our forticasb extends the core capabilities of our security fabric architecture to provide businesses the same level of cybersecurity and threat intelligence in cloud environments as they do on their physical networks . the fortinet cloud security is available across all major cloud providers , including microsoft azure , amazon web services , google cloud , ibm cloud and oracle cloud . fourth , the emergence of the iot has created an environment where data move freely between devices across locations , network environments , remote offices , mobile workers and public cloud environments , making it difficult to consistently track and secure . financial highlights we recorded total revenue of $ 1.49 billion in 2017 , an increase of 17 % compared to $ 1.28 billion in 2016 . product revenue was $ 577.2 million in 2017 , an increase of 5 % compared to $ 548.1 million in 2016 . service revenue was $ 917.8 million in 2017 , an increase of 26 % compared to $ 727.3 million in 2016 . we generated operating income of $ 109.8 million in 2017 , an increase of 156 % compared to $ 42.9 million in 2016. cash , cash equivalents and investments were $ 1.35 billion as of december 31 , 2017 , an increase of $ 38.8 million , or 3 % , from december 31 , 2016 . deferred revenue was $ 1.34 billion as of december 31 , 2017 , an increase of $ 301.0 million , or 29 % , from december 31 , 2016 . we generated cash flows from operating activities of $ 594.4 million in 2017 , an increase of $ 248.7 million , or 72 % , compared to 2016 . in 2017 , we repurchased 11.2 million shares of common stock under the repurchase program for an aggregate purchase price of $ 446.3 million . in 2016 , we repurchased 3.9 million shares of common stock for a total purchase price of $ 110.8 million . our revenue growth was driven by the strength in sales of our fortigate and non-fortigate products and the sale of new , and the renewal and upgrade of existing , forticare technical support and fortiguard security subscription service contracts . revenue grew in 2017 as the investment made in sales and marketing enabled us to continue to gain enterprise customers . 42 we continue to see a shift in our revenue mix from product revenues to higher-margin , recurring service revenues , reflecting our success in driving higher-priced subscription bundles and services . on a geographic basis , revenue continues to be diversified globally , which remains a key strength of our business . the percentage of our fortigate-related billings from high-end products increased from 38 % in 2016 to 39 % in 2017 , and the percentage of our fortigate-related billings from mid-range products increased from 28 % in 2016 to 30 % in 2017. the percentage of our fortigate-related billings from entry-level products decreased to 31 % in 2017 from 34 % in 2016. the sale of non-fortigate products also grew significantly in 2017. we also saw more deals that included multiple fortinet products in physical , virtual and cloud environments . in 2017 , operating expenses as a percentage of revenue decreased by 3 percentage points compared to 2016 . the decrease was primarily driven by a reduction in sales and marketing expenses as a percentage of revenue . headcount increased by 9 % to 5,066 employees and contractors as of december 31 , 2017 , up from 4,665 as of december 31 , 2016. business model our sales strategy is based on a distribution model whereby we primarily sell our products , software licenses and services directly to distributors which sell to resellers and service providers , which , in turn , sell to our end-customers . in certain cases , we sell directly to large service providers and major systems integrators . we also offer our products across all major cloud providers , including amazon web services , microsoft azure , google cloud , ibm cloud and oracle cloud . while the revenue from such sales are still relatively insignificant , they have increased significantly in recent periods on a percentage basis . typically , fortiguard security subscription and forticare technical support services are purchased along with our hardware products and software licenses , most frequently as part of a bundle offering that includes hardware and services functionality . we generally invoice at the time of our sale for the total price of the products and security and technical support services , and the invoice is payable within 30 to 90 days . we also invoice certain licenses and services on a monthly basis . we generally recognize product revenue up front , and recognize revenue for the sale of new and the renewal of existing fortiguard security subscription and forticare technical support services contracts ratably over the term of the service contract . we recognize revenue for certain software licenses up front as product revenue and , to a lesser extent , recognize other software licenses over the term of the agreement as services revenue . we recognize the security and support revenue over the service period , which is typically one to three years , to a lesser extent , five years . sales of new and renewal services are a source of recurring revenue and increase our deferred revenue balance , which has contributed to our positive cash flow from operations . we recognize commissions on both product and service sales at the time of sale . our approach to network security is defined by our spu hardware architecture . the spu includes three lines of proprietary asics , content processor , network processor and the system on a chip . the asics are designed for highly efficient execution of computationally intensive tasks , including policy enforcement , threat detection and encryption . story_separator_special_tag security services provide access to our antivirus , intrusion prevention , web filtering , and anti-spam functionality . support services include rights to unspecified software upgrades , maintenance releases and patches , telephone and internet access to technical support personnel , and hardware support . service revenue consists of sales from our fortiguard security subscription and forticare technical support services , professional and training services and other services that include saas and iaas , both of which are hosted or cloud-based services . we recognize revenue from these arrangements as the subscription service is delivered over the term , which is typically one year , or on a monthly usage basis . to date , saas and iaas revenues have not represented a significant percentage of our total revenue . we reduce revenue for estimates of sales returns and allowances and record reductions to revenue for rebates and estimated commitments related to price protection and other customer incentive programs . additionally , in limited circumstances , we may permit end-customers , distributors and resellers to return our products , subject to varying limitations , for a refund within a reasonably short period from the date of purchase . we estimate and record reserves for sales incentives and sales returns based on historical experience . our sales arrangements typically contain multiple elements , such as hardware , security subscription , technical support services and other services . the majority of our hardware appliance products contain our operating system software that together function to deliver the essential functionality of the product . our products and services generally qualify as separate units of accounting . we allocate revenue to each unit of accounting based on an estimated selling price using vendor-specific objective evidence ( “ vsoe ” ) of selling price , if it exists , or third-party evidence ( “ tpe ” ) of selling price . if neither vsoe nor tpe of selling price exists for a deliverable , we use our best estimate of selling price ( “ besp ” ) for that deliverable . revenue allocated to each element is then recognized when the basic revenue recognition criteria are met for each element . revenue is reported net of sales taxes . for our hardware appliances , we use besp as our selling price estimate . for our support and other services , we generally use vsoe as our selling price estimate . we determine vsoe of fair value for elements of an arrangement based on the historical pricing and discounting practices for those services when sold separately . in establishing vsoe , we require that a substantial majority of the selling prices for a service fall within a reasonably narrow pricing range , generally evidenced by a substantial majority of such historical stand-alone transactions falling within a reasonably narrow range as a percentage of list price . when we are unable to establish a selling price using vsoe for our support and other services , we use besp in our allocation of arrangement consideration . we determine besp for a product or service by considering multiple historical factors including , but not limited to , cost of products , gross margin objectives , pricing practices , geographies , customer classes and distribution channels that fall within a reasonably narrow range as a percentage of list price . for multiple-element arrangements where software deliverables are included , revenue is allocated to the non-software deliverables and to the software deliverables as a group using the relative estimated selling prices of each of the deliverables in the arrangement based on the estimated selling price hierarchy . the amount allocated to the software deliverables is then allocated to each software deliverable using the residual method when vsoe of fair value exists . if evidence of vsoe of fair value of one or more undelivered elements does not exist , all software allocated revenue is deferred and recognized when delivery of those elements occurs or when fair value can be established . when the undelivered element for which we do not have vsoe of fair value is support , revenue for the entire arrangement is recognized ratably over the support period . the same residual method and vsoe of fair value principles apply for our multiple element arrangements that contain only software elements . 48 asu 2014-09 on january 1 , 2018 , we adopted accounting standards update ( “ asu ” ) 2014-09—revenue from contracts with customers , which outlines a single , comprehensive model for entities to use in accounting for revenue arising from contracts with customers . the core principle of asu 2014-09 is to recognize revenue when promised goods or services are transferred to customers in an amount that reflects the consideration that is expected to be received for those goods or services . asu 2014-09 defines a five-step process to achieve this core principle and , accordingly , we expect more judgment and estimates may be required within the revenue recognition process than is required under the legacy gaap , including identifying performance obligations in the contract , estimating the amount of variable consideration to include in the transaction price and allocating the transaction price to each separate performance obligation . asu 2014-09 permits two methods of adoption : retrospectively to each prior reporting period presented ( the full retrospective method ) , or retrospectively with the cumulative effect of initially applying the guidance recognized at the date of initial application ( the modified retrospective method ) . we elected to adopt asu 2014-09 using the modified retrospective method and will apply the standard to contracts that are not completed as of january 1 , 2018 , and will recognize the cumulative effect of initially applying the standard as an adjustment to the opening balance of accumulated deficit . we have completed our analysis of open revenue contracts as of january 1 , 2018. based on our assessment , the impact on revenue in our consolidated financial statements

liquidity and capital resources replace_table_token_23_th liquidity and capital resources may be impacted by our operating activities , as well as by our stock repurchases , real estate and other capital expenditures , proceeds associated with stock option exercises and issuances of common stock under our espp , payment of taxes in connection with the net settlement of equity awards and business acquisitions . in recent years , we have received significant capital resources as a result of increases in our deferred revenue and the proceeds from exercise of stock options and purchases under our espp . additional increases in deferred revenue may depend on a number of factors including our billing growth rate , service contract renewal rates and length of initial and renewals service contracts . we expect proceeds from the issuance of stock options in future years to be impacted by the increased mix of restricted stock units granted versus stock options and also to vary based on our share price . as of december 31 , 2017 , $ 442.8 million remained available for future share repurchase under the repurchase program . we currently expect to spend $ 90.0 million to $ 120.0 million for 2018 in capital expenditures , primarily related to expansion of our offices to support worldwide growth . as of december 31 , 2017 , our cash , cash equivalents and investments of $ 1.35 billion were invested primarily in corporate debt securities , money market fund , certificate of deposits , commercial paper and u.s. government and agency securities . it is our investment policy to invest excess cash in a manner that preserves capital , provides liquidity and maximizes return without significantly increasing risk . as of december 31 , 2017 , $ 848.0 million of our cash and investments were held by our international subsidiaries .


 Write a concise suspicious activity report of the following text delimited by triple backquotes. Return your response as a formal report which covers the key points highlighting the location,dates,entity names and account holder information in chronological order of the text.
     ```liquidity and capital resources replace_table_token_23_th liquidity and capital resources may be impacted by our operating activities , as well as by our stock repurchases , real estate and other capital expenditures , proceeds associated with stock option exercises and issuances of common stock under our espp , payment of taxes in connection with the net settlement of equity awards and business acquisitions . in recent years , we have received significant capital resources as a result of increases in our deferred revenue and the proceeds from exercise of stock options and purchases under our espp . additional increases in deferred revenue may depend on a number of factors including our billing growth rate , service contract renewal rates and length of initial and renewals service contracts . we expect proceeds from the issuance of stock options in future years to be impacted by the increased mix of restricted stock units granted versus stock options and also to vary based on our share price . as of december 31 , 2017 , $ 442.8 million remained available for future share repurchase under the repurchase program . we currently expect to spend $ 90.0 million to $ 120.0 million for 2018 in capital expenditures , primarily related to expansion of our offices to support worldwide growth . as of december 31 , 2017 , our cash , cash equivalents and investments of $ 1.35 billion were invested primarily in corporate debt securities , money market fund , certificate of deposits , commercial paper and u.s. government and agency securities . it is our investment policy to invest excess cash in a manner that preserves capital , provides liquidity and maximizes return without significantly increasing risk . as of december 31 , 2017 , $ 848.0 million of our cash and investments were held by our international subsidiaries .
```    
 Suspicious Activity Report : our forticasb extends the core capabilities of our security fabric architecture to provide businesses the same level of cybersecurity and threat intelligence in cloud environments as they do on their physical networks . the fortinet cloud security is available across all major cloud providers , including microsoft azure , amazon web services , google cloud , ibm cloud and oracle cloud . fourth , the emergence of the iot has created an environment where data move freely between devices across locations , network environments , remote offices , mobile workers and public cloud environments , making it difficult to consistently track and secure . financial highlights we recorded total revenue of $ 1.49 billion in 2017 , an increase of 17 % compared to $ 1.28 billion in 2016 . product revenue was $ 577.2 million in 2017 , an increase of 5 % compared to $ 548.1 million in 2016 . service revenue was $ 917.8 million in 2017 , an increase of 26 % compared to $ 727.3 million in 2016 . we generated operating income of $ 109.8 million in 2017 , an increase of 156 % compared to $ 42.9 million in 2016. cash , cash equivalents and investments were $ 1.35 billion as of december 31 , 2017 , an increase of $ 38.8 million , or 3 % , from december 31 , 2016 . deferred revenue was $ 1.34 billion as of december 31 , 2017 , an increase of $ 301.0 million , or 29 % , from december 31 , 2016 . we generated cash flows from operating activities of $ 594.4 million in 2017 , an increase of $ 248.7 million , or 72 % , compared to 2016 . in 2017 , we repurchased 11.2 million shares of common stock under the repurchase program for an aggregate purchase price of $ 446.3 million . in 2016 , we repurchased 3.9 million shares of common stock for a total purchase price of $ 110.8 million . our revenue growth was driven by the strength in sales of our fortigate and non-fortigate products and the sale of new , and the renewal and upgrade of existing , forticare technical support and fortiguard security subscription service contracts . revenue grew in 2017 as the investment made in sales and marketing enabled us to continue to gain enterprise customers . 42 we continue to see a shift in our revenue mix from product revenues to higher-margin , recurring service revenues , reflecting our success in driving higher-priced subscription bundles and services . on a geographic basis , revenue continues to be diversified globally , which remains a key strength of our business . the percentage of our fortigate-related billings from high-end products increased from 38 % in 2016 to 39 % in 2017 , and the percentage of our fortigate-related billings from mid-range products increased from 28 % in 2016 to 30 % in 2017. the percentage of our fortigate-related billings from entry-level products decreased to 31 % in 2017 from 34 % in 2016. the sale of non-fortigate products also grew significantly in 2017. we also saw more deals that included multiple fortinet products in physical , virtual and cloud environments . in 2017 , operating expenses as a percentage of revenue decreased by 3 percentage points compared to 2016 . the decrease was primarily driven by a reduction in sales and marketing expenses as a percentage of revenue . headcount increased by 9 % to 5,066 employees and contractors as of december 31 , 2017 , up from 4,665 as of december 31 , 2016. business model our sales strategy is based on a distribution model whereby we primarily sell our products , software licenses and services directly to distributors which sell to resellers and service providers , which , in turn , sell to our end-customers . in certain cases , we sell directly to large service providers and major systems integrators . we also offer our products across all major cloud providers , including amazon web services , microsoft azure , google cloud , ibm cloud and oracle cloud . while the revenue from such sales are still relatively insignificant , they have increased significantly in recent periods on a percentage basis . typically , fortiguard security subscription and forticare technical support services are purchased along with our hardware products and software licenses , most frequently as part of a bundle offering that includes hardware and services functionality . we generally invoice at the time of our sale for the total price of the products and security and technical support services , and the invoice is payable within 30 to 90 days . we also invoice certain licenses and services on a monthly basis . we generally recognize product revenue up front , and recognize revenue for the sale of new and the renewal of existing fortiguard security subscription and forticare technical support services contracts ratably over the term of the service contract . we recognize revenue for certain software licenses up front as product revenue and , to a lesser extent , recognize other software licenses over the term of the agreement as services revenue . we recognize the security and support revenue over the service period , which is typically one to three years , to a lesser extent , five years . sales of new and renewal services are a source of recurring revenue and increase our deferred revenue balance , which has contributed to our positive cash flow from operations . we recognize commissions on both product and service sales at the time of sale . our approach to network security is defined by our spu hardware architecture . the spu includes three lines of proprietary asics , content processor , network processor and the system on a chip . the asics are designed for highly efficient execution of computationally intensive tasks , including policy enforcement , threat detection and encryption . story_separator_special_tag security services provide access to our antivirus , intrusion prevention , web filtering , and anti-spam functionality . support services include rights to unspecified software upgrades , maintenance releases and patches , telephone and internet access to technical support personnel , and hardware support . service revenue consists of sales from our fortiguard security subscription and forticare technical support services , professional and training services and other services that include saas and iaas , both of which are hosted or cloud-based services . we recognize revenue from these arrangements as the subscription service is delivered over the term , which is typically one year , or on a monthly usage basis . to date , saas and iaas revenues have not represented a significant percentage of our total revenue . we reduce revenue for estimates of sales returns and allowances and record reductions to revenue for rebates and estimated commitments related to price protection and other customer incentive programs . additionally , in limited circumstances , we may permit end-customers , distributors and resellers to return our products , subject to varying limitations , for a refund within a reasonably short period from the date of purchase . we estimate and record reserves for sales incentives and sales returns based on historical experience . our sales arrangements typically contain multiple elements , such as hardware , security subscription , technical support services and other services . the majority of our hardware appliance products contain our operating system software that together function to deliver the essential functionality of the product . our products and services generally qualify as separate units of accounting . we allocate revenue to each unit of accounting based on an estimated selling price using vendor-specific objective evidence ( “ vsoe ” ) of selling price , if it exists , or third-party evidence ( “ tpe ” ) of selling price . if neither vsoe nor tpe of selling price exists for a deliverable , we use our best estimate of selling price ( “ besp ” ) for that deliverable . revenue allocated to each element is then recognized when the basic revenue recognition criteria are met for each element . revenue is reported net of sales taxes . for our hardware appliances , we use besp as our selling price estimate . for our support and other services , we generally use vsoe as our selling price estimate . we determine vsoe of fair value for elements of an arrangement based on the historical pricing and discounting practices for those services when sold separately . in establishing vsoe , we require that a substantial majority of the selling prices for a service fall within a reasonably narrow pricing range , generally evidenced by a substantial majority of such historical stand-alone transactions falling within a reasonably narrow range as a percentage of list price . when we are unable to establish a selling price using vsoe for our support and other services , we use besp in our allocation of arrangement consideration . we determine besp for a product or service by considering multiple historical factors including , but not limited to , cost of products , gross margin objectives , pricing practices , geographies , customer classes and distribution channels that fall within a reasonably narrow range as a percentage of list price . for multiple-element arrangements where software deliverables are included , revenue is allocated to the non-software deliverables and to the software deliverables as a group using the relative estimated selling prices of each of the deliverables in the arrangement based on the estimated selling price hierarchy . the amount allocated to the software deliverables is then allocated to each software deliverable using the residual method when vsoe of fair value exists . if evidence of vsoe of fair value of one or more undelivered elements does not exist , all software allocated revenue is deferred and recognized when delivery of those elements occurs or when fair value can be established . when the undelivered element for which we do not have vsoe of fair value is support , revenue for the entire arrangement is recognized ratably over the support period . the same residual method and vsoe of fair value principles apply for our multiple element arrangements that contain only software elements . 48 asu 2014-09 on january 1 , 2018 , we adopted accounting standards update ( “ asu ” ) 2014-09—revenue from contracts with customers , which outlines a single , comprehensive model for entities to use in accounting for revenue arising from contracts with customers . the core principle of asu 2014-09 is to recognize revenue when promised goods or services are transferred to customers in an amount that reflects the consideration that is expected to be received for those goods or services . asu 2014-09 defines a five-step process to achieve this core principle and , accordingly , we expect more judgment and estimates may be required within the revenue recognition process than is required under the legacy gaap , including identifying performance obligations in the contract , estimating the amount of variable consideration to include in the transaction price and allocating the transaction price to each separate performance obligation . asu 2014-09 permits two methods of adoption : retrospectively to each prior reporting period presented ( the full retrospective method ) , or retrospectively with the cumulative effect of initially applying the guidance recognized at the date of initial application ( the modified retrospective method ) . we elected to adopt asu 2014-09 using the modified retrospective method and will apply the standard to contracts that are not completed as of january 1 , 2018 , and will recognize the cumulative effect of initially applying the standard as an adjustment to the opening balance of accumulated deficit . we have completed our analysis of open revenue contracts as of january 1 , 2018. based on our assessment , the impact on revenue in our consolidated financial statements

