ITEM 1.
BUSINESS
Overview
WatchGuard is a leading provider of Internet security solutions designed to protect small- to medium-sized enterprises, or SMEs, that use the Internet for e-commerce and secure communications. We provide SMEs worldwide with integrated and expandable Internet security solutions employing multi-layered defenses that protect against known and future threats in an intelligent way backed by an intuitive user interface and the expert guidance and support of our LiveSecurity Service. With the risk that threats and attacks will compromise multiple access points in a corporate network, an effective security solution now requires more layers of defense than just firewalls for access control and virtual private networks, or VPNs, for secure communications. A security solution that integrates multiple layers of defense, however, must do so efficiently to preserve performance and remain flexible enough to adapt to future threats and attacks in the evolving security landscape.
Thousands of enterprises worldwide use our award-winning products and services to meet these requirements. These products and services include our integrated, expandable Firebox security solutions that
offer firewall protection and intrusion prevention technology for access control, virtual private networking for secure communications, content and spam filtering, anti-virus protection and vulnerability assessment services. We offer our customers centralized point-and-click management that allows even the non-security professional to effectively install, configure and monitor our security products as well as the networking features required for more complex network installations. In addition, our innovative subscription-based LiveSecurity Service provides our customers with access to expert guidance and support so they can protect their data and communications in a continuously changing environment.
Our market spans the SME market, from smaller-sized companies, for which ease-of-use is a primary requirement, to medium-sized companies, including those with high-speed connections supporting VPNs between the corporate headquarters and geographically dispersed branch offices, for which performance, scalability and networking features are key requirements. Our security solutions also give enterprises a security management choice. An enterprise can manage its own Internet security with our product offerings or outsource its security management to an Internet service provider, or ISP, or other managed service provider implementing our managed security solutions. For the service provider, our technology improves the economics of managed security services through a scalable delivery platform that enables the service provider to remotely configure and manage thousands of customer sites quickly and easily.
We sell our Internet security solutions indirectly to end-users through a network that includes thousands of distributors and resellers and we have customers located in over 125 countries. We also sell directly and indirectly to a number of service providers that implement our managed security solution. As of December 31, 2003, we had shipped over 200,000 of our security appliances.
We initially incorporated in Washington in 1996 and reincorporated in Delaware in 1997. References to “we,” “our,” “us” and “WatchGuard” in this annual report refer to WatchGuard Technologies, Inc., our subsidiaries and our predecessor. Our executive offices are located at 505 Fifth Avenue South, Suite 500, Seattle, Washington 98104, and our telephone number is (206) 521-8340. We make available on our Web site, free of charge, copies of our annual report on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and amendments to those reports filed with or furnished to the SEC, as soon as reasonably practicable after filing or furnishing the information to the SEC. This information can be found in the investor relations portion of our Web site, which is located at www.watchguard.com. In addition, the SEC maintains a Web site that contains reports, proxy and information statements and other information regarding issuers that file with the SEC, at http://www.sec.gov.
Industry Background
Reliance on the Internet
The growth in the Internet has provided enterprises, regardless of size, with new revenue opportunities by facilitating global distribution of products and services and enabling significant reductions in sales and marketing costs through automation and instantaneous access. Enterprises are increasingly required to establish secure Internet access to facilitate and support their strategic business objectives. In a marketplace that is becoming more competitive, enterprises are increasingly utilizing new business tools and initiatives, such as remote access, e-commerce, online customer service and supply chain management to gain competitive advantage.
The need for Internet security
The increased importance of e-commerce and the proliferation and growth of corporate intranets have dramatically increased the openness of computer networks, with the Internet becoming a widely accepted platform for many business-to-business and business-to-consumer transactions. The accessibility and relative anonymity of users in open computing environments, however, make systems and the integrity of information stored on them increasingly vulnerable to security threats. Open systems present inviting opportunities for computer hackers, terrorists, curious or disgruntled employees or contractors, or competitors, to compromise,
alter or destroy sensitive information within the system or to disrupt operations and Internet access. Open computing environments are also complex and typically involve a variety of hardware, operating systems and applications supplied by a variety of vendors, making networks difficult to manage, monitor and protect from unauthorized access. In addition, because even smaller organizations are rapidly adopting public-facing Web and application servers, they now face the types of threats and vulnerabilities that had been previously reserved for much larger organizations that could deploy sufficient personnel to meet that challenge.
New attacks and security vulnerabilities are created or discovered on almost a daily basis. Security vulnerabilities are faults in software and hardware that may permit unauthorized network access or allow an attacker to cause network damage. According to the Computer Emergency Response Team, or CERT, a federally funded research and development center, not only is the number of cyber incidents and attacks increasing at an alarming rate, but the number of vulnerabilities is increasing as well. The number of vulnerabilities has increased almost four-fold in three years, from 1,090 reported vulnerabilities in 2000 to 3,784 reported vulnerabilities in 2003. In addition, CERT handled 137,529 security incidents in 2003, approximately 68% more than the 82,094 security incidents handled in 2002, and over six times the 21,756 security incidents handled in 2000.
The annual Computer Security Institute, or CSI, survey conducted in 2003 highlights the fact that the potential risks faced by organizations connected to the Internet remains very high. The CSI survey revealed that 75% of companies responding had experienced security breaches that resulted in financial losses, with the average loss per company due to theft of proprietary information, denial of service, or sabotage of data on networks estimated at nearly $1.5 million. Virus attacks (82% of respondents) were most frequently cited, along with insider abuse of network access (80% of respondents). In addition to an increase in the number of attacks, the speed of propagation of these attacks is increasing as well. For example, MyDoom, an automated Internet attack that was a blend of a computer worm and a computer virus, quickly spread around the world. At its peak, it was estimated that 1 in 12 emails carried the worm. Organizations therefore often do not have the luxury of waiting for an alert about a current threat, but must be proactive in their defense against Internet security attacks.
The Internet security challenge
Internet security is not a response to a single attack or point of vulnerability, but rather a comprehensive solution comprised of a series of defenses against a wide variety of attacks and points of vulnerabilities. Because enterprises need to control the flow of information between their internal networks and the Internet, they need firewalls, which are the foundation of a comprehensive security solution. A firewall, a security component that varies in complexity, is designed to block access from the Internet to an enterprise’s internal networks, as well as control the flow of and access to information shared between the networks and the Internet. A comprehensive security solution, however, needs to do more than control access. It also needs to integrate several other sophisticated security layers, such as VPNs, to enable encrypted communications between points on the Internet, gateway and desktop anti-virus solutions, to scan and detect viruses and worms, and other security methodologies, such as vulnerability assessment, intrusion prevention, authentication and content filtering.
Even a comprehensive security solution must, however, be easy to install, configure and manage to be truly effective. With businesses increasingly establishing secure Internet access for branch offices, trading partners and traveling employees, an enterprise must often deploy multiple point solutions such as firewalls and VPNs to fully protect the corporate network, as well as a variety of other solutions such as anti-virus, intrusion detection, and spam filtering to protect all points within their network. This often requires a variety of different security technologies, often from a wide variety of vendors, all with disparate management systems. The complexity of effectively managing all of these point solutions is often beyond the scope and skill of an enterprise, and without a robust, intuitive and easy-to-use system to manage these point solutions, the complexity and difficulty of successfully implementing a corporate information security solution rises dramatically.
To further complicate matters, the dangers against which an effective Internet security solution must protect are dynamic rather than static, with new types of intrusion schemes, worms, viruses and other security threats and
vulnerabilities emerging constantly. In addition, unless an enterprise can timely and easily implement updates across the enterprise’s point solutions protecting its network, the enterprise may need dedicated, and expensive, security experts to proactively identify, obtain and manually implement these updates quickly and correctly.
The Internet security opportunity
According to the VPN and Firewall Products Quarterly Worldwide Market Share and Forecasts for 3Q03 report from Infonetics Research, Inc., “end-user demand is clearly a fundamental driver for deployment of VPN and firewall products, and demand is skyrocketing.” Infonetics reports that the worldwide market for VPN and firewall appliances reached $1.4 billion in 2002 and is forecasted to grow to $2.2 billion in 2006, at a compound annual growth rate, or CAGR, of 22%. Infonetics believes that the demand for VPN and firewall appliances is growing in part because most end-users are moving from a model of centralized Internet connectivity to distributed connectivity in order to take advantage of the cost savings offered by VPNs.
Enterprises require a robust, comprehensive Internet security solution that secures all vulnerable points in the corporate network, that can be installed, configured and managed easily, and that can be kept up to date quickly and effectively, all for an economical price. In addition, many enterprises would rather outsource the management of their Internet security to ISPs and other managed service providers. Service providers face challenges, however, in delivering affordable security services that can be rapidly and economically deployed to thousands of customer sites and easily managed from a central location.
The WatchGuard Approach to Internet Security
WatchGuard’s approach to Internet security has the following key elements:
Integrated Appliance
By integrating multiple security capabilities-which normally reside on numerous devices-integrated security appliances provide multi-layered protection in a single appliance. This allows SMEs that often have limited security budgets and lack the resources to adequately research and acquire multiple point solutions to get enterprise-level security at a lower total cost of ownership. In addition, managing a single device requires less time than managing disparate systems and leaves more time to proactively secure networks against ever-present threats.
Upgradeable Platform
Upgradeability and expandability enables the SME customer to adapt its security to meet changing business needs. It also provides investment protection for the SME customer that typically lacks the budget to replace hardware devices every time increased performance or new features or functionality are required.
Intelligent Layered Security
An Intelligent Layered Security architecture is designed to incorporate and manage multiple defense layers to increase efficiencies and minimize performance degradation while remaining flexible enough to insert new layers of security as emerging threats arise. The conceptual layers of defense include external defenses such as vulnerability assessment to protect against attacks before they are launched, data integrity protection that discards malformed data packets, virtual private networking for secure communications, standard stateful packet filtering, application layer filtering (proxies) to protect networks from application-layer threats that can elude standard packet-filter technologies, content filtering, which includes Web access control to protect users from harmful content, and spam
filtering to efficiently reduce wasted corporate resources. The architecture also includes behavioral mechanisms which protect against attacks by detecting precursors such as port scans and spoofing attacks as well as actual attacks such as buffer overflows and protocol anomaly attacks, and dynamically changing firewall policy to prevent subsequent traffic from the sources of those scans and attacks.
Intuitive User Experience
An intuitive user interface provides a number of key benefits: (1) the visibility to allow a user to see what is happening in its network instantly with real-time monitoring and centralized management for multiple devices and security services; (2) the efficiency to update defenses across a network from one central location with the same management interface even as additional security appliances are added to the network; and (3) the ability of the user to monitor the solution with the level of detail it prefers with a range of sophisticated management tools. In addition, smart defaults reduce configuration time and allow a security product to protect a network from the moment it is installed, and “drag-and-drop” interfaces allow users to create VPN tunnels in seconds instead of hours. Finally, graphically highlighted need-to-know data facilitate network management and allow efficient and quick analysis of logs.
Expert Guidance and Support
The subscription-based LiveSecurity Service helps the IT Director or network administrator of a SME act like a security expert. WatchGuard customers can spend less time mired in security concerns and simply conduct their core business. The LiveSecurity Service is valuable for both SMEs and managed security providers, and offers subscribers the following important services:
•
Timely early-warning vulnerability alerts e-mailed directly to the subscriber’s Inbox, so customers can stay ahead of attackers;
•
Convenient, downloadable software updates providing not only hotfixes, but also featuring enhancements, which allows subscriber defenses to keep pace with hacker innovations;
•
Expert instruction and training to help subscribers stay current, grow in their security knowledge, and better respond to security issues; and
•
Superior customer care that responds quickly to subscriber problems and offers technical support and convenient online resources.
We expect that these key elements will be increasingly reflected in our products throughout 2004.
Strategy
Our objective is to be the leading provider of Internet security solutions to SMEs worldwide. Our strategy to achieve these goals is based on the following key elements:
Continue to introduce technologically innovative products and services to the SME market
We intend to continue to introduce products and services targeted for the SME customer that provide the robust security typically reserved for larger enterprises without the complexity and higher cost of ownership of
other solutions. We plan to accomplish this with integrated, expandable security appliances that adapt and expand with the changing security needs of our customers. We also intend to continue to converge the security, management and hardware technology of each of our core product lines. We expect that this will allow us to reduce our development and manufacturing costs and our time-to-market for future innovative technology.
Expand, enhance and leverage our innovative LiveSecurity Service
Our subscription-based LiveSecurity Service is an innovative, value-added security service that provides information and early-warning vulnerability alerts, software updates, expert instruction and training, along with superior customer care, over the Internet directly to our subscribers and service provider partners. We plan to expand and enhance our LiveSecurity Service, and therefore the value of our subscription service, by adding new software and services. We also intend to better leverage this relationship with our installed customer base by increasing the number of software and service add-ons sold through this service to these existing customers through internal development and partnering with third-party providers. As we expand and enhance our LiveSecurity Service, we plan to ensure that it remains easy to implement and use by our SME customers and by service providers.
Leverage third-party technology and resources to enhance our product offerings
In addition to utilizing internal development efforts, we plan to increase the breadth and depth of our multi-layered defense by leveraging the technology of third parties, which may involve either partnering or acquisition strategies. This strategy allows us to further decrease our time-to-market and reduce our development risk while gaining the benefit of other parties’ expertise in particular technologies or markets.
Continue to expand WatchGuard brand awareness
We believe that we have an opportunity to make the WatchGuard brand synonymous with Internet security for the SME. We will continue to participate in public relations activities and seminars both domestically and abroad to secure WatchGuard’s position as an expert and innovator in Internet and network security and to leverage our Web site and increase our end-user demand generation activities. Through online and print advertising, direct mail, email and telemarketing campaigns, and particularly through our Web site and sales tools, we intend to leverage our marketing activities worldwide to uniquely position WatchGuard in the marketplace and clearly communicate the benefits of our comprehensive solutions to our customers and partners. We also intend to introduce innovative programs designed to simplify the purchase of our products, and to offer end-users product and service options that allow them to customize the solution to better address their needs.
We have not determined a schedule for implementing these components of our strategy. The timing for executing our strategies will depend on market conditions, the availability of strategic opportunities and the availability of management resources.
Products and Services
Our comprehensive security solutions include an integrated suite of security and management software, an Internet security appliance and a dynamic Internet-based service to keep security defenses current. These solutions provide firewall protection and intrusion prevention technology for access control, virtual private networking for secure communications, content and spam filtering, anti-virus protection and vulnerability assessment services. Enterprises may use our products to internally manage their Internet security or elect to outsource security management to a service provider implementing our managed security solution.
Security Appliances
By using our Firebox products, an enterprise can quickly and affordably deploy comprehensive perimeter security protection and VPN capability across its network, but still retain centralized control and administration.
In addition, our LiveSecurity Service enables enterprises to augment their information technology staff with our security experts, which we believe substantially reduces personnel costs. Our Firebox products (other than our prior-generation Firebox III products) include an initial 90-day subscription to our LiveSecurity Service. In addition, with the specific options that are expected to be available in the first half of 2004, customers will be able to upgrade their existing Firebox X appliance to any higher model in the line or add ports to their Firebox X appliance simply by applying a license key.
We currently offer the following Firebox X, Firebox SOHO and Firebox Vclass models:
Upgradeable to 50 Branch Office/VPN Tunnels.
Option to upgrade existing appliance to any higher model in the line is expected to be available in the first half of 2004.
Three ports active initially. Option to activate three additional ports is expected to be available in the first half of 2004.
Firebox SOHO 6tc-50 User and 50 User Upgrade License is available in North America and select countries.
Included in Firebox SOHO 6tc and S6-VPN; optional on Firebox SOHO 6 and S6.
*
High availability optional on Firebox V60L.
Security Appliance Management and Monitoring
We offer robust and intuitive management and monitoring of our comprehensive Internet security appliances that reduce the complexity and difficulty of successful implementation and provide for better visibility of the security environment. Our management and monitoring tools include:
•
WatchGuard System Manager. Our easy-to-use WatchGuard System Manager tool serves as the operational headquarters for the Firebox X products. The WatchGuard System Manager is designed to enable the end-user to quickly and easily configure the Firebox X product, implement security policies and monitor the status of installed network services.
•
Global Policy Manager. Centrally located at a managed security service provider’s network operations center, our Global Policy Manager for our Firebox X and Firebox SOHO line of products provides security intelligence and configuration for all customer sites under management. Global Policy Manager allows the service provider to create and store various security policy configurations for different customer groups or service plans.
•
Logging, Notification and Monitoring. For the Firebox X and Firebox SOHO products, the following tools are also available:
•
Firebox Monitors: Integrated monitoring and reporting tools for the Firebox X products provide real-time and historical data about network traffic and allow customers to detect and interrupt suspicious activity.
•
Logging and Notification: The Firebox X products support multiple levels of logging and notification while the Firebox SOHO product supports a more limited form of logging. Logs from multiple sites can be securely distributed to a central location using 3DES encryption.
•
HostWatch: HostWatch displays real-time monitoring of network usage mapped to authenticated users and host computers. Color-coded connection types (Allowed, Denied, Proxied or Masqueraded) between internal and external hosts are identified by IP address, DNS name or user name.
•
Historical Reporting: Our flexible HTML-based historical reporting tool for the Firebox X products enables end-users to summarize network activity through custom and standardized reporting options.
•
VPN Manager. VPN Manager automates the creation of VPN tunnels between an enterprise’s headquarters, branch offices and remote users utilizing Firebox X and Firebox SOHO products, and is designed to dramatically reduce the complexity of creating and managing multi-site VPNs. With VPN Manager, VPN tunnels can be created with a revolutionary quick and simple point-and-click user interface.
•
Web Interface. For SOHO products the Web user interface provides a platform-independent management tool for quick set-up, configuration and status.
•
Vcontroller. A comprehensive, cross-platform Firebox Vclass appliance management console, the Vcontroller provides for the configuration of firewall and VPN policies and provides access to all the enterprise-class features of the Firebox Vclass appliance, such as:
•
Firewall, network address translation and VPN policies;
•
Quality of service, “virtual” LAN, or VLAN, server load balancing and remote user policies;
•
Real-time monitoring of traffic statistics;
•
Configurable alarm and event notification; and
•
Configurable logging.
•
Central Policy Manager. Central Policy Manager, or CPM, is a powerful, scalable network management platform designed to simplify large-scale deployment, configuration and monitoring of firewall and VPN features for Firebox Vclass appliances. CPM compiles network-wide security policies into individual appliance policies, automatically taking into account the relationship between different appliances. This allows CPM to effectively and efficiently manage even hundreds of security appliances.
LiveSecurity Service
Our LiveSecurity Service is valuable for both SMEs and managed security providers, and offers subscribers the following important services:
•
Timely early-warning vulnerability alerts emailed directly to the subscriber’s Inbox, so customers can stay ahead of attackers;
•
Convenient, downloadable software updates providing not only hotfixes, but also featuring enhancements, which allows subscriber defenses to keep pace with hacker innovations;
•
Expert instruction and training to help subscribers stay current, grow in their security knowledge, and better respond to security issues; and
•
Superior customer care that responds quickly to subscriber problems and offers technical support and convenient online resources.
We currently offer standard and enhanced versions of our LiveSecurity Service, each of which provides end-users with differing levels of interactive technical support:
•
Standard Technical Support Service, which includes:
• Access to a moderated online user forum;
• Technical support 12 hours a day, five days a week (based on the customer’s local time);
• Target four-hour maximum response time for customer service; and
• Access to technical support team, limited to three to five incidents per year (depending on the product).
•
Gold Technical Support Service Upgrade, which includes:
• Access to a moderated online user forum;
• Technical support 24 hours a day, seven days a week;
• Target one-hour maximum response time for customer service; and
• Unlimited access to technical support team.
Other Products
We offer additional upgrades and options, including:
•
Model upgrades to increase performance and feature attributes to that of any higher model in the line (Firebox X)*;
•
Port upgrades to activate three additional ports (Firebox X)*;
•
Mobile-user VPN for telecommuting or traveling employees (all models);
•
Vulnerability assessment powered by Qualys, Inc. to identify and correct vulnerabilities before an attack is launched (all models);
•
Desktop virus protection with McAfee Virus Scan ASaP for Microsoft Windows 98, NT and 2000 operating systems (all models);
•
High Availability for security appliance failover protection (Firebox X and Firebox Vclass);
•
Web-Blocker content filtering to restrict Web site access (Firebox X and Firebox SOHO);
•
VPNForce Port secures wireless users’ connections with IPSec and routes the wireless user traffic through secure branch office VPNs to an enterprise’s trusted network (Firebox SOHO 6 Wireless);
•
Dual ISP Port Upgrade failover protection (Firebox SOHO);
•
SpamScreen to filter or identify email spam (Firebox X); and
•
User limit upgrades (Firebox SOHO).
*
Expected availability in the first half of 2004.
Customer Service
We make customer service a priority and consider it a competitive advantage for WatchGuard. Our staff of technical support representatives serves our end-users and our reseller, distributor and service provider partners by phone and via the Internet. Support is available to our partners that have representatives who have passed required WatchGuard technical training. For our end-users, we offer the two technical support programs described above, our Standard Technical Support Service and our Gold Technical Support Service Upgrade. In addition to the WatchGuard technical support staff, we offer all authorized WatchGuard customers access to our
Web-based technical support self-help toolset 24 hours a day, seven days a week. These tools include comprehensive frequently asked questions, a listing of all known issues with our current software version (and any available work-arounds or fixes), and an interactive Web forum that allows customers to post WatchGuard-related technical questions to other customers and the WatchGuard technical moderator.
The WatchGuard Team of Experts
Our Rapid Response team identifies, analyzes and generates responses to new Internet security threats. To identify new threats, the team monitors a wide variety of Internet sources related to network security, including newsgroups, vendor Web sites, security-related bulletin boards, and even underground “black hat” sites. When the Rapid Response team identifies an emerging security threat, it alerts LiveSecurity Service subscribers with concise, prompt emails, written understandably and including step-by-step countermeasures that bolster defenses. In conjunction with our Rapid Response team, world-class outside experts also provide continuing education and editorials on the rapidly changing subject of Internet security. This service is robust and comprehensive, broadcasting more than 180 LiveSecurity articles during 2003.
Licensing and Pricing
We offer our resellers, distributors and service provider partners discounts from our suggested retail prices. In addition, we offer educational discounts and promotional pricing as appropriate. All customers purchasing our Firebox and ServerLock products receive a perpetual license for our security and management software, which is included in the system price. Each end-user purchaser of our current products also receives a renewable 90-day subscription to our standard LiveSecurity Service, while purchasers of our prior-generation Firebox III products receive a renewable one-year subscription to our standard LiveSecurity Service. For our managed security solution, the service provider buys a license to use our network operations center security suite management and security software. In addition, the service provider must have an active subscription to the LiveSecurity Service for each end-user security appliance that it manages.
Sales, Marketing and Distribution
Because the need for Internet security crosses geographic and economic boundaries, our business opportunity extends worldwide to all business segments. Since our inception, we have invested heavily in worldwide sales and marketing. International sales generated 58% of our revenues in 2002 and 54% of our revenues in 2003.
We sell our security solutions through distributors, value-added resellers, or VARs, and service providers, which resell our products and services to end-users spanning a wide variety of industries and more than 125 countries. We also sell our managed security solution products and services directly to service providers. As of December 31, 2003, we had shipped over 200,000 of our security appliances to our distribution network. Examples of members of our distribution network include:
•
distributors, such as Ingram Micro, Tech Data, Wick Hill Group, Westcon and Alternative Technologies;
•
VARs, such as Secure Networks Ltd., Century Computing Ltd., Taskarena IT-Solutions GmbH, Softbank, Fujitsu Business Systems, Ltd. and Network Computing Architects, Inc.;
•
direct marketers, such as CDW Computer Centers, Insight Enterprises, Dell and PC Connection; and
•
service providers, such as AT&T Global Network Services Hong Kong Limited (AGNS Ltd.), Deutsche Telekom, Internet Initiative Japan, KPN, Easynet and Star Internet.
As part of our distribution network, thousands of resellers worldwide sell our security solutions. In 2002 and 2003, we significantly realigned our channel network to focus our efforts on channel customers capable of
assisting us in growing our business and expanding our reach in the SME market and required many of our smaller channel customers to purchase our products and services through our established distribution partners. Two of our channel customers, Tech Data and Ingram Micro, accounted respectively for 18.6% and 16.1% of our revenues in the year ended December 31, 2003 on a global basis. One of the key programs we implemented worldwide in our reseller channel to implement this realignment was our authorized reseller program, called the WatchGuard Secure Partner Program, or WSP Program. The WSP Program offers programs and financial benefits to security-focused resellers who meet technical and sales certifications and promote WatchGuard to end-users. At the end of 2003, we had authorized over 650 WatchGuard Secure Partners worldwide. Our agreements with our distribution network are nonexclusive.
We divide our sales organization geographically and by channel customer focus. We have sales teams specifically responsible for the Americas, Europe/Middle East/Africa and Asia Pacific. Our sales professionals are typically local nationals who live and work in their designated geographic regions. We also assign sales resources to specific channel categories, including distribution, resellers and managed security providers. In the Americas, our national account managers are responsible for our relationships with our distribution and e-tail network, helping them sell and support key reseller accounts and acting as a liaison to our marketing and product development organizations. In addition, our national account managers help to recruit new resellers and generally promote the sale of our products to end-user customers.
We have a dedicated channel marketing team responsible for delivering programs, sales tools and communication specific to the categories of channel customers. The team supporting national accounts works closely with distributors and e-tailers to promote WatchGuard brand awareness. The team supporting enterprise accounts also promotes and manages the WSP Program, organizes training seminars and assists with co-marketing opportunities presented by our resellers. We actively participate in public forums to inform existing and potential end-user customers, distributors, resellers and service providers about the capabilities and benefits of our products. These include industry trade shows in every major geographic region, product technology conferences, regional awareness programs, trade publications and journals. We use the Web extensively to deliver information to both end-users and our channel customers and have a dedicated, secure Web site that provides extensive information to channel customers. We offer resellers access to white papers, competitive information, graphics to assist their advertising efforts, product and sales training modules and the opportunity to post information about their events online. In addition, partners receive communications from us through the LiveSecurity Service.
We offer comprehensive online training on our security solutions through our Web site. Our interactive training system guides both end-user customers and resellers through the installation, setup and management of our Firebox security solutions and provides new product information. Training modules cover firewall basics, VPN and sales training (for resellers only), and include live-action video and audio question-and-answer segments. Online certification testing is offered for both end-user customers and resellers to confirm their product knowledge.
The growth rate of our domestic and international sales has been and may in the future be lower in the summer months, when businesses often defer purchasing decisions. Also, as a result of customer buying patterns and the efforts of our sales force to meet or exceed quarterly and year-end quotas, historically we have received a substantial portion of a quarter’s sales orders and earned a substantial portion of a quarter’s revenues during the quarter’s last month and the latter half of the last month.
Technology and Architecture
Firebox X and Firebox SOHO Products
For smaller enterprises, or those that require an easy-to-use solution, the Firebox X and Firebox SOHO products (with Firebox SOHO, including our Japanese-language versions called the Firebox S6) provide access
control and VPN through three key components: our security management system software with security and management features, our security appliance and a subscription to our Internet-based LiveSecurity Service.
Security features. The Firebox X and Firebox SOHO products contain the following security features:
•
Firewall. Our firewall controls incoming and outgoing traffic between the Internet and an enterprise’s systems and data. The firewall incorporates access control and detection and blocking features.
•
Authentication. In our Firebox X products, our authentication features identify network users and define user and user-group security policies for both incoming and outgoing access.
•
Virtual private networking. Using encryption technology, our software enables enterprises to create VPNs, which allow data to flow securely across the Internet between two predetermined points. Our branch office VPN, which is available for all of our Firebox X and Firebox SOHO products, secures communications with branch offices and trading partners. Our remote-user VPN, included in our Firebox X and Firebox SOHO products, secures connections to telecommuters and traveling employees. Our VPN solutions implement industry standard protocols such as IPSec, IKE and PPTP.
•
Network address translation. Network address translation, or NAT, enables users to hide their internal IP addresses and allows internal servers with unregistered IP addresses to function as Internet-accessible servers, which increases network security. The Firebox X products support static, dynamic, real one-to-one NAT, while our Firebox SOHO products support dynamic NAT. Both product lines can be configured to serve DHCP addresses.
•
Web surfing control. In our Firebox X products, our Web-blocking feature enables enterprises to restrict site access privileges by user, group, time of day, site type or particular site. In our Firebox SOHO products, Web site access privileges may be restricted simply by site type.
•
Intrusion prevention/application security features. The Firebox X products include Protocol Anomaly Detection implemented through our application proxies, behavioral mechanisms that use autoblocking technology and DoS and DDoS preventions. The solution’s transparent application proxying examines the content of a data stream in detail and provides enhanced protection against specific threats that standard stateful packet filters cannot detect. This is particularly important for the four key business protocols, HTTP, SMTP, FTP (file transfer) and DNS (Internet name services)
•
Security appliance. Our Firebox X and Firebox SOHO security appliances are dedicated solely to running security functions and IP sharing and have no other function and no hard drive memory storage (however, the Firebox X has a hard drive bay to allow the addition of a hard drive in the future). Our Firebox X products are standalone Internet security appliances that run the security functions of the product line. The security capabilities of these security appliances come entirely from the operating system, security software and security policies directed to them from the remote management software. They simply plug in and reside between an enterprise’s Internet router and its internal network of servers and workstations. These security appliances have three independent, separately monitored connections: one to the enterprise’s network, one to the Internet and one to the enterprise’s public network for hosting Web and email servers. The Firebox X products encrypt communications between the security appliance and the management software on the in-house manager’s desktop. Our Firebox SOHO products are standalone Internet security appliances that run security functions and provide IP sharing. Our Firebox SOHOtc appliances are also increasingly being used by enterprises as endpoints for VPNs. The security capabilities of the Firebox SOHO security appliances come entirely from the operating system, security software and security policies that reside on the appliances or that the appliances receive from remote management software. They simply plug in and reside between the Firebox SOHO’s or telecommuter’s Internet router and broadband modem and its internal network of servers and workstations. These security appliances have up to three independent, separately monitored connections: one to the Firebox SOHO’s or telecommuter’s network, one to the Internet and, optionally, one for a second failover Internet connection, or separate secondary telecommuter network where encryption can be enforced.
Our Firebox X and Firebox SOHO products utilize an innovative distributed architecture through which a basic processor in a security appliance receives and executes software directed to it from a remote management system. This technology allows us to keep our customers’ security up to date with our LiveSecurity Service, which provides new security software and operating system configurations while still enabling us to take advantage of hardware acceleration for key functions.
Our Firebox X and Firebox SOHO products encrypt communications between WatchGuard, the management system software and the security appliance. This allows the management system and the appliance to be separated within an enterprise’s local- or wide-area network or between a service provider and its subscriber. Typically, to install software on a computer using a general-purpose operating system such as Windows, a person must be physically present at the computer. Our distributed architecture, however, allows our customers to remotely install our software on the security appliances and receive our LiveSecurity Service over the Internet, thereby eliminating the need for someone to be physically present at each location.
Our Firebox SOHO products also support integrated wireless access points based on industry-standard 802.11b and mobile user VPN for secure wireless communication. In addition, our Firebox S6, Firebox S6-VPN, Firebox S6 Wireless and Firebox S6-VPN Wireless are fully localized for the Japanese market, including a translated user interface, user guide, installation poster and other associated materials, and we offer Japanese-language technical support and LiveSecurity broadcasts.
Intelligent Layered Security architecture. The Intelligent Layered Security architecture of our Firebox X products incorporates multiple layers of security on a single platform and allows those layers to more efficiently examine network traffic and block threats. This is possible because rather than simply passing all network traffic through all security layers, certain layers may be intelligently bypassed to reduce the performance degradation associated with utilizing unnecessary layers. This architecture is also specifically designed to allow additional security layers to be added in the future as the need arises.
Operating system software. Our Firebox X products use a Linux operating system and our Firebox SOHO products use a VxWorks operating system. For the Linux operating system, we use a custom-configured kernel under an open source license, which enables us to review the source code and generate a flexible, robust and secure operating system. We use specially designed application programming interfaces in all of our Firebox X and Firebox SOHO products to facilitate secure loading of the operating system and security software that our management software sends to the appliance.
Security feature implementation. The Firebox X and Firebox SOHO products implement our security features through a number of software modules. Each module provides the specific function that the management system defines in security rules and transmits to the appliance. For example, the firewall features that control network traffic are based on an extensible set of network service protocols, such as HTTP (Web traffic) and SMTP (email). Our Firebox X firewall differs from other appliance firewalls in that we provide two different levels of protection, stateful packet filtering, which has become the de facto standard in the industry, plus transparent application proxying that examines the content of a data stream in detail and provides enhanced protection against specific threats that stateful packet filters cannot detect. This is particularly important for the four key business protocols, HTTP, SMTP, FTP (file transfer) and DNS (Internet name services). The Firebox X or Firebox SOHO appliance applies the security policies defined by the management system to all incoming or outgoing traffic. Additional modules implement other security features, such as authentication and Web-surfing control, which also are defined in the security policies that the management system transmits to the appliance. If Web-surfing control is activated, for example, the Web-surfing control software module will automatically check the details of all outgoing Web traffic to make sure it complies with the defined policies.
We use an open architectural structure to allow integration with common standards for network security. For example, our VPN component currently supports IPSec and IKE standards and the authentication module in our Firebox X products supports a variety of standard authentication methods. We intend to adopt additional standards as they mature in the market.
Management features. Our management software allows a customer to manage and monitor the enterprise’s Internet security with an intuitive, point-and-click user interface.
Integrated suite of system management tools. Our Firebox X products use a Windows-based security management system that packages, configures and deploys security software, security policies and the operating system from the in-house manager’s desktop computer to the enterprise’s security appliances. The management system also includes logging and notification functions and real-time monitoring and historical reporting of network, service and bandwidth usage. Our Firebox SOHO products are managed by a Web-based interface accessed from the appliance itself or from remote management software. Our management tools allow the management of multiple security appliances from a single location.
Because enterprise, distributed VPN and service provider environments are very different, we designed separate management systems for each. Our Firebox X and Firebox SOHO management software enables quick installation and management by an in-house manager using a standard Windows-based system. The VPN management software in each of our security appliance types is designed specifically for ease of configuration and visual representation of multiple VPNs in a network. We designed our managed security solution management software, on the other hand, for a trained operator using a dedicated management console to configure and manage the security of a large subscriber base. All management systems have the ability to remotely deploy new security software to the appliances or update their security engines from the management console. Our SOHO and telecommuter customers can also choose a simple Web-based management interface, which removes the need to install management software.
Automated installation guides. Our automated installation guides enable enterprises to install and configure our systems in as quickly as 15 to 30 minutes. Software updates or upgrades are also accessed through easy-to-use installation guides.
Firebox Vclass Products
For medium enterprises, or for those that require greater performance, scalability and networking features, our Firebox Vclass products provide access control and high-performance VPN through three key components: our security management system software with security and management features, our security appliance and a subscription to our innovative LiveSecurity Service.
Security and networking features. The Firebox Vclass products contain the following security and networking features:
•
Firewall. Our firewall controls incoming and outgoing traffic between the Internet and an enterprise’s systems and data. The firewall incorporates access control and detection and blocking features. The filters track which computer is sending what traffic, and what type of traffic should typically come next. Based on what the next expected packet should look like in a normal session, stateful packet filtering can instantly create new accept-or-deny rules.
•
Authentication. Our authentication features identify network users and define user and user-group security policies.
•
Virtual private networking. Using encryption technology, our software enables enterprises to create VPNs, which allow data to flow securely across the Internet between two predetermined points. Our branch office VPN, which is included in all of our Firebox Vclass products, secures communications with branch offices and trading partners. Our Mobile User VPN, which is included in our Firebox V100, V80, and V60 models, secures connections to telecommuters and traveling employees. Our VPN solutions implement industry standard protocols such as IPSec, IKE and PPTP.
•
Network address translation. NAT enables users to hide their internal IP addresses and allows internal servers with unregistered IP addresses to function as Internet-accessible servers, which increases
network security. The Firebox Vclass products support static, dynamic, real one-to-one NAT, subnet-to-subnet, port forwarding and Virtual IP.
•
Traffic management Quality of Service. Firebox Vclass products provide policy-based traffic management and Quality of Service, or QoS. With weighted fair queuing, policies are prioritized and provisioned. Users can overwrite DiffServ Codepoint, or DCSP, and Type of Service, or ToS, marking for inbound and outbound traffic flow to qualified packets. Traffic management QoS enables the Firebox Vclass appliances to participate in Multi Protocol Label Switching, or MPLS, environments and provides additional QoS.
•
VLAN. VLAN allows multiple “virtual” LANs to be configured on each physical interface thus providing more fine-grained network segmentation and better integration into more complex networks.
•
Server load balancing. To ensure that mission-critical resources remain available, the Firebox Vclass products distribute traffic to up to 16 servers. Traffic is then balanced between available servers using six common algorithms: round-robin, weighted round-robin, random, weighted random, least connections, and weighted least connections.
•
DoS defenses. DoS defenses protect against Denial of Service attacks.
•
Application security features. The solution’s transparent application proxying examines the content of a data stream in detail and provides enhanced protection against specific threats that standard stateful packet filters cannot detect. This functionality is included for the key business protocols, HTTP and SMTP.
•
Security appliance. Our security appliances are dedicated solely to running security functions and IP sharing and have no other function and no hard drive memory storage. Our Firebox Vclass security appliances are stand-alone Internet security appliances that run the security functions of the products. The security capabilities of these security appliances come entirely from the operating system, security software and security policies directed to them from the remote management software. They simply plug in and reside between an enterprise’s Internet router and its internal network of servers and workstations. These security appliances have three independent, separately monitored connections: one to the enterprise’s network, one to the Internet and one to the enterprise’s public network for hosting Web and email servers. The Firebox Vclass products encrypt communications between the security appliance and the management software on the in-house manager’s desktop.
Our Firebox Vclass products use a high-speed custom security application specific integrated circuit, or ASIC, processor that enables our cut-through software architecture. With this architecture, the first packet or first few packets of a connection are forwarded to the firewall/VPN software to find the matching policy action. Once a policy decision is made, the policy actions are downloaded to the security ASIC processor so subsequent policy actions of the same connection can be processed in the high-performance security ASIC processor. This cut-through architecture not only improves firewall and VPN performance, but also leaves the central processing unit more bandwidth to process logging and other management tasks. The security ASIC processor accelerates firewall, VPN, NAT and QoS functionalities. The security ASIC processor also has four embedded RISC processors for greater feature flexibility to meet the needs of the most demanding network security applications.
Our Firebox Vclass products encrypt communications between corporate offices and between the appliance and the management software. This allows the management system and the appliance to be separated within an enterprise’s local- or wide-area network or between a service provider and its subscriber. Typically, to install software on a computer using a general-purpose operating system such as Windows, a person must be physically present at the computer. Our distributed architecture, however, allows our customers to remotely install our software on the security appliances and receive our LiveSecurity Service over the Internet, thereby eliminating the need for someone to be physically present at each location.
Operating system software. Our Firebox Vclass products incorporate a Linux operating system using a custom-configured kernel under an open source license, which enables us to review the source code and generate
a flexible, robust and secure operating system. We use specially designed application programming interfaces in all of our Firebox Vclass products to facilitate secure loading of the operating system and security software that our management software sends to the appliance.
Security feature implementation. Our Firebox Vclass products implement our security features through a number of software modules. Each module provides the specific function that the management system defines in security rules and transmits to the appliance. For example, the firewall features that control network traffic are based on an extensible set of network service protocols, such as HTTP and SMTP. The Firebox Vclass appliances apply security policies defined by the management system to all incoming or outgoing traffic. Additional modules implement other security features, such as authentication, NAT, and QoS functions. Our Firebox Vclass firewall differs from many other appliance firewalls in that we provide two different levels of protection, stateful packet filtering, which has become the de facto standard in the industry, plus transparent application proxying that examines the content of a data stream in detail and provides enhanced protection against specific threats that stateful packet filters cannot detect. This functionality is included for the key business protocols, HTTP and SMTP.
We use an open architectural structure to allow integration with common standards for network security. For example, our VPN component currently supports IPSec and IKE standards and the authentication module in our medium-large enterprise Firebox Vclass products support a variety of standard authentication methods.
Management features. Our management software allows a customer to manage and monitor the enterprise’s Internet security with an intuitive, point-and-click user interface or Command Line Interface.
Integrated suite of system management tools. Our medium-large enterprise Firebox Vclass products use a Windows-based security management system that packages, configures and deploys security software, security policies and the operating system from the in-house manager’s desktop computer to the enterprise’s security appliances. The management system also includes logging and notification functions and real-time monitoring. Our management tools allow the management of multiple security appliances from a single location.
Because larger, distributed enterprise environments can be very different from single site deployments, we designed separate management systems for each. Our Firebox Vclass single appliance management software, Firebox Vcontroller, enables quick installation and management by an in-house manager using a standard Windows-based system. The WatchGuard CPM management software is designed specifically for ease of configuration and visual representation of a multiple appliance deployment. All management systems have the ability to remotely deploy new security software to the appliances or update their security engines from the management console.
Automated installation guides. Our automated installation guides enable enterprises to install and configure our Firebox Vclass products in as quickly as 15 to 30 minutes. Software updates or upgrades are also accessed through easy-to-use installation guides.
LiveSecurity Service
Our scalable LiveSecurity Service, which runs on a collection of secured servers, registers subscribers, facilitates downloading our software to the desktop computers of registered subscribers and delivers LiveSecurity content to subscribers. To facilitate a high level of security and authenticity, we protect our servers with our own security system and strongly encrypt data communication between servers.
Early Warning Service. Our Rapid Response team identifies, analyzes and generates responses to new Internet security threats. To identify new threats, the team monitors a wide variety of Internet sources related to network security, including newsgroups, vendor Web sites, security-related bulletin boards, and even underground “black hat” sites. When the Rapid Response team identifies an emerging security threat, they alert
LiveSecurity Service subscribers with concise, understandable and prompt emails that include step-by-step countermeasures to bolster defenses. In conjunction with our Rapid Response team, world-class outside experts also provide continuing education and editorials on the rapidly changing subject of Internet security. This service is robust and comprehensive, broadcasting more than 180 LiveSecurity articles during 2003.
Evolving Defense. LiveSecurity provides ongoing updates to WatchGuard firewall software, maintaining steady improvement so customer defenses do not decay. In 2003, LiveSecurity issued 24 software updates, which subscribers could download at their convenience from LiveSecurity’s Software Center Web site.
Security Instruction. The skill and knowledge of a network’s administrators are key determinates of the strength of any network’s defenses. Current Internet security threats spread so rapidly that there is often no time for humans to learn and react once the attack begins. LiveSecurity helps subscribers boost their aggregate security knowledge, rather than merely respond to immediate problems. LiveSecurity issues educational material almost weekly (47 times in 2003), written in plain English by WatchGuard experts and world-class network security authorities. A LiveSecurity Service subscription also entitles the customer to access:
•
on-line training;
•
a forum where users help other users;
•
a plain-English glossary of networking and security terminology;
•
answers to frequently asked questions; and
•
hundreds of articles customized for all levels of understanding, from stark beginner to networking veteran.
Superior Customer Care. A LiveSecurity Service subscription also entitles customers to personal technical support, delivered by phone and via the Internet. LiveSecurity’s technical support features aggressive service levels, targeting a 4-hour response time on “standard” care and a 1-hour response time for premium customers. Live telephone support engineers are available 12 hours a day local time for our standard LiveSecurity offering and 24 hours a day for our premium LiveSecurity offering, worldwide. A buffet-style offering of support options allows customers to choose the support plan that enables them to invest their capital and human resources most appropriately.
The scalable LiveSecurity Service runs on a collection of secured servers. To facilitate a high level of security and authenticity, we protect our servers with our own security system and strongly encrypt data communication between servers. The LiveSecurity Service evolves continuously (for example, in 2003 we introduced discounts for subscribers on automated vulnerability assessment) and, as a result, we enjoy a robust level of subscription renewals, which provides us with an excellent revenue stream.
Managed Security Solution
WatchGuard’s managed security solution for service providers has three main components: our network operations center, or NOC, security suite software with security and management features, our security appliances and our LiveSecurity Service. It is designed to manage our Firebox X, Firebox SOHO and our prior generation Firebox III appliances.
Security features. Our managed security solution includes the same comprehensive set of security features offered in our Firebox products.
Management features. We designed our managed security solution management software for a trained operator using a dedicated management console to configure and manage the security of a large subscriber base. Centrally located at the service provider’s NOC, our Global Policy Manager software provides security
intelligence and configuration for all customer sites under management. Our software allows the service provider to create and store various security policy configurations for different customer groups or service plans. For example, our service provider customers can choose to separately and remotely deploy select security features, such as VPN and Web blocking. This gives service providers the ability to incrementally add for-fee services to their basic service offering, without the expense of sending personnel to their customers’ sites. To enable service providers to configure, monitor and manage the Internet security of thousands of customers, our managed security solution includes scalable logging and monitoring software called WatchGuard event processors. The event processors run on Sun Solaris-based workstations and can be located in the NOC or distributed at the service provider’s point of presence. Each event processor manages the logging and notification features of up to 500 security appliances through commands issued from the Global Policy Manager at the NOC.
Security appliances. One or more of our security appliances reside on the premises of each managed customer of the service provider or are hosted in the service provider’s data center. The appliances receive and implement the security software and security policies sent by the service provider. All of our security appliances may be centrally managed by the service provider.
LiveSecurity Service. Through our LiveSecurity Service, the service provider’s NOC receives information and virus alerts, threat responses, software updates, support flashes and expert editorials, as well as access to training and service provider-specific technical support. The service provider then updates the security policies of its customers and transmits these policy updates over its network to its customers.
By receiving the benefits of our security solution through a service provider, an enterprise gains a number of added advantages. The service provider can:
•
monitor and manage customers’ security 24 hours a day, seven days a week;
•
define and implement professional, customized Internet security policies;
•
easily install software updates across its installed base;
•
regularly review customers’ security and provide detailed reporting and analysis; and
•
mitigate the up-front cost of a security system purchase and setup.
Research and Development
We focus our research and development efforts on enhancing our existing products and services, developing new products based on our innovative expandable architecture, and developing services that capitalize on our LiveSecurity Service infrastructure. We use a layered design, which allows us to develop new applications that plug into our existing product line. As a result, our products can be deployed in stages, either directly by an enterprise or by a service provider if the enterprise has outsourced its security management. As we develop new products, our LiveSecurity Service end-users and service provider partners can incorporate the new products and services into their systems with minimal system interruption.
As of December 31, 2003, we employed 111 people on our research and development staff. Research and development expenses were $18.9 million in 2001, $20.9 million in 2002 and $20.8 million in 2003. We have product development facilities in Seattle, Washington, San Jose, California and Tustin, California.
Competition
We compete in a market that is intensely competitive, highly fragmented and rapidly changing. We face competition in sales both of products and services designed for enterprises and those designed for service providers. We have experienced and will continue to experience increasing competition from current and emerging competitors, many of which have significantly greater financial, technical, marketing and other resources than we do.
In the market for Internet security solutions, we compete on the basis of technological expertise and functionality, breadth of service and product technology and features, ease of installation and management, performance, updatability, scalability, brand recognition, price, customer support and distribution capability. Currently, the primary competitors in our industry include Check Point, Cisco Systems, Inc., Fortinet Inc., Netscreen Technologies, Inc., Nokia Corporation, SonicWALL, Inc. and Symantec Corporation. Other competitors offering security products include hardware and software vendors such as Lucent Technologies, Inc. and Network Associates, Inc., operating system vendors such as Microsoft Corporation, Novell, Inc. and Sun Microsystems, Inc., and a number of smaller companies.
Our competitors may be able to respond more quickly to new or emerging technologies and changes in customer requirements than we can. In addition, our current and future competitors may bundle their products with other software or hardware, including operating systems and browsers, in a manner that may discourage users from purchasing the products and services we offer. Many of our current and potential competitors have greater name recognition, larger customer bases to leverage and greater access to proprietary technology, and could therefore gain market share to our detriment. Our current and potential competitors may establish cooperative relationships among themselves or with third parties that may further enhance their resources, such as the relationship between Check Point and Nokia. In addition, current or potential competitors may be acquired by third parties with greater available resources, as may happen as a result of Juniper Networks, Inc.’s agreement to acquire Netscreen. We expect additional competition as other established and emerging companies enter the Internet security market and new products and technologies are introduced.
While some of our competitors have traditionally targeted large-enterprise security needs, these vendors could adapt their existing products to make them more attractive to our markets. If these or other of our competitors were to focus their greater financial, technical and marketing resources on our markets, our business could be harmed. In addition, as our security solutions are adopted by larger enterprises, we expect to see increased competition. Increased competition in any of our markets could result in price reductions, fewer customer orders, reduced gross margins and loss of market share.
Proprietary Rights
To protect our proprietary rights, we rely primarily on:
•
copyright, trademark, service mark and trade secret laws;
•
license agreements with third parties, including a standard software license included with our products;
•
confidentiality agreements with our employees and third parties;
•
invention assignment agreements with our employees and contractors;
•
protective contractual provisions in our agreements with some of our consultants, resellers and customers; and
•
limited access to our software, documentation and other proprietary information.
The following are trademarks of ours or our affiliates: WatchGuard® is a registered trademark in the United States, the European Union, Canada, Norway, Australia, New Zealand, Indonesia, Singapore, Japan and Mexico, RapidStream® is a registered trademark in the United States, Japan, the European Union and South Korea, Designing Peace of Mind® is a registered trademark in the United States, the WatchGuard logo is a registered trademark in the United States, LiveSecurity® is a registered trademark in the United States, the European Union, Canada, Japan and Mexico, Firebox® is a registered trademark in the United States, Canada and Japan, RapidCore® is a registered trademark in the United States, the European Union and Japan, ServerLock® is a registered trademark in the United States, Australia, Japan, Norway and Singapore, AppLock® is a registered trademark in the United States and LockSolid® is a registered trademark in the United States, Australia, Japan, New Zealand, Canada, the European Union, Indonesia, Singapore and Norway. Applications to register the WatchGuard, LiveSecurity, Firebox, RapidCore and ServerLock trademarks are pending in other jurisdictions.
We also have other trademarks in use in the United States that do not currently have applications pending in any jurisdiction. We have eight issued patents and 15 patents pending.
Many of our products are designed to include software or other intellectual property licensed from third parties. While it may be necessary in the future to seek or renew licenses relating to various aspects of our products, we believe, based on past experience and standard industry practice that such licenses generally could be obtained on commercially reasonable terms. Nonetheless, the necessary licenses may not be available on acceptable terms, if at all. Our inability to obtain certain licenses or other rights or to obtain such licenses or rights on favorable terms, or the need to engage in litigation regarding these matters, could have a material adverse effect on our business, financial condition and operating results. Moreover, inclusion in our products of software or other intellectual property licensed from third parties on a non-exclusive basis can limit our ability to protect our proprietary rights in our products.
U.S. Government Export Regulation Compliance
Our products are subject to U.S. governmental regulations governing the export of encryption commodities and software. In recent years, however, U.S. legislation has relaxed export controls on encryption. U.S. law now allows the export of encryption commodities and software of any strength to nongovernmental end-users located in any country except those designated as embargoed or otherwise restricted by the U.S. government, subject to streamlined reporting requirements. To satisfy these encryption export reporting requirements, we use data gathered from end-users during product registration. WatchGuard’s encryption technology and software have been approved for export by the U.S. Department of Commerce’s Bureau of Industry and Security, or BIS, under an export license exception granted after previous technical reviews by the BIS. The approved technology and software include our branch office and remote user VPN software and our Firebox II, Firebox III, Firebox Vclass and Firebox X lines of security appliances. The BIS has granted retail export status to our Firebox III 500 and 700, Firebox V10, Firebox X500 and Firebox SOHO security appliances, which use encryption in branch office VPN software. We are eligible to export products that qualify for retail export status to all nonembargoed and nonrestricted foreign end-users, including government entities.
Manufacturing
We currently outsource all hardware manufacturing and assembly for our Firebox Vclass products to Washington-based TFS Corporation, for our Firebox X line of products to Lanner Corporation, a Taiwan Republic-of-China-based company, and for our Firebox SOHO product to SerComm Corporation, also a Taiwan Republic-of-China-based company. All contract manufacturers are certified as meeting the International Organization for Standardization’s quality assurance standards ISO 9001 and 9002. We are currently reviewing other contract manufacturers for potential engagement as either primary or back-up suppliers for current and future products. Worldwide distribution is currently performed at our distribution facility in Seattle, Washington.
Employees
As of December 31, 2003, we had 317 employees. Of these, 112 were employed in sales and marketing, 36 in finance and administration, 58 in customer support and operations and 111 in research and development. We are not a party to any collective bargaining agreements with our employees and we have not experienced any work stoppages. We believe we have good relations with our employees.
IMPORTANT FACTORS THAT MAY AFFECT OUR OPERATING RESULTS, OUR BUSINESS AND OUR STOCK PRICE
In addition to the other information contained in this annual report, you should carefully read and consider the following risk factors. If any of these risks actually occur, our business, financial condition or operating results could be materially adversely affected and the trading price of our common stock could decline.
We have incurred losses in the past and may not achieve or sustain consistent profitability, which could result in a decline in the value of our common stock.
Since inception, we have incurred net losses and experienced negative cash flows from operations in each quarter, except that we had net income and a positive cash flow from operations in the third quarter of 2000 and a positive cash flow from operations in the third quarter of 2001. As of December 31, 2003, we had an accumulated deficit of approximately $130 million. Although our revenues have increased each year since we began operations, the historical percentage growth rate of our revenues may not be sustainable as our revenue base increases and we may not achieve or sustain profitability in future periods. We expect that over time we will have to increase our operating expenses in connection with:
•
continuing to develop our technology;
•
expanding into new product markets;
•
expanding into new geographic markets;
•
pursuing additional strategic acquisitions;
•
meeting enhanced regulatory and corporate governance requirements;
•
hiring additional personnel; and
•
upgrading our information and internal control systems.
If we are unable to achieve or sustain profitability in future quarters, the trading price of our common stock could decline.
Our operating results fluctuate and could fall below expectations of securities analysts and investors, resulting in a decline in our stock price.
Our quarterly and yearly operating results have varied widely in the past and will probably continue to fluctuate. For this reason, we believe that period-to-period comparisons of our operating results may not be meaningful. In addition, our limited operating history makes predicting our future performance difficult. If our operating results for a future quarter or year fail to meet market expectations, this shortfall could result in a decline in our stock price.
The economic downturn in the U.S. economy has adversely affected the demand for our products and services and may continue to result in decreased revenue and growth rates. We do not know how long this economic downturn will last or whether it will become more severe. To the extent that this downturn continues or grows deeper in the United States or other geographic regions in which we operate, the Internet security industry and demand for our products and services are likely to be adversely affected.
We base our spending levels for product development, sales and marketing and other operating expenses largely on our expected future revenues. Because our expenses are largely fixed for a particular quarter or year, we may be unable to adjust our spending in time to compensate for any unexpected quarterly or annual shortfall in revenues. A failure to so adjust our spending in time also could cause operating results to fall below the expectations of securities analysts and investors, resulting in a decline in our stock price.
If our estimates or judgments relating to our critical accounting policies are based on assumptions that change or prove to be incorrect, our operating results could fall below expectations of securities analysts and investors, resulting in a decline in our stock price.
Our discussion and analysis of financial condition and results of operations in this annual report is based on our consolidated financial statements, which have been prepared in accordance with accounting principles generally accepted in the United States. The preparation of financial statements in conformity with generally accepted accounting principles requires management to make estimates and assumptions that affect the amounts reported in the consolidated financial statements and accompanying notes. On an ongoing basis, we evaluate significant estimates used in preparing our consolidated financial statements, including those related to:
•
revenue recognition, including sales returns and allowances;
•
bad debt;
•
inventory reserves;
•
restructuring reserves; and
•
analysis of impairment of goodwill and other long-lived intangible assets.
We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, as provided in our discussion and analysis of financial condition and results of operations in this annual report, the results of which form the basis for making judgments about the carrying values of assets and liabilities that are not readily apparent from other sources. Examples of such estimates include, but are not limited to, those associated with the costs of our 2001 and 2002 restructuring and impairment analysis of our Qiave and RapidStream “Secured by Check Point” product brand intangible assets, as well as goodwill relating to the acquisitions of BeadleNet, Qiave and RapidStream. Although we do not anticipate further significant adjustments to our 2002 restructuring in addition to the $1 million charge we recorded in the fourth quarter of 2003, the actual costs related to the restructuring may differ from our estimate if it takes us longer than expected to find suitable tenants for our excess facilities or if there are further changes in the real estate market where excess facilities are located. Actual results may differ from these and other estimates if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our operating results to fall below the expectations of securities analysts and investors, resulting in a decline in our stock price.
Because many potential customers do not fully understand or remain unaware of the need for comprehensive Internet security or may perceive it as costly and difficult to implement, our products and services may not achieve market acceptance.
We believe that many potential customers, particularly SMEs, do not fully understand or are not aware of the need for comprehensive Internet security products and services. Historically, only enterprises having substantial resources have developed or purchased comprehensive Internet security solutions. Also, there is a perception that comprehensive Internet security is costly and difficult to implement. We will therefore not succeed unless the market understands the need for comprehensive Internet security and we can convince our potential customers of our ability to provide this security in an integrated, cost-effective and administratively feasible manner. Although we have spent, and will continue to spend, considerable resources educating potential customers about the need for comprehensive Internet security and the benefits of our products and services, our efforts may be unsuccessful.
If potential customers do not accept our Firebox products and the related LiveSecurity Service, our business will not succeed.
We currently expect that future revenues will be primarily generated through sales of our Firebox products and the related LiveSecurity Service, including subscription fees, and we cannot succeed if the market does not accept these products and services. Our success depends on our ability and the ability of our distribution network,
which includes distributors, VARs and ISPs and other managed service providers, to obtain and retain customers. Some of our Firebox products, particularly our key Firebox X line of products, however, are relatively new and unproven. The Firebox X line of products have only been available since February 2004. The Firebox X line of products, which replace a product line that represented a majority of our revenues, also represent a new approach to providing security to the SME in that they are designed to be expandable both to incorporate additional features and to provide increased performance, and we may be unsuccessful in marketing and selling this type of product.
To receive our LiveSecurity Service, enterprises are required to pay an annual subscription fee, either to us or, if they obtain the LiveSecurity Service through one of our channel customers, to the channel customer. We are not aware of any other Internet security product that allows enterprises to keep their security solution current by receiving software updates and comprehensive security information over the Internet. SMEs may be unwilling to pay a subscription fee to keep their Internet security up to date and to receive Internet security-related information. Because our LiveSecurity Service is an innovative service, we may not be able to accurately predict the rate at which our customers will renew their annual subscriptions. In addition, most businesses implementing security services have traditionally managed their own Internet security rather than using the services of third-party service providers. As a result, our products and services and the outsourcing of Internet security to third parties may not achieve significant market acceptance.
If we are unable to compete successfully in the highly competitive market for Internet security products and services, our business will fail.
The market for Internet security products is intensely competitive and we expect competition to intensify in the future. An increase in competitive pressures in our market or our failure to compete effectively may result in pricing reductions, reduced gross margins and loss of market share. Currently, the primary competitors in our industry include Check Point, Cisco Systems, Inc., Fortinet Inc., NetScreen Technologies, Inc., Nokia Corporation, SonicWALL, Inc. and Symantec Corporation. Other competitors offering security products include hardware and software vendors such as Lucent Technologies, Inc. and Network Associates, Inc., operating system vendors such as Microsoft Corporation, Novell, Inc. and Sun Microsystems, Inc., and a number of smaller companies. Many of our competitors have longer operating histories, greater name recognition, larger customer bases and significantly greater financial, technical, marketing and other resources than we do. Our current and potential competitors may establish cooperative relationships among themselves or with third parties that may further enhance their resources. In addition, current or potential competitors may be acquired by third parties with greater available resources, as may happen as a result of Juniper Networks, Inc.’s agreement to acquire Netscreen. As a result of these potential actions, our current or potential competitors may be able to adapt more quickly to new technologies and customer needs, devote greater resources to the promotion or sale of their products and services, initiate or withstand substantial price competition, take advantage of acquisition or other opportunities more readily or develop and expand their product and service offerings more quickly. In addition, our competitors may bundle products competitive with ours with other products that they may sell to our current or potential customers. These customers may accept these bundled products rather than separately purchasing our products.
If our third-party channel customers fail to perform, our ability to sell our products and services will be limited.
We sell most of our products and services through our distribution network, and we expect our success to continue to depend in large part on the performance of this network. Our channel customers have the ability to sell products and services that are competitive with ours, to devote more resources to those competitive products or to cease selling our products and services altogether. Two of our channel customers, Tech Data and Ingram Micro, accounted respectively for 18.6% and 16.1% of our revenues in the year ended December 31, 2003 on a global basis. The loss of one of these channel customers, a reduction in their sales, a reduction in our share of their sales of Internet security products, or a loss or reduction in sales involving one or more other channel
customers, particularly if the reduction results in increased sales of competitive products, could harm our business. In addition, we are in the process of reorganizing our channel in the Asia Pacific region and, particularly, Japan. If this reorganization causes disruption, we could experience a loss or reduction in sales involving one or more of our channel customers.
Product returns, retroactive price adjustments and rebates could exceed our allowances, which could adversely affect our operating results.
We provide most of our channel customers with product return rights for stock rotation and price protection rights for their inventories, which they may exercise if we lower our prices for those products. We also provide promotional rebates to some of our channel customers. We may experience significant returns, price adjustments and rebate costs for which we may not have adequate allowances, particularly with the recent introduction of our Firebox X line of products, which replaces the Firebox III line of products. The short life cycles of our products and the difficulty of predicting future sales increase the risk that new product introductions or price reductions by us or our competitors could result in significant product returns or price adjustments. When we introduced the Firebox II, and then later the Firebox III, security appliances, we experienced an increase in returns of previous products and product versions. Provisions for returns and allowances were $6.9 million in 2001, $4.6 million in 2002 and $7.3 million in 2003 or 10%, 6% and 8% of total revenues before returns and allowances. While we review and adjust our provision for returns and allowances in order to properly reflect the potential for promotional rebate costs, increased returns and pricing adjustments associated with the introduction of new products, particularly the Firebox X product line, the provision may still be inadequate.
Rapid changes in technology and industry standards could render our products and services unmarketable or obsolete, and we may be unable to introduce new products and services timely and successfully.
To succeed, we must continually change and improve our products in response to rapid technological developments and changes in operating systems, Internet access and communications, application and networking software, computer and communications hardware, programming tools, computer language technology and hacker techniques. We may be unable to successfully and timely develop these new products and services or achieve and maintain market acceptance. The development of new, technologically advanced products and services is a complex and uncertain process that requires great innovation and the ability to anticipate technological and market trends. Because Internet security technology is complex, it can require long development and testing periods.
Releasing new products and services prematurely may result in quality problems, and releasing them late may result in loss of customer confidence and market share. In the past, we have on occasion experienced delays in the scheduled introduction of new and enhanced products and services, and we may experience delays in the future. When we do introduce new or enhanced products and services, we may be unable to successfully manage the transition from the older products and services to minimize disruption in customer ordering patterns, avoid excessive inventories of older products and deliver enough new products and services to meet customer demand.
Seasonality and concentration of revenues at the end of the quarter could cause our revenues to fall below the expectations of securities analysts and investors, resulting in a decline in our stock price.
The growth rate of our domestic and international sales has been and may in the future be lower in the summer months, when businesses often defer purchasing decisions. Also, as a result of customer buying patterns and the efforts of our sales force to meet or exceed quarterly and year-end quotas, historically we have received a substantial portion of a quarter’s sales orders and earned a substantial portion of a quarter’s revenues during the quarter’s last month and the latter half of the last month. If expected revenues at the end of any quarter are delayed, our revenues for that quarter could fall below the expectations of securities analysts and investors, resulting in a decline in our stock price.
We may be unable to adequately expand our operational systems to accommodate growth, which could harm our ability to deliver our products and services.
Our operational systems have not been tested at the customer volumes that may be required in the future. We may encounter performance difficulties when operating with a substantially greater number of customers. These performance difficulties could harm our ability to deliver our products and services. An inability to add software and hardware or to develop and upgrade existing technology or operational systems to handle increased traffic may cause unanticipated system disruptions, slower response times and poor customer service, including problems filling customer orders.
We may be required to defend lawsuits or pay damages in connection with the alleged or actual failure of our products and services.
Because our products and services provide and monitor Internet security and may protect valuable information, we may face claims for product liability, tort or breach of warranty relating to our products and services. Anyone who circumvents our security measures could misappropriate the confidential information or other property of end-users using our products and services or interrupt their operations. If that happens, affected end-users or channel customers may sue us. In addition, we may face liability for breaches caused by faulty installation and implementation of our products by end-users or channel customers. Although we attempt to reduce the risk of losses from claims through contractual warranty disclaimers and liability limitations, these provisions may be unenforceable. Some courts, for example, have found contractual limitations of liability in standard software licenses to be unenforceable because the licensee does not sign the license. Defending a suit, regardless of its merit, could be costly and could divert management attention. Although we currently maintain business liability insurance, this coverage may be inadequate or may be unavailable in the future on acceptable terms, if at all.
A breach of security could harm public perception of our products and services.
We will not succeed unless the marketplace is confident that we provide effective Internet security protection. Even networks protected by our software products may be vulnerable to electronic break-ins and computer viruses. If an actual or perceived breach of Internet security occurs in an end-user’s systems, regardless of whether the breach is attributable to us, the market perception of the efficacy of our products and services could be harmed. This could cause us or our channel customers to lose current and potential customers or cause us to lose potential channel customers. Because the techniques used by computer hackers to access or sabotage networks change frequently and generally are not recognized until launched against a target, we may be unable to anticipate these techniques.
If we are unable to prevent attacks on our internal network system by computer hackers, public perception of our products and services will be harmed.
Because we provide Internet security, we are a significant target of computer hackers. We have experienced attacks by computer hackers in the past and expect attacks to continue. If attacks on our internal network system are successful, public perception of our products and services will be harmed.
We may be unable to adequately protect our operational systems from damage, failure or interruption, which could harm our reputation and our ability to attract and retain customers.
Our operations, customer service, reputation and ability to attract and retain customers depend on the uninterrupted operation of our operational systems. Although we utilize limited off-site backup facilities and take other precautions to prevent damage, failure or interruption of our systems, our precautions may be inadequate. Any damage, failure or interruption of our computer or communications systems could lead to service interruptions, delays, loss of data and inability to accept and fill customer orders and provide customers with our LiveSecurity Service.
We may be unable to deliver our products and services if we cannot continue to license third-party technology that is important for the functionality of our products.
Our success will depend in part on our continued ability to license technology that is important for the functionality of our products. A significant interruption in the supply of a third-party technology, including open source software, could delay our development and sales until we can find, license and integrate equivalent technology. This could damage our brand and result in loss of current and potential customers. Although we believe that we could find other sources for the technology we license, alternative technologies may be unavailable on acceptable terms, if at all. We depend on our third-party licensors to deliver reliable, high-quality products, develop new products on a timely and cost-effective basis and respond to evolving technology and changes in industry standards. We also depend on the continued compatibility of our third-party software with future versions of our products.
We may be unable to deliver our products and services if component manufacturers fail to supply component parts with acceptable quantity, quality and cost.
We obtain the component parts for our hardware from a variety of manufacturers. While our component vendors have produced parts for us in acceptable quantities and with acceptable quality and cost in the past, they may be unable to do so in the future. Companies in the electronics industry regularly experience lower-than-required component allocations, and the industry is subject to frequent component shortfalls. Although we believe that we could find additional or replacement sources for our hardware components, our operations could be disrupted if we have to add or switch to a replacement vendor or if our component supply is interrupted for an extended period. This could result in loss of customer orders and revenue.
Governmental controls over the export or import of encryption technology could cause us to lose sales.
Any additional governmental regulation of imports or exports or failure to obtain required export approval of our encryption technologies could adversely affect our international and domestic sales. The United States and various other countries have imposed controls, export license requirements and restrictions on the import or export of some technologies, especially encryption technology. In addition, from time to time governmental agencies have proposed additional regulation of encryption technology, such as requiring the escrow and governmental recovery of private encryption keys. Additional regulation of encryption technology could delay or prevent the acceptance and use of encryption products and public networks for secure communications. This, in turn, could result in decreased demand for our products and services. In addition, some foreign competitors are subject to less stringent controls on exporting their encryption technologies. As a result, they may be able to compete more effectively than we can in the U.S. and international Internet security markets.
We may be unable to adequately protect our proprietary rights, which may limit our ability to compete effectively.
Despite our efforts to protect our proprietary rights, unauthorized parties may misappropriate or infringe on our trade secrets, copyrights, trademarks, service marks and similar proprietary rights. We face additional risk when conducting business in countries that have poorly developed or inadequately enforced intellectual property laws. While we are unable to determine the extent to which piracy of our software products exists, we expect piracy to be a continuing concern, particularly in international markets and as a result of the growing use of the Internet.
If we fail to obtain and maintain patent protection for our technology, we may be unable to compete effectively. We have eight issued patents and 15 patents pending, but our patent applications may not result in issued patents. Even if we secure a patent, the patent may not provide meaningful protection. In addition, we rely on unpatented proprietary technology. Because this proprietary technology does not have patent protection, we may be unable to meaningfully protect this technology from unauthorized use or misappropriation by a third party. In addition, our competitors may independently develop similar or superior technologies or duplicate any unpatented technologies that we have developed, which could significantly reduce the value of our proprietary technology or threaten our market position.
Intellectual property claims and litigation could subject us to significant liability for damages and invalidation of our proprietary rights.
In the future, we may have to resort to litigation to protect our intellectual property rights, to protect our trade secrets or to determine the validity and scope of the proprietary rights of others. Any litigation, regardless of its success, would probably be costly and require significant time and attention of our key management and technical personnel. Litigation could also force us to
•
stop or delay selling, incorporating or using products that incorporate the challenged intellectual property;
•
pay damages;
•
enter into licensing or royalty agreements, which may be unavailable on acceptable terms; or
•
redesign products or services that incorporate infringing technology, which may not be technologically or economically feasible.
Although we have not been sued for intellectual property infringement, we may face infringement claims from third parties in the future. The software industry has seen frequent litigation over intellectual property rights, and we expect that participants in the Internet security industry will be increasingly subject to infringement claims as the number of products, services and competitors grows and functionality of products and services overlaps.
Undetected product errors or defects could result in loss of revenues, delayed market acceptance and claims against us.
Our products and services may contain undetected errors or defects, especially when first released. Despite extensive testing, some errors are discovered only after a product has been installed and used by customers. Any errors discovered after commercial release could result in loss of revenues or claims against us or our channel customers.
If we do not retain our key employees, if changes to the management team cause disruption or if new management team members fail to perform, our ability to execute our business strategy will be impaired.
Our future success will depend largely on the efforts and abilities of our senior management and our key development, technical, operations, information systems, customer support and sales and marketing personnel, and on our ability to retain them. These employees are not obligated to continue their employment with us and may leave us at any time. In addition, there have been changes to our management team in the past year, including the addition of a new chief executive officer. If these changes have a negative impact on our operations, our business and operating results could be adversely affected.
In attempting to integrate the business and technology of any future acquisition, we could incur significant costs that may not be outweighed by any benefits of the acquisition.
As part of our business strategy, we may acquire other companies, products or technologies, and these acquisitions may result in substantial costs. The costs of any future acquisitions may include costs for:
•
integration of operations, including combining teams and processes in various functional areas;
•
reorganization or closure of operations and facilities;
•
integration of new technology into our products;
•
fees and expenses of professionals involved in completing the integration process; and
•
potential existing liabilities of any future acquisition target.
Successful integration of the operations, technology, products, customers, suppliers and personnel of any future acquisition could place a significant burden on our management and internal resources. The diversion of the attention of our management and any difficulties encountered in the transition and integration process could disrupt our business and have an adverse effect on our business and operating results.
If we do not expand our international operations and successfully overcome the risks inherent in international business activities, the growth of our business will be limited.
Our ability to grow will depend in part on the expansion of our international sales and operations, which are expected to continue to account for a significant portion of our revenues. Sales to customers outside of the United States accounted for approximately 56% of total revenues in 2001, 58% in 2002 and 54% in 2003. The failure of our channel customers to sell our products internationally would limit our ability to increase our revenues. In addition, our international sales are subject to the risks inherent in international business activities, including
•
cost of customizing products for foreign countries;
•
export and import restrictions, such as those affecting encryption commodities and software or those requiring local content;
•
difficulties in acquiring and authenticating customer information;
•
reduced protection of intellectual property rights and increased liability exposure; and
•
regional economic and political conditions.
Our international sales currently are U.S. dollar-denominated. As a result, any increase in the value of the U.S. dollar relative to foreign currencies makes our products less competitive in international markets. Because of this, we may be required to denominate our sales in foreign currencies at some point in the future to remain competitive.
We may need additional capital and our ability to secure additional funding is uncertain.
We believe that existing cash and cash equivalent balances will be sufficient to meet our capital requirements for at least the next 12 months. Our capital requirements will depend on several factors, however, including
•
the rate of market acceptance of our products and services;
•
our ability to expand our customer base;
•
the growth of our sales and marketing capabilities; and
•
the cost of any acquisitions we may complete.
Our existing capital and future revenues may therefore be insufficient to support the expenses of our operations and the expansion of our business. We may therefore need additional equity or debt capital. We may seek additional funding through
•
public or private equity financings, which could result in significant dilution to stockholders;
•
public or private debt financings; and
•
capital lease transactions.
Financing, however, may be unavailable to us when needed or on acceptable terms.
Our stock price is volatile.
The trading price of our common stock could be subject to fluctuations for a number of reasons, including
•
actual or anticipated variations in quarterly or annual operating results;
•
changes in analysts’ earnings projections or recommendations;
•
failure to meet analysts’ revenue or earnings projections;
•
inability to successfully implement our business strategy;
•
changes in business conditions affecting our customers, our competitors and us; and
•
changes in accounting standards that adversely affect our revenues and earnings.
In recent years, moreover, the stock market in general and the market for Internet-related technology companies in particular have experienced extreme price and volume fluctuations, often unrelated to the operating performance of the affected companies. Our common stock has experienced, and is likely to continue to experience, these fluctuations in price, regardless of our performance.
ITEM 2.
ITEM 2.
PROPERTIES
Our principal administrative, marketing, sales, development and operations facility is located in Seattle, Washington. We lease approximately 100,000 square feet in this facility (including space that is subleased) under a lease that expires in September 2010. We have the option to extend the lease for an additional five-year term. We also maintain a product fulfillment and distribution warehouse in Seattle under a lease that expires in April 2006, a satellite office in San Jose, California under a lease that expires in November 2004 and an office for development personnel in Tustin, California under a lease that expires in October 2005. In addition, we lease facilities in Aliso Viejo, California and Waltham, Massachusetts under operating leases that expire between 2005 and 2007 and we lease offices for sales activities in various regions throughout the world. Our excess facilities at our corporate headquarters in Seattle, and in Aliso Viejo and San Jose, California, are partially subleased to tenants, with sublease terms that expire between 2004 and 2010.
ITEM 3.
ITEM 3.
LEGAL PROCEEDINGS
We are not currently a party to any material legal proceedings.
ITEM 4.
ITEM 4.
SUBMISSION OF MATTERS TO A VOTE OF SECURITY HOLDERS
No matters were submitted to a vote of our security holders during the fourth quarter of 2003.
PART II
ITEM 5.
ITEM 5.
MARKET FOR REGISTRANT’S COMMON EQUITY AND RELATED STOCKHOLDER MATTERS
Market Information
Our common stock began trading on the Nasdaq National Market on July 30, 1999 under the symbol WGRD. The following table lists, for the periods indicated, the high and low sales prices per share of our common stock as reported on the Nasdaq National Market.
The last reported sale price of our common stock on the Nasdaq National Market on March 1, 2004 was $7.53 per share.
Holders
As of March 1, 2004, there were approximately 165 holders of record of our common stock. This does not include the number of persons whose stock is held in nominee or “street name” through brokers or other fiduciaries.
Dividends
We have never paid cash dividends on our common stock. We currently intend to retain any future earnings to fund the development and growth of our business and therefore do not anticipate paying any cash dividends in the foreseeable future.
Recent Sales of Unregistered Securities
None.
ITEM 6.
ITEM 6.
SELECTED FINANCIAL DATA
When you read this selected financial data, it is important that you also read the historical consolidated financial statements and related notes included in this annual report, as well as the section entitled “Management’s Discussion and Analysis of Financial Condition and Results of Operations.” The historical results are not necessarily indicative of future results.
(1)
See Notes 1 and 6 to our consolidated financial statements for an explanation of the method used to calculate basic and diluted net loss per share.
ITEM 7.
ITEM 7.
MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS OF OPERATIONS
The following discussion and analysis provides information that we believe is relevant to an assessment and understanding of WatchGuard’s financial condition and results of operations. The discussion should be read in conjunction with the consolidated financial statements and the notes thereto.
Overview
WatchGuard is a leading provider of Internet security solutions designed to protect small- to medium-sized enterprises, or SMEs, that use the Internet for e-commerce and secure communications.
Our award-winning products and services include our integrated, expandable Firebox security solutions that offer firewall protection and intrusion prevention technology for access control, virtual private networking for secure communications, content and spam filtering, anti-virus protection and vulnerability assessment services. Our innovative subscription-based LiveSecurity Service provides our customers with access to expert guidance and support so they can protect their data and communications in a continuously changing environment.
Our market spans the SME market, from smaller-sized companies for which ease-of-use is a primary requirement, to medium-sized companies, including those with high-speed connections supporting virtual private networks, or VPNs, between the corporate headquarters and geographically dispersed branch offices, for which performance, scalability and networking features are key requirements. Our security solutions also give enterprises a security management choice. An enterprise can manage its own Internet security with our product offerings or outsource its security management to an Internet service provider, or ISP, or other managed service provider implementing our managed security solutions.
Since January 2002, we have continued to invest heavily in the development of our products as follows:
•
In the second quarter of 2002, we acquired RapidStream, Inc., a privately held provider of high-performance, ASIC (application-specific integrated circuit)-based firewall and VPN appliances, and introduced high-performance Firebox Vclass firewall and VPN appliances, based on the technology RapidStream had developed.
•
In August 2002, we introduced our new Firebox SOHO 6, Firebox SOHO 6tc, and Firebox SOHO 6tc-50 user models.
•
In March 2003, we introduced the Firebox S6 and Firebox S6tcVPN firewall and VPN network security appliances for small businesses, remote offices and telecommuters, which were fully localized for the Japanese market.
•
In March 2003, we introduced the Firebox V60L, an addition to our line of Firebox Vclass security appliances. The new product is designed to provide mid-size enterprises with firewall/VPN performance and scalability superior to other solutions in the same price range.
•
In March 2003, we introduced the Firebox 500, an addition to our Firebox III family of sophisticated, easy-to-manage security solutions for SMEs. The new product is a hardened firewall appliance for small businesses requiring perimeter security, mobile user VPN support and Web content control.
•
In March 2003, we introduced the Firebox V200, which extends our line of high-performance Firebox Vclass security solutions. The new product is designed to eliminate the need for multiple appliances in environments requiring multi-gigabit throughput, thereby providing a cost-effective, easy-to-implement solution for distributed enterprises and service providers.
•
In June 2003, we introduced the SOHO 6 Wireless product line, designed to provide a complete, robust wireless and scalable wired security solution in a single firewall/VPN appliance for small businesses, remote offices and telecommuters.
•
In September 2003, we introduced our AuditScan network vulnerability assessment service, as an option to WatchGuard customers available beginning in the fourth quarter of 2003 through the LiveSecurity Service subscription. AuditScan service has been developed in partnership with Qualys, Inc., a leading Web service provider of network security audits and vulnerability management, and is designed to enable organizations to perform independent network security audits quickly, easily and cost effectively.
•
In February 2004, we introduced our Firebox X line of integrated, expandable security appliances for SMEs, combining firewall, VPN, application layer security, intrusion prevention functionality, spam blocking, Web filtering and authentication in a single appliance designed to enable customers to upgrade the appliance to any higher model in the same line or to add ports just by applying a software license key.
Critical Accounting Policies
Our discussion and analysis of financial condition and results of operations is based on our consolidated financial statements, which have been prepared in accordance with accounting principles generally accepted in the United States. The preparation of financial statements in conformity with generally accepted accounting principles requires management to make estimates and assumptions that affect the amounts reported in the consolidated financial statements and accompanying notes. On an ongoing basis, we evaluate significant estimates used in preparing our financial statements, including those related to
•
revenue recognition, including sales returns and allowances;
•
the provision for bad debt;
•
inventory reserves;
•
restructuring reserves;
•
the allocation of purchase price in business combinations to intangible assets; and
•
analysis for impairment of goodwill and intangible assets.
We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, the results of which form the basis for making judgments about the carrying values of assets and liabilities that are not readily apparent from other sources. Actual results may differ from these estimates if our assumptions change or if actual circumstances differ from those in our assumptions.
We believe the following critical accounting policies affect the more significant judgments and estimates used in preparing our consolidated financial statements.
Revenue Recognition
Revenue recognition rules for software companies are very complex. Although we follow very specific and detailed guidelines in measuring revenue, certain judgments affect the application of our revenue policy. The complexity of the revenue recognition rules and estimates inherent in the revenue recognition process makes revenue results difficult to predict, and any shortfall in revenues or delay in recognizing revenues could cause our operating results to vary significantly from quarter to quarter and could result in future operating losses.
We generate revenues through
•
sales of products and service subscriptions indirectly through our distribution network at a discount from list price;
•
sales of products and service subscriptions to our service provider customers at volume pricing rates; and
•
sales of service subscription renewals directly to end-users.
Product revenues, net of sales returns, allowances and promotions, include
•
sales of our security appliances and the perpetual software license fees for our Firebox products that are bundled with the sale of our security appliances as part of our security solutions;
•
revenues from license sales of software options, such as user expansion and software management modules;
•
revenues from sales of our network operations center security suite software license as part of our managed security solution;
•
hardware sales of our RapidStream “Secured by Check Point” line of high-performance security appliances; and
•
sales of our ServerLock products and anti-virus solutions for server content, application and desktop security.
Revenues from products are generally recognized upon delivery if persuasive evidence of an arrangement exists, collection is probable, the fee is fixed or determinable, and vendor-specific objective evidence of fair value for undelivered elements of the arrangement has been established. While we generally recognize product revenues upon shipment, revenues on product sales for some of our major distributors are recorded when these distributors have sold the product to their customers.
Service revenues primarily include the initial fees for our LiveSecurity Service subscriptions, which have periods ranging from 90 days to one year and are sold as part of our security solutions, and for LiveSecurity Service subscription renewals, which have periods ranging from nine months to two years, from our enterprise customers and end-users. These service fees provide our customers access to our LiveSecurity Service for product updates, security threat responses, general security information and technical support. These service fees also enable our service provider customers access to the LiveSecurity Service and the ability to manage and update a specific number of their customers’ security appliances. Service subscription revenues are recognized ratably on a monthly basis over the subscription period generally ranging from 90 days to two years.
When service fees are bundled with the sales of our products in multiple element arrangements, the elements of those arrangements are unbundled using our objective evidence of the fair value of the undelivered elements represented by our customary pricing for each element when sold in separate transactions. Since customers receive the services over a period of time, WatchGuard determines the fair value of the service portion of the arrangement as an undelivered element, based on the renewal price of the service. Changes in the composition of such multiple-element arrangements, our ability to identify the existence of the vendor-specific objective evidence for the elements in the arrangement or our ability to estimate the fair value of elements in the arrangement could materially impact the amount of earned and unearned revenue.
We have established allowances for estimated returns and pricing protection rights. We have also established an allowance for promotional rebates that may be earned by our customers. We estimate these allowances and adjust them periodically based on historical rates of returns and allowances, as well as the expected effect of current promotional programs and new product introductions. We estimate the allowance for promotional rebates based on the maximum amounts potentially available to the customers, unless we have accumulated sufficient historic evidence for individual customers with respect to their realization of rebates. If new or expanded promotional programs are introduced, or new products are announced, additional allowances will be required. Alternatively, if actual promotional rebates fall below maximum exposure levels, we will reduce the allowances and recognize additional revenue.
Bad Debts
We maintain allowances for doubtful accounts for estimated losses resulting from the inability of our customers to make required payments. Significant judgment is required when we assess the ultimate realization
of receivables, including the probability of collection and the creditworthiness of each customer. If the financial condition of our customers were to deteriorate, resulting in an impairment of their ability to make payments, additional allowances might be required, which could have an adverse effect on our results of operations.
Inventory Valuation
Our inventories are stated at the lower of cost or market, with cost being determined on a first-in, first-out basis. We write our inventories down to estimated market value based on assumptions about future demand and market conditions. The introduction of new products that replace existing products, technological advances, and variation in market trends or customer preferences could, however, significantly affect these estimates and result in additional inventory write-downs, which could have an adverse effect on our results of operations.
Restructuring
In 2001, 2002 and 2003, we recorded significant accruals related to our restructuring plans. These accruals included estimates related to the abandonment of excess facilities. We have adjusted, as required, the restructuring accruals due to continued poor real estate market conditions in the areas where these excess facilities are located. The actual costs related to the restructuring may differ from our estimate if it takes us longer than expected to find suitable tenants for excess facilities or if there are further changes in the real estate market in those areas where excess facilities are located. Any additional adjustments resulting from these factors could have a material effect on our financial condition and operating results.
Business Combinations Purchase Price Allocation
We account for our business combinations using the purchase method of accounting prescribed by Statement of Financial Accounting Standard, or SFAS, 141. We allocate the total consideration paid in an acquisition to the fair value of the acquired company’s identifiable assets and liabilities. The remainder of consideration is allocated to goodwill.
We identify and record separately the intangible assets acquired apart from goodwill based on the specific criteria for separate recognition established in SFAS 141, namely:
•
the asset arises from contractual or other legal rights or
•
the asset is capable of being separated from the acquired entity and sold, transferred, licensed, rented or exchanged.
We recognize current technology as a separate intangible asset acquired and assign the value to this technology based on the income valuation approach, reflecting the present value of the projected net cash flows expected to be generated from future commercial sales of products incorporating this current technology. WatchGuard capitalizes the acquired technology that has reached the phase of technological feasibility.
Apart from the capitalized current technology, we also identify the value of the research and development efforts spent on the technology that has not yet reached the technological feasibility stage and does not have alternative future uses. We base this value of the in-process research and development on several factors, including the state of the development of each project, the time and cost needed to complete the project, expected income and associated risks related to the viability of the potential changes in future target markets. The value of the in-process research and development is expensed at the time of acquisition pursuant to the provisions of SFAS 2.
Accounting for Goodwill and Other Intangible Long-Lived Assets
Our business acquisitions have resulted in, and future acquisitions typically will result in, the recording of goodwill, which represents the excess of the purchase price over the fair value of identifiable assets acquired and liabilities assumed, including capitalized technology and other definite-lived intangible assets.
Pursuant to SFAS 142, we test purchased goodwill for impairment at least annually. Application of the goodwill impairment test may require judgments, including those inherent in the determination of fair value of the reporting unit in which the goodwill resides and the resulting determination of the implicit value of the goodwill. Significant judgments required to estimate the fair value include estimating future cash flows, determining appropriate discount rates and other assumptions. Changes in these estimates and assumptions could materially affect the determination of fair value.
Separable intangible assets that do not have indefinite lives are amortized over their useful lives ranging between three and five years. In accordance with SFAS 144, these assets are also periodically reviewed for the existence of facts and circumstances, both internal and external, which may suggest potential impairment. The determination of whether these intangible assets are impaired involves significant judgments based on short- and long-term projections of future performance. Certain of these forecasts reflect assumptions regarding our ability to continue to develop and ultimately to commercialize the products based on these intangible assets, as well as our projections of future cash flows from these products. Changes in strategy and/or market conditions may result in an impairment charge to our operating expenses, which could have an adverse effect on our results of operations.
Results of Operations
The following table provides financial data for the periods indicated as a percentage of total revenues:
Years Ended December 31, 2002 and 2003
Revenues
We categorize our revenues into three geographic regions: the Americas, Europe/Middle East/Africa, or EMEA, and Asia Pacific, or APAC. Revenue information by geographic region, in dollars and as a percentage of total revenues, was as follows (dollars in thousands):
Revenue information for countries representing more than 10% of total revenues in either year, in dollars and as a percentage of total revenues, was as follows (dollars in thousands):
*
Country’s information is based on destination of original shipments.
Revenue information for customers representing more than 10% of total revenues, in dollars and as a percentage of total revenues, was as follows (dollars in thousands):
The dollar and percentage decrease in product revenues for 2003 as compared to 2002 was primarily due to decreased revenues from sales of our Firebox III product line. Firebox III revenues decreased despite an increase in unit shipments due to a reduction in average selling prices. The unfavorable pricing changes are the result of sales promotions and extension of aggressive trade-up and competitive trade-in programs we introduced in response to competitive pricing pressure in the mid-tier of our market, combined with product life-cycle considerations. The decline in revenues is also partially attributable to a mix shift as we introduced a lower- priced product model within the Firebox III line in the first quarter of 2003. We have managed inventory levels of the Firebox III line in anticipation of the introduction of our Firebox X product line in February 2004, which is aimed at SMEs and is therefore competitive with our existing Firebox III product line.
The decrease in product revenues is also partially attributable to the decline in sales of the RapidStream “Secured by Checkpoint” products, due to our increased focus on the SME market and diminished sales and marketing support for the Rapid Stream “Secured by Checkpoint” brand, which is aimed at the large enterprise market. In the fourth quarter of 2003, we made a decision to exit the market segment served by those products and terminated their manufacturing and promotion.
Partially offsetting these declines were revenue increases from our SOHO and Vclass product lines. Those increases are attributable to growth in unit shipments from new product introductions, including the Firebox Vclass in the second quarter of 2002, the Firebox SOHO 6 in the third quarter of 2002, further additions of new products to the Firebox Vclass in the first quarter of 2003 and Firebox SOHO Wireless products in the second quarter of 2003.
From a regional standpoint, we experienced a decrease in total revenues from our APAC market, specifically in Japan, while total revenues for the Americas and EMEA increased. In the beginning of 2003 and continuing throughout 2003, we realigned our APAC business, focused on improving the performance of our sales channel, reevaluated our channel customer selection strategy and localized some of our products.
Given these realignment efforts in the APAC region and the continuing economic and geopolitical uncertainty and constrained corporate information technology spending, it is difficult to predict future revenue levels, which may decrease or fluctuate more than they have historically. It is still too early to determine if recent signs of slight improvement in information technology spending by businesses and positive sentiment on the economic outlook in late 2003 will continue and can translate into increased demand for our products. We may be unable to maintain or increase the demand for our products, our revenues may not grow at all or may decline, and we may be unable to achieve similar results in future periods.
Service revenues consist of revenues recognized from initial fees for our LiveSecurity Service subscriptions bundled with a hardware product sale, and revenues recognized for subscription renewals sold to the existing customer base. The increase in service revenues in both absolute dollars and as a percentage of total revenues for 2003 as compared to 2002, was primarily due to the increase in revenues generated on subscription renewals, as our installed customer base grows.
This increase in revenues from subscription renewals was partially offset by several factors as follows:
•
changes in terms of our initial LiveSecurity Service subscriptions, bundled with a product sale, due to our including a shorter initial subscription period for certain products beginning in mid-2002;
•
a reduction of LiveSecurity Service subscription prices corresponding to lower prices on related hardware products in response to a competitive environment; and
•
a shift in product mix toward lower-priced models of the Firebox III product line, resulting in the corresponding shift in mix in LiveSecurity Service subscription revenues.
The increase in service revenues for 2003 as compared to 2002 is also partially attributable to service revenue of $635,000 in 2003 generated from LiveSecurity Services that were provided through certain managed security customers to their end-users in prior periods, but were identified by WatchGuard through a license compliance initiative as being previously unreported to WatchGuard by those customers.
Service revenues recognized from initial service subscription fees are generally related to product shipments in preceding quarters, while revenues recognized from service renewals depend on the existing customer base. A decline in product shipments will result in lower initial LiveSecurity Service subscriptions bundled with the products, while an increase in our installed customer base will increase the number of customers with the opportunity to renew their LiveSecurity Service subscriptions. As a result, it is difficult to predict future service revenue levels.
The provision for sales returns, price protection rights and promotional rebates was $4.6 million, or 5.7% of total revenues before these returns and allowances, in 2002 and $7.3 million, or 8.4% of total revenues before returns and allowances, in 2003. The higher provision in absolute dollars and as a percentage of revenues for 2003 as compared to 2002 corresponds to increased unit shipments, as well as an increase in promotional offerings in 2003.
We expect to introduce new products and promotional programs each year, which may affect our reserve for sales returns and allowances.
Cost of Revenues and Gross Margin
Gross margins are affected by various factors, including the volume discount level offered to our customers, the cost of our hardware appliances, including components and labor, the expense associated with provision for inventory reserves, lower of cost or market assessment of inventory carrying value, fixed manufacturing overhead, the mix of product and services sales, which include hardware and software products and service subscriptions, the cost of royalties associated with our products, promotional programs, and the cost of our technical support organization and LiveSecurity Service.
Cost of product revenues includes the cost of manufacturing our security appliances, distribution operations, product packaging, third-party product licensing fees and provisions for inventory reserves and warranty.
The dollar increase in cost of product revenues for 2003 as compared to 2002 was primarily due to the increase in unit volume and in the provision for inventory reserves. The provision for inventory reserves increased from $1.0 million in 2002 to $2.9 million in 2003. Quantities of shipments of our products and related consumption of component inventory have been below our expectations. Our sales projections for future quarters and product life cycle considerations related to our plan to introduce new products in the latter part of 2004, resulted in our recording an additional provision for inventory reserves for certain of our products and related components. The provision also includes the write-down of our RapidStream “Secured by Check Point” brand products, as we discontinued further development and marketing of this brand. This brand is a subset of the products and technology obtained as a result of our April 2002 acquisition of RapidStream.
The decline in product margins as a percentage of product revenues was negatively affected by an increase in inventory reserves, by continued competitive pricing in the marketplace for our products, which included aggressive trade-up and competitive trade-in programs relating to the Firebox III line, by the introduction of new lower-margin product models within the Firebox III and Firebox Vclass product lines in the beginning of 2003, and by the relatively fixed nature of distribution and manufacturing support costs on lower revenues.
If the provision for inventory reserves were excluded from the calculation of product margin, the product margin as a percentage of product revenues would have been approximately 64.5% for 2002 and 60.9% for 2003.
Forecasting future product gross margin is difficult, as our gross margins may be adversely affected in the future by various factors, such as competitive selling pressures, the impact on the existing inventory values when replacement products are introduced and availability of key components. Our margins as a percentage of revenues could also be negatively affected by continued economic uncertainty, which could result in downward pressure on the prices of technology-based products.
Cost of service revenues includes the costs of our technical support organization and costs associated with our LiveSecurity Service.
Cost of service revenues increased in absolute dollars but decreased as a percentage of related revenues for 2003 as compared to 2002. The dollar increase in cost of services is primarily related to the increase of internal information technology costs associated with the LiveSecurity Service and customer support. In 2003, we made significant investments in information technology that consolidated our customer-facing applications and databases and migrated them onto more scalable and extensible application platforms. This cost increase was partially offset by cost savings achieved after transitioning to a new provider of the first level of customer support.
Service margins increased in both absolute dollars and as a percentage of service revenues due to operational and cost efficiencies we have realized from our expanded customer base, resulting in lower incremental costs incurred to add each additional subscription customer.
We expect service costs to continue to increase in absolute dollars as our user base expands. Actual service costs and margins could differ materially from those anticipated, which could have an adverse effect on our results of operations.
Operating Expenses
Sales and Marketing
Sales and marketing expenses include salaries, commissions and employee-related expenses and certain variable marketing expenses, including distributor promotional costs, public relations costs, marketing collateral, trade show and advertising expenses.
The dollar decrease in sales and marketing expenses for 2003 as compared to 2002 was primarily due to the decline in variable marketing expenditures, especially due to a reduction of distributor promotional programs. Distributor promotional programs were reduced from $4.1 million in 2002 to $2.8 million in 2003. Those costs declined as we attempted to balance those activities with the increases in direct sales discounts available to our channel customers.
Costs of other marketing programs, such as advertising, marketing collateral and promotions, trade shows, public relations, market research, direct marketing and other programs declined from $6.7 million in 2002 to $5.4 million in 2003. The reduction in those marketing programs resulted from our enhanced expenditures in 2002 related to the international rollout of the new Firebox Vclass product line.
Those decreases in distributor promotional costs and marketing programs were partially offset by an increase in compensation and benefits.
In 2004, we expect our sales and marketing expenses, in absolute dollar terms, to remain comparable to the levels incurred in 2003. Should our revenues improve, we expect sales and marketing expenses to decrease as a percentage of revenues as we focus on improving depth and productivity of our distribution network and cost-effectiveness of our marketing efforts. Our actual sales and marketing expenses could differ materially from those anticipated, which could have an adverse effect on our results of operations.
Research and Development
Research and development expenses include costs associated with the development of new products, enhancements of existing products, product integration efforts and quality assurance activities. These costs consist primarily of employee salaries and benefits, costs of noncapitalized equipment, software tools, our security appliance prototypes and certification procedures, payments to designers and contractors and depreciation of capital equipment and software.
Research and development expenses decreased in both absolute dollars and as a percentage of revenues for 2003 as compared to 2002. This decline is primarily related to the decline in salaries and benefits associated with elimination in personnel redundancies caused by our RapidStream acquisition in 2002. Headcount-related compensation costs and other research and development costs increased substantially in the second quarter of 2002 as a result of the RapidStream acquisition and due to product integration efforts we implemented to accelerate the rollout of new Vclass products based on the RapidStream technology. Headcount was gradually brought down to pre-acquisition levels by the end of the second quarter of 2003 as redundant functions were eliminated. Also, lower-than-expected ServerLock revenue in 2003 resulted in reductions of related research and development costs for this product line.
These cost savings were partially offset by the increase in outsourced expenses, due primarily to the additional cost of undergoing the evaluation for Common Criteria Evaluation Assurance Level 4 and Federal Processing Standards certification for the Firebox Vclass product line in 2003.
We intend to continue to fund our research and development efforts in order to meet the changing requirements of our customers, to provide for continued introduction of new products as technology advances and to enhance and expand our current product offerings. We expect to continue investments in key areas aimed at the development of new generations of our products, further extension of our existing product lines and the development of future technologies. At the same time, we expect the overall cost of research and development for 2004 to be comparable to 2003 as we continue to concentrate on cost control and efficiency initiatives in our research and development activities. Should our revenues improve, we expect research and development expenses to decrease as a percentage of revenues. Our actual research and development expenses could differ materially from those anticipated, which could have an adverse effect on our results of operations.
General and Administrative
General and administrative expenses include costs of executive, human resource, finance and administrative support functions, provisions for uncollectible accounts, costs of legal and accounting professional services, and director and officer insurance.
General and administrative expenses increased in absolute dollars and declined slightly as a percentage of revenues for 2003 as compared to 2002. The dollar increase in general and administrative expenses for 2003 as compared to 2002 reflects increases in severance costs, as well as an increase in legal and accounting fees as a result of enhanced corporate governance requirements. Those increases were partially offset by a reduction in travel costs. General and administrative expenses declined slightly as a percentage of revenues, primarily due to improved revenues in 2003.
For 2004, we anticipate a modest increase in general and administrative expenses, in terms of absolute dollars, from the levels incurred in 2003 as we may incur additional expenses in connection with enhanced regulatory and corporate governance requirements relating to additional internal controls and procedures pursuant to Section 404 of the Sarbanes-Oxley Act of 2002. Our actual general and administrative expenses could differ materially from those anticipated, which could have an adverse effect on our results of operations.
Stock-Based Compensation
Stock-based compensation expenses allocated by functional operating expense category were as follows (in thousands):
Stock-based compensation expenses arise primarily from amortization of previously deferred stock-based compensation over the vesting periods of common stock subject to repurchase and stock options.
Deferred stock-based compensation is initially recorded as a component of stockholders’ equity in the amount of the excess of the fair value of our common stock on the date of grant over the exercise price of options and also in the amount of the fair value of our common stock that we issued in connection with our October 2000 acquisition of Qiave and our April 2002 acquisition of RapidStream that is subject to repurchase. In addition, deferred stock-based compensation is recorded for the fair value of stock options granted to consultants. Deferred stock-based compensation is amortized into expense over the relevant vesting periods using the accelerated method.
Amortization of Other Intangible Assets Acquired
Amortization of other intangible assets acquired consists of amortization of capitalized technology and other definite-lived intangibles related to our acquisitions of Qiave in 2000 and RapidStream in 2002. We are amortizing the intangible assets on a straight-line basis over useful lives ranging from three to five years.
Amortization of other intangible assets acquired was $4.4 million for 2002 and $2.0 million for 2003.
The decrease in amortization of other intangible assets acquired for 2003 as compared to 2002 resulted primarily from the reduction in the amortizable basis of other intangible assets. This reduction, in turn, was caused by the impairment of the technology we obtained in the acquisition of Qiave in October 2000, as discussed below. The amortization related to this technology decreased by approximately $2.7 million in 2003 as compared to 2002. This intangible asset was fully amortized by the end of 2003.
This reduction in amortization was partially offset by the $280,000 increase in amortization of technology obtained in the acquisition of RapidStream in April 2002. This increase is primarily caused by the fact that in 2003 this technology was amortized for a full year, as opposed to 2002, when it was amortized over only a partial year from the time of acquisition.
Impairment of Other Intangible Assets Acquired
In addition to the amortization expense, a partial impairment of the intangible assets related to our acquisition of Qiave in 2000 was recorded in the fourth quarter of 2002 and a partial impairment of the intangible assets related to our acquisition of RapidStream in 2002 was recorded in the third and fourth quarters of 2003.
In accordance with SFAS 144, the carrying value of intangible assets is reviewed on a regular basis for the existence of facts or circumstances, both internal and external, that may suggest impairment.
During the fourth quarter of 2002, we developed a business plan that, because of limited resources, constrained further development and integration of the technology we obtained in connection with our acquisition of Qiave in October 2000. Separately, we continued to realize lower than expected revenue from products based on the Qiave technology. As a result, the expected future cash flows were determined to be insufficient to support the carrying value of the Qiave capitalized technology. We therefore recorded an impairment charge of $6.7 million in the last quarter of 2002 of capitalized technology related to the acquisition of Qiave.
During the third quarter of 2003, it was determined that an impairment existed for the intangible asset associated with the RapidStream “Secured by Check Point” product brand based on the technology obtained in the 2002 acquisition of RapidStream. Our increased focus on the SME market, resulting in a significant reduction in our sales, marketing and development efforts in support of this brand, together with the historically poor performance of this brand, led management to reduce the future sales projections for the brand. The revised undiscounted expected future cash flows resulting from the reduced sales projections were determined to be insufficient to recover the carrying value of the related capitalized technology. We therefore recorded an impairment charge of $3.3 million in the third quarter of 2003 based on the revised estimate of the asset’s fair value using a discounted cash flow approach. In the fourth quarter of 2003, we decided to exit the market segment served by this product; we therefore recorded an additional impairment charge of $230,000 for the remaining book value of this intangible asset.
Acquired In-Process Technology
Acquired in-process technology expenses of $1.2 million in 2002 consists of in-process research and development expense related to our acquisition of RapidStream.
Restructuring Charges
The restructuring charges in 2002 are associated with the restructuring plans initiated in 2001 and 2002.
In the second quarter of 2001, we announced a restructuring plan designed to streamline operations and reduce operating costs, which included a reduction in workforce and a consolidation of excess facilities, in addition to other cost-saving strategies. As part of the restructuring plan, we exited the consumer security market and terminated various original equipment manufacturer agreements to develop products and services for that market, and streamlined operations in support of new products and services aimed at business customers. In 2002, we recorded additional restructuring charges of $1.4 million, relating to revised estimates of the costs associated with the consolidation and sublease of excess facilities.
In the second quarter of 2002, we implemented a second restructuring plan primarily designed to eliminate redundancies and excess headcount resulting from the acquisition of RapidStream, which included a reduction in workforce, consolidation of excess facilities and elimination of technology-related contracts that are no longer required or part of our strategy. As a result of this restructuring, we recorded a $6.7 million restructuring charge in 2002, relating to severance and termination benefits, costs of consolidation and sublease of excess facilities and cost of technology-related contracts cancellation.
The restructuring charges of $1 million in 2003 are associated with the restructuring plans initiated in 2001 and 2002, discussed above. The additional charges in 2003 relate to the revision of our estimates for future costs associated with the sublease of excess facilities in our corporate headquarters in Seattle, Washington. As the real estate market in downtown Seattle remains depressed, we revised down our earlier estimates of possible sublease rental income for our space that remains vacant.
Interest Income and Interest Expense
Interest income is generated primarily from our investment of proceeds from the sale of common stock in our initial public offering in 1999 and our follow-on public offering in February 2000. Interest income decreased from $3.2 million in 2002 to $1.3 million in 2003. The decrease was caused by both a decrease in the average balance invested and a decline in the average rates of return.
Net interest expense primarily represents financing costs incurred due to term discounts taken by our customers. Interest expense increased from $288,000 in 2002 to $604,000 in 2003. The increase in term discounts taken was caused by the increase in revenues generated from our larger channel customers to whom such discounts were available.
Income Taxes
Income tax expense of $29,000 in 2002 and $34,000 in 2003 primarily relates to our provision for foreign income taxes associated with our international operations. We have experienced losses since inception, resulting in a net operating loss carryforward position for federal income tax purposes of approximately $194.9 million as of December 31, 2003. These carryforwards, if not utilized, will begin to expire after the 2011 tax year, and may be subject to limitations under Section 382 of the Internal Revenue Code of 1986, as amended. In addition, approximately $103.1 million of the net operating losses generated for federal income tax purposes are not available to reduce income tax expense for financial reporting purposes because the effects of tax deductions for employee stock options in excess of the related financial reporting compensation expense are recognized through equity. A valuation allowance has been established to reflect the uncertainty of generating future taxable income necessary to utilize available tax loss carryforwards.
Years Ended December 31, 2001 and 2002
Revenues
Revenue information by geographic region, in dollars and as a percentage of total revenues, was as follows (dollars in thousands):
Revenue information for countries representing more than 10% of total revenues in either year, in dollars and as a percentage of total revenues, was as follows (dollars in thousands):
*
Country’s information is based on destination of original shipments.
Revenue information for customers representing more than 10% of total revenues, in dollars and as a percentage of total revenues, was as follows (dollars in thousands):
The increase of product revenues in absolute dollars reflects an increase in unit shipments as a result of new product releases, such as Firebox Vclass products in the second quarter of 2002 and Firebox SOHO 6 products in the third quarter of 2002, and improved sales channel performance. Product revenues as a percentage of total revenues decreased for 2002 as compared to 2001 due to a lower growth rate associated with continued slowing of economic conditions, and an increase in service revenues from an increased base of customers renewing their LiveSecurity Service subscriptions.
The increase in service revenues in both absolute dollars and as a percentage of revenues is due to a greater number of installed products in 2002 and an increase in LiveSecurity Service renewals, as a result of growth in our installed customer base.
The provision for sales returns and allowances was $6.9 million, or 9.7% of total revenues before returns and allowances, in 2001 and $4.6 million, or 5.7% of total revenues before returns and allowances, in 2002. The higher provision in 2001 reflects the major product replacement of the Firebox II with the Firebox III undertaken in 2001, in combination with related promotional rebates associated with selling residual Firebox II inventory and the introduction of Firebox III products. The decrease in the provision in 2002 as a percentage of revenues reflects improved trends in actual returns and allowances.
Cost of Revenues and Gross Margin
The decrease in cost of product revenues in both absolute dollars and as a percentage of revenues in 2002 as compared to 2001 is due to the introduction of new products with higher product margins and more favorable pricing obtained from original equipment manufacturers.
The increase in cost of service revenues in absolute dollars reflects a growing number of initial LiveSecurity Service subscriptions and subscription renewals, while the decrease in cost of service revenues as a percentage of revenues reflects the economies of scale achieved in support of larger number of subscriptions.
Operating Expenses
Sales and Marketing
The dollar increase in sales and marketing expenses was primarily due to increases in payroll and related costs from headcount increases associated with the realignment of our sales and marketing organization beginning in the fourth quarter of 2001 and the RapidStream acquisition, and from higher commissions expense associated with increased revenues. These increases were partially offset by a reduction in travel expenditures. Specifically, salaries, commissions, recruiting, consulting and related expenses increased from $12.5 million in 2001 to $16.5 million in 2002. The decrease in sales and marketing expenses as a percentage of revenues reflects the improvements in depth and productivity of our existing channel customers.
Research and Development
The dollar increase in research and development expenses reflects the increased employee-related expenses resulting from the RapidStream acquisition, as well as product integration costs to accelerate the rollout of new products associated with the RapidStream acquisition. Specifically, major components of the increase included:
•
an increase in payroll and related expenses from $11.6 million to $14.6 million, the majority of which is a result of our acquisition of RapidStream; and
•
an increase in security appliance prototype development and consulting costs from $3.0 million to $3.5 million, related to expanded product offerings in 2002 and integration of new RapidStream and Firebox products.
General and Administrative
The dollar increase in general and administrative expenses reflects the expansion of our infrastructure to manage the growth of our operations. The increase was partially offset by the reduction in bad debt expenses. The fluctuations in major components of total general and administrative expenses included:
•
an increase in payroll and consulting and related expenses from $3.8 million to $4.2 million, the majority of which is related to our acquisition of RapidStream;
•
an increase in business insurance from $470,000 to $680,000, primarily reflecting changes in market price for premiums for directors’ and officers’ insurance; and
•
a $930,000 decrease in bad debt expense as a result of tighter credit policies implemented during a period of changing global economic conditions and fewer small direct channel customers.
Stock-Based Compensation
Stock-based compensation expenses allocated by functional operating expense category were as follows (in thousands):
The decrease in stock-based compensation expense for 2002 as compared to 2001 reflects the use of the accelerated amortization method for deferred stock compensation recorded in connection with our October 2000 acquisition of Qiave.
Amortization of Goodwill
Amortization of goodwill related to our acquisitions of BeadleNet and Qiave was $7.3 million in 2001. Amortization of goodwill was discontinued in 2002 due to the adoption on January 1, 2002 of SFAS 142, “Goodwill and Other Intangible Assets,” which provides that goodwill no longer be amortized but instead be periodically reviewed for impairment. During the fourth quarter of 2002, we performed the required annual impairment analysis of goodwill. No impairment of goodwill was identified.
Amortization of Other Intangible Assets Acquired
Amortization of other intangible assets acquired in 2002 consisted of amortization of capitalized technology and other definite-lived intangibles related to our acquisitions of Qiave and RapidStream. The intangible assets associated with our acquisition of BeadleNet in 1999 were fully amortized in 2001. We recorded amortization charges related to these intangible assets of $3.6 million in 2001 and $4.4 million in 2002. The increase in amortization in 2002 as compared to 2001 primarily resulted from the $1.5 million amortization of new intangible assets related to the acquisition of RapidStream in April 2002.
Restructuring Charges
As discussed above, we carried out restructuring plans in both 2001 and 2002. As a result of the adoption of the 2001 restructuring plan, we recorded a $3.7 million restructuring charge in 2001. In 2002, we recorded a $1.4 million charge related to the 2001 restructuring plan and a $6.7 million charge related to the 2002 restructuring plan.
Interest Income and Interest Expense
Interest income decreased from $5.9 million in 2001 to $3.2 million in 2002. This decrease resulted from both a decrease in the average balance of invested funds, primarily due to cash used for the acquisition of RapidStream in April 2002, as well as from a decrease in the average rates of return.
Interest expense primarily represents financing costs incurred due to term discounts taken by our customers. Interest expense increased from $147,000 in 2001 to $288,000 in 2002. The increase in term discounts taken is caused by the increase in revenues generated from our larger channel customers to whom such discounts were available.
Income Taxes
Income tax expense of $157,000 in 2001 and $29,000 in 2002 primarily relates to our provision for foreign income taxes associated with our international operations.
Quarterly Results of Operations
The following tables provide our unaudited results of operations, both in dollar amounts and as a percentage of total revenues, for each quarter in the eight-quarter period ended December 31, 2003. In our opinion, this unaudited information has been prepared on the same basis as our audited consolidated financial statements. This information includes all adjustments, consisting only of normal recurring adjustments, necessary for a fair presentation of the information for the quarters presented when read in conjunction with our consolidated financial statements and the notes to our consolidated financial statements. The results of operations for any quarter are not necessarily indicative of our future results.
(1)
See Notes 1 and 6 to our consolidated financial statements for an explanation of the method used to calculate basic and diluted net loss per share.
Liquidity and Capital Resources
As of December 31, 2003, we had $78.8 million in cash, cash equivalents and short-term investments, which were invested primarily in high-quality money market accounts and marketable securities. We believe that the market risk arising from our holdings of these financial instruments is not material. Our working capital as of December 31, 2003 was $64.0 million.
Operating Activities
Our operating activities resulted in net cash outflows of $7.2 million in 2002 and $7.1 million in 2003. The operating cash outflows during these periods resulted primarily from net losses.
The difference between our net loss and our operating cash outflow is attributable to noncash expenses included in net loss, and changes in the operating assets and liabilities, as presented below (in thousands):
Noncash expenses are associated with the amortization and impairment of other intangible assets acquired, depreciation and amortization of property and equipment, and compensation charges resulting from the issuance of stock options and common stock subject to repurchase by WatchGuard. In 2002, these expenses also included the cost of acquired in-process technology recorded in connection with the acquisition of RapidStream.
Changes in operating assets and liabilities reflect primarily changes in working capital components of the balance sheet apart from cash and short-term investments, and also changes in long-term deferred revenues and long-term acquisition and restructuring liabilities with larger fluctuations within some of them as described below.
Trade Accounts Receivable, Net decreased from $8.8 million at December 31, 2002 to $6.7 million at December 31, 2003, primarily reflecting lower total revenues in the fourth quarter of 2003 as compared to the fourth quarter of 2002. Days sales outstanding, or DSOs, calculated on a quarterly basis, decreased from 36 days at December 31, 2002 to 31 days at December 31, 2003. DSOs are affected by:
•
the payment terms contained in our customer contracts (which may vary geographically);
•
term discounts taken by our customers;
•
revenues on product sales for some of our major distributors that are recorded when these distributors have sold the product to their customers;
•
risks associated with the uncertain economy; and
•
whether revenues in a particular quarter are linear (that is, whether revenues are evenly distributed throughout the quarter or weighted more toward the end of the quarter).
Based on our current sales mix, the linearity of revenues in past and future quarters and timing differences arising from the varying payment terms in our customer agreements, we expect our DSOs to generally range from 40 to 50 days in the future. Any change in these factors, however, could negatively affect expected DSO results.
Net Inventories decreased from $4.4 million at December 31, 2002 to $3.1 million at December 31, 2003. The decrease in inventories is primarily due to the reduction in volume of inventory on hand for older products in anticipation of the introduction of our new Firebox X product line in February 2004. The decrease in inventory is also due to reducing the cost of certain components, including our RapidStream “Secured by Check Point” brand products, to net realizable value based on our sales projections combined with our product life cycle planning process and expectations of new product releases in the latter part of 2004.
Total Accrued Restructuring and Acquisition Costs decreased from $9.0 million at December 31, 2002 to $6.5 million at December 31, 2003, due to settlements of an abandoned lease and a technology-related contract, as well as to the ongoing payment of rents on excess facilities. The reduction of accrued restructuring costs was partially offset by an additional $1 million charge, due to increased estimates of future costs of abandoned facilities.
Total Deferred Revenues decreased from $18.5 million at December 31, 2002 to $16.7 million at December 31, 2003. The decrease of deferred revenue balance is related to the following factors:
•
changes in terms of our initial LiveSecurity Service subscriptions, bundled with a product sale, due to our including a shorter initial subscription period for certain products beginning in mid-2002;
•
a reduction of LiveSecurity Service subscription prices corresponding to lower prices on related hardware products in response to a competitive environment; and
•
a shift in product mix toward lower-priced models of the Firebox III product line, resulting in the corresponding shift in mix in LiveSecurity Service subscription revenues.
Investing Activities
Cash provided by investing activities was $352,000 in 2002 and $416,000 in 2003. In 2003, these activities primarily related to short-term investment of the proceeds received from our public offerings, offset by capital expenditures for property and equipment. In 2002, the investing activities also included the net cash consideration paid in connection with the acquisition of RapidStream.
Financing Activities
Cash provided by financing activities totaled $1.8 million in 2002 and $1.7 million in 2003. Cash provided by financing activities in both periods reflects the exercise of employee stock options and the purchase of common stock through our employee stock purchase plan.
We believe that our existing available cash, cash equivalents and investments will be sufficient to meet our operating expenses, working capital needs and capital expenditure requirements for at least the next 12 months. We may seek additional funding before that time through public or private financings or other arrangements, however, if the underlying assumed levels of spending prove to be inaccurate, or if we choose to pursue acquisitions or investments in complementary business technology.
Contractual Obligations and Contingencies
We lease office space and some computer equipment under operating leases that are not cancelable. Our facilities commitments include a lease for our corporate headquarters in Seattle, Washington, which expires in September 2010. We have the option to extend this lease for an additional five-year term. We also lease a product fulfillment and distribution warehouse in Seattle with a lease term through April 2006. We lease facilities in Aliso Viejo, San Jose and Tustin, California and Waltham, Massachusetts under operating leases that expire between 2004 and 2007, in addition to leases for other sales offices under operating leases or other lease obligations that expire over various terms. Our excess facilities at our corporate headquarters in Seattle, and in Aliso Viejo and San Jose, California, are partially subleased to tenants, with sublease terms that expire between 2004 and 2010. We also have several operating leases for computer equipment. WatchGuard is also a party to several noncancelable and nonrefundable agreements to purchase inventory.
Our contractual commitments at December 31, 2003 associated with lease obligations and purchase obligations, net of future minimum rental income from subleases of $1.9 million, are presented below (in thousands). This future rental income from subleases may be adversely affected if the financial condition of our tenants were to deteriorate, resulting in an impairment of their ability to make lease payments.
ITEM 7A.
ITEM 7A. QUANTITATIVE AND QUALITATIVE DISCLOSURES ABOUT MARKET RISK
Interest Rate Risk. We do not hold derivative financial instruments or derivative equity securities in our investment portfolio. Our cash equivalents and short-term investments consist of high-quality securities, as specified in our investment policy guidelines. Our policy limits the amount of credit exposure to any one issue or issuer to a maximum of 20% of the total portfolio or $5 million per issuer at the time of purchase, with the exception of U.S. treasury and agency securities and money market funds, which are exempt from this size limitation. Our policy limits all investments to those that mature in two years or less, with the average maturity of our investments equal to one year or less. The securities are subject to interest-rate risk and will decrease in value if interest rates increase. The fair value of our investment portfolio or related income would not be significantly affected by either a 100 basis point increase or decrease in interest rates, due primarily to the short-term nature of the major portion of our investment portfolio, which is summarized in Note 4 to our consolidated financial statements.
Foreign Currency Risk. All of our sales and the majority of our expenses are currently denominated in U.S. dollars. As a result, we have not experienced significant foreign exchange gains and losses. While we incurred some expenses in foreign currencies during 2002 and 2003 and expect to continue to do so in the future, we do not anticipate that foreign exchange gains or losses will be material to us. Although we have not engaged in foreign currency hedging to date, we may do so in the future. In addition, we may be required to denominate our sales in foreign currencies at some point in the future to remain competitive.
ITEM 8.
ITEM 8.
FINANCIAL STATEMENTS AND SUPPLEMENTARY DATA
REPORT OF ERNST & YOUNG LLP, INDEPENDENT AUDITORS
Board of Directors and Stockholders
WatchGuard Technologies, Inc.
We have audited the accompanying consolidated balance sheets of WatchGuard Technologies, Inc. as of December 31, 2002 and 2003 and the related consolidated statements of operations, stockholders’ equity, and cash flows for each of the three years in the period ended December 31, 2003. Our audits also included the financial statement schedule listed in the Index at Item 15(a)(2). These financial statements and schedule are the responsibility of WatchGuard’s management. Our responsibility is to express an opinion on these financial statements and schedule based on our audits.
We conducted our audits in accordance with auditing standards generally accepted in the United States. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement. An audit includes examining, on a test basis, evidence supporting the amounts and disclosures in the financial statements. An audit also includes assessing the accounting principles used and significant estimates made by management, as well as evaluating the overall financial statement presentation. We believe that our audits provide a reasonable basis for our opinion.
In our opinion, the financial statements referred to above present fairly, in all material respects, the consolidated financial position of WatchGuard Technologies, Inc. at December 31, 2002 and 2003, and the consolidated results of its operations and its cash flows for each of the three years in the period ended December 31, 2003, in conformity with accounting principles generally accepted in the United States. Also, in our opinion, the related financial statement schedule, when considered in relation to the basic financial statements taken as a whole, presents fairly in all material respects the information set forth therein.
As discussed in Note 2 to the consolidated financial statements, the Company changed its method of accounting for goodwill and other intangible assets as a result of adopting the provisions of the Statement of Financial Accounting Standards No. 142, “Goodwill and Other Intangible Assets,” effective January 1, 2002.
ERNST & YOUNG LLP
Seattle, Washington
January 23, 2004
WATCHGUARD TECHNOLOGIES, INC.
CONSOLIDATED BALANCE SHEETS
(In thousands, except share and per share data)
See accompanying notes.
WATCHGUARD TECHNOLOGIES, INC.
CONSOLIDATED STATEMENTS OF OPERATIONS
(In thousands, except per share data)
(2)
See Notes 1 and 6 to our consolidated financial statements for an explanation of the method used to calculate basic and diluted net loss per share.
See accompanying notes.
WATCHGUARD TECHNOLOGIES, INC.
CONSOLIDATED STATEMENTS OF STOCKHOLDERS’ EQUITY
(In thousands, except share data)
See accompanying notes.
WATCHGUARD TECHNOLOGIES, INC.
CONSOLIDATED STATEMENTS OF CASH FLOWS
(In thousands)
See accompanying notes.
WATCHGUARD TECHNOLOGIES, INC.
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS
1. Accounting Policies
Description of Business
WatchGuard Technologies, Inc. (WatchGuard) is a leading provider of Internet security solutions designed to protect enterprises that use the Internet for electronic commerce and secure communications.
Revenue Recognition
WatchGuard generates revenues through sales of its Firebox products, including licenses for related software options, subscriptions for its LiveSecurity Service, which includes access to technical support, software updates (if and when available), early-warning vulnerability alerts and expert instruction and training, and sales of ServerLock products. Software license revenues are generated from licensing the rights to use WatchGuard’s products directly to end-users, from sublicense fees from resellers and distributors and from sales of its managed security solution products to Internet service providers and other service providers that utilize WatchGuard’s products to provide managed security services to their customers.
WatchGuard recognizes revenue in accordance with accounting standards for software companies, including Statement of Position (SOP) 97-2, “Software Revenue Recognition,” as amended by SOP 98-9, and related interpretations, including Technical Practice Aids and the United States Securities and Exchange Commission (SEC) Topic 13 “Revenue Recognition” of the codification of the Staff Accounting Bulletins. Topic 13 summarizes certain of the SEC’s views in applying generally accepted accounting principles to revenue recognition in financial statements. WatchGuard believes its current revenue recognition policies and practices are consistent with the current accounting standards.
Revenues from software license agreements are generally recognized upon delivery of software if persuasive evidence of an arrangement exists, collection is probable, the fee is fixed or determinable, and vendor-specific objective evidence of fair value for undelivered elements of the arrangement has been established. Vendor-specific objective evidence of fair value is typically based on the price charged when an element is sold separately or, if an element is not sold separately, on the price established by authorized management, if it is probable that the price, once established, will not change before market introduction. WatchGuard uses the residual method, as defined in SOP 98-9, to allocate revenues to delivered elements once it has established vendor-specific objective evidence of fair value for all undelivered elements. Under the residual method, any discount in the arrangement is allocated to the delivered element.
WatchGuard provides allowances for estimated returns and return rights and pricing protection rights, which are offered to most customers. WatchGuard also provides allowances for promotional rebates offered to its customers. A customer’s return rights are generally limited to the lesser of its on-hand inventory or a percentage of the customer’s purchases for the previous quarter. Pricing protection rights, offered to many of WatchGuard’s customers, are generally limited to 60 to 90 days after notification of a price change. Revenues are reduced by the provision for estimated returns and allowances at the time the sales are made.
The promotional rebates vary by type and term and are earned by customers in accordance with various conditions. WatchGuard accounts for promotional rebates given to customers in accordance with the Emerging Issues Task Force (EITF) Issue No. 01-09, “Accounting for Consideration Given by a Vendor to a Customer or a Reseller of the Vendor’s Product,” which requires that sales incentives given to customers or resellers be accounted for as a reduction of revenue unless a vendor receives a benefit that is identifiable and can be reasonably estimated. WatchGuard accrues allowances for rebates to the maximum amount possible unless there are sufficient historical trends which would indicate a lower rate of accrual is appropriate.
WATCHGUARD TECHNOLOGIES, INC.
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS-(Continued)
Revenues from some distribution arrangements where the distributor has unlimited stock returns and rotation rights are not recognized until the distributors sell the products to their customers. Revenues from LiveSecurity Service subscriptions are recognized ratably over the term of the subscription, typically 90 days to two years. WatchGuard’s payment terms typically range from 30 to 60 days.
Principles of Consolidation
The consolidated financial statements include the accounts of WatchGuard and its wholly owned subsidiaries. All significant intercompany accounts and transactions are eliminated in consolidation.
Fair Values of Financial Instruments
At December 31, 2003, WatchGuard had the following financial instruments: cash and cash equivalents, short-term investments, accounts receivable, restricted cash, accounts payable and accrued expenses. Carrying amounts of those financial instruments approximate their fair value due to their liquidity or short-term duration.
Cash Equivalents
WatchGuard considers all highly liquid investments purchased with maturities of three months or less at the date of purchase to be cash equivalents. Cash equivalents are carried at fair market value. Cash equivalents consist of money market funds.
Short-Term Investments
WatchGuard’s investments consist of commercial paper and corporate and government debt securities, are considered available for sale, and are stated at fair value with unrealized gains and losses included as a component of stockholders’ equity. The amortized cost of investments is adjusted for amortization of premiums and accretion of discounts to maturity. The amortizations and accretions are included in interest income. Realized gains and losses, declines in value of securities judged to be other than temporary, and interest and all dividends earned on securities are also included in interest income. The cost of securities sold is calculated using the specific identification method. WatchGuard’s investment guidelines state that the maximum life of any one security shall be two years, with the maximum weighted average life of the investment portfolio being one year.
Inventories
Inventories are stated at the lower of cost or market, with cost being determined on a first-in, first-out basis. WatchGuard’s inventory costs include the freight and handling costs incurred to transport goods from WatchGuard’s suppliers. WatchGuard receives some of its components from single-source suppliers and relies on a limited number of hardware manufacturers. Inventories sold to distributors who have unlimited return rights are included in finished goods. In assessing the ultimate realization of inventories, WatchGuard is required to make judgments as to future demand requirements and compare these with the current or committed inventory levels. WatchGuard writes down its inventory for estimated obsolescence or unmarketable inventory. The allowance requirements fluctuate due to market conditions, customer preferences and technological and product life-cycle changes.
Property and Equipment
Property and equipment is stated at cost, less accumulated depreciation and amortization. Equipment and furniture is depreciated using the straight-line method over estimated useful lives ranging from three to five years. Leasehold improvements are amortized over the shorter of the lease term or the estimated useful life.
WATCHGUARD TECHNOLOGIES, INC.
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS-(Continued)
Goodwill
Beginning on January 1, 2002, with the adoption of Statement of Financial Accounting Standards (SFAS) 142, “Goodwill and Other Intangible Assets,” goodwill and other indefinite lived intangibles are no longer amortized, but instead tested for impairment on an annual basis or on an interim basis if indications of impairment are present. Prior to 2002, goodwill related to acquisitions was amortized on a straight-line basis over the period of expected benefit of three to five years.
Intangible Assets with Definite Lives and Other Long-Lived Assets
Intangible assets with definite lives, consisting primarily of technology received in connection with acquisitions, are amortized over their estimated useful lives ranging from three to five years. In accordance with SFAS 144, “Accounting for the Impairment or Disposal of Long-Lived Assets,” the carrying value of intangible assets with definite lives and other long-lived assets is reviewed on a regular basis for the existence of facts that may indicate that the assets are impaired. Such an asset is considered impaired when its estimated future cash flows are less than the amount of its carrying value. If the carrying value of this asset is deemed not recoverable, it is adjusted downwards to the asset’s estimated fair value.
Research and Development
Research and development costs consist primarily of software development costs. SFAS 86, “Accounting for the Costs of Computer Software to Be Sold, Leased, or Otherwise Marketed,” requires the capitalization of certain software development costs after technological feasibility of the software is established. In the development of WatchGuard’s new products and enhancements to existing products, the technological feasibility of the software is not established until substantially all product development is complete, including the development of a working model. Costs incurred after technological feasibility is established are not material, and, accordingly, WatchGuard expenses all research and development costs when incurred.
Internal-Use Software
WatchGuard recognizes costs of software developed or purchased for internal-use in accordance with SOP 98-1, “Accounting for Costs of Computer Software Developed or Obtained for Internal Use.” Under SOP 98-1, WatchGuard expenses all costs incurred that relate to planning and post-implementation phases of development. Costs incurred in the development and implementation phases are capitalized and amortized over the estimated useful life of the software. In 2002 and 2003, WatchGuard capitalized the development costs of $169,000 and $567,000 for internal-use software, respectively. Because costs incurred during the development stage were insignificant, no costs related to internal-use software were capitalized in 2001.
Advertising Costs
WatchGuard expenses advertising costs as incurred. Total advertising expenses were $885,000, $1.2 million and $1.2 million in 2001, 2002 and 2003, respectively.
Concentrations of Risk
WatchGuard is subject to concentrations of credit risk primarily from cash, short-term investments and accounts receivable. WatchGuard manages its credit risk by investing its excess cash in a diverse portfolio of high-quality money market instruments and short-term investments.
WATCHGUARD TECHNOLOGIES, INC.
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS-(Continued)
In addition, substantially all of WatchGuard’s accounts receivable are due from WatchGuard’s resellers, distributors and service providers located throughout the world. Revenue information by geographic region is as follows (dollars in thousands):
Revenue information for countries representing more than 10% of total revenues is as follows (dollars in thousands):
*
Less than 10%
Revenue information for customers representing more than 10% of total revenues, in dollars and as a percentage of total revenues, was as follows (dollars in thousands):
WatchGuard does not require collateral or other security to support credit sales, but provides an allowance for bad debts based on historical experience and specifically identified risks.
WatchGuard currently outsources its manufacturing to a limited number of third-party contract manufacturers, and some of the key components and licensed technologies incorporated in WatchGuard’s products come from single or limited sources of supply. The inability of any supplier or manufacturer to fulfill supply requirements could negatively impact future operating results.
Stock-Based Compensation
WatchGuard has elected to apply the disclosure-only provisions of SFAS 123, “Accounting for Stock-Based Compensation,” as amended by SFAS 148, “Accounting for Stock-Based Compensation - Transition and Disclosure.” Accordingly, WatchGuard accounts for stock-based compensation using the intrinsic value method prescribed in Accounting Principle Board (APB) Opinion No. 25, “Accounting for Stock Issued to Employees,” and related interpretations. Compensation cost for stock options is measured as the excess, if any, of the fair value of WatchGuard’s common stock at the date of grant over the stock option exercise price.
Stock compensation expense for options or warrants granted to non-employees has been determined in accordance with EITF Issue No. 96-18, “Accounting for Equity Instruments That Are Issued to Other Than
WATCHGUARD TECHNOLOGIES, INC.
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS-(Continued)
Employees for Acquiring, or in Conjunction with Selling, Goods or Services,” and is based on the fair value of the equity instruments issued. The fair value of options granted to non-employees is periodically measured as the underlying options vest.
Pro Forma Disclosures Under SFAS 123
The following pro forma information regarding stock-based compensation has been determined as if WatchGuard had accounted for its employee stock options and its employee stock purchase plan shares under the fair market value method of SFAS 123. The fair value of the employee stock options was estimated at the date of grant, using a minimum value option pricing model through the date of WatchGuard’s initial public offering in July 1999 and using the Black-Scholes pricing model thereafter.
The fair value of each option granted was estimated at the date of grant, with the following weighted average assumptions as follows:
The weighted average fair values of stock options granted during 2001, 2002 and 2003 were as follows:
For purposes of pro forma disclosures, the estimated fair value of the options is amortized over their vesting periods using the accelerated method.
Pro forma disclosures are not representative of future results. WatchGuard’s pro forma information is as follows (in thousands, except per share data):
WATCHGUARD TECHNOLOGIES, INC.
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS-(Continued)
Income Taxes
WatchGuard recognizes deferred tax assets and liabilities based on differences between the financial reporting and tax bases of assets and liabilities using the enacted tax rates and laws that are expected to be in effect when the differences are expected to be recovered. WatchGuard provides a valuation allowance for deferred tax assets that cannot be currently recognized due to WatchGuard’s cumulative losses and the uncertainty of future recoverability.
Comprehensive Income (Loss)
WatchGuard complies with SFAS 130, “Reporting Comprehensive Income,” which establishes standards for reporting and displaying comprehensive income and its components (revenues, expenses, gains and losses) in a full set of general-purpose financial statements. WatchGuard’s comprehensive loss includes net loss and the effect of unrealized gains or losses on securities available for sale. Comprehensive loss is shown on the consolidated statement of stockholders’ equity.
Net Loss Per Share
Basic and diluted net loss per share is calculated using the average number of shares of common stock outstanding. Other common stock equivalents, including stock options, are excluded from the computation of diluted loss per share because their effect is antidilutive.
Use of Estimates
The preparation of financial statements in conformity with generally accepted accounting principles requires management to make estimates and assumptions that affect the amounts reported in the consolidated financial statements and accompanying notes. Actual results could differ from those estimates. Significant estimates used in preparing the financial statements relate to (i) revenue recognition, including sales returns and allowances, (ii) provision for bad debt, (iii) inventory reserves, (iv) restructuring reserves relating to abandoned facilities, (v) the allocation of the purchase price in business combinations to intangible assets and (vi) fair values and impairment analysis of goodwill and intangible assets with definite lives.
Segment Information
SFAS 131, “Disclosures About Segments of an Enterprise and Related Information,” establishes standards for reporting information about operating segments in annual financial statements. WatchGuard operates in a single business segment related to Internet and computer security and provides hardware, software and services as a complete security solution. While certain expenses for sales and marketing activities are incurred in various geographical regions, substantially all of WatchGuard’s assets are located, and the majority of its operating expenses are incurred, at its corporate headquarters.
Reclassifications
Certain prior-year items have been reclassified to conform to the current-year presentation. As of December 31, 2003, deferred revenues and accrued restructuring and acquisition costs with a settlement period over one year are presented separately from the short-term portion of those costs as a component of long-term liabilities. As of December 31, 2003, cash under a collateral restriction included in WatchGuard’s operating lease arrangement is presented separately as a component of long-term assets.
WATCHGUARD TECHNOLOGIES, INC.
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS-(Continued)
Recent Accounting Pronouncements
In December 2003, the SEC issued Staff Accounting Bulletin (SAB) No. 104, “Revenue Recognition” (SAB No. 104), which codifies, revises and rescinds certain sections of SAB No. 101, “Revenue Recognition”, in order to make this interpretive guidance consistent with current authoritative accounting and auditing guidance and SEC rules and regulations. SAB 104’s primary purpose is to rescind accounting guidance contained in SAB 101 related to multiple element revenue arrangements, superseded as a result of the issuance of EITF 00-21 Additionally, SAB 104 rescinds the SEC’s Revenue Recognition in Financial Statements Frequently Asked Questions and Answers (the FAQ) issued with SAB 101 that had been codified in SEC Topic 13, Revenue Recognition. Selected portions of the FAQ have been incorporated into SAB 104. While the wording of SAB 104 has changed to reflect the issuance of EITF 00-21, the revenue recognition principles of SAB 101 remain largely unchanged by the issuance of SAB 104. Adoption of this standard had no material impact on the company’s financial position, results of operations or cash flows.
2. Accounting for Goodwill and Intangibles with Definite Lives
In July 2001, the Financial Accounting Standards Board (FASB) issued SFAS 141, “Business Combinations,” and SFAS 142, “Goodwill and Other Intangible Assets.” SFAS 141 requires business combinations completed after June 30, 2001 to be accounted for using the purchase method of accounting, and broadens the criteria for recording intangible assets separate from goodwill.
SFAS 142 requires that goodwill and other indefinite lived intangibles no longer be amortized to earnings, but instead be tested for impairment at least annually and written down and charged to results of operations only in periods in which the recorded value of those assets exceeds their fair value. SFAS 142 prescribes the use of the two-phase approach for testing goodwill for impairment. The first phase is a screen for potential impairment, while the second phase (if necessary) measures the amount of impairment, if any. Current technology and other separable intangible assets that do not have indefinite lives are continued to be amortized over their useful lives.
WatchGuard adopted SFAS 141 and SFAS 142 on January 1, 2002. WatchGuard performed its annual impairment tests for goodwill using an October 1, 2002 and October 1, 2003 measurement dates. No impairment of goodwill was recognized during 2002 or 2003.
The following table summarizes the effect SFAS 142 would have had on net loss and basic and diluted net loss per share, had the statement been applied retroactively for all years presented (in thousands, except per share data):
WATCHGUARD TECHNOLOGIES, INC.
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS-(Continued)
In August 2001, the FASB issued SFAS 144, “Accounting for the Impairment or Disposal of Long- Lived Assets,” which was effective January 1, 2002. SFAS 144 supercedes SFAS 121, “Accounting for the Impairment of Long-Lived Assets to be Disposed Of,” and the accounting and reporting provisions relating to the disposal of a segment of a business in APB Opinion No. 30. In accordance with SFAS 144, the carrying value of intangible assets and other long-lived assets is reviewed on a regular basis for the existence of facts or circumstances, both internal and external, that may suggest impairment.
During the fourth quarter of 2002, WatchGuard developed a business plan that, because of limited resources, de-emphasized further development and integration of the technology acquired from Qiave in 2000. Separately, WatchGuard continued to realize lower than expected revenue from products based on Qiave technology. In accordance with SFAS 144, the undiscounted expected future cash flows were determined to be insufficient to support the carrying value of the Qiave capitalized technology. WatchGuard, therefore, recorded an impairment charge of $6.7 million of capitalized technology related to the acquisition of Qiave. The remaining net balance of Qiave technology of $186,000, after the above-mentioned impairment charge, was fully amortized during 2003.
During the third quarter of 2003, it was determined that an impairment existed for the intangible asset associated with the RapidStream “Secured by Check Point” product brand based on the technology obtained in the 2002 acquisition of RapidStream. WatchGuard’s increased focus on its core market of small- to medium-sized enterprises, resulting in a significant reduction in WatchGuard’s sales, marketing and development efforts in support of this brand, together with the historically poor performance of the RapidStream “Secured by Check Point” brand, led management to reduce future sales projections for the brand. The revised undiscounted expected future cash flows resulting from the reduced future sales projections were determined to be insufficient to recover the carrying value of the related capitalized technology. WatchGuard therefore recorded an impairment charge of $3.3 million during the quarter ended September 30, 2003, based on the difference between the carrying value of the intangible assets and its estimated fair value using a discounted cash flow approach. In the fourth quarter of 2003, WatchGuard made a decision to exit the market segment served by this product; therefore, an additional impairment charge of $230,000 was recorded during the quarter ended December 31, 2003 for the remaining net book value of this intangible asset.
The following table summarizes other intangibles, net, and other assets as of December 31, 2002 and December 31, 2003 (in thousands):
Current technology will be amortized over its remaining useful lives through 2007. The remaining amortization is expected to be $974,000 for each of the three years between 2004 and 2006 and $243,000 for 2007.
WATCHGUARD TECHNOLOGIES, INC.
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS-(Continued)
3. Balance Sheet Account Detail
Trade Accounts Receivable, Net
Trade accounts receivable, net consisted of the following (in thousands):
Inventories, Net
Inventories, net consisted of the following (in thousands):
Property and Equipment, Net
Property and equipment, net consisted of the following (in thousands):
Accrued Expenses and Other Liabilities
Accrued expenses consisted of the following (in thousands):
WATCHGUARD TECHNOLOGIES, INC.
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS-(Continued)
4. Short-Term Investments
Short-term investments consisted of the following (in thousands):
The contractual maturities, all of which are classified as current, of WatchGuard’s available-for-sale securities as of December 31, 2003 are as follows (in thousands):
Realized net gains on sales of short-term investments, which were included in interest income, were $352,000 in 2001, $443,000 in 2002 and $2,000 in 2003.
5. Stockholders’ Equity
Stock Options
WatchGuard’s 1996 Stock Incentive Compensation Plan (the 1996 Plan) provides for the grant of incentive and nonqualified stock options to employees, officers, directors, agents, consultants and independent contractors. At December 31, 2003, WatchGuard had reserved 11,108,766 shares of common stock for grant under the 1996 Plan. The number of shares reserved for issuance of stock options under the 1996 Plan is automatically increased on the first day of each fiscal year by the least of (a) 750,000 shares, (b) 3% of the average number of common shares outstanding used to calculate fully diluted earnings per share as reported in WatchGuard’s annual financial statements for the preceding year and (c) an amount determined by the board of directors.
WatchGuard’s 2000 Stock Option Plan (the 2000 Plan) provides for the granting of nonqualified stock options to employees, agents, consultants, advisors and independent contractors. As of December 31, 2003, WatchGuard had reserved 8,000,000 shares of common stock for grant under the 2000 Plan.
Options under both the 1996 Plan and the 2000 Plan generally are granted at fair market value on the date of grant. The shares of common stock covered by options granted on the date of hire generally vest at the rate of 25% on the first anniversary of the date of grant, and an additional 2.08% every month thereafter, with all shares becoming fully vested on the fourth anniversary date of the date of grant. Options granted other than on the date of hire generally vest at the rate of 2.08% every month, commencing one month from the date of grant. Stock options granted under both the 1996 Plan and the 2000 Plan have a term of ten years.
WATCHGUARD TECHNOLOGIES, INC.
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS-(Continued)
In April 2002, WatchGuard acquired RapidStream, Inc. Under the terms and conditions of the acquisition, the RapidStream, Inc. 1998 Stock Option Plan (the RapidStream Plan) was assumed by WatchGuard and all options to purchase shares of RapidStream common stock at the effective time of the acquisition converted into options to purchase an aggregate of 318,251 shares of WatchGuard common stock (see Note 12) granted under the RapidStream Plan. At the time of acquisition, WatchGuard had reserved 645,896 shares of common stock for grant under the RapidStream Plan.
The following table summarizes WatchGuard’s stock option activity for all of its stock option plans during 2001, 2002 and 2003:
The weighted average remaining contractual life and weighted average exercise price of options outstanding and options exercisable at December 31, 2003 under all of WatchGuard’s stock option plans for selected exercise price ranges is as follows:
Deferred Stock-Based Compensation
WatchGuard uses the intrinsic value-based method to account for all of its employee stock-based compensation arrangements. Therefore, compensation costs are not recognized in WatchGuard’s consolidated financial statements, unless the underlying fair value of WatchGuard’s common stock exceeds the exercise price of the stock options at the date of grant.
WATCHGUARD TECHNOLOGIES, INC.
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS-(Continued)
In 2001, WatchGuard recorded $213,000 of deferred stock-based compensation related to 20,000 option shares granted to one consultant and 12,000 option shares granted to other consultants. Final measurement of the fair value of the 20,000 option shares occurred in 2002 and final measurement of the 12,000 options shares will occur when the options fully vest in 2005. Also, in 2001, WatchGuard recognized deferred stock-based compensation of $161,000 when it accelerated vesting provisions of an employee’s stock option on his termination of employment in connection with the April 2001 restructuring.
In 2002, WatchGuard recorded $558,000 of deferred stock-based compensation in connection with the acquisition of RapidStream (see Note 12), $419,000 of which related to WatchGuard’s assumption of unvested options to purchase RapidStream common stock and $139,000 of which related to the issuance of WatchGuard common stock to twelve RapidStream employees, subject to a repurchase restriction, released over a 28-month period beginning on the purchase date. Also in 2002, WatchGuard recorded $24,000 of deferred stock-based compensation related to 6,000 option shares granted to consultants in 2002. In addition, WatchGuard decreased by $25,000 deferred stock-based compensation previously recorded for 2001 stock option grants to consultants, due to the remeasurement of the originally estimated fair value of these grants. Final measurement of the fair value of options granted to consultants in 2002 will not occur until the options are fully vested in 2006.
In 2001 and in 2002, WatchGuard also recorded adjustments of $1.4 million and $211,000 to reduce previously recorded deferred stock-based compensation for the unvested portion of options upon termination of employees prior to vesting.
In 2003, WatchGuard recorded $16,000 of deferred stock-based compensation due to modification of terms on the previously issued options and decreased deferred compensation by $1,000 due to re-measurement of estimated fair value of options issued to consultants in 2001 and 2002.
Amounts recorded as deferred stock-based compensation related to stock options are generally being amortized over the vesting period of the individual award (generally three to four years), using the accelerated method, consistent with FASB Interpretation No. 28. Amortization of deferred stock-based compensation related to shares subject to repurchase is generally recognized over the term of the related employment agreements. Stock based compensation expense was $9.4 million, $1.5 million and $244,000 in 2001, 2002 and 2003, respectively. The stock-based compensation expense in 2001 excluded $579,000 of deferred stock-based compensation amortization, which was included in the restructuring charge, for the acceleration of options and restricted share vesting for employees terminated in connection with restructuring. In 2001, 2002 and 2003, stock-based compensation expense included $166,000, $10,000 and $31,000 for amortization of deferred stock option expense on options issued to consultants.
Stock Option Exchange Program
On August 1, 2001, WatchGuard cancelled options to purchase 2,106,347 shares of WatchGuard common stock with exercise prices ranging from $14.47 to $100.19 per share. In exchange for these options, in February 2002, WatchGuard granted options to purchase 1,833,303 shares of WatchGuard common stock with exercise prices equal to $6.1255 per share, the then fair market value of the underlying common stock. Each replacement option vested and was exercisable substantially to the same degree as the original option.
1999 Employee Stock Purchase Plan
The 1999 Employee Stock Purchase Plan (the ESPP) permits eligible employees of WatchGuard to purchase common stock through payroll deductions of up to 15% of their compensation. The price of the common stock
WATCHGUARD TECHNOLOGIES, INC.
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS-(Continued)
purchased under the ESPP will be the lesser of 85% of the fair market value on the first day of an offering period and 85% of the fair market value on the last day of an offering period. WatchGuard authorized the issuance under the ESPP of a total of 600,000 shares of common stock, plus an automatic annual increase to be added on the first day of each fiscal year equal to the least of (a) 400,000 shares, (b) 1.5% of the average number of common shares outstanding used to calculate fully diluted earnings per share as reported in WatchGuard’s annual financial statements for the preceding year and (c) an amount determined by the board of directors.
A total of 113,622, 167,701 and 184,410 shares of common stock were purchased by WatchGuard employees under the ESPP during 2001, 2002 and 2003, respectively. At December 31, 2003, WatchGuard had a total of 1,336,226 shares of common stock reserved for future issuance under the ESPP.
Common Shares Reserved
At December 31, 2003, common stock reserved for future issuance was as follows:
6. Net Loss per Share
Basic and diluted net loss per common share is calculated by dividing net loss by the weighted average number of common shares outstanding. Options to purchase 4,999,942 shares, 7,754,251 shares and 6,611,756 shares of common stock at December 31, 2001, 2002 and 2003 respectively, and 74,186 shares, 8,821 shares and 277 shares of common stock subject to repurchase at December 31, 2001, 2002 and 2003, respectively, were excluded from the computation of diluted net loss per common share, as their effect is antidilutive.
7. Income Taxes
At December 31, 2003, WatchGuard had a net operating loss carryforward for federal tax purposes of approximately $194.9 million and research and development tax credit carryforwards of $4.0 million. These carryforwards begin to expire after the 2011 tax year. Utilization of net operating loss carryforwards may be subject to certain limitations under Section 382 of the Internal Revenue Code. Additionally, approximately $103.1 million of the net operating losses generated for federal income tax purposes are not available to reduce income tax expense for financial reporting purposes because the tax effects of tax deductions for employee stock options in excess of the related financial reporting compensation expense are recognized through equity. A valuation allowance has been established to reflect the uncertainty of generating future taxable income necessary to utilize available tax loss carryforwards.
WATCHGUARD TECHNOLOGIES, INC.
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS-(Continued)
WatchGuard provides for deferred taxes based on the difference between the basis of assets and liabilities for financial reporting purposes and the basis for income tax purposes, calculated using enacted rates that will be in effect when the differences are expected to reverse. Significant components of WatchGuard’s deferred tax assets and liabilities are as follows (in thousands):
WatchGuard’s valuation allowance increased by $9.6 million in 2001, by $14.3 million in 2002 and by $6.5 million in 2003. Included in the amounts for 2001 and 2002 are increases in valuation allowance associated with the acquisitions of Qiave and RapidStream of $2.5 million and $6.6 million, respectively.
The reconciliation of the income tax provision (benefit) calculated using the federal statutory rates to the recorded income tax provision are as follows (dollars in thousands):
8. 401(k) Retirement Plan
WatchGuard sponsors a 401(k) plan that is available to all employees who satisfy certain eligibility requirements relating to minimum age, length of service and hours worked. Eligible employees may elect to contribute up to 15% of their pre-tax gross earnings, subject to statutory limitations regarding maximum contributions. WatchGuard may also make a discretionary contribution to the plan. No such contributions have been made by WatchGuard.
WATCHGUARD TECHNOLOGIES, INC.
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS-(Continued)
9. Commitments
WatchGuard leases office space and some computer equipment under noncancelable operating leases. Facilities commitments include a 10-year lease for its corporate headquarters in Seattle, Washington, which expires in September 2010. WatchGuard has the option to extend this lease for an additional five-year term.
WatchGuard’s operating lease arrangement for its corporate headquarters includes a collateral restriction that requires WatchGuard to maintain an irrevocable standby letter of credit issued to WatchGuard’s landlord and secured by restricted cash. At December 31, 2002 and 2003, WatchGuard’s restricted cash balance was $3 million in conjunction with this facilities lease.
WatchGuard also leases a product fulfillment and distribution warehouse in Seattle, with the lease term through April 2006. WatchGuard also leases facilities in Aliso Viejo and San Jose, California and Waltham, Massachusetts under operating leases that expire in years between 2004 and 2007, in addition to leases for other sales offices under operating leases or other lease obligations that expire over various terms. WatchGuard’s excess facilities at corporate headquarters in Seattle, Waltham, Massachusetts and in Aliso Viejo and San Jose, California are partially subleased to tenants, with sublease terms that expire between 2004 and 2010. Future minimum payments at December 31, 2003 under leases for office space and computer equipment, net of future minimum rental income from sublease of $1.9 million, are as follows (in thousands):
Rent expense for 2001, 2002 and 2003 was $2.8 million, $3.2 million and $3.6 million, respectively.
In addition to the foregoing lease commitments, WatchGuard is a party to several noncancelable and non-refundable agreements to purchase inventory in 2004. The total of these commitments was $1.5 million at December 31, 2003.
10. Guarantees
In November 2002, the FASB issued FIN 45, “Guarantor’s Accounting and Disclosure Requirements for Guarantees, Including Indirect Guarantees of Indebtedness of Others.” FIN 45 requires a company that is a guarantor to make specific disclosures about its obligations under certain guarantees that it has issued. FIN 45 also requires a company to recognize, at the inception of a guarantee, a liability for the fair value of the obligations it has undertaken in issuing certain other types of guarantees.
As discussed in Note 9, WatchGuard’s operating lease for its corporate headquarters includes a collateral restriction that requires WatchGuard to maintain a standby letter of credit secured by restricted cash.
WATCHGUARD TECHNOLOGIES, INC.
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS-(Continued)
WatchGuard’s hardware products carry a one-year warranty from the delivery date that includes factory repair services or replacement products as needed. WatchGuard accrues estimated expenses for warranty obligations at the time that products are shipped based on historical product repair and replacement information. WatchGuard’s liability is affected by the warranty terms provided to WatchGuard by the original equipment manufacturers ranging from 16 to 24 months from the manufacture date. Other factors that affect WatchGuard’s warranty liability include the number of installed units, historical rates of warranty claims and cost per claim. WatchGuard periodically assesses the adequacy of its recorded warranty liabilities and adjusts the amounts as necessary.
WatchGuard’s estimated product warranty liability was $107,000 and $197,000 at December 31, 2002 and 2003, respectively.
11. Business Restructuring
WatchGuard recorded restructuring charges of approximately $3.7 million, $8.1 million and $1.0 million in 2001, 2002 and 2003, respectively. These costs are accounted for under EITF Issue No. 94-3, “Liability Recognition for Certain Employee Termination Benefits and Other Costs to Exit an Activity” as they pertain to the restructuring plans initiated in 2001 and 2002.
In July 2002, the FASB issued SFAS 146, “Accounting for Costs Associated with Exit or Disposal Activities.” This pronouncement nullified EITF Issue No. 94-3, and generally requires that a liability for a cost associated with an exit or disposal activity be recognized when the liability is incurred rather than at the date of an entity’s commitment to an exit plan. However, the provisions of SFAS 146 are effective for exit and disposal activities initiated after December 31, 2002, and therefore are not applicable to WatchGuard’s restructuring plans initiated in 2001 and 2002.
2001 Restructuring
In the second quarter of 2001, WatchGuard announced a restructuring plan designed to streamline operations and reduce operating costs. This restructuring plan included a reduction in workforce and a consolidation of excess facilities, in addition to other cost-saving strategies. As part of the restructuring plan, WatchGuard exited the consumer security market and terminated various original equipment manufacturer agreements to develop product and services for that market, and streamlined operations in support of new products and services aimed at business customers. As a result of this restructuring, WatchGuard recorded a $3.7 million restructuring charge in 2001. Additional charges of $1.4 million and $300,000 related to the 2001 restructuring plan were recorded in 2002 and 2003, respectively, due to the revision of estimated proceeds from the sublease of excess facilities, as the real estate market remains depressed longer than originally expected.
As part of this reorganization, WatchGuard implemented a workforce reduction of 50 employees, which represented approximately 16% of WatchGuard’s employee base at that time and included employees from all of WatchGuard’s functional areas. All such employees were terminated prior to June 30, 2001. Other expenses associated with the reorganization consisted of stock-based compensation expense associated with the acceleration of vesting of stock subject to repurchase and stock options held by terminated employees, the discontinuation of the consumer security market products and the abandonment of facilities and equipment. Costs that related to ongoing operations were not included as restructuring charges. All restructuring charges have been paid as of December 31, 2001, except accrued amounts primarily related to losses for the lease commitments, net of estimated proceeds from subleases of abandoned facilities, which are expected to be paid through August 2010. Revenues recorded from the consumer security market were insignificant prior to the restructuring.
WATCHGUARD TECHNOLOGIES, INC.
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS-(Continued)
The accrued liability relating to this restructuring as of December 31, 2001, 2002 and 2003 and activity recorded through 2001, 2002 and 2003 are as follows (in thousands):
2002 Restructuring
In the second quarter of 2002, WatchGuard implemented a restructuring plan primarily designed to eliminate redundancies and excess headcount resulting from the acquisition of RapidStream (see Note 12), which included a reduction in workforce, consolidation of excess facilities and elimination of technology-related contracts that are no longer required or part of WatchGuard’s strategy. As a result of this restructuring, WatchGuard recorded a $6.7 million restructuring charge during 2002. An additional charge of $700,000 was recorded in 2003 due to the revision of estimated proceeds from the sublease of excess facilities, as the real estate market remains depressed longer than originally expected.
As part of this reorganization, WatchGuard implemented a workforce reduction of 36 employees, which represented approximately 10% of WatchGuard’s post-acquisition employee base and included employees from all of WatchGuard’s functional areas. All such employees were terminated prior to June 30, 2002. Other costs associated with the reorganization consist of contract terminations and the consolidation of excess facilities. Costs that related to ongoing operations were not included as restructuring charges. Restructuring charges for severance and termination benefits were paid by December 31, 2002. Contract termination costs were paid in the quarter ended March 31, 2003. Amounts related to losses for the lease commitments, net of proceeds from the sublease of abandoned facilities of approximately $4.0 million at December 31, 2003, are expected to be paid through 2010.
WATCHGUARD TECHNOLOGIES, INC.
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS-(Continued)
The accrued liability relating to this restructuring as of December 31, 2002 and 2003 and activity recorded through 2002 and 2003 are as follows (in thousands):
12. Acquisitions
RapidStream, Inc.
On April 2, 2002, WatchGuard acquired all of the outstanding capital stock of RapidStream, Inc., a privately held provider of ASIC (application specific integrated circuit)-based firewall and virtual private networking (VPN) appliances. The acquisition of RapidStream brings ASIC technology that allows WatchGuard to address customers that require enterprise-level networking functionality and VPN scalability. The results of RapidStream’s operations have been included in WatchGuard’s consolidated financial statements since the date of acquisition.
The total RapidStream consideration of $51.0 million was comprised of (a) $16.5 million in cash, (b) 4.92 million shares of WatchGuard common stock valued at $31.0 million, (c) WatchGuard’s assumption of RapidStream’s obligations under its stock option plan, resulting in the conversion of RapidStream options into options to purchase 318,251 shares of WatchGuard common stock valued at approximately $1.8 million using the Black-Scholes pricing model and the following assumptions: risk-free interest rate of 4.75%, an expected life of 5 years and a volatility of 1.37, and (d) $1.7 million in professional fees related to the acquisition. Deferred stock-based compensation associated with the conversion of unvested RapidStream stock options and the issuance of restricted stock was $558,000.
WATCHGUARD TECHNOLOGIES, INC.
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS-(Continued)
The following table summarizes the purchase price allocation as of December 31, 2002 (in thousands):
Tangible assets and liabilities. Tangible assets and liabilities are recorded at fair value. The accounts payable and accrued liabilities included acquisition-related liabilities of approximately $2.9 million for severance and termination costs associated with RapidStream employees, costs related to the abandonment of excess facilities, a liability reflecting the fair value of an above-market lease, and other costs. Amounts recorded related to these items and accrued balances remaining at December 31, 2002 and at December 31, 2003 were as follows (in thousands):
As part of the acquisition, WatchGuard terminated 21 employees from the original RapidStream workforce. All of these employees were terminated prior to December 31, 2002. Accrued amounts related to above-market leases and abandoned facilities are expected to be realized through 2004.
Current technology. Values assigned to current technology were determined using the income approach. Under the income approach, fair value reflects the present value of the projected cash flows that are expected to be generated by the products incorporating the current technology. To determine the value of current technology, WatchGuard discounted the expected future cash flows of the existing technology products at a rate of 15%,
WATCHGUARD TECHNOLOGIES, INC.
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS-(Continued)
taking into account the weighted average cost of capital and risks related to the characteristics and applications of each product, existing and future markets and assessments of the life-cycle stage of each project. Based on this analysis, WatchGuard capitalized the existing technology that had reached technological feasibility.
The projected revenues used in the income approach were based on the 2002 estimates of future revenues that could have been most likely generated by the commercial sales of the technology. The useful life of the current technology was estimated to be five years. Gross profit was assumed to be 58% in the partial year of 2002, 60% in 2003 and 70% in each of the remaining three years of the five-year projection period. Operating expenses, including sales and marketing, research and development and general and administrative costs, were assumed to be 79% of revenues in the initial year of the projection, declining to 29% in 2003 and 38% for each of the three remaining years.
As discussed in Note 2, during the third quarter of 2003, WatchGuard recorded an impairment charge of $3.3 million for the intangible asset associated with the RapidStream “Secured by Check Point” product brand that represents a subset of the total current technology obtained in the 2002 acquisition of RapidStream. In the fourth quarter of 2003, WatchGuard made a decision to exit the market segment served by this product; therefore, an additional impairment charge of $230,000 was recorded in the quarter ended December 31, 2003 for the remaining net book value of this intangible asset.
Goodwill. The value assigned to goodwill represents the excess of the purchase price over the sum of the amounts assigned to identifiable assets acquired less liabilities assumed. A value of approximately $39.6 million was assigned to goodwill in the acquisition. The goodwill is not deductible for tax purposes.
Acquired in-process research and development. Values assigned to the acquired in-process research and development (IPR&D) were determined using an income approach. To determine the value of the IPR&D, WatchGuard considered, among other factors, the state of development of each project, the time and cost needed to complete each project, expected income and associated risks, which included the inherent difficulties and uncertainties in completing the project and achieving technological feasibility and risks related to the viability of and potential changes in future target markets. This analysis resulted in amounts assigned to IPR&D for projects that had not yet reached technological feasibility and do not have alternative future uses. The entire $1.2 million allocated to acquired IPR&D was expensed on the date of acquisition.
At the time of the acquisition, three IPR&D projects were identified as being related to future products for which technological or commercial feasibility had not yet been established and that did not have an alternative future use. WatchGuard analyzed each project, using estimated percentage completion factors ranging from less than 10% to 65%. Revenue growth rates for RapidStream’s IPR&D were assumed to be as high as 175% in the year after the year of introduction and decreasing each year to a negative growth rate of 35% in the final year of the five-year projection period. Projected annual revenues related to IPR&D ranged from approximately $1.6 million to $5.0 million over the term of the projections. These projections were based on aggregate revenue growth rates for the business as a whole, anticipated growth rates for the Internet security market, anticipated product development and product introduction cycles and the estimated life of the underlying technology.
Gross profit was assumed to be 58% in the partial year of 2002, 60% in 2003 and 70% in each of the remaining three years of the five-year projection period. Operating expenses, including sales and marketing, research and development and general and administrative costs, were assumed to be 161% of revenues in the initial year of the projection, declining to 29% in 2003 and 38% for each of the three remaining years.
WatchGuard used a 25% discount rate for valuing the acquired IPR&D. In arriving at the discount rate, WatchGuard considered the implied rate of the transaction and the weighted average cost of capital. WatchGuard
WATCHGUARD TECHNOLOGIES, INC.
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS-(Continued)
also took into account risks related to the characteristics and applications of each project, existing future markets and assessments of the life cycles of each project.
Deferred compensation. A total of approximately $558,000 of deferred stock-based compensation was recorded in connection with the acquisition. Approximately $419,000 of the deferred stock-based compensation was due to WatchGuard’s assumption of unvested options to purchase RapidStream common stock. This deferred stock-based compensation was based on the intrinsic value of the unvested options at the closing date of the merger. In addition, before the close of the merger, twelve RapidStream employees were allowed to exercise a portion of their unvested options. The WatchGuard stock that was acquired by the former RapidStream employees in exchange for the RapidStream stock acquired upon the exercise of these options is considered restricted and the restrictions will lapse over the original vesting term of the options, which did not exceed 28 months from the date of purchase. Additionally, because the shares of RapidStream were exchanged for a cash payment in addition to shares of WatchGuard common stock, the cash payment related to the restricted shares is also subject to the same vesting period. The total number of restricted shares is 25,281 and the intrinsic value of the arrangement in the amount of $139,000 is recorded as deferred compensation, based on the fair value of WatchGuard common stock on the closing date of the merger. At December 31, 2003, 277 of these shares remained subject to repurchase.
Pro forma results. The following unaudited pro forma combined historical results for 2001, 2002 and 2003 are presented as if RapidStream had been acquired on January 1, 2001 and 2002. The pro forma results, which exclude the nonrecurring charge in 2002 of $1.2 million for IPR&D, are presented below (in thousands, except per share data):
SCHEDULE II
VALUATION AND QUALIFYING ACCOUNTS
(In thousands)
(A)
Deductions consist of write-offs of uncollectible accounts.
(B)
Deductions consist of product returns, price protection credits issued and credits issued under promotional allowances previously accrued.
(C)
Deductions consist of write-offs of obsolete or excess quantities of inventory.
ITEM 9.
ITEM 9.
CHANGES IN AND DISAGREEMENTS WITH ACCOUNTANTS ON ACCOUNTING AND FINANCIAL DISCLOSURE
None.
ITEM 9A.
ITEM 9A. CONTROLS AND PROCEDURES
Evaluation of disclosure controls and procedures. Our chief executive officer and our chief financial officer, after evaluating the effectiveness of our “disclosure controls and procedures” (as defined in Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934) as of the end of the period covered by this annual report, have concluded that, as of that date, our disclosure controls and procedures were effective in ensuring that information required to be disclosed by us in this annual report is accumulated and communicated by our management, to allow timely decisions regarding required disclosure.
To our knowledge, there were no significant changes in our internal controls during the fourth quarter of 2003 that have materially affected, or are reasonably likely to materially affect, our internal controls.
PART III
ITEM 10.
ITEM 10.
DIRECTORS AND EXECUTIVE OFFICERS OF THE REGISTRANT
(a) The information regarding our directors required by this item is incorporated into this annual report by reference to the section entitled “Election of Directors” in the proxy statement for our annual meeting of stockholders to be held on June 3, 2004.
(b) The information regarding our executive officers required by this item is incorporated into this annual report by reference to the section entitled “Executive Officers” in the proxy statement for our annual meeting of stockholders to be held on June 3, 2004.
(c) The information regarding our Code of Ethics required by this item is incorporated into this annual report by reference to the section entitled “Corporate Governance” in the proxy statement for our annual meeting of stockholders to be held on June 3, 2004.
We will file the proxy statement for our 2004 annual meeting of stockholders within 120 days of December 31, 2003, our fiscal year-end.
ITEM 11.
ITEM 11.
EXECUTIVE COMPENSATION
The information regarding executive compensation required by this item is incorporated into this annual report by reference to the section entitled “Executive Compensation” in the proxy statement for our annual meeting of stockholders to be held on June 3, 2004. We will file the proxy statement for our 2004 annual meeting of stockholders within 120 days of December 31, 2003, our fiscal year-end.
ITEM 12.
ITEM 12.
SECURITY OWNERSHIP OF CERTAIN BENEFICIAL OWNERS AND MANAGEMENT AND RELATED STOCKHOLDER MATTERS
The information regarding beneficial ownership of our common stock required by this item is incorporated into this annual report by reference to the section entitled “Security Ownership of Certain Beneficial Owners and Management” and “Securities Authorized for Issuance Under Equity Compensation Plans” in the proxy statement for our 2004 annual meeting of stockholders to be held on June 3, 2004. We will file the proxy statement within 120 days of December 31, 2003, our fiscal year-end.
ITEM 13.
ITEM 13.
CERTAIN RELATIONSHIPS AND RELATED TRANSACTIONS
The information regarding certain relationships and related transactions required by this item is incorporated into this annual report by reference to the section entitled “Certain Relationships and Related Transactions” in the proxy statement for our 2004 annual meeting of stockholders to be held on June 3, 2004. We will file the proxy statement within 120 days of December 31, 2003, our fiscal year-end.
ITEM 14.
ITEM 14.
PRINCIPAL ACCOUNTANT FEES AND SERVICES
The information regarding principal accountant fees and services required by this item is incorporated into this annual report by reference to the section entitled “Independent Auditors” in the proxy statement for our 2004 annual meeting of stockholders to be held on June 3, 2004. We will file the proxy statement within 120 days of December 31, 2003, our fiscal year-end.
PART IV
ITEM 15.
ITEM 15.
EXHIBITS, FINANCIAL STATEMENT SCHEDULES AND REPORTS ON FORM 8-K
(a) Financial Statements and Financial Statement Schedules
(1) Index to Financial Statements
Page
Report of Ernst & Young LLP, Independent Auditors
Consolidated Balance Sheets
Consolidated Statements of Operations
Consolidated Statements of Stockholders’ Equity
Consolidated Statements of Cash Flows
Notes to Consolidated Financial Statements
(2) Index to Financial Statement Schedules
Schedule II-Valuation and Qualifying Accounts for each of the three years ended December 31, 2003, 2002 and 2001.
Schedules not listed above have been omitted because they are not applicable or are not required or the information required to be set forth in the schedules is included in the consolidated financial statements or related notes.
(3) Exhibits

Portions of this exhibit have been omitted based on a request for confidential treatment filed with the SEC. The omitted portions of the exhibits have been filed separately with the SEC.
(A)
Incorporated by reference to the specified exhibit to the registrant’s Current Report on Form 8-K (File No. 000-26819), filed with the SEC on February 15, 2002.
(B)
Incorporated by reference to the specified exhibit to the registrant’s Current Report on Form 8-K (File No. 000-26819), filed with the SEC on April 12, 2002.
(C)
Incorporated by reference to the specified exhibit to the registrant’s Registration Statement on Form S-1 (File No. 333-76587), filed with the SEC on April 20, 1999, as amended.
(D)
Incorporated by reference to the specified exhibit to the registrant’s Annual Report on Form 10-K/A (File No. 000-26819), filed with the SEC on May 1, 2000.
(E)
Incorporated by reference to the specified exhibit to the registrant’s Quarterly Report on Form 10-Q for the quarter ended March 31, 2001 (File No. 000-26819), filed with the SEC on May 15, 2001.
(F)
Incorporated by reference to the specified exhibit to the registrant’s Registration Statement on Form S-8 (File No. 333-86168), filed with the SEC on April 12, 2002.
(G)
Incorporated by reference to the specified exhibit to the registrant’s Registration Statement on Form S-8 (File No. 333-51196), filed with the SEC on December 4, 2000.
(H)
Incorporated by reference to the specified exhibit to the registrant’s Quarterly Report on Form 10-Q for the quarter ended September 30, 2003 (File No. 000-26819), filed with the SEC on November 13, 2003.
(I)
Incorporated by reference to the specified exhibit to the registrant’s Quarterly Report on Form 10-Q for the quarter ended June 30, 2003 (File No. 000-26819), filed with the SEC on August 12, 2003.
(b) Reports on Form 8-K
On October 20, 2003, we furnished a current report on Form 8-K to announce our financial results for the quarter ended September 30, 2003.
On November 19, 2003, we filed a current report on Form 8-K to announce the resignation of John Todd from our board of directors.
On December 24, 2003, we filed a current report on Form 8-K to announce the resignation of James A. Cady as our President, Chief Executive Officer and Chairman of the Board.
SIGNATURES
Pursuant to the requirements of Section 13 or 15(d) of the Securities Exchange Act of 1934, as amended, the registrant has duly caused this report to be signed on its behalf by the undersigned, thereunto duly authorized, in the city of Seattle, state of Washington, on March 12, 2004.
WATCHGUARD TECHNOLOGIES, INC.
By:
/s/ STEVEN N. MOORE
Steven N. Moore
President and Chief Executive Officer
POWER OF ATTORNEY
Each person whose individual signature appears below hereby authorizes and appoints Steven N. Moore and Michael E. McConnell and each of them, with full power of substitution and resubstitution and full power to act without the other, as his or her true and lawful attorney-in-fact and agent to act in his or her name, place and stead and to execute in the name and on behalf of each person, individually and in each capacity stated below, and to file, any and all amendments to this report, and to file the same, with all exhibits thereto, and other documents in connection therewith, with the Securities and Exchange Commission, granting unto said attorneys-in-fact and agents, and each of them, full power and authority to do and perform each and every act and thing, ratifying and confirming all that said attorneys-in-fact and agents or any of them or their or his substitute or substitutes may lawfully do or cause to be done by virtue thereof.
Pursuant to the requirements of the Securities Exchange Act of 1934, as amended, this report has been signed below by the following persons on behalf of the registrant and in the capacities and on the dates indicated.
EXHIBIT INDEX

Portions of this exhibit have been omitted based on a request for confidential treatment filed with the SEC. The omitted portions of the exhibits have been filed separately with the SEC.
(A)
Incorporated by reference to the specified exhibit to the registrant’s Current Report on Form 8-K (File No. 000-26819), filed with the SEC on February 15, 2002.
(B)
Incorporated by reference to the specified exhibit to the registrant’s Current Report on Form 8-K (File No. 000-26819), filed with the SEC on April 12, 2002.
(C)
Incorporated by reference to the specified exhibit to the registrant’s Registration Statement on Form S-1 (File No. 333-76587), filed with the SEC on April 20, 1999, as amended.
(D)
Incorporated by reference to the specified exhibit to the registrant’s Annual Report on Form 10-K/A (File No. 000-26819), filed with the SEC on May 1, 2000.
(E)
Incorporated by reference to the specified exhibit to the registrant’s Quarterly Report on Form 10-Q for the quarter ended March 31, 2001 (File No. 000-26819), filed with the SEC on May 15, 2001.
(F)
Incorporated by reference to the specified exhibit to the registrant’s Registration Statement on Form S-8 (File No. 333-86168), filed with the SEC on April 12, 2002.
(G)
Incorporated by reference to the specified exhibit to the registrant’s Registration Statement on Form S-8 (File No. 333-51196), filed with the SEC on December 4, 2000.
(H)
Incorporated by reference to the specified exhibit to the registrant’s Quarterly Report on Form 10-Q for the quarter ended September 30, 2003 (File No. 000-26819), filed with the SEC on November 13, 2003.
(I)
Incorporated by reference to the specified exhibit to the registrant’s Quarterly Report on Form 10-Q for the quarter ended June 30, 2003 (File No. 000-26819), filed with the SEC on August 12, 2003.