---

---

---

•	the evolution of the threat landscape facing our customers and prospects;

•	our ability to educate the market regarding the advantages of our virtual machine-based security solution;

•	our ability to maintain an adequate rate of revenue growth;

•	our future financial and operating results;

•	our business plan and our ability to effectively manage our growth and associated investments;

•	beliefs and objectives for future operations;

•	our ability to expand our leadership position in advanced network security;

•	our ability to attract and retain customers and to expand our solutions footprint within each of these customers;

•	our expectations concerning renewal rates for subscriptions and services by existing customers, including our expectation that revenue from such renewals will increase as a percentage of our total revenue from subscriptions and services;

•	our ability to maintain our competitive technological advantages against new entrants in our industry;

•	our ability to timely and effectively scale and adapt our existing technology;

•	our ability to innovate new products and bring them to market in a timely manner;

•	our ability to maintain, protect, and enhance our brand and intellectual property;

•	our ability to expand internationally;

•	the effects of increased competition in our market and our ability to compete effectively;

•	cost of revenue, including changes in costs associated with production, manufacturing and customer support;

•	operating expenses, including changes in research and development, sales and marketing, and general and administrative expenses;

•	anticipated income tax rates;

•	sufficiency of cash to meet cash needs for at least the next 12 months;

•	our ability to generate cash flows from operations and free cash flows;

•	our ability to capture new, and renew existing, contracts with the United States and international governments;

•	costs associated with defending intellectual property infringement and other claims, such as those claims discussed in “Business—Legal Proceedings”;

•	our expectations concerning relationships with third parties, including channel partners and logistics providers;

•	the release of new products;

•	economic and industry trends or trend analysis;

•	the attraction and retention of qualified employees and key personnel;

•	future acquisitions of or investments in complementary companies, products, subscriptions or technologies; and

•	the effects of seasonal trends on our results of operations.

---

---

•

First, Mandiant provided endpoint-based threat detection, forensic and response solutions, and we have continued to develop Mandiant’s endpoint technology as part of our comprehensive security platform. The integration of threat intelligence from our endpoint products with our web, email, file and mobile platforms increases security teams' visibility into attacks and enables faster, more accurate decisions about potential security incidents occurring across an organization’s network and endpoints.

•

Second, Mandiant brings significant depth in intelligence on next-generation attacks and threat actors, which is continually gathered from ongoing monitoring of more than six million endpoints and through compromise assessments, incident response and remediation teams that serve on the front lines combating the most advanced attacks. When this depth of threat intelligence is paired with the breadth of the FireEye real-time threat intelligence gathered from more than ten million virtual machines every hour, organizations will have robust detection and contextual information about attempted attacks, including the level of risk, the identity of the attackers, and the intended target of the attacks.

•	Third, Mandiant’s team of highly skilled incident response experts has performed hundreds of incident response investigations across numerous industries at some of the largest organizations in the world. This role as first responder to high profile breaches fosters a trusted advisor relationship with organizations and enables long term strategic relationships.

---

•	Fourth, Mandiant brought its Managed Defense monitoring service to FireEye. The addition of these skills and expertise significantly expands our ability to offer value-added services to our customers, and was the basis for our FireEye-as-a-Service advanced security-as-a-service offering.

---

•

Threat Prevention Platform. Our Threat Prevention Platform consists of vector-specific appliance and cloud-based solutions that provide comprehensive advanced threat protection, from network to endpoint, for both inbound and outbound network traffic that may contain sensitive information. Our portfolio of Threat Prevention solutions includes the following appliances covering the Web, email, endpoint, file and mobile threat vectors:

•

Network Threat Prevention Platform (NX Series). Our Network Security NX Series appliances scale from 10 Mbps to multiple gigabits of throughput and are deployed in-line at enterprise Internet access points to analyze all web traffic. Utilizing our MVX engine, these appliances identify and block cyber threats deeply embedded inside web traffic, create real-time protection descriptors with the identification of new threats, and capture potential multi-protocol outbound communication data from threats that may already be inside the network. Our MVX engine detects advanced attacks exploiting unknown vulnerabilities as well as malicious code embedded in common Web and multimedia content. Our MVX engine executes suspicious software against a range of browsers, plug-ins, applications, and operating environments that are instrumental in tracking malicious actions. As potential threats can sometimes enter the network via user devices and may have been resident in the network previously, our MVX engine also analyzes outbound traffic for threats that may attempt to extract sensitive information or enable control of devices within the network by communicating with servers. Using our MVX engine, our Network Security platform confirms zero-day attacks, generates real-time security intelligence and captures dynamic callback destinations to defend against attacks. In September 2013, we introduced the NX 10000, a multi-gigabit throughput appliance that can be deployed in-line at Internet egress points to block Web exploits and outbound multi-protocol callbacks. In December 2013, we introduced our NX 900 to enable threat protection at various remote and branch offices as well as at the homes of an organization’s executive officers and key personnel. In June 2014, we added intrusion prevention systems functionality (IPS) to our Network Threat Prevention Platform to allow organizations to consolidate advanced threat prevention with traditional signature-based network security. This allows an organization to optimize security spending, reduce false positives to illuminate actual attacks, and enable compliance. In September 2014, we introduced the NX 7500 with support for Windows and Mac OSX on the same appliance. In February 2015, we introduced the NX 4400 to bridge performance requirements from 1 gigabit to multiple gigabits, and in October 2015, we added decryption capabilities to enable visibility into encrypted network traffic.

•

Email Threat Prevention Platform (EX Series and ETP). Our Email Threat Prevention appliances (EX series) and cloud-based solutions (ETP) detect and stop advanced attacks that exploit unknown operating system, browser, and application vulnerabilities as well as malicious code and attachments included in emails. Using our MVX engine, both the appliance and cloud-based solutions analyze email content as well as email attachments, including all common file and archive formats. In particular, our Email Threat Prevention solutions secure networks against spear phishing emails, which bypass traditional anti-spam and reputation-based technologies. Spear phishing attacks use individually targeted content to trick users into clicking on a malicious link or opening a document, and are frequently used by cybercriminals to extract sensitive information such as user IDs and passwords. Our MVX engine actively executes, and is able to quickly identify, links to compromised websites and malicious attachments and blocks spear-phishing emails.

•

Endpoint Threat Prevention Platform (HX Series). Our Endpoint Threat Prevention Platform is an appliance and endpoint agent system that equips security organizations to detect, analyze and resolve security incidents on desktops, laptops and other end-user devices using the threat detection algorithms of the MVX engine. Threat intelligence and alerts are correlated between our Network Threat Prevention and Endpoint Threat Prevention platforms to provide visibility across an organization and enable rapid containment. Additionally, the HX agent collects forensic data necessary for investigation and analysis of attacks. Our Endpoint Threat Prevention can be configured to sweep for indicators of compromise at regular intervals to identify new attacks and compromised devices and is a component of our FireEye-as-a-Service offering. In November 2015, we introduced HX Endpoint 3.0 with enterprise search and live response, enabling organizations to rapidly search for new threats across as many as 100,000 endpoints.

•

File Content Security (FX Series). Our FX Series appliances analyze network file servers to detect and quarantine malicious software brought into the network through technologies that bypass traditional security solutions, such as online file sharing and associated collaboration tools. These appliances analyze files using our MVX engine and detect malicious code embedded in common file types, including PDF, Microsoft Office documents, archived files, and multimedia content such as QuickTime and other video, audio and image files. Our FX Series appliances perform recursive, scheduled, and on-demand scanning of accessible network file servers to continuously identify and quarantine resident threats.

---

•

Mobile Threat Prevention (MX Series). Our Mobile Threat Prevention product allows organizations to identify malicious mobile apps and assess risk levels for other apps for Android and Apple devices. Using our MVX technology, we have threat intelligence from more than nine million mobile applications and assigned security and privacy risk levels for each. Our Mobile Threat Prevention platform includes a downloadable app and a management solution that can integrate with a number of the major mobile device management solutions. The management solution is available as an on-premise appliance or a cloud-based solution.

•	Security Management Products

•

Central Management System. Our Central Management System, or CMS, unifies reporting, configuration, and threat intelligence sharing and manages the overall deployment of the components of our Threat Prevention Platform. CMS appliances distribute threat intelligence from the DTI cloud and provide cross-enterprise threat data correlation to identify and block blended attacks across multiple attack vectors. CMS consolidates the management and reporting of activities in a unified security dashboard to provide a real-time view of an organization’s security profile. Customers generally purchase this appliance when they need to manage multiple FireEye appliances.

•

Threat Analytics Platform (TAP). Our Threat Analytics Platform, or TAP, is a cloud-based solution that enables security teams to identify and effectively respond to cyber threats by correlating enterprise-generated security event data from any security product with real-time threat intelligence from FireEye. The platform is designed to scale by keeping as much data online and searchable as business needs demand. Search results can be exported from the user interface for use in other incident response management tools as needed.

•

Malware Analysis System (AX Series). Our AX Series of appliances provide a secure environment to test, replay, characterize and document advanced malicious activities by allowing security teams to manually execute and inspect advanced malware, zero-day, and other advanced cyber-attacks embedded in files, email attachments, and Web objects. Using our MVX engine, AX analyzes the execution path of a particular malware sample to generate a dynamic and anonymized profile that can be distributed to other FireEye appliances on the network. Larger customers typically purchase the product to enable advanced and deeper analysis of potential malicious software outside of the real-time traffic scanning done by our Threat Prevention appliances.

•

Network Forensics Platform (PX Series). Our Network Forensics Platform appliances complement our Threat Prevention Platform by capturing and indexing full packets at extremely rapid speeds to allow organizations to investigate and resolve security incidents. Using our Network Forensics Platform in conjunction with our Threat Prevention Platform, security analysts can detect threats and view specific packets and sessions before, during, and after the attack to confirm what may have triggered a malware download or callback. This information can be used for rapid response and to develop future protective strategies.

•

Investigation Analysis System (AI Series). Our Investigative Analysis System provides a centralized, easy-to-use analytical interface to the Network Forensics Platform to provide data visualization and in-depth analytics to security analysts in a single centralized dashboard. Our Investigation Analysis System supports a number of configurations for single node and distributed architectures to optimize bandwidth and performance of metadata aggregation, queries, and analytics.

•	Mandiant Intelligent Response (MIR). The MIR endpoint forensics product enables remote investigation of endpoints and allows security teams to collect targeted forensic data for identification of attacker behavior, tools and techniques.

•	Product Subscriptions

•	Threat Intelligence Subscriptions

---

•	Security-as-a-Service Offerings

•

FireEye-as-a-Service. Our FireEye-as-a-Service offering includes our Network Security Platform and our Endpoint Security Platform solutions, managed by our security experts through our security operations centers around the world. Using automated techniques and our advanced threat intelligence, our analysts monitor and analyze network traffic, regularly sweep enterprise endpoints for new malware, and actively hunt for new attacks and adversaries. Customers receive detailed analyses of threats with the context necessary to assess risk and prioritize action, as well as recommendations for containment and response.

•	Customer Support and Consulting Services

•

Incident response, compromise assessments and related consulting services. We have a team of cybersecurity experts to quickly respond to customers that have experienced a breach and help them understand the scope of the incident and quickly remediate the attack. Our cybersecurity experts will inform customers who is behind the attack (i.e., organized crime, nation state or malicious insider) and how much damage was done, and will work with them to recover from the incident while minimizing the impact of the event on the organization. We have performed hundreds of successful security investigations across all industries, organization sizes and technical environments. As part of our services, we can help customers scope their own security programs, provide litigation support and forensic analysis. Our cybersecurity experts also perform compromise assessments to analyze network, endpoint and log data to identify indications of present or historical attacker activity. These consulting services are marketed under the Mandiant brand.

•

Training and professional services. We offer training services to our customers and channel partners through our training department and authorized training partners. These services are designed to provide education regarding implementation, use and functionality, and maintenance and support of our products. We also provide training on managing the stages of our sales cycle for our channel partners. We offer professional services to customers for large implementations where expert technical resources are required. We provide professional services both directly to our customers, and indirectly through our authorized partners, who provide similar services to the end-customer.

---

•

Customer Support and Maintenance Services. We offer technical support on our products and subscriptions. We provide multiple levels of support and have regional support centers located across the globe to help customers solve technical challenges that they may encounter. In addition to post-sales support activities, our support organization works with our product management and engineering teams to ensure the attainment of defined pre-requisite quality levels for our products and services prior to release. Like our subscription services, our support and maintenance contracts have terms of either one or three years.

---

•	Automatic creation of indicators of compromise coupled with rapid enterprise-wide search. Security teams are able to generate search parameters based on new threat intelligence, query tens or hundreds of thousands of endpoints to identify critical issues, and contain compromised hosts in a matter of minutes.

•	Agent Anywhere. Investigate any endpoint event even when the device is disconnected from the network.

•	Unified endpoint dashboard. In addition, our Endpoint Threat Prevention platform provides a unified dashboard that allows administrators to view malicious activity both on conventional endpoints like PCs as well as mobile devices.

---

---

•	large networking vendors such as Cisco and Juniper that may emulate or integrate features similar to ours into their own products;

•	large companies such as Intel, IBM and HPE that have acquired large IT security specialist vendors in recent years and have the technical and financial resources to bring competitive solutions to the market;

•	independent security vendors such as Palo Alto Networks and Trend Micro that offer products that claim to perform similar functions to our platform;

•	small and large companies, including new entrants, that offer point solutions that compete with some of the features present in our platform;

•	providers of traditional IT security solutions, such as Symantec, that we may compete with in the future; and

•	other providers of incident response and compromise assessment services.

•	ability to deliver the combination of technology, intelligence and expertise necessary to combat the current threat landscape;

•	ability to detect current threats by overcoming the limitations of signature-based approaches, while maintaining a low rate of false-positive alerts;

•	scalability, throughput and overall performance of the virtual machine technology;

•	visibility into all stages of an attack, especially the exploit phase;

•	breadth and richness of the shared threat intelligence, including threat intelligence on cyber crime, cyber espionage, hacktivism, attacks on critical infrastructure and nation-state attacks;

---

•	flexible deployment options, including on-premise appliances, software in the cloud, or a hybrid of both;

•	brand awareness and reputation;

•	strength of sales and marketing efforts;

•	product extensibility and ability to integrate with other technologies in the network infrastructure;

•	ease of use;

•	price and total cost of ownership; and

•	ability to provide an orchestrated solution of products and services for detecting, preventing and resolving advanced cybersecurity threats across multiple attack vectors.

---

---

•	effectively attracting, training and integrating a large number of new employees, particularly members of our sales and management teams;

•	further improving our key business applications, processes and IT infrastructure, including our data centers, to support our business needs;

•	continuing to refine our ability to forecast our bookings, billings, revenues, expenses and cash flows;

•	enhancing our information and communication systems to ensure that our employees and offices around the world are well coordinated and can effectively communicate with each other and our growing base of channel partners and customers;

•	improving our internal control over financial reporting and disclosure controls and procedures to ensure timely and accurate reporting of our operational and financial results; and

•	appropriately documenting and testing our IT systems and business processes.

---

•	a loss of existing or potential customers or channel partners;

•	delayed or lost revenue and harm to our financial condition and results of operations;

•	a delay in attaining, or the failure to attain, market acceptance;

•	the expenditure of significant financial and product development resources in efforts to analyze, correct, eliminate, or work around errors or defects, to address and eliminate vulnerabilities, or to identify and ramp up production with alternative third-party manufacturers;

•	an increase in warranty claims, or an increase in the cost of servicing warranty claims, either of which would adversely affect our gross margins;

•	harm to our reputation or brand; and

•	litigation, regulatory inquiries, or investigations that may be costly and further harm our reputation.

•	our ability to attract new and retain existing customers;

•	changes in our mix of products, subscriptions and services sold;

•	the budgeting cycles, seasonal buying patterns and purchasing practices of customers;

•	the timing of shipments of our products and length of our sales cycles;

•	changes in customer or reseller requirements or market needs;

•	changes in the growth rate of the IT security market, particularly the market for threat protection solutions like ours that target next-generation advanced cyber attacks;

•	the timing and success of new product and service introductions by us or our competitors or any other change in the competitive landscape of the IT security market, including consolidation among our customers or competitors;

•	the level of awareness of IT security threats, particularly advanced cyber attacks, and the market adoption of our platform;

•	deferral of orders from customers in anticipation of new products or product enhancements announced by us or our competitors;

•	our ability to successfully expand our business domestically and internationally;

•	reductions in customer renewal rates for our subscriptions;

---

•	decisions by organizations to purchase IT security solutions from larger, more established security vendors or from their primary IT equipment vendors;

•	changes in our pricing policies or those of our competitors;

•	any disruption in, or termination of, our relationships with channel partners;

•	our inability to fulfill our customers’ orders due to supply chain delays or events that impact our manufacturers or their suppliers;

•	insolvency or credit difficulties confronting our customers, affecting their ability to purchase or pay for our products, subscriptions and services, or confronting our key suppliers, particularly our sole source suppliers, which could disrupt our supply chain;

•	the cost and potential outcomes of existing and future litigation, including, without limitation, the purported stockholder lawsuits described under the "Litigation" subheading in Note 9 Commitments and Contingencies contained in the "Notes to Consolidated Financial Statements" in Item 8 of Part II of this Annual Report on Form 10-K;

•	seasonality in our business;

•	general economic conditions, both domestic and in our foreign markets;

•	future accounting pronouncements or changes in our accounting policies or practices;

•	the amount and timing of operating costs and capital expenditures related to the expansion of our business; and

•	increases or decreases in our revenues and expenses caused by fluctuations in foreign currency exchange rates.

•	diversion of management time and focus from operating our business to addressing acquisition integration challenges;

•	coordination of research and development and sales and marketing functions;

•	integration of product and service offerings;

•	retention of key employees from the acquired company;

•	changes in relationships with strategic partners as a result of product acquisitions or strategic positioning resulting from the acquisition;

•	cultural challenges associated with integrating employees from the acquired company into our organization;

•	integration of the acquired company’s accounting, management information, human resources and other administrative systems;

---

•	the need to implement or improve controls, procedures, and policies at a business that prior to the acquisition may have lacked sufficiently effective controls, procedures and policies;

•	financial reporting, revenue recognition or other financial or control deficiencies of the acquired company that we don’t adequately address and that cause our reported results to be incorrect;

•	liability for activities of the acquired company before the acquisition, including intellectual property infringement claims, violations of laws, commercial disputes, tax liabilities and other known and unknown liabilities;

•	unanticipated write-offs or charges; and

•	litigation or other claims in connection with the acquired company, including claims from terminated employees, customers, former stockholders or other third parties.

---

•	greater name recognition, longer operating histories and larger customer bases;

•	larger sales and marketing budgets and resources;

•	broader distribution and established relationships with channel and distribution partners and customers;

•	greater customer support resources;

•	greater resources to make acquisitions;

•	lower labor and research and development costs;

•	larger and more mature intellectual property portfolios; and

•	substantially greater financial, technical and other resources.

---

•	research and development related to our platform, including investments in our research and development team;

•	sales and marketing, including a significant expansion of our sales organization, particularly in international markets;

•	international expansion of our business; and

•	expansion of our professional services organization.

•	maintain and expand our customer base and the ways in which customers use our products and services;

•	expand revenue from existing customers through increased or broader use of our products and services within their organizations;

•	convince customers to allocate a fixed portion of their annual IT budgets to our products and services;

•	improve the performance and capabilities of our platform through research and development;

•	effectively expand our business domestically and internationally, which will require that we rapidly expand our sales force and service professionals and fill key management positions, particularly internationally; and

•	successfully compete with other companies that currently provide, or may in the future provide, solutions like ours that protect against next-generation advanced cyber attacks.

---

---

---

---

•	increased purchasing power and leverage held by large customers in negotiating contractual arrangements with us;

•	more stringent or costly requirements imposed upon us in our support service contracts with such customers, including stricter support response times and penalties for any failure to meet support requirements;

•	more complicated implementation processes;

•	longer sales cycles and the associated risk that substantial time and resources may be spent on a potential customer that ultimately elects not to purchase our platform or purchases less than we hoped;

•	closer relationships with, and dependence upon, large technology companies who offer competitive products; and

•	more pressure for discounts and write-offs.

---

---

•	selling to governmental agencies can be highly competitive, expensive and time consuming, often requiring significant upfront time and expense without any assurance that such efforts will generate a sale;

---

•	government certification requirements applicable to our products may change and, in doing so, restrict our ability to sell into the U.S. federal government sector until we have attained the revised certification;

•	government demand and payment for our products and services may be impacted by public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our products and services;

•	we sell our platform to governmental agencies through our indirect channel partners, and these agencies may have statutory, contractual or other legal rights to terminate contracts with our distributors and resellers for convenience or due to a default, and any such termination may adversely impact our future results of operations;

•	governments routinely investigate and audit government contractors’ administrative processes, and any unfavorable audit could result in the government refusing to continue buying our platform, which would adversely impact our revenue and results of operations, or institute fines or civil or criminal liability if the audit were to uncover improper or illegal activities; and

•	governments may require certain products purchased by it to be manufactured in the United States and other relatively high-cost manufacturing locations, and we may not manufacture all products in locations that meet these requirements, affecting our ability to sell these products to governmental agencies.

---

---

•	develop or enhance our products and subscriptions;

•	continue to expand our sales and marketing and research and development organizations;

---

•	acquire complementary technologies, products or businesses;

•	expand operations, in the United States or internationally;

•	hire, train and retain employees; or

•	respond to competitive pressures or unanticipated working capital requirements.

•	greater difficulty in enforcing contracts and managing collections, as well as longer collection periods;

•	higher costs of doing business internationally, including costs incurred in establishing and maintaining office space and equipment for our international operations;

•	fluctuations in exchange rates between the U.S. dollar and foreign currencies in markets where we do business;

•	management communication and integration problems resulting from cultural and geographic dispersion;

•	risks associated with trade restrictions and foreign legal requirements, including any importation, certification, and localization of our platform that may be required in foreign countries;

•	greater risk of unexpected changes in tariffs and tax laws and treaties;

---

•	compliance with anti-bribery laws, including, without limitation, compliance with the U.S. Foreign Corrupt Practices Act of 1977, as amended, the U.S. Travel Act and the UK Bribery Act 2010, violations of which could lead to significant fines, penalties and collateral consequences for our Company;

•	heightened risk of unfair or corrupt business practices in certain geographies and of improper or fraudulent sales arrangements that may impact financial results and result in restatements of, or irregularities in, financial statements;

•	the uncertainty of protection for intellectual property rights in some countries;

•	general economic and political conditions in these foreign markets;

•	foreign exchange controls or tax regulations that might prevent us from repatriating cash earned outside the United States;

•	political and economic instability in some countries; and

•	double taxation of our international earnings and potentially adverse tax consequences due to changes in the tax laws of the United States or the foreign jurisdictions in which we operate.

---

---

•	we may be more vulnerable to economic downturns, less able to withstand competitive pressures and less flexible in responding to changing business and economic conditions;

•	our ability to obtain additional financing in the future for working capital, capital expenditures, acquisitions, general corporate or other purposes may be limited

•	a substantial portion of our cash flows from operations in the future may be required for the payment of the principal amount of our existing indebtedness when it becomes due; and

•	we may elect to make cash payments upon any conversion of the convertible notes, which would reduce our cash on hand.

---

---

•	announcements of new products, services or technologies, commercial relationships, acquisitions or other events by us or our competitors;

•	changes in how customers perceive the effectiveness of our platform in protecting against advanced cyber attacks or other reputational harm;

•	publicity concerning cyber attacks in general or high profile cyber attacks against specific organizations;

•	price and volume fluctuations in the overall stock market from time to time;

•	significant volatility in the market price and trading volume of technology and/or growth companies in general and of companies in the IT security industry in particular;

•	fluctuations in the trading volume of our shares or the size of our public float;

•	actual or anticipated changes or fluctuations in our results of operations;

•	whether our results of operations, and in particular, our revenue growth rates, meet the expectations of securities analysts or investors;

•	actual or anticipated changes in the expectations of investors or securities analysts, whether as a result of our forward-looking statements, our failure to meet such expectation or otherwise;

•	litigation involving us, our industry, or both;

•	regulatory developments in the United States, foreign countries or both;

•	general economic conditions and trends;

•	major catastrophic events;

•	sales of large blocks of our common stock; and

•	departures of key personnel.

---

---

•	a classified board of directors with three-year staggered terms, which could delay the ability of stockholders to change the membership of a majority of our board of directors;

•	the ability of our board of directors to issue shares of preferred stock and to determine the price and other terms of those shares, including preferences and voting rights, without stockholder approval, which could be used to significantly dilute the ownership of a hostile acquiror;

•	the exclusive right of our board of directors to elect a director to fill a vacancy created by the expansion of our board of directors or the resignation, death or removal of a director, which prevents stockholders from being able to fill vacancies on our board of directors;

•	a prohibition on stockholder action by written consent, which forces stockholder action to be taken at an annual or special meeting of our stockholders;

•	the requirement that a special meeting of stockholders may be called only by our board of directors, the chairperson of our board of directors, our Chief Executive Officer or our President (in the absence of a Chief Executive Officer), which could delay the ability of our stockholders to force consideration of a proposal or to take action, including the removal of directors;

---

•

the requirement for the affirmative vote of holders of at least 66 2/3% of the voting power of all of the then outstanding shares of the voting stock, voting together as a single class, to amend the provisions of our amended and restated certificate of incorporation relating to the management of our business (including our classified board structure) or certain provisions of our amended and restated bylaws, which may inhibit the ability of an acquiror to effect such amendments to facilitate an unsolicited takeover attempt;

•	the ability of our board of directors to amend the bylaws, which may allow our board of directors to take additional actions to prevent an unsolicited takeover and inhibit the ability of an acquiror to amend the bylaws to facilitate an unsolicited takeover attempt; and

•	advance notice procedures with which stockholders must comply to nominate candidates to our board of directors or to propose matters to be acted upon at a stockholders’ meeting, which may discourage or deter a potential acquiror from conducting a solicitation of proxies to elect the acquiror’s own slate of directors or otherwise attempting to obtain control of us.

---

---

---

(1)	Under our 2008 Stock Plan, certain participants may exercise options prior to vesting, subject to a right of a repurchase by us. All shares in the above table were shares repurchased as a result of us exercising this right and not pursuant to a publicly announced plan or program.

---

---

---

---

---

•	Product revenue. Our product revenue is generated from sales of our appliances which we generally recognize at the time of shipment, provided that all other revenue recognition criteria have been met.

•

Subscription and services revenue. Subscription and services revenue is generated primarily from our cloud subscriptions, FireEye-as-a-Service, support and maintenance services and other professional services. We recognize revenue from subscriptions and support and maintenance services over the one or three year contract term, as applicable. Professional services revenue, which includes incident response and compromise assessments, is offered on a time-and-material basis or through a fixed fee arrangement and is recognized as the services are delivered.

•

Cost of product revenue. Cost of product revenue primarily consists of costs paid to our third-party contract manufacturers for our appliances and personnel and other costs in our manufacturing operations department. Our cost of product revenue also includes product testing costs, shipping costs and allocated overhead costs. We expect our cost of product revenue to increase as our product revenue increases.

•	Cost of subscription and services revenue. Cost of subscription and services revenue consists of personnel costs for our global customer support and services organization and allocated overhead costs. We expect our cost of subscription and services revenue to increase as our customer base grows and as we hire additional support and professional services personnel.

•

Research and development. Research and development expense consists primarily of personnel costs and allocated overhead. Research and development expense also includes prototype related expenses. We expect research and development expense to continue to increase in absolute dollars, primarily due to the full year impact of past investments, as well as recent acquisitions in our research and product development efforts to introduce new products, enhance our current product capabilities, address new threat vectors and access new customer markets, although such expense may fluctuate as a percentage of total revenue.

•

Sales and marketing. Sales and marketing expense consists primarily of personnel costs, incentive commission costs and allocated overhead. We expense commission costs as incurred. Sales and marketing expense also includes costs for market development programs, promotional and other marketing activities, travel, office equipment, depreciation of proof-of-concept evaluation units and outside consulting costs. We expect sales and marketing expense to continue to increase in absolute dollars, primarily

---

•

General and administrative. General and administrative expense consists of personnel costs, professional services and allocated overhead. General and administrative personnel include our executive, finance, human resources, facilities and legal organizations. Professional services consist primarily of legal, auditing, accounting and other consulting costs. We expect general and administrative expense to continue to increase in absolute dollars, primarily due to the full year impact of past investments, as well as recent acquisitions which grew our operations.

•

Restructuring charges. Beginning in August 2014, we initiated a series of business restructuring plans to reduce our cost structure and improve efficiency. The expenses incurred primarily consisted of employee severance charges related to workforce reductions, and real estate and related fixed asset charges for the consolidation of certain leased facilities. We did not initiate any plans related to restructuring activities during the year ended December 31, 2015.

---

---

---

---

---

---

---

---

---

---

---

---

---

---

•	Persuasive Evidence of an Arrangement Exists. We rely upon non-cancelable sales agreements and purchase orders to determine the existence of an arrangement.

•	Delivery has Occurred. We use shipping documents or transmissions of service contract registration codes to verify delivery.

•	The Fee is Fixed or Determinable. We assess whether the fee is fixed or determinable based on the payment terms associated with the transaction.

•	Collectability is Reasonably Assured. We assess collectability based on credit analysis and payment history.

---

•	Fair Value of Common Stock. Because our common stock was not publicly traded until September 20, 2013, we were required to estimate the fair value of common stock for grants made prior to that date, as discussed in “Common Stock Valuations” below.

•	Risk-Free Interest Rate. We base the risk-free interest rate used in the Black-Scholes option-pricing model on the implied yield available on U.S. Treasury zero-coupon issues with a remaining term equivalent to that of the options for each option group.

•	Expected Term. The expected term represents the period that our stock-based awards are expected to be outstanding. We base the expected term assumption on our historical exercise behavior combined with estimates of the post-vesting holding period.

•

Volatility. We determine the price volatility factor based on the historical volatilities of our publicly traded peer group as we do not have a significant trading history for our common stock. Industry peers consist of several public companies in the technology industry that are similar to us in size, stage of life cycle, and financial leverage. We used the same set of peer group companies in all the relevant valuation estimates. We did not rely on implied volatilities of traded options in our industry peers’ common stock because the volume of activity was relatively low. We intend to continue to consistently apply this process using the same or similar public companies until a sufficient amount of historical information regarding the volatility of our own common stock share price becomes available, or unless circumstances change such that the identified companies are no longer similar to us, in which case, more suitable companies whose share prices are publicly available would be utilized in the calculation.

•	Dividend Yield. The expected dividend assumption is based on our current expectations about our anticipated dividend policy. Consequently, we used an expected dividend yield of zero.

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

•	Persuasive Evidence of an Arrangement Exists. We rely upon non-cancelable sales agreements and purchase orders to determine the existence of an arrangement.

•	Delivery has Occurred. We use shipping documents or transmissions of service contract registration codes to verify delivery.

•	The Fee is Fixed or Determinable. We assess whether the fee is fixed or determinable based on the payment terms associated with the transaction.

•	Collectability is Reasonably Assured. We assess collectability based on credit analysis and payment history.

---

---

---

•	Level 1: Observable inputs that reflect quoted prices (unadjusted) for identical assets or liabilities in active markets.

•

Level 2: Inputs that reflect quoted prices for identical assets or liabilities in less active markets; quoted prices for similar assets or liabilities in active markets; benchmark yields, reported trades, broker/dealer quotes, inputs other than quoted prices that are observable for the assets or liabilities; or inputs that are derived principally from or corroborated by observable market data by correlation or other means.

•	Level 3: Unobservable inputs that reflect our own assumptions incorporated in valuation techniques used to measure fair value. These assumptions are required to be consistent with market participant assumptions that are reasonably available.

---

---

---

---

---

---

---

•

during any calendar quarter commencing after the calendar quarter ended on September 30, 2015 (and only during such calendar quarter), if the last reported sale price of the common stock for at least 20 trading days (whether or not consecutive) during a period of 30 consecutive trading days ending on the last trading day of the immediately preceding calendar quarter is greater than or equal to 130% of the conversion price for the Convertible Senior Notes of the relevant series on each applicable trading day;

•

during the five business day period after any five consecutive trading day period in which the trading price per $1,000 principal amount of Series A Notes or Series B Notes, as applicable, for each trading day of the measurement period was less than 98% of the product of the last reported sale price of our common stock and the conversion rate for the notes of the relevant series on each such trading day;

•	if we call any or all of the Convertible Senior Notes of a series for redemption, at any time prior to the close of business on the scheduled trading day immediately preceding the relevant redemption date; or

•	upon the occurrence of specified corporate events, as specified in each indenture governing the Convertible Senior Notes.

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---