Shortly afterward, FireEye acquired another data breach investigation company, nPulse, for approximately $60 million. By 2015, FireEye was making more than $100 million in annual revenue, but was still unprofitable, largely due to research and development spending. In January 2016, FireEye acquired iSIGHT Partners for $275 million. iSIGHT was a threat intelligence company that gathered information about hacker groups and other cybersecurity risks. This was followed by the acquisition of Invotas, an IT security automation company. DeWalt stepped down as CEO in 2016 and was replaced by Mandiant CEO and former FireEye President Kevin Mandia. Afterwards, there was a downsizing and restructuring in response to lower-than-expected sales, resulting in a layoff of 300-400 employees. Profit and revenue increased on account of shifts to a subscription model and lower costs. FireEye started out as a "sandboxing" company. Sandboxing is where incoming network traffic is opened within a virtual machine to test it for malicious software, before being introduced into the network. FireEye's products diversified over time, in part through acquisitions. In 2017, FireEye transitioned from primarily selling appliances, to a software-as-a-service model. FireEye sells technology products including network, email and endpoint security, a platform for managing security operations centers called Helix, consulting services primarily based on incident response, and threat intelligence products. The Central Management System (CMS) consolidates the management, reporting, and data sharing of Web MPS (Malware Protection System), Email MPS, File MPS, and Malware Analysis System (MAS) into a single network-based appliance by acting as a distribution hub for malware security intelligence. The FireEye Cloud crowd-sources Dynamic Threat Intelligence (DTI) detected by individual FireEye MPS appliances, and automatically distributes this time sensitive zero-day intelligence globally to all subscribed customers in frequent updates. Content Updates include a combination of DTI and FireEye Labs generated intelligence identified through research efforts. FireEye is known for uncovering high-profile hacking groups. In October/November 2009, FireEye participated in an effort to take down the Mega-D botnet (also known as Ozdok). On March 16, 2011, the Rustock botnet was taken down through an action by Microsoft, US federal law enforcement agents, FireEye, and the University of Washington. In July 2012, FireEye was involved in analysis of the Grum botnet's command and control servers located in the Netherlands, Panama, and Russia.