by hackers. Although we believe we have sufficient controls in place to prevent disruption and misappropriation, and to respond to such situations, we expect these efforts by hackers to continue. If these efforts are successful, our operations, reputation and sales could be adversely affected.

 

We utilize a just-in-time contract manufacturing and inventory process, which increases our vulnerability to supply disruption.

 

Our ability to meet our customers’ demand for certain of our products depends upon obtaining adequate hardware platforms on a timely basis, which must be integrated with our software. We purchase hardware platforms through our contract manufacturers from a limited number of suppliers on a just-in-time basis. In addition, these suppliers may extend lead times, limit the supply to our manufacturers or increase prices due to capacity constraints or other factors. Although we work closely with our manufacturers and suppliers to avoid shortages, we may

encounter these problems in the future. Our results of operations would be adversely affected if we were unable to obtain adequate supplies of hardware platforms in a timely manner or if there were significant increases in the costs of hardware platforms or problems with the quality of those hardware platforms.

 

We depend on a single source to manufacture our enterprise class intrusion sensor product; if that sole source were to fail to satisfy our requirements, our sales revenue would decline and our reputation would be harmed.

 

We rely on one manufacturer, Bivio Networks, to build the hardware platform for three models of our intrusion sensor products that are used by our enterprise class customers. These enterprise class intrusion sensor products are purchased directly by customers for their internal use and are also utilized by third party managed security service providers, or MSSPs, to provide services to their customers. Revenue resulting from sales of these enterprise class intrusion sensor products accounted for approximately 27%, 22% and 21% of our product revenue for the years ended December 31, 2008, 2007 and 2006, respectively. The unexpected termination of our relationship with Bivio Networks would be disruptive to our business and our reputation, which could result in a material decline in our revenue as well as shipment delays and possible increased costs as we seek and implement production with an alternative manufacturer.

 

We depend on resellers, distributors and other partners for our sales; if they fail to perform as expected, our revenue will suffer.

 

Part of our business strategy involves entering into additional agreements with resellers, distributors, MSSPs, government integrators and other partners that permit them to resell our products and service offerings. There is a risk that our pace of entering into such agreements may slow, or that our existing agreements may not produce as much business as we anticipate. There is also a risk that some or all of our resellers, distributors and other partners may be acquired, may change their business models or may go out of business, any of which could have an adverse effect on our business.

 

If we do not continue to establish and effectively manage our indirect distribution channels, our revenue could decline.

 

Our ability to sell our network security software products in new markets and to increase our share of existing markets will be impaired if we fail to expand our indirect distribution channels. Our sales strategy involves the establishment of multiple distribution channels domestically and internationally through strategic resellers, distributors, MSSPs, government integrators and other partners. We have agreements with third parties for the distribution of our products and we cannot predict the extent to which these companies will be successful in marketing or selling our products. Our agreements with these companies could be terminated on short notice, and they do not prevent these companies from selling the network security software of other companies, including our competitors. Any distributor of our products could give higher priority to other companies’ products or to their own products than they give to ours, which could cause our revenue to decline.

 

Our inability to hire or retain key personnel would slow our growth.

 

Our business is dependent on our ability to hire, retain and motivate highly qualified personnel, including senior management, sales and technical professionals. In particular, as part of our growth strategy, we intend to expand the size of our direct sales force domestically and internationally and to hire additional customer support and professional services personnel. However, competition for qualified services personnel is intense, and if we are unable to attract, train or retain the number of highly qualified sales and services personnel that our business needs, our reputation, customer satisfaction and potential revenue growth could be seriously harmed. To the extent that we hire personnel from competitors, we may also be subject to allegations that they have been improperly solicited or divulged proprietary or other confidential information.

 

In addition, our future success will depend to a significant extent on the continued services of our executive officers and senior personnel. Although we have adopted retention plans applicable to certain of these officers, there can be no assurance that we will be able to retain their services. The loss of the services of one or more of these individuals could adversely affect our business and could divert other senior management time in searching for their replacements.

Our inability to effectively manage our expected headcount growth and expansion and our additional obligations as a public company could seriously harm our ability to effectively run our business.

 

Our historical growth has placed, and our intended future growth is likely to continue to place, a significant strain on our management, financial, personnel and other resources. We will likely not continue to grow at our historical pace. We have grown from 240 employees at December 31, 2007 to 281 employees at December 31, 2008. Since January 1, 2005, we have opened additional sales offices and have significantly expanded our operations. This rapid growth has strained our facilities and required us to lease additional space at our headquarters.

 

In several recent quarters, we have not been able to hire sufficient personnel to keep pace with our growth. In addition to managing our expected growth, we have substantial additional obligations and costs as a result of becoming a public company in March 2007. These obligations include investor relations, preparing and filing periodic SEC reports, developing and maintaining internal controls over financial reporting and disclosure controls, and compliance with corporate governance rules, Regulation FD and other requirements imposed on public companies by the SEC and the NASDAQ Global Market that we did not experience as a private company. Fulfilling these additional obligations will make it more difficult to operate a growing company. Any failure to effectively manage growth or fulfill our obligations as a public company could seriously harm our ability to respond to customers, the quality of our software and services and our operating results.

 

The price of our common stock may be subject to wide fluctuations.

 

Prior to our IPO in March 2007, there was not a public market for our common stock. The market price of our common stock is subject to significant fluctuations. Among the factors that could affect our common stock price are the risks described in this “Risk Factors” section and other factors, including:

 

 

Stock markets in general have experienced extreme volatility that has often been unrelated to the operating performance of a particular company. These broad market fluctuations may adversely affect the trading price of our common stock, regardless of our operating performance.

 

Sales of substantial amounts of our common stock in the public markets, or the perception that they might occur, could reduce the price that our common stock might otherwise attain.

 

As of March 5, 2009, we had 25,927,183 outstanding shares of common stock. This number includes 6,185,500 shares of our common stock that we sold in our IPO, which has been and may in the future be resold at any time in the public market. This number also includes an aggregate of approximately 10.8 million shares held by directors, officers and venture capital funds that invested in Sourcefire prior to our IPO, and who may sell such shares at their discretion subject, in some cases, to certain volume limitations. Sales of substantial amounts of our common stock in the public market, as a result of the exercise of registration rights or otherwise, or the perception that such sales could occur, could adversely affect the market price of our common stock and may make it more difficult for you to sell your common stock at a time and price that you deem appropriate.

We and certain of our officers and directors have been named as co-defendants in, and are the subject of, certain legal proceedings in connection with our IPO. We have entered into an agreement to settle these proceedings, although the settlement may not be approved, in which case the litigation could continue, which may result in substantial costs and divert management’s attention and resources.

 

As described in “Legal Proceedings” below, multiple federal securities class action lawsuits have been filed naming our Company and certain of our officers and directors as co-defendants. We are not able to predict the ultimate outcome of this litigation. It is possible that these matters could be resolved adversely to us, could result in substantial costs and could divert management’s attention and resources, which could harm our business. On February 11, 2009, we filed a settlement stipulation and related papers with the court, tentatively settling all claims in the litigation. If finally approved, the settlement will result in the dismissal of the claims against all defendants. The proposed settlement will include a cash payment of $3.2 million by the defendants, $3.1 million of which will be paid by our insurer and $0.1 million of which will be paid by us. Neither we nor any of the other defendants admitted any wrongdoing in connection with the proposed settlement. The settlement will require final approval from the court before it becomes effective. A hearing at which the court will consider whether to approve the settlement has been scheduled for June 12, 2009. No assurances can be given that the settlement ultimately will be approved. If the settlement is not approved, the litigation could continue, which could result in substantial costs and could divert management’s attention and resources.

 

Risks associated with legal liability often are difficult to assess or quantify, and their existence and magnitude can remain unknown for significant periods of time. While we maintain director and officer insurance, the amount of insurance coverage may not be sufficient to cover a claim, and the continued availability of this insurance cannot be assured. We may in the future be the target of additional proceedings, and these proceedings may result in substantial costs and divert management’s attention and resources.

 

Our business is subject to complex corporate governance, public disclosure, accounting and tax requirements that have increased both our costs and the risk of noncompliance.

 

Because our common stock is publicly traded, we are subject to certain rules and regulations of federal, state and financial market exchange entities charged with the protection of investors and the oversight of companies whose securities are publicly traded. These entities, including the Public Company Accounting Oversight Board, the SEC, and NASDAQ, have implemented requirements and regulations and continue developing additional regulations and requirements in response to corporate scandals and laws enacted by Congress, most notably the Sarbanes-Oxley Act of 2002. Our efforts to comply with these regulations have resulted in, and are likely to continue resulting in, increased general and administrative expenses and diversion of management time and attention from revenue-generating activities to compliance activities.

 

We completed our evaluation of our internal controls over financial reporting for the fiscal year ended December 31, 2008 as required by Section 404 of the Sarbanes-Oxley Act of 2002. Although our assessment, testing and evaluation resulted in our conclusion that as of December 31, 2008, our internal controls over financial reporting were effective, we cannot predict the outcome of our testing in future periods. If our internal controls are ineffective in future periods, our business and reputation could be harmed. We may incur additional expenses and commitment of management’s time in connection with further evaluations, either of which could materially increase our operating expenses and accordingly increase our net loss.

 

Because new and modified laws, regulations, and standards are subject to varying interpretations in many cases due to their lack of specificity, their application in practice may evolve over time as new guidance is provided by regulatory and governing bodies. This evolution may result in continuing uncertainty regarding compliance matters and additional costs necessitated by ongoing revisions to our disclosure and governance practices.

 

We implemented a new enterprise resource planning system and any material disruption or problem with the implementation or operation of this system may result in disruption to our business, operating processes and internal controls.

 

The efficient operation of our business is dependent on the successful operation of our information systems. In particular, we rely on our information systems to process financial information, manage inventory and administer our sales transactions. In recent years, we have experienced a considerable growth in transaction volume, headcount and reliance upon international resources in our operations. Our information systems need to be sufficiently

scalable to support the continued growth of our operations and the efficient management of our business. In an effort to improve the efficiency of our operations, achieve greater automation and support the growth of our business, we have implemented a new enterprise resource planning, or ERP, system. As part of the implementation of this ERP system, we were required to modify a number of operational processes and internal control procedures.

 

We finalized the implementation of the financial, human resources and order fulfillment components of the ERP system in the third quarter of 2008 and expect to add additional functionality. We cannot assure you that the system will work as we currently intend. Any material disruption or similar problems with the implementation or operation of this ERP system could have a material negative effect on our business and results of operations. In addition, if our information system resources are inadequate, we may be required to undertake costly modifications and the growth of our business could be harmed.

 

Potential uncertainty resulting from unsolicited acquisition proposals and related matters may adversely affect our business.

 

During the second quarter of 2008, we received two unsolicited proposals from a privately held company to acquire all of the outstanding shares of our common stock. In each case, our Board of Directors, after carefully reviewing the proposal, unanimously concluded that the proposal was not in the best interests of Sourcefire and its stockholders. The review and consideration of the acquisition proposals and related matters required the expenditure of significant time and resources by us. There can be no assurance that the privately held company or another company will not in the future make another proposal, or take other actions, to acquire us. Such a proposal may create uncertainty for our employees, customers and business partners. Any such uncertainty could make it more difficult for us to retain key employees and hire new talent, and could cause our customers and business partners to not enter into new arrangements with us or to terminate existing arrangements. Additionally, we and members of our Board of Directors could be subject to future lawsuits related to unsolicited proposals to acquire us. Any such future lawsuits could become time consuming and expensive. These matters, alone or in combination, may harm our business.

 

Anti-takeover provisions in our charter documents and under Delaware law and our adoption of a stockholder rights plan could make an acquisition of us, which may be beneficial to our stockholders, more difficult and may prevent attempts by our stockholders to replace or remove our current management.

 

Our certificate of incorporation and our bylaws contain provisions that may delay or prevent an acquisition of us or a change in our management. These provisions include a classified Board of Directors, a prohibition on actions by written consent of our stockholders, and the ability of our Board of Directors to issue preferred stock without stockholder approval. In addition, because we are incorporated in Delaware, we are governed by the provisions of Section 203 of the Delaware General Corporation Law, which prohibits stockholders owning in excess of 15% of our outstanding voting stock from merging or combining with us. Although we believe these provisions of our certificate of incorporation and bylaws and Delaware law and our stockholder rights plan, which is described below, collectively provide for an opportunity to receive higher bids by requiring potential acquirers to negotiate with our Board of Directors, they would apply even if the offer may be considered beneficial by some stockholders. In addition, these provisions may frustrate or prevent attempts by our stockholders to replace or remove our current management by making it more difficult for stockholders to replace members of our Board of Directors, which is responsible for appointing the members of our management.

 

In October 2008, our Board of Directors adopted a stockholder rights plan, which we refer to as the Rights Plan, and declared a dividend distribution of one preferred share purchase right, or Right, to be paid for each outstanding share of our common stock to stockholders of record as of November 14, 2008. Each Right, when exercisable, will entitle the registered holder to purchase from us one one-hundredth of a share of a newly designated Series A Junior Participating Preferred Stock at a purchase price of $30.00, subject to adjustment. The Rights expire on October 30, 2018, unless they are earlier redeemed, exchanged or terminated as provided in the Rights Plan. Each such fractional share of the new preferred stock has terms designed to make it substantially the economic equivalent of one share of common stock. Initially the Rights will not be exercisable and will trade with our common stock. Generally, the Rights may become exercisable if a person or group acquires beneficial ownership of 15% or more of our common stock or commences a tender or exchange offer upon consummation of which such person or group would beneficially own 15% or more of our common stock. Such person or group is

referred to as an acquiring person. At such time as the Rights become exercisable, each holder of a Right (except Rights held by an acquiring person) shall thereafter have the right to receive, upon exercise, preferred stock or, at our option, shares of common stock having a value equal to two times the exercise price of the Right. Because the Rights may substantially dilute the stock ownership of a person or group attempting to take us over without the approval of our Board of Directors, our Rights Plan could make it more difficult for a third party to acquire us (or a significant percentage of our outstanding capital stock) without first negotiating with our Board of Directors regarding such acquisition.

 

 

Not applicable.

 

 

Our principal executive offices are located in Columbia, Maryland. We also lease sales offices in Vienna, Virginia; Livonia, Michigan; Wokingham, United Kingdom; Tokyo, Japan; Singapore; Munich, Germany; Courbevoie Cedex, France; Hoofddorp, The Netherlands; Stockholm, Sweden; and Espoo, Finland. Our lease in Columbia, Maryland expires on May 31, 2010; our lease in Vienna, Virginia expires on January 31, 2012; our lease in Livonia, Michigan expires on June 30, 2010; our lease in Wokingham, United Kingdom expires on January 24, 2012; our lease in Singapore expires on September 30, 2009; our lease in Tokyo, Japan expires November 30, 2009; our leases in Munich, Germany; Courbevoie Cedex, France; Hoofddorp, The Netherlands; Stockholm, Sweden; and Espoo, Finland run month-to-month. We believe that our facilities are generally suitable to meet our needs for the foreseeable future; however, we will continue to seek additional space as needed in accordance with our growth.

 

 

On May 8, 2007, a putative class action lawsuit was filed in the United States District Court for the District of Maryland, against us and certain of our officers and directors, captioned Howard Katz v. Sourcefire, Inc., et al., Case No. 1:07-cv-01210-WMN. Since then, two other putative class action lawsuits were filed in the United States District Court of Maryland against us and certain of our officers and directors and other parties making similar allegations, captioned Mark Reaves v. Sourcefire, Inc. et al., Case No. 1:07-cv-01351-JFM and Raveill v. Sourcefire, Inc. et al., Case No. 1:07-cv-01425-WMN. In addition, a fourth putative class action lawsuit was filed in the United States District Court for the Southern District of New York against us and certain of our officers and directors and other parties making similar allegations, captioned Barry Pincus v. Sourcefire, Inc., et al., Case No. 1:07-cv-04720-RJH. Pursuant to a stipulation of the parties, and an order entered on or about June 29, 2007, the United States District Court of the Southern District of New York transferred the Pincus case to the United States District Court for the District of Maryland (the “Court”).

 

These actions claim to be filed on behalf of all persons or entities who purchased our common stock pursuant to an allegedly false and misleading registration statement and prospectus issued in connection with our March 9, 2007 IPO. These lawsuits allege violations of Section 11, Section 12 and Section 15 of the Securities Act of 1933, as amended, in connection with allegedly material misleading statements and/or omissions contained in our registration statement and prospectus issued in connection with the IPO. The plaintiffs seek, among other things, a determination of class action status, compensatory and rescission damages, a rescission of the initial public offering, as well as fees and costs on behalf of a putative class.

 

On September 4, 2007, the Court granted a motion to consolidate the four putative class action lawsuits into a single civil action. In that same order, the Court also appointed Ms. Sandra Amrhein as lead plaintiff, the law firm of Kaplan Fox & Kilsheimer LLP as lead counsel, and Tydings & Rosenberg LLP as liaison counsel. On October 4, 2007, Ms. Amrhein filed an Amended Consolidated Class Action Complaint asserting legal claims that previously had been asserted in one or more of the four original actions.

 

On November 20, 2007, the defendants moved to dismiss the Amended Consolidated Class Action Complaint. On April 23, 2008, the motion to dismiss was granted in part and denied in part. On May 7, 2008, the defendants filed an answer denying all liability.

 

On May 12, 2008, the Court entered a scheduling order. On July 16, 2008, the Court granted the parties’ motion to amend the Court’s prior scheduling order to provide the parties with an opportunity to conduct mediation.

On February 11, 2009, we filed a settlement stipulation and related papers with the Court, tentatively settling all claims in the litigation. If finally approved, the settlement will result in the dismissal of the claims against all defendants. The proposed settlement will include a cash payment of $3.2 million by the defendants, $3.1 million of which will be paid by our insurer and $0.1 million of which will be paid by us. Neither we nor any of the other defendants admitted any wrongdoing in connection with the proposed settlement. The settlement will require final approval from the Court before it becomes effective. A hearing at which the Court will consider whether to approve the settlement has been scheduled for June 12, 2009. No assurances can be given that the settlement ultimately will be approved.

 

From time to time, we are involved in other disputes and legal actions arising in the ordinary course of our business.

 

 

No matters were submitted to a vote of security holders during the fourth quarter of the fiscal year covered by this report.

 

 

Market Information

 

Our common stock is publicly traded on the NASDAQ Global Market under the symbol “FIRE.” Our stock began trading on the NASDAQ Global Market on March 9, 2007. The following table sets forth, for the periods indicated, the high and low sales prices of our common stock as reported by the NASDAQ Global Market.

 

 

 

As of March 5, 2009, there were approximately 148 holders of record of our common stock. The number of holders of record of our common stock does not reflect the number of beneficial holders whose shares are held by depositories, brokers or other nominees.

 

Dividend Policy

 

We have never declared or paid any cash dividends on our common stock. We currently intend to retain all available funds and any future earnings for use in the operation and expansion of our business and do not anticipate paying any cash dividends in the foreseeable future.

Stock Performance Graph

 

The following graph illustrates a comparison of the total cumulative stockholder return on our common stock (traded under the symbol “FIRE”) since March 9, 2007, the date our stock commenced public trading, through December 31, 2008 to two indices: the Russell 2000 Index and the RDG Software Composite Index. The graph assumes an initial investment of $100 on March 9, 2007 in Sourcefire common stock and on February 28, 2007 in each of the two indices. The comparisons in the graph are required by the Securities and Exchange Commission and are not intended to forecast or be indicative of possible future performance of our common stock.

 

COMPARISON OF 21 MONTH CUMULATIVE TOTAL RETURN*
Among Sourcefire, Inc., The Russell 2000 Index
And The RDG Software Composite Index

 

 

* $100 invested on 3/9/07 in stock & 2/28/07 in index-including reinvestment of dividends.

Use of Proceeds

 

In March 2007, we completed the initial public offering of shares of our common stock. The offer and sale of these shares were registered under the Securities Act of 1933, as amended, pursuant to our Registration Statement on Form S-1, as amended (File No. 333-138199), which was declared effective by the SEC on March 8, 2007. Our portion of the net proceeds from the initial public offering was approximately $83.9 million after deducting underwriting discounts and commissions of approximately $1.05 per share, or $6.5 million in the aggregate, and $2.4 million in offering expenses.

 

We intend to use the net proceeds from the offering for working capital and other general corporate purposes, including financing our growth, developing new products and funding capital expenditures. Pending such usage, we have invested the net proceeds in short-term, interest-bearing investment grade securities.

 

Repurchases of Equity Securities During 2008

 

The following table provides information about purchases by us during the fiscal year ending December 31, 2008 of equity securities that are registered by us pursuant to Section 12 of the Securities Act.

 

Repurchases are made under the terms of our 2007 Equity Incentive Plan. Under this plan, we may award shares of restricted stock to our employees. These shares of restricted stock typically are subject to a lapsing right of repurchase by us. We may exercise this right of repurchase in the event that a restricted stock recipient’s service to us is terminated. If we exercise this right, we are required to repay the purchase price paid by or on behalf of the recipient for the repurchased restricted shares, which typically is the par value per share of $0.001. Repurchased shares are returned to the 2007 Equity Incentive Plan and are available for future awards under the terms of that plan.

 

In addition, upon vesting of restricted stock awarded by us to employees, we may withhold shares to cover employees’ tax withholding obligations, other than for employees who have chosen to make tax withholding payments in cash.

 

These were the only repurchases of equity securities made by us during 2008. We do not currently have a stock repurchase program.

 

 

 

 

 

The consolidated statement of operations data for the three years ended December 31, 2008 and the consolidated balance sheet data as of December 31, 2007 and 2008 have been derived from our audited consolidated financial statements appearing elsewhere in this report. The consolidated statement of operations data for the years ended December 31, 2004 and 2005 and the consolidated balance sheet data as of December 31, 2004, 2005 and 2006 have been derived from our audited consolidated financial statements that do not appear in this report. The selected consolidated financial data set forth below should be read in conjunction with “Management’s Discussion and Analysis of Financial Condition and Results of Operations” set forth below and our consolidated financial statements and related notes included elsewhere in this report. The historical results are not necessarily indicative of the results to be expected in any future period.

 

 

Consolidated Balance Sheet Data:

 

 

 

Introduction

 

Management’s discussion and analysis of financial condition, changes in financial condition and results of operations is provided as a supplement to the accompanying consolidated financial statements and notes to help provide an understanding of Sourcefire, Inc.’s financial condition and results of operations. This item of our Annual Report on Form 10-K is organized as follows:

 

 

Overview

 

We are a leading provider of Enterprise Threat Management, or ETM, intelligent security infrastructure solutions for information technology, or IT, environments of commercial enterprises (such as healthcare, financial services, manufacturing, energy, education, retail, and telecommunications) and federal and state government organizations. The Sourcefire 3D^® System — comprised of multiple Sourcefire hardware and software product offerings — provides a comprehensive, intelligent approach to network protection that equips our customers with an efficient and effective layered security defense — protecting computer network assets before, during and after an attack.

We sell our network security solutions to a diverse customer base that includes Fortune 1000 companies, Global 500 companies, U.S. government agencies and small and mid-size businesses. We also manage two of the security industry’s leading open source initiatives, Snort and ClamAV.

 

Key Financial Metrics and Trends

 

Our financial results are affected by a number of factors, including broad economic conditions, the amount and type of technology spending of our customers, and the financial condition of our customers and the industries and geographic areas that we serve. During the second half of 2008, the industries and geographic areas that we serve experienced weakness as macroeconomic conditions, credit market conditions, and levels of business confidence and activity deteriorated. During the fourth quarter of 2008, some of our commercial customers delayed purchases of our products and services in response to these factors and the operating and financial difficulties facing these customers. We expect to continue to experience some delays in customer purchases but cannot yet predict if this trend will worsen or the extent to which customers may decide not to purchase our products and services as a result of these or other factors. We are continuing to monitor economic conditions and their potential effect on our customers and on us. A severe or prolonged economic downturn could affect our customers’ financial condition and the levels of business activity. This could reduce demand and depress pricing for our products and services, which could have a material adverse effect on our results of operations or financial condition.

 

During 2008, a significant portion of our revenue growth resulted from sales of our products to U.S. government agencies. Contracts with the U.S. federal and state and other national and state government agencies accounted for 21%, 11% and 11% of our total revenue for the years ended December 31, 2008, 2007 and 2006, respectively. We expect sales to U.S. government agencies to continue to account for a significant portion of our total revenue in 2009. A reduction in the amount of U.S. government purchases of our products could have a material adverse effect on our results of operations or financial condition.

 

We evaluate our performance on the basis of several performance indicators, including pricing and discounts, credit and collections, revenue, cost of revenue, gross profit, and operating expenses. We compare these key performance indicators, on a quarterly basis, to both target amounts established by management and to our performance for prior periods.

 

Pricing and Discounts

 

We maintain a standard price list for all of our products. Additionally, we have a corporate policy that governs the level of discounts our sales organization may offer on our products, based on factors such as transaction size, volume of products, federal or state programs, reseller or distributor involvement and the level of technical support commitment. Our total product revenue and the resulting cost of revenue and gross profit percentage are directly affected by our ability to manage our product pricing policy. During the fourth quarter of 2008, in some cases we increased discounts on the prices of our products and services as a result of the operating and financial difficulties facing our customers, and in response to discounts offered by our competitors. We expect the pressure to provide increased discounts to continue and, in the future, we may be forced to further discount or reduce our prices to remain competitive.

 

Credit and Collections

 

We evaluate the creditworthiness of our customers prior to accepting an order for our products and extending the customer terms of payment which typically range from 30 to 90 days from the date of our invoice. In the fourth quarter of 2008 we experienced an increase in the aging of our outstanding receivables which we attributed to the decline in macroeconomic conditions and credit market conditions. Although our actual write-offs of uncollectible accounts were less than $10,000 for all of 2008, as a result of the increase in our receivables, we increased our reserve for uncollectible accounts. We believe that the decline in macroeconomic conditions may lead to a further increase in the aging of our receivables and we may have to increase our reserve as a result.

 

Revenue

 

We currently derive revenue from product sales and services. Product revenue is principally derived from the sale of our network security solutions. Our network security solutions include a perpetual software license bundled with a third-party hardware platform. Services revenue is principally derived from technical support and

professional services. We typically sell technical support to complement our network security product solutions. Technical support entitles a customer to product updates, new rule releases and both telephone and web-based assistance for using our products. Our professional services revenue includes optional installation, configuration and tuning, which we refer to collectively as network security deployment services. These network security deployment services typically occur on-site after delivery has occurred.

 

Product sales are typically recognized as revenue at shipment of the product to the customer. For sales through resellers and distributors, we recognize revenue upon the shipment of the product only if those resellers and distributors provide us, at the time of placing their order, with the identity of the end-user customer to whom the product has been sold. We recognize revenue from services when the services are performed. For technical support services, we recognize revenue ratably over the term of the support arrangement, which is generally 12 months. Our support agreements generally provide for payment in advance.

 

We sell our network security solutions globally. However, 76%, 75% and 81% of our revenue for the years ended December 31, 2008, 2007 and 2006, respectively, was generated by sales to U.S.-based customers. We expect that our revenue from customers based outside of the United States will increase in amount and as a percentage of total revenue as we strengthen our international presence. We also expect that our revenue from sales through our indirect sales channel, comprised of resellers, distributors, managed security service providers, or MSSPs, government integrators and other partners, will increase in amount and as a percentage of total revenue as we expand our current relationships and establish new relationships with these third parties.

 

Historically, our product revenue has been seasonal, with a significant portion of our total product revenue in recent fiscal years generated in the fourth quarter. The timing of our year-end shipments could materially affect our fourth quarter product revenue in any fiscal year and quarterly comparisons. Revenue from our government customers has been influenced by the September 30th fiscal year-end of the U.S. federal government, which has historically resulted in our revenue from government customers being highest in the third quarter. Notwithstanding these general seasonal patterns, our revenue within a particular quarter is often affected significantly by the unpredictable procurement patterns of our customers. Our prospective customers usually spend a long time evaluating and making purchase decisions for network security solutions. Historically, many of our customers have not finalized their purchasing decisions until the final weeks or days of a quarter. We expect these purchasing patterns to continue in the future. Therefore, a delay in even one large order beyond the end of the quarter could materially reduce our anticipated revenue for a quarter. Because many of our expenses must be incurred before we expect to generate revenue, delayed orders could negatively impact our results of operations and cash flows for a particular period and could therefore cause us to fail to meet the financial performance expectations of securities industry research analysts or investors.

 

Cost of Revenue

 

Cost of product revenue includes the cost of the hardware platform bundled into our network security solution, royalties for third-party software included in our network security solution, materials and labor that are incorporated in the quality assurance of our products, logistics, warranty, shipping and handling costs and, in the limited instances where we lease our network security solutions to our customers, depreciation and amortization. Hardware costs, which are our most significant cost item, generally have not fluctuated materially as a percentage of revenue in recent years because competition among hardware platform suppliers has remained strong and, therefore, unit hardware costs have remained consistent. Because of the competition among hardware suppliers and our outsourcing of the manufacture of our products to three separate domestic contract manufacturers, we currently have no reason to expect that our cost of product revenue as a percentage of total product revenue will change significantly in the foreseeable future due to hardware pricing increases. However, hardware or other costs of manufacturing may increase in the future. We incur labor and associated overhead expenses, such as occupancy costs and fringe benefits costs, as part of managing our outsourced manufacturing process. These costs are included as a component of our cost of product revenue.

 

Cost of services revenue includes the direct labor costs of our employees and outside consultants engaged to furnish those services, as well as their travel and associated direct material costs. Additionally, we include in cost of services revenue an allocation of overhead expenses such as occupancy costs, fringe benefits and supplies, as well as the cost of time and materials to service or repair the hardware component of our products covered under a renewed support arrangement beyond the manufacturer’s warranty. As our customer base continues to grow, we anticipate

incurring an increasing amount of these service and repair costs, as well as costs for additional personnel to support and service our customers.

 

Gross Profit

 

Our gross profit is affected by a variety of factors, including competition, the mix and average selling prices of our products, our pricing policy, technical support and professional services, new product introductions, the cost of hardware platforms, the cost of labor to generate such revenue and the mix of distribution channels through which our products are sold. Our gross profit would be adversely affected by price declines or pricing discounts if we are unable to reduce costs on existing products and fail to introduce new products with higher margins. Currently, product sales typically have a lower gross profit as a percentage of revenue than our services due to the cost of the hardware platform. Our gross profit for any particular quarter could be adversely affected if we do not complete a sufficient level of sales of higher-margin products by the end of the quarter. As discussed above, many of our customers do not finalize purchasing decisions until the final weeks or days of a quarter, so a delay in even one large order of a higher-margin product could reduce our total gross profit percentage for that quarter.

 

Operating Expenses

 

Research and Development.  Research and development expenses consist primarily of payroll, benefits and related occupancy and other overhead for our engineers, costs for professional services to test our products, and costs associated with data used by us in our product development.

 

We have expanded our research and development capabilities and expect to continue to expand these capabilities in the future. We are committed to increasing the level of innovative design and development of new products as we strive to enhance our ability to serve our existing commercial and federal government markets as well as new markets for security solutions. To meet the changing requirements of our customers, we will need to fund investments in several development projects in parallel. Accordingly, we anticipate that our research and development expenses will continue to increase in absolute dollars for the foreseeable future; however, as a percentage of revenue we expect these expenses to remain relatively flat.

 

Sales and Marketing.  Sales and marketing expenses consist primarily of salaries, incentive compensation, benefits and related costs for sales and marketing personnel; trade show, advertising, marketing and other brand-building costs; marketing consultants and other professional services; training, seminars and conferences; travel and related costs; and occupancy and other overhead costs.

 

As we focus on increasing our market penetration, expanding internationally and continuing to build brand awareness, we anticipate that selling and marketing expenses will continue to increase in absolute dollars, but decrease as a percentage of our revenue, in the future.

 

General and Administrative.  General and administrative expenses consist primarily of salaries, incentive compensation, benefits and related occupancy and other overhead costs for executive, legal, finance, information technology, human resources and administrative personnel; corporate development expenses and professional fees related to legal, audit, tax and regulatory compliance; travel and related costs; information systems, our enterprise resource planning, or ERP, system and other infrastructure costs; and corporate insurance.

 

General and administrative expenses increased during the period of time leading up to our IPO and, as we operate as a public company, we have incurred additional expenses for costs associated with compliance with Section 404 of the Sarbanes-Oxley Act of 2002, directors’ and officers’ liability insurance, our investor relations function, and an increase in personnel to perform SEC reporting functions.

 

Stock-Based Compensation.  Effective January 1, 2006, we adopted the fair value recognition provisions of the Financial Accounting Standards Board’s, or FASB, Statement of Financial Accounting Standard, or SFAS, No. 123(R), Share-Based Payment, using the prospective transition method, which requires us to apply its provisions only to awards granted, modified, repurchased or cancelled after the effective date. Under this transition method, stock-based compensation expense recognized beginning January 1, 2006 is based on the grant date fair value of stock awards granted or modified after January 1, 2006.

 

We use the Black-Scholes option pricing model, except for certain option awards that contain market conditions relating to our stock price achieving specified levels, in which case we use a Lattice option pricing model, to estimate the fair value of stock options granted and employee stock purchases. The use of option valuation

models requires the input of highly subjective assumptions, including the expected term and the expected stock price volatility. Based on the estimated grant date fair value of stock-based awards, we recognized aggregate stock-based compensation expense of $4.5 million, $2.6 million and $806,000 for the years ended December 31, 2008, 2007 and 2006, respectively.

 

Results of Operations

 

Revenue.  The following table shows products and technical support and professional services revenue (in thousands):

 

 

The increase in our product revenue for the year ended December 31, 2008, as compared to the year ended December 31, 2007, was mostly driven by higher demand for our sensor products, primarily our enterprise class 3D products. For the year ended December 31, 2008, sensor product revenue increased $9.6 million over the prior year, including a $4.5 million increase in our enterprise class 3D products. The increase in our services revenue for the year ended December 31, 2008, as compared to the year ended December 31, 2007, resulted from an increase in our installed customer base due to new product sales in which associated support was purchased, as well as support renewals by our existing customers.

 

The increase in our product revenue for the year ended December 31, 2007, as compared to the year ended December 31, 2006, was also driven primarily by higher demand for our sensor products, sales of which increased $3.4 million, including $1.1 million of sales from our 9800 sensors introduced in the fourth quarter of 2007. In addition, royalty income increased $1.1 million. These increases were partially offset by a decrease in sales of our software only license products of $1.0 million. The increase in our services revenue for the year ended December 31, 2007, as compared to the year ended December 31, 2006, resulted from our support services being provided to a larger installed customer base comprised of new customers, as well as current customers who renewed their maintenance subscriptions.

 

Cost of revenue.  The following table shows products and technical support and professional services cost of revenue (in thousands):

 

The increases in product cost of revenue for 2008 compared to 2007 and 2007 compared to 2006 were driven primarily by higher volume demand in each year for our sensor products, for which we must procure and provide the hardware platform to our customers. We did not experience a material increase in our cost per unit of hardware platforms, which is the largest component of our product cost of revenue.

 

The increase in our services cost of revenue for the year ended December 31, 2008, as compared to the year ended December 31, 2007, was attributable to increased hardware service expense related to support renewal contracts and our hiring of additional personnel to both service our larger installed customer base and to provide training and professional services to our customers. Our services cost of revenue for the year ended December 31, 2007, as compared to the year ended December 31, 2006, increased primarily due to our hiring of additional personnel to both service our larger installed customer base and to provide training and professional services to our customers.

 

Gross profit.  The following table shows products and technical support and professional services gross profit (in thousands):

 

 

Products gross margin remained relatively flat for 2008 compared to 2007 and for 2007 compared to 2006. Technical support and professional services gross margin for the year ended December 31, 2007, as compared to the year ended December 31, 2006 also remained relatively flat. Gross margin for technical support and professional services for the year ended December 31, 2007, as compared to the prior year, increased primarily due to additional, higher-margin services revenues, which grew at a higher rate than our product revenues.

 

Operating expenses.  The following table highlights our operating expenses (in thousands):

 

Research and development expenses for the year ended December 31, 2008 increased over the prior year, primarily due to an increase in salaries, incentive compensation, benefits and occupancy overhead expenses of $1.4 million and an increase in stock-based compensation expense of $327,000, partially offset by a one-time expense of $1.0 million in 2007 in connection with the ClamAV acquisition for the completion of additional source code. The increased expenses in 2008 resulted from the hiring of additional personnel in our research and development department to support the release of updates and enhancements to our 3D products. The increase in the amount of research and development expenses for the year ended December 31, 2007, as compared to the year ended December 31, 2006, was primarily due to an increase in payroll, benefits and overhead expenses of $2.1 million, a one-time expense of $1.0 million in 2007 in connection with the ClamAV acquisition for the completion of additional source code and an increase in stock-based compensation expense of $268,000 due to the hiring of additional personnel in our research and development department to support the release of updates and enhancements to our 3D products.

 

Sales and marketing expenses for the year ended December 31, 2008 increased over the prior year, primarily due to an increase of $6.1 million in salary, commissions and incentive compensation and benefit expenses as a result of additional sales and marketing personnel and increased revenue, an increase of $501,000 in travel and travel-related expenses, an increase of $412,000 in advertising, promotion, partner-marketing programs and trade show expenses in support of our network security solutions and an increase of $379,000 in stock-based compensation expense. The increase in the amount of sales and marketing expenses for the year ended December 31, 2007, as compared to the year ended December 31, 2006, was primarily due to an increase of $2.5 million in payroll and benefit expenses for additional sales and marketing personnel, an increase of $578,000 in sales travel and travel-related expenses, an increase of $644,000 for stock-based compensation expense and an increase of $639,000 for advertising, promotion, partner marketing programs and trade show expenses in support of our network security solutions.

 

General and administrative expenses for the year ended December 31, 2008 increased over the prior year, primarily due to an increase of $2.9 million in corporate development expenses and professional fees related to legal, accounting, information technology, audit, tax and regulatory compliance, an increase of $2.4 million in salaries, incentive compensation and benefit expenses for personnel hired in our executive, accounting, information technology, human resources and legal departments, an increase of $172,000 in director attendance, retainer and other board-related fees, one-time costs associated with our CEO transition of $742,000, stock-based compensation expense of $449,000 for the acceleration of vesting of equity awards for our former CEO and an additional increase of $633,000 in stock-based compensation expense for general and administrative personnel. The increase in general and administrative expense for the year ended December 31, 2007, as compared to the year ended December 31, 2006, was primarily due to an increase of payroll and benefits of $1.3 million for personnel hired in our accounting, information technology, human resources and legal departments, an increase of $841,000 for stock-based compensation expense, an increase of $1.6 million in professional fees related to audit, tax and regulatory compliance, and an increase of $474,000 in insurance premiums primarily due to an increase in our D&O insurance coverage.

 

Depreciation and amortization expense for the year ended December 31, 2008 increased over the prior year, primarily due to the depreciation of additional lab and testing equipment purchased for our engineering department and computers purchased for personnel hired since December 31, 2007, as well as the depreciation associated with our new ERP system. The increase in depreciation and amortization expense for the year ended December 31, 2007, as compared to the year ended December 31, 2006, was principally due to amortization of leasehold improvements relating to our UK office, additional lab and testing equipment purchased for the engineering department and personal computers purchased for personnel hired since December 31, 2006.

 

In-process research and development expense for the year ended December 31, 2007 was attributable to the August 2007 acquisition of certain assets of ClamAV for which technological feasibility had not yet been reached and no alternative future use existed.

Other income, net and income tax expense.  The following table shows our other income, net and income tax expense (in thousands):

 

 

Other income, net for the year ended December 31, 2008 decreased as compared to the prior year, primarily due to a decrease in interest and investment income as a result of lower average interest rates on invested cash balances. Other income for the year ended December 31, 2007 increased compared to the prior year, primarily due to an increase in interest and investment income as a result of higher cash balances resulting from our March 2007 IPO.

 

We record a valuation allowance to reduce our deferred tax assets to the amount of future tax benefit that is more likely than not to be realized. As of December 31, 2008 and 2007, our deferred tax assets were fully reserved, except for a $71,000 and $29,000 benefit, respectively, expected to be available to offset foreign tax liabilities in the future. The provision for income taxes for each of the years ended December 31, 2008 and 2007 primarily related to foreign income taxes.

 

Seasonality

 

Our product revenue has tended to be seasonal. In our third quarter, we have historically benefited from the Federal government’s fiscal year end purchasing activity. This increase has been partially offset by European sales, which have tended to decline significantly in the summer months due to vacation practices in Europe and the resulting delay in capital purchase activities until the fall. We have historically generated a significant portion of our product revenue in the fourth quarter due to increased activity in Europe, coupled with North American enterprise customers who operate on a calendar year budget and often wait until the fourth quarter to make their most significant capital equipment purchases. We expect this historical trend of a lower portion of our annual revenue in the first half of the year and a more significant portion of our annual revenue in the third and fourth quarters to continue in 2009. The timing of these transactions could materially affect our quarterly or annual product revenue.

 

Quarterly Timing of Revenue

 

On a quarterly basis, we have usually generated the majority of our product revenue in the final month of the quarter. We believe this occurs for two reasons. First, many customers wait until the end of the quarter to extract favorable pricing terms from their vendors, including Sourcefire. Second, our sales personnel, who have a strong incentive to meet quarterly sales targets, have tended to increase their sales activity as the end of a quarter nears, while their participation in sales management review and planning activities are typically scheduled at the beginning of a quarter.

Liquidity and Capital Resources

 

Cash Flows

 

 

Operating Activities.  Cash used in operating activities for the year ended December 31, 2008 is the result of our net loss of $6.1 million adjusted for $6.5 million of net non-cash revenues and expenses and changes in our operating assets and liabilities resulting in a net cash outflow of $1.5 million. Receivables increased $7.6 million during the year, primarily as a result of increased revenue in 2008.

 

Investing Activities.  Cash provided by investing activities for the year ended December 31, 2008 was primarily the result of maturities and sales of investments of $108.0 million, offset by purchases of investments of $94.5 million and capital expenditures of $6.7 million. Capital expenditures includes $3.2 million of capitalized costs associated with the implementation of our new ERP system.

 

Financing Activities.  Cash provided by financing activities for the year ended December 31, 2008 was primarily the result of proceeds from the issuance of common stock under employee stock-based plans, partially offset by the repayment of capital lease obligations and the repurchase of common stock from terminated employees.

 

Liquidity Requirements

 

We manufacture our products through contract manufacturers and other third parties. This approach provides us with the advantage of relatively low capital investment requirements and significant flexibility in scheduling production and managing inventory levels. The majority of our products are delivered to our customers directly from our contract manufacturers. Accordingly, our contract manufacturers are responsible for purchasing and stocking the components required for the production of our products, and they invoice us when the finished goods are shipped. By leasing our office facilities, we also minimize the cash needed for expansion. Our capital spending is generally limited to leasehold improvements, computers, office furniture and product-specific test equipment.

 

Our short-term liquidity requirements through December 31, 2009 consist primarily of working capital requirements and capital expenditures. We expect to meet these short-term requirements primarily through cash flow from operations. To the extent that cash flow from operations is not sufficient to meet these requirements, we expect to fund these amounts through the use of existing cash and investment resources. As of December 31, 2008, we had cash, cash equivalents and investments of $101.6 million and working capital of $99.0 million.

 

As described above, our product sales are, and are expected to continue to be, highly seasonal. We believe that our current cash reserves are sufficient for any short-term needs arising from the seasonality of our business.

 

Our long-term liquidity requirements consist primarily of obligations under our operating leases. We expect to meet these long-term requirements primarily through cash flow from operations.

 

In addition, we may utilize cash resources, equity financing or debt financing to fund acquisitions or investments in complementary businesses, technologies or product lines.

Contractual Obligations

 

The following table describes our commitments to settle contractual obligations in cash as of December 31, 2008 (in thousands):

 

 

 

 

Critical Accounting Policies and Estimates

 

Our consolidated financial statements are prepared in accordance with accounting principles generally accepted in the United States of America. The preparation of these consolidated financial statements requires the use of estimates, judgments and assumptions that affect the reported amounts of assets and liabilities at the date of the financial statements and the reported amounts of revenues and expenses during the periods presented. An accounting estimate is considered critical if: the estimate requires management to make assumptions about matters that were highly uncertain at the time the estimate was made; different estimates reasonably could have been used; or the impact of the estimates and assumptions on financial condition or operating performance is material. We evaluate our estimates and assumptions on an ongoing basis. Our actual results may differ from these estimates.

 

We believe that, of our significant accounting policies, which are described in Note 2 to the consolidated financial statements contained in this report, the following accounting policies involve a greater degree of judgment and complexity. Accordingly, we believe that the following accounting policies are the most critical to aid in fully understanding and evaluating our consolidated financial condition and results of operations.

 

Revenue Recognition.  We recognize substantially all of our revenue in accordance with AICPA Statement of Position (“SOP”) No. 97-2, Software Revenue Recognition, as amended by SOP No. 98-4 and SOP No. 98-9. For each arrangement, we defer revenue recognition until persuasive evidence of an arrangement exists, such as a signed contract; delivery of the product has occurred and there are no remaining obligations or substantive customer acceptance provisions; the fee is fixed or determinable; and collection of the fee is probable. We allocate the total arrangement fee among each deliverable based on the fair value of each of the deliverables, determined based on vendor-specific objective evidence. If vendor-specific objective evidence of fair value does not exist for each of the deliverables, we defer all revenue from the arrangement until the earlier of the point at which sufficient vendor-specific objective evidence of fair value can be determined for any undelivered elements or all elements of the arrangement have been delivered. However, if the only undelivered elements are elements for which we currently have vendor-specific objective evidence of fair value, we recognize revenue for the delivered elements based on the residual method.

 

We have established vendor-specific objective evidence of fair value for our technical support based upon actual renewals of each type of technical support that is offered. Technical support and technical support renewals are currently priced based on a percentage of the list price of the respective product or software and historically have not varied from a narrow range of values in the substantial majority of our arrangements. We defer and recognize revenue related to technical support ratably over the contractual period of the technical support arrangement, which is generally 12 months. The vendor-specific objective evidence of fair value of our other services is based on the

price for these same services when they are sold separately. We defer and recognize revenue for services that are sold either on a stand-alone basis or included in multiple element arrangements as the services are performed.

 

Changes in our judgments and estimates about these assumptions could materially impact the timing of our revenue recognition.

 

Accounting for Stock-Based Compensation.  SFAS No. 123(R) requires the use of a valuation model to calculate the fair value of stock-based awards. We use the Black-Scholes option pricing model, except for certain option awards that contain market conditions relating to our stock price achieving specified levels, in which case we use a Lattice option pricing model, for estimating the fair value of stock options granted and for employee stock purchases under the 2007 Employee Stock Purchase Plan, or the 2007 ESPP. The use of option valuation models requires the input of highly subjective assumptions, including the expected term and the expected price volatility. Additionally, the recognition of expense requires the estimation of the number of options that will ultimately vest and the number of options that will ultimately be forfeited.

 

Under the provisions of SFAS No. 123(R), the fair value of share-based awards is recognized as expense over the requisite service period, net of estimated forfeitures. Effective October 1, 2008, we adjusted our estimated forfeiture rate for options from 20% to 17% per annum. Effective April 1, 2008, we adjusted our estimated forfeiture rate from 10% to 14% per annum for restricted stock grants. We rely on historical experience of employee turnover to estimate our expected forfeitures.

 

The following are the assumptions used in the Black-Scholes option valuation of stock options granted under our plans and employee stock purchases under the 2007 ESPP.

 

Average risk-free interest rate — This is the average U.S. Treasury rate (with a term that most closely resembles the expected life of the option) for the quarter in which the option was granted.

 

Expected dividend yield — We have never declared or paid dividends on our common stock and do not anticipate paying dividends in the foreseeable future.

 

Expected useful life — This is the period of time that stock options granted under our option plans and employee purchases under the 2007 ESPP are expected to remain outstanding.

 

For stock options granted, this estimate is derived from the average midpoint between the weighted-average vesting period and the contractual term as described in the SEC’s Staff Accounting Bulletin, or SAB, No. 107, Share-Based Payment, as amended by SAB No. 110. In future periods, we expect to begin to incorporate our own data in estimating the expected life as we develop appropriate historical experience of employee exercise and post-vesting termination behavior considered in relation to the contractual life of the option.

 

For purchases under the 2007 ESPP, the expected useful life is the plan period.

 

Expected volatility — Volatility is a measure of the amount by which a financial variable such as a share price has fluctuated (historical volatility) or is expected to fluctuate (expected volatility) during a period.

 

For stock options granted, given our limited historical stock data from our IPO in March 2007, we have used a blended volatility to estimate expected volatility. The blended volatility includes the average of our historical volatility from our IPO to the respective grant date and an average of our peer group historical volatility consistent with the expected life of the option. Our peer group historical volatility includes the historical volatility of companies that are similar in revenue size, in the same industry or are competitors. We expect to continue to use a larger proportion of our historical volatility in future periods as we develop appropriate historical experience of our own stock price fluctuations considered in relation to the expected life of the option.

 

For purchases under the 2007 ESPP, we use our historical volatility since we have historical data available since our IPO consistent with the expected useful life.

 

During the third quarter of 2008, we granted an option to purchase 99,924 shares of common stock to our new Chief Executive Officer, which vests based on the price of our common stock achieving certain levels. The Lattice option pricing model was used for the valuation of this option because the valuation of this award cannot be reasonably estimated using the Black-Scholes option pricing model. The weighted-average assumptions using the Lattice option pricing model included a volatility of 65%, an average risk-free interest rate of 3.5%, a dividend yield of 0% and a strike price of $6.77.

If factors change and we employ different assumptions for estimating stock-based compensation expense in future periods, or if we decide to use a different valuation model, the amount of expense recorded in future periods may differ significantly from what we have recorded in recent periods.

 

The Black-Scholes option pricing model was developed for use in estimating the fair value of traded options that have no vesting restrictions and are fully transferable, characteristics that are not present in our option grants. Existing valuation models, including the Black-Scholes and Lattice models, may not provide reliable measures of the fair values of our stock-based compensation awards. Consequently, there is a risk that our estimates of the fair values of our stock-based compensation awards on the grant dates may be significantly different than the actual values upon the exercise, expiration, early termination, or forfeiture of those stock-based payments in the future. Certain stock-based payments, such as employee stock options, may expire worthless or otherwise result in zero intrinsic value as compared to the fair values originally estimated on the grant date and reported in our financial statements. Alternatively, values may be realized from these instruments that are significantly higher than the fair values originally estimated on the grant date and reported in our financial statements.

 

The application of these principles may be subject to further interpretation and refinement over time. There are significant differences among valuation models, and there is a possibility that we will adopt different valuation models in the future. This may result in a lack of consistency between past and future periods and materially affect the fair value estimate of stock-based payments. It may also result in a lack of comparability with other companies that use different models, methods, and assumptions.

 

Stock-based compensation expense related to employee stock options, nonvested stock, and employee stock purchases recognized under SFAS No. 123R for the year ended December 31, 2008 was $4.5 million.

 

Accounting for Income Taxes.   We account for income taxes in accordance with SFAS No. 109, Accounting for Income Taxes. Deferred income taxes are recorded for the expected tax consequences of temporary differences between the basis of assets and liabilities recorded for financial reporting purposes and the amounts recognized for income tax purposes. We record a valuation allowance to reduce deferred tax assets to the amount of future tax benefit that is more likely than not to be realized. As of December 31, 2008, and December 31, 2007, our deferred tax assets were fully reserved except for foreign deferred tax assets of $71,000 and $29,000, respectively, expected to be available to offset foreign tax liabilities in the future. We recorded a provision for income taxes of $319,000, $244,000 and $67,000 for the years ended December 31, 2008, 2007 and 2006, respectively, primarily related to foreign income taxes.

 

On January 1, 2007, we adopted Financial Accounting Standards Board, or FASB, Interpretation No. 48, Accounting for Uncertainty in Income Taxes, an interpretation of SFAS No. 109, Accounting for Income Taxes, or FIN 48. FIN 48 clarifies the accounting for income taxes by prescribing a minimum recognition threshold a tax position is required to meet before being recognized in the financial statements. FIN 48 also provides guidance on derecognition, measurement, classification, interest and penalties, accounting in interim periods, disclosure and transition. The adoption of FIN 48 did not have an impact on our financial position or results of operations.

 

Allowance for Doubtful Accounts.  We make estimates regarding the collectibility of our accounts receivable. When we evaluate the adequacy of our allowance for doubtful accounts, we consider multiple factors including historical write-off experience, the need for specific customer reserves, the aging of our receivables, customer creditworthiness and changes in our customer payment cycle. Historically, our allowance for doubtful accounts has been adequate based on actual results. If any of the factors used to calculate the allowance for doubtful accounts change or if it does not reflect the future ability to collect outstanding receivables, additional provisions for doubtful accounts may be needed and the future results of operations could be materially affected.

 

Inventories.  Inventories consist of hardware and related component parts and are stated at the lower of cost on a first-in, first-out basis or market, except for evaluation units which are stated at the lower of cost, on a specific identification basis, or market. Evaluation units are used for customer testing and evaluation and are predominantly located at the customers’ premises. Inventory that is obsolete or in excess of our forecasted demand is written down to its estimated net realizable value based on historical usage, expected demand, and age. Inherent in our estimates of market value in determining inventory valuation are estimates related to economic trends, as well as technological obsolescence of our products.

Investments.  We account for investments in accordance with SFAS No. 115, Accounting for Certain Investments in Debt and Equity Securities. We determine the appropriate classification of debt securities at the time of purchase and reevaluate such designation as of each balance sheet date. Our investments are comprised of money market funds, corporate debt investments, asset-backed securities, commercial paper, government-sponsored enterprises, government securities and certificates of deposit. These investments have been classified as available-for-sale. Available-for-sale investments are stated at fair value, with the unrealized gains and losses, net of tax, reported in accumulated other comprehensive income. The amortization of premiums and accretion of discounts to maturity are computed under the effective interest method. Such amortization is included in interest and investment income. Interest on securities classified as available-for-sale is also included in interest and investment income. Any other-than-temporary declines in fair value are recorded in earnings, and a new cost basis for the investment is established.

 

We evaluate our investments on a regular basis to determine whether an other-than-temporary decline in fair value has occurred. This evaluation consists of a review of several factors, including, but not limited to: the length of time and extent that an investment has been in an unrealized loss position; the existence of an event that would impair the issuer’s future earnings potential; and our intent and ability to hold an investment for a period of time sufficient to allow for any anticipated recovery in fair value. Declines in value below cost for investments where it is considered probable that all contractual terms of the investment will be satisfied, is due primarily to changes in interest rates, and where we have the intent and ability to hold the investment for a period of time sufficient to allow a market recovery, are not assumed to be other-than-temporary.

 

Recent Accounting Pronouncements

 

In September 2006, the FASB issued SFAS No. 157, Fair Value Measurements, which defines fair value, establishes a framework for measuring fair value in generally accepted accounting principles and expands disclosures about fair value measurements. SFAS No. 157 does not require any new fair value measurements, but provides guidance on how to measure fair value by providing a fair value hierarchy used to classify the source of the information. SFAS No. 157 is effective for fiscal years beginning after November 15, 2007. In February 2008, the FASB issued FASB Staff Position No. 157-2, Effective Date of FASB Statement No. 157 (“FSP 157-2”), which delays the effective date of SFAS No. 157 by one year for all non-financial assets and non-financial liabilities, except those that are recognized or disclosed at fair value in the financial statements on a recurring basis (at least annually). On January 1, 2008, we adopted SFAS No. 157 for our financial assets and liabilities. The adoption of SFAS No. 157 did not have a material impact on our financial statements. We have not yet determined the impact on our consolidated financial statements, if any, from the adoption of SFAS No. 157, as it pertains to our non-financial assets and non-financial liabilities.

 

In February 2007, the FASB issued SFAS No. 159, The Fair Value Option for Financial Assets and Financial Liabilities, which allows companies the option to measure financial assets or liabilities at fair value and include unrealized gains and losses in net income rather than equity. We have elected not to adopt SFAS No. 159.

 

In December 2007, the FASB issued SFAS No. 141 (revised 2007), Business Combinations. SFAS No. 141R will significantly change the accounting for business combinations in a number of areas, including the treatment of contingent consideration, contingencies, acquisition costs, in-process research and development and restructuring costs. In addition, under SFAS No. 141R, changes in deferred tax asset valuation allowances and acquired income tax uncertainties in a business combination after the measurement period will impact income tax expense. SFAS 141R is effective for fiscal years beginning after December 15, 2008, and we will adopt this standard on January 1, 2009. We do not expect the adoption of SFAS No. 141R to have a material impact on our consolidated financial statements.

 

Off-Balance Sheet Arrangements

 

We have no off-balance sheet arrangements with unconsolidated entities or related parties, and accordingly there are no off-balance sheet risks to our liquidity and capital resources from unconsolidated entities.

 

Foreign Currency Risk

 

Nearly all of our revenue is derived from transactions denominated in U.S. dollars, even though we maintain sales and business operations in foreign countries. As such, we have exposure to adverse changes in exchange rates, particularly the Euro, British pound and Yen, associated with operating expenses of, and cash held in, our foreign operations, but we believe this exposure to be immaterial at this time. As we grow our international operations, our exposure to foreign currency risk could become more significant. We do not currently engage in currency hedging activities to limit the risk of exchange rate fluctuations.

 

Interest Rate Sensitivity

 

We had cash, cash equivalents and investments totaling approximately $101.6 million at December 31, 2008. The cash equivalents are held for working capital purposes while investments, made in accordance with our low-risk investment policy, take advantage of higher interest income yields. In accordance with our investment policy, we do not enter into investments for trading or speculative purposes. Some of the securities in which we invest, however, may be subject to market risk. This means that a change in prevailing interest rates may cause the fair value amount of the investment to fluctuate. To minimize this risk in the future, we intend to maintain our portfolio of cash equivalents, short- and long-term investments in a variety of securities, including commercial paper, money market funds, debt securities and certificates of deposit. Due to the nature of these investments, we believe that we do not have any material exposure to changes in the fair value of our investment portfolio as a result of changes in interest rates.

 

Credit Market Risk

 

We invest our cash in accordance with an established internal policy and in investments, comprised of money market funds, corporate debt investments, asset-backed securities and commercial paper, that historically have been highly liquid and matured at their full par value. However, as a result of the recent adverse conditions in the global credit markets, there is a risk that we may incur other-than-temporary impairment charges.

 

 

Our consolidated financial statements are submitted on pages F-1 through F-25 of this report.

 

 

None.

 

 

Evaluation of Disclosure Controls and Procedures.  We maintain “disclosure controls and procedures,” as defined in Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934, as amended (the “Exchange Act”), which are controls and other procedures that are designed to ensure that information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is recorded, processed, summarized and reported, within the time periods specified in the SEC’s rules and forms. Disclosure controls and procedures include, without limitation, controls and procedures designed to ensure that information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is accumulated and communicated to the company’s management, including its principal executive and principal financial officers, as appropriate to allow timely decisions regarding required disclosure. Management recognizes that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving their objectives and management necessarily applies its judgment in evaluating the cost-benefit relationship of possible controls and procedures. In addition, the design of any system of controls also is based in part upon certain assumptions about the likelihood of future events, and there can be no assurance that any design will succeed in achieving its stated goals under all potential future conditions; over time, controls may become inadequate because of changes in conditions, or the degree of compliance with policies or procedures may deteriorate. Because of the inherent limitations in a control system, misstatements due to error or fraud may occur and not be detected.

Under the supervision and with the participation of our management, including our Chief Executive Officer and Chief Financial Officer, we evaluated the effectiveness of the design and operation of our disclosure controls and procedures as of the end of the period covered by this report. Based on this evaluation, our Chief Executive Officer and Chief Financial Officer have concluded that, as of December 31, 2008, our disclosure controls and procedures were effective at the reasonable assurance level.

 

Changes in Internal Control Over Financial Reporting.  No change in our internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act) occurred during the fiscal quarter ended December 31, 2008 that has materially affected, or is reasonably likely to materially affect, our internal control over financial reporting.

 

Management’s Report on Internal Control Over Financial Reporting

 

Our management is responsible for establishing and maintaining adequate internal control over financial reporting, as such term is defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act. Internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with U.S. generally accepted accounting principles. A company’s internal control over financial reporting includes those policies and procedures that (i) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (ii) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (iii) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company’s assets that could have a material effect on our consolidated financial statements.

 

There are inherent limitations in the effectiveness of any internal control over financial reporting, including the possibility of human error and the circumvention or overriding of controls. Accordingly, even effective internal control over financial reporting can provide only reasonable assurance with respect to financial statement preparation and may not prevent or detect all misstatements. Further, because of changes in conditions, effectiveness of internal control over financial reporting may vary over time. Our internal control system was designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with U.S. generally accepted accounting principles.

 

Under the supervision and with the participation of our management, including our Chief Executive Officer and Chief Financial Officer, we conducted an evaluation of the effectiveness of our internal control over financial reporting based on the framework in Internal Control — Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission. Based on this evaluation, our management concluded that our internal control over financial reporting was effective as of December 31, 2008 to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with U.S. generally accepted accounting principles.

 

The effectiveness of our internal control over financial reporting as of December 31, 2008 has been audited by Ernst & Young LLP, independent registered public accounting firm, as stated in their report which is included herein.

Report of Independent Registered Public Accounting Firm on
Internal Control Over Financial Reporting

 

The Board of Directors and Stockholders of Sourcefire, Inc.:

 

We have audited Sourcefire, Inc.’s (the “Company”) internal control over financial reporting as of December 31, 2008, based on criteria established in Internal Control — Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (the “COSO criteria”). The Company’s management is responsible for maintaining effective internal control over financial reporting, and for its assessment of the effectiveness of internal control over financial reporting included in the accompanying Management’s Report on Internal Control Over Financial Reporting at Item 9A. Our responsibility is to express an opinion on the Company’s internal control over financial reporting based on our audit.

 

We conducted our audit in accordance with the standards of the Public Company Accounting Oversight Board (United States). Those standards require that we plan and perform the audit to obtain reasonable assurance about whether effective internal control over financial reporting was maintained in all material respects. Our audit included obtaining an understanding of internal control over financial reporting, assessing the risk that a material weakness exists, testing and evaluating the design and operating effectiveness of internal control based on the assessed risk, and performing such other procedures as we considered necessary in the circumstances. We believe that our audit provides a reasonable basis for our opinion.

 

A company’s internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. A company’s internal control over financial reporting includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company’s assets that could have a material effect on the financial statements.

 

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

 

In our opinion, the Company maintained, in all material respects, effective internal control over financial reporting as of December 31, 2008, based on the COSO criteria.

 

We also have audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States), the consolidated balance sheets of Sourcefire, Inc. as of December 31, 2008 and 2007, and the related consolidated statements of operations, changes in convertible preferred stock and stockholders’ equity (deficit), and cash flows for each of the three years in the period ended December 31, 2008, and our report dated March 10, 2009 expressed an unqualified opinion thereon.

 

 

Baltimore, Maryland

March 10, 2009

 

Amendment and Restatement of Bylaws

 

Our Board of Directors adopted the Fifth Amended and Restated Bylaws of the Company effective as of March 12, 2009. The changes effected by this amendment and restatement include, among other matters:

 

 

A copy of the Bylaws is attached as Exhibit 3.2 to this annual report. The foregoing description of the changes effected by the Fifth Amended and Restated Bylaws is qualified in its entirety by reference to the full text thereof.

 

2009 Executive Officer Compensation

 

On March 12, 2009, the Compensation Committee of our Board of Directors approved compensation arrangements for our executive officers for the year ending December 31, 2009. Compensation for our executive officers consists of three elements: (i) base salaries; (ii) cash bonus awards in accordance with our incentive compensation plan that was adopted by our Board of Directors in February 2008; and (iii) long-term equity incentives in the form of restricted stock units under our 2007 Stock Incentive Plan.

 

Base Salaries

 

Effective April 1, 2009, base salaries of our executive officers were set as follows:

 

Target Annual Cash Bonus Awards

 

In accordance with our annual executive incentive compensation plan established in February 2008, the target annual cash bonus awards for our executive officers for the year ending December 31, 2009 were set as follows:

 

 

For each of the executive officers, the target annual bonus amount is divided into four equal quarterly target bonus amounts. Bonuses are payable quarterly based on the achievement of three performance measures for the quarter: (i) our total revenues measured against our 2009 operating plan; (ii) our adjusted operating income/loss measured against our 2009 operating plan; and (iii) for executive officers other than Mr. Burris, the individual officer’s management of departmental expenses measured against a departmental budget established by our Chief Executive Officer and approved by our Compensation Committee. In lieu of a quarterly bonus for the fourth quarter, the Compensation Committee will measure attainment of the three performance measures for the full 2009 year, determine the achievement of the officer’s performance against the total target annual bonus amount, and reduce the annual bonus by the amount of quarterly bonuses paid for the first three quarters of the year.

 

The three performance measure components are described in more detail below:

 

Revenue

 

Our total revenues will represent a 50% weighting of each executive officer’s quarterly target bonus amount. The attainment of quarterly revenues against our 2009 operating plan will determine a payout percentage to be multiplied against the 50% weighting for the revenue component:

 

 

Adjusted Operating Income/Loss

 

Our adjusted operating income/loss will represent a 30% weighting of each executive officer’s quarterly target bonus amount (other than Mr. Burris for which it will represent a 50% weighting). Adjusted operating income/loss is a non-GAAP measure and is calculated as net income or loss before interest income/expense, income taxes, non-cash stock-based compensation expense and other adjustments approved by the Compensation Committee.

 

The attainment of quarterly adjusted operating income/loss against our 2009 operating plan will determine a payout percentage to be multiplied against the 30% weighting for the adjusted operating income/loss component:

 

 

Expense Management

 

Each officer’s (other than Mr. Burris) departmental budget expense results will represent a 20% weighting of the officer’s quarterly target bonus amount. The attainment of expense management against our 2009 operating plan will determine a payout percentage to be multiplied against the 20% weighting for the budget component:

 

 

Total Bonus Payment; Limitations

 

Once the payout percentage has been calculated for each of the three performance measure components, the payout percentage is multiplied by the respective percentage weighting for that component, and the three component payment percentages are then added to yield a composite payout percentage that is multiplied against the target bonus amount for the quarter. In no event, however, may the actual quarterly payout for the first, second or third quarters exceed 90% of the quarterly target bonus amount.

 

As described above, in lieu of a quarterly bonus for the fourth quarter of 2009, annual bonuses will be calculated for each executive officer in the same manner as quarterly bonuses for the first three quarters of the year using actual annual performance and target annual performance for each of the three performance measures. The total amount of quarterly bonuses previously paid will then be subtracted from the calculated annual bonus amount to determine the final amount, if any, payable to each executive officer for the year. In no event, however, may the total of the quarterly bonuses and any additional year-end bonus exceed 150% of the total annual target bonus.

 

In addition, no quarterly or additional year-end bonuses are payable if we have not achieved certain minimum cumulative adjusted operating income/loss measures for the year.

 

Our Compensation Committee retains the discretion to make upward or downward adjustments to the foregoing calculations and to make discretionary bonus payments as it deems appropriate.

 

Equity Compensation

 

The equity compensation awarded to our executive officers on March 12, 2009 consists of the following:

 

 

Time-based restricted stock unit awards. Each executive officer has been awarded a number of restricted stock units equal to 25% of the officer’s total equity grant. Each award has been approved by our Compensation Committee subject to the officer’s execution of a restricted stock unit award agreement. The shares underlying each restricted stock unit award will vest and be issued in three equal annual installments beginning on March 12, 2010, subject to the officer’s continuous service with us as of the vesting date.

Performance-based restricted stock unit awards. Each executive officer has been awarded a number of restricted stock units equal to 75% of the officer’s total equity grant. Each award has been approved by our Compensation Committee subject to the officer’s execution of a restricted stock unit award agreement. The shares underlying each restricted stock unit award are eligible for vesting in four equal annual installments beginning on March 12, 2010. The number of shares eligible for vesting on each vesting date will vest and be issued upon our meeting or exceeding the annual financial objectives set by the Compensation Committee for such year, subject to the officer’s continuous service with us as of such date. In the event the financial objectives for a particular year are not achieved, the shares that otherwise would have vested at the end of such year shall vest on March 12, 2014, the fifth anniversary of the date of the award, subject to the officer’s continuous service with us as of such date.

 

The Compensation Committee has set total revenues and adjusted operating income, as contemplated by our operating plan, as the financial objectives for determining the vesting of the first installment of the performance-based restricted stock units awarded on March 12, 2009 that could vest on March 12, 2010, as well as the vesting of the next installment of the performance-based restricted stock awarded to our executive officers in 2008 and 2007.

 

 

The information required by this item will be set forth under the headings “Election of Directors,” “Information Regarding the Board of Directors and Corporate Governance,” “Executive Officers” and “Section 16(a) Beneficial Ownership Reporting Compliance” in the definitive Proxy Statement for our 2009 Annual Meeting of Stockholders (the “Proxy Statement”) and is incorporated into this report by reference.

 

 

The information required by this item will be set forth under the heading “Executive Compensation” in the Proxy Statement and is incorporated into this report by reference.

 

 

The information required by this item will be set forth under the headings “Security Ownership of Certain Beneficial Owners and Management” and “Equity Compensation Plan Information” in the Proxy Statement and is incorporated into this report by reference.

 

 

The information required by this item will be set forth under the headings “Certain Relationships and Related Transactions” and “Information Regarding the Board of Directors and Corporate Governance — Independence of the Board of Directors” in the Proxy Statement and is incorporated into this report by reference.

 

 

The information required by this item will be set forth under the heading “Ratification of Selection of Independent Auditors” in the Proxy Statement and is incorporated into this report by reference.

 

 

(a)

 

(1) Financial Statements.

 

The list of consolidated financial statements and schedules set forth in the accompanying Index to Consolidated Financial Statements at page F-1 of this annual report is incorporated herein by reference. Such consolidated financial statements and schedules are filed as part of this annual report.

 

(3) Exhibits.

The exhibits listed on the accompanying Exhibit Index are filed or incorporated by reference as part of this annual report and such Exhibit Index is incorporated herein by reference. Exhibits 10.2-10.20 listed on the accompanying Exhibit Index identify management contracts or compensatory plans or arrangements required to be filed as exhibits to this annual report, and such listing is incorporated herein by reference.

 

Pursuant to the requirements of Section 13 or 15(d) of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned, thereunto duly authorized, on March 13, 2009.

 

SOURCEFIRE, INC.

 

John C. Burris

Chief Executive Officer

 

Pursuant to the requirements of the Securities Exchange Act of 1934, this report has been signed below by the following persons on behalf of the registrant and in the capacities and on the dates indicated. Each person whose signature appears below constitutes and appoints Todd P. Headley and Douglas W. McNitt, and each of them, as attorneys-in-fact, each with the power of substitution, for him in any and all capacities, to sign any amendment to this Annual Report on Form 10-K and to file the same, with exhibits thereto and other documents in connection therewith, with the Commission, granting to said attorneys-in-fact, full power and authority to do and perform each and every act and thing requisite and necessary to be done in connection therewith, as fully to all intents and purposes as he might or could do in person, hereby ratifying and confirming all that the said attorney-in-fact, or his substitute or substitutes, may lawfully do or cause to be done by virtue hereof.