As filed with the Securities and Exchange Commission on April 21, 2011

No. 333-

UNITED STATES SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

Form S-1

REGISTRATION STATEMENT

UNDER

THE SECURITIES ACT OF 1933

Trustwave Holdings, Inc.

(Exact name of registrant as specified in its charter)


Delaware	7372	11-3745786
(State or other jurisdiction of incorporation or organization)	(Primary Standard Industrial Classification Code Number)	(I.R.S. Employer Identification No.)

Trustwave Holdings, Inc.

70 W. Madison, Suite 1050

Chicago, Illinois 60602

(Address, including zip code, and telephone number, including area code, of registrant’s principal executive offices)

Robert J. McCullen

Chairman, Chief Executive Officer and President

Trustwave Holdings, Inc.

70 W. Madison, Suite 1050

Chicago, Illinois 60602

(312) 873-7500

(Name, address, including zip code, and telephone number, including area code, of agent for service)

Copies of all communications, including communications sent to agent for service, should be sent to:


Dennis M. Myers, P.C. Kirkland & Ellis LLP 300 North LaSalle Chicago, Illinois 60654 (312) 862-2000		John J. Sabl Sidley Austin LLP One South Dearborn Chicago, Illinois 60603 (312) 853-7000

Approximate date of commencement of proposed sale to the public: As soon as practicable after this Registration Statement becomes effective.

If any of the securities being registered on this Form are to be offered on a delayed or continuous basis pursuant to Rule 415 under the Securities Act, check the following box: o

If this Form is filed to register additional securities for an offering pursuant to Rule 462(b) under the Securities Act, please check the following box and list the Securities Act registration statement number of the earlier effective registration statement for the same offering. o

If this Form is a post-effective amendment filed pursuant to Rule 462(c) under the Securities Act, check the following box and list the Securities Act registration statement number of the earlier effective registration statement for the same offering. o

If this Form is a post-effective amendment filed pursuant to Rule 462(d) under the Securities Act, check the following box and list the Securities Act registration statement number of the earlier effective registration statement for the same offering. o

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, or a smaller reporting company. See the definitions of “large accelerated filer,” “accelerated filer” and “smaller reporting company” in Rule 12b-2 of the Exchange Act. (Check one):


Large accelerated filer o		Accelerated filer o		Non-accelerated filer þ (Do not check if a smaller reporting company)		Smaller reporting company o

CALCULATION OF REGISTRATION FEE


(1)	Estimated solely for the purpose of calculating the registration fee pursuant to Rule 457(o) under the Securities Act.
(2)	Includes the offering price of shares of common stock that may be sold if the over-allotment option granted by us to the underwriters is exercised.
(3)	Calculated pursuant to Rule 457(o) based on an estimate of the proposed maximum aggregate offering price.

The Registrant hereby amends this Registration Statement on such date or dates as may be necessary to delay its effective date until the Registrant shall file a further amendment which specifically states that this Registration Statement shall thereafter become effective in accordance with Section 8(a) of the Securities Act of 1933 or until this Registration Statement shall become effective on such date as the Commission, acting pursuant to said Section 8(a), may determine.

The information in this prospectus is not complete and may be changed. We may not sell these securities until the registration statement filed with the Securities and Exchange Commission is effective. The prospectus is not an offer to sell these securities nor a solicitation of an offer to buy these securities in any jurisdiction where the offer and sale is not permitted.

PROSPECTUS (Subject to completion)

Issued April 21, 2011

COMMON STOCK

This is the initial public offering of common stock by Trustwave Holdings, Inc. We are selling shares of common stock. Prior to this offering, there has been no public market for our common stock. The initial public offering price of our common stock is expected to be between $ and $ per share.

We intend to apply to list our common stock on under the proposed symbol “ .”

Investing in our common stock involves risks. See “Risk Factors” beginning on page 11.

PRICE $ PER SHARE


		*Underwriting*
	*Price to*	*Discounts and*	*Proceeds to*
	*Public*	*Commissions*	*Company*

Per Share	$	$	$
Total	$	$	$

We have granted the underwriters a 30-day option to purchase up to additional shares of common stock on the same terms as set forth above. See the section of this prospectus entitled “Underwriting.”

Neither the Securities and Exchange Commission nor any state securities commission has approved or disapproved of these securities nor passed upon the accuracy or adequacy of the disclosures in the prospectus. Any representation to the contrary is a criminal offense.

The underwriters expect to deliver the shares on or about , 2011.


MORGAN STANLEY	J.P. MORGAN	BARCLAYS CAPITAL


WILLIAM BLAIR & COMPANY	BMO CAPITAL MARKETS

, 2011

TABLE OF CONTENTS


Prospectus Summary			1
Risk Factors			11
Forward-Looking Statements			34
Market And Industry Data And Forecasts			36
Use Of Proceeds			37
Dividend Policy			38
Capitalization			39
Dilution			41
Unaudited Pro Forma Consolidated Financial Data			43
Selected Historical Consolidated Financial Data			47
Management’s Discussion And Analysis Of Financial Condition And Results Of Operations			49
Business			77
Management			98
Executive Compensation			104
Security Ownership Of Certain Beneficial Owners			123
Certain Relationships And Related Party Transactions			126
Description Of Certain Indebtedness			129
Description Of Capital Stock			130
Shares Eligible For Future Sale			134
Material U.S. Federal Income And Estate Tax Considerations To Non-U.S. Holders			136
Underwriting			139
Legal Matters			145
Experts			145
Where You Can Find More Information			145
Index to financial statements			F-1
EX-5.1
EX-10.1
EX-10.2
EX-10.3
EX-10.4
EX-10.5
EX-10.6
EX-10.7
EX-10.8
EX-10.9
EX-10.10
EX-10.14
EX-10.15
EX-10.16
EX-10.17
EX-10.18
EX-10.19
EX-10.20
EX-10.21
EX-10.22
EX-10.23
EX-10.24
EX-10.25
EX-10.26
EX-10.27
EX-10.33
EX-10.34
EX-10.35
EX-10.36
EX-10.37
EX-10.38
EX-10.39
EX-21.1
EX-23.1
EX-23.2
EX-23.3
EX-23.4
EX-23.5

We have not authorized anyone to provide any information other than that contained or incorporated by reference in this prospectus or in any free writing prospectus prepared by or on behalf of us or to which we have referred you. We take no responsibility for, and can provide no assurance as to the reliability of, any other information that others may give you. We are offering to sell, and seeking offers to buy, shares of our common stock only in jurisdictions where such offers and sales are permitted. The information in this prospectus or a free-writing prospectus is accurate only as of its date, regardless of its time of delivery or of any sale of shares of our common stock. Our business, financial condition, results of operations and prospects may have changed since that date.

Until , 2011 (25 days after the commencement of this offering), all dealers that effect transactions in these securities, whether or not participating in this offering, may be required to deliver a prospectus. This delivery requirement is in addition to the dealer’s obligation to deliver a prospectus when acting as an underwriter and with respect to unsold allotments or subscriptions.

TRADEMARKS AND TRADENAMES

This prospectus includes our trademarks and service marks such as Trustwave^®, TrustKeeper^®, SpiderLabs^®, ModSecurity^®, TrustedApp^®, TrustedSentry^®, Smart Tag^®, Trusted Commerce^®, Trustwave Security Data Warehouse^tm and WebDefend^® which are protected under applicable intellectual property laws and are the property of Trustwave Holdings, Inc. or its subsidiaries. This prospectus also contains trademarks, service marks, trade names and copyrights of other companies, which are the property of their respective owners. Solely for convenience, trademarks and trade names referred to in this prospectus may appear without the ^® or ^tm symbols. We do not intend our use or display of other parties’ trademarks, trade names or service marks to imply, and such use or display should not be construed to imply, a relationship with, or endorsement or sponsorship of us by, these other parties.

PROSPECTUS SUMMARY

This summary highlights information contained elsewhere in this prospectus and does not contain all of the information that you should consider in making your investment decision. You should read this entire prospectus, including the sections entitled “Risk Factors” and “Management’s Discussion and Analysis of Financial Condition and Results of Operations” in this prospectus before deciding to invest in our common stock. Some of the statements in this summary constitute forward-looking statements, with respect to which you should review the section of this prospectus entitled “Forward-Looking Statements.” Except where the context otherwise requires or where otherwise indicated, the terms “Trustwave,” “we,” “us,” “our,” “our Company” and “our business” refer to Trustwave Holdings, Inc., together with its consolidated subsidiaries as a combined entity. Our fiscal year ends on December 31 of each calender year.

TRUSTWAVE HOLDINGS, INC.

Trustwave is a leading provider of on-demand data security compliance solutions that enable businesses and other organizations of all sizes to efficiently achieve and maintain compliance with regulatory requirements and industry standards. Our compliance management solutions, including our easy-to-use software-as-a-service TrustKeeper^® offering, have helped hundreds of thousands of organizations simplify the complex process of validating compliance. Additionally, our broad suite of compliance enablement solutions remediates data security deficiencies, allowing our customers to achieve and maintain compliance in a cost effective manner. These solutions assist our subscribers in comprehensively securing their network infrastructure, data communications and sensitive information assets, protecting them against the increasing threats of unauthorized access, fraudulent activity and other intrusions or breaches. We have been successful in rapidly expanding our customer base across a broad range of industries as a result of our differentiated partner network, which is comprised of many of the world’s largest financial institutions and other organizations influential to the compliance and data security mandates of their customers.

Our data security compliance solutions can be applied to address many regulations and standards, including the Payment Card Industry data security standards, or “PCI,” the Health Insurance Portability and Accountability Act, or “HIPAA,” the Federal Information Security Management Act, or “FISMA,” and a number of other federal, state and international regulations and standards. To date, we have primarily focused on PCI compliance, as it is among the best defined and broadest reaching data security standards. Through this effort, we have become a leader in facilitating PCI compliance, helping organizations address the risks and challenges associated with payment card fraud and compromise. Financial institutions are generally responsible for the risk of payment card fraud or compromise and security breaches involving their payment card accepting customers to the extent they are unable to recover losses from them or other parties. In turn, many of these institutions rely on our knowledge and proprietary technology to help their customers validate, achieve and maintain compliance.

We believe data security compliance represents a large and growing addressable market, driven in part by PCI compliance. For example, MasterCard estimates that its payment cards were accepted at approximately 30 million locations worldwide as of December 31, 2010. We expect financial institutions to increasingly enforce PCI compliance among their payment card accepting customers. In addition, we believe that the number of locations where data is stored or transmitted, and consequently require protection, will continue to increase for financial transactions, as well as health care, government and other services.

Our solutions include our industry leading software-as-a-service, or “SaaS,” TrustKeeper compliance management offering along with a comprehensive suite of proprietary compliance enablement solutions. TrustKeeper and the TrustKeeper Agent assist organizations in validating compliance by analyzing, aggregating and reporting on prohibited data storage, systems configurations and security policy settings on subscribers’ systems in centralized or distributed information technology, or “IT,” environments. In addition, our compliance enablement offerings provide a comprehensive, integrated turnkey suite of data security solutions, including encryption, extensible threat management, security information and event management, network access control, web application firewalls and data loss prevention. These solutions help address vulnerabilities detected by TrustKeeper, allowing our customers to achieve and maintain compliance.

We serve customers of all sizes, from eight of the top ten Fortune 500 companies in 2010 to small- and medium-sized businesses and other organizations. Our customers include subscribers, which are businesses, government entities and other organizations that purchase our subscription services either directly or are provided our service through a member of our partner network, as well as purchasers of our professional services or perpetual-license products. Examples of our customers include financial services companies, franchised restaurants, hospitality chains, hospitals and physician networks, technology, media and telecommunications companies, educational organizations and retail operations.

We have reached many of our customers through our partner network, which is comprised of approximately 75 organizations influential to the compliance and data security mandates of their customers. Our PCI partner network includes many of the world’s leading financial institutions, major payment card companies, and other members of the payment and IT ecosystem, which we believe expands our global reach and reputation. In addition to PCI, we plan to expand our partner network in health care, government services and other sectors, facilitating the distribution of our solutions that address relevant regulations and standards, such as HIPAA and FISMA.

Set forth below in alphabetical order is a representative sample of our customers by the geography in which we primarily serve them:


North America	American Express*	JPMorgan Chase*
	Banc of America Merchant Services*	MICROS Systems*
	Discover*	Moneris*
	EVO	Sage Payment Solutions*
	Fifth Third Processing Solutions*	TSYS Merchant Solutions*
	First American Payment Systems*	U.S. Bank*
	First Data Corporation*	Visa
	Global Payments*	Wells Fargo*

Rest of World	Atos Worldline*	Nordea Bank*
	Barclays Capital Services	Redecard
	China UnionPay Data	Swedbank*
	Cielo	Transbank
	First National Bank (South Africa)

* Indicates a member of our partner network

As of December 31, 2010, we had over 900,000 TrustKeeper subscriptions, primarily consisting of payment card acceptance locations, the majority of which were identified by our partner network as requiring PCI compliance services. Each payment card acceptance location of a subscriber is generally counted as a separate TrustKeeper subscription when either one of our partners or the subscriber has initiated payment for our service. As of the same date, we estimate that there were approximately 6 million payment card acceptance locations within our existing PCI partner network. A number of our partners are in the midst of a multi-year effort to monitor and enforce PCI compliance among their payment card accepting customers, and in turn we expect the number of subscriptions to increase, although we do not expect this effort will result in all of them becoming subscribers and some may already be covered by our enterprise arrangements.

Our revenue increased from $58.3 million in 2008 to $73.1 million in 2009 and $111.5 million in 2010, and our net loss for each of those years was $2.0 million, $1.5 million and $4.6 million, respectively. In the same periods, our Adjusted EBITDA increased from $0.4 million in 2008 to $3.1 million in 2009 and $4.9 million in 2010. We believe Adjusted EBITDA is useful to investors in evaluating our operating performance. Adjusted EBITDA should not be considered as an alternative to net income (loss), which is the most directly comparable financial measure calculated in accordance with GAAP, or any other measure of financial performance calculated in accordance with GAAP. For a discussion of Adjusted EBITDA and a reconciliation of Adjusted EBITDA to net loss, see note 3 to the tables included in “Summary Historical and Pro Forma Consolidated Financial Data.”

Industry Background

We believe businesses, government entities and other organizations face a number of challenges in achieving and maintaining compliance with regulatory requirements and industry standards, including:


	•	increasing data security threats, which have led to a heightened regulatory and compliance environment;

	•	regulatory and compliance requirements that are becoming increasingly complex and challenging to achieve and maintain; and

	•	many existing compliance and data security solutions that are highly complex and expensive.

As a result, we believe there is an increasing need for on-demand, scalable, automated and cost-effective data security compliance solutions that can help these organizations address these challenges in real time and simplify the process for validating, achieving and maintaining compliance. According to International Data Corporation, or “IDC,” the total governance, risk and compliance infrastructure software market is expected to grow from $17.3 billion in 2009 to $34.5 billion in 2014, representing a compound annual growth rate of 14.8%. According to IDC, the software-as-a-service, or on-demand, software market is expected to grow from $13.1 billion in 2009 to $40.5 billion in 2014, representing a compound annual growth rate of 25.3%.

Our Solutions

Key differentiators of our solutions include:

Cost-effective to achieve and maintain compliance. We provide our customers with many cost-effective solutions delivered as a service, eliminating much of the need for up-front infrastructure costs to achieve and maintain compliance. Our integrated solutions also reduce the need for in-house personnel resources and out-of-pocket costs to monitor and demonstrate on-going compliance.

Differentiated proprietary knowledge and technology. Our large, global customer footprint gives us visibility into existing and potential threats, which is enhanced by our SpiderLabs team, a leader in analyzing security threats and incident response. This allows us to proactively develop our solutions to address specific customer needs and protect against the latest security threats.

Our Business Model

We have developed a differentiated business model that has the following attributes:

Global delivery capabilities. As of December 31, 2010, we served customers in approximately 65 countries through employees and dedicated third-party support located in approximately 20 countries. We believe our multilingual, on-demand solutions allow us to efficiently serve organizations of all sizes worldwide.

Our Growth Strategy

The following are key elements of our growth strategy:

Build upon relationships with existing subscriber base. We believe that our compliance management solutions will continue to generate cross-selling opportunities to our installed base of our comprehensive suite of compliance enablement solutions as subscribers seek to remediate vulnerabilities identified by the compliance management process. In addition, we anticipate further expansion into the network of branches and franchises of our distributed enterprise customers.

Expand portfolio of new technologies. We expect to continue to develop and enhance our solutions to address specific customer needs and the latest security threats. We also plan to leverage our expertise in addressing PCI compliance to further expand our offerings in other data security compliance regimes such as HIPAA and FISMA, among others.

Extend our partner network. We plan to continue to seek additional partners to reach more payment card acceptance locations worldwide. Additionally, we plan to develop partner networks in health care, government services and other sectors, facilitating the distribution of our solutions that address relevant regulations and standards.

Expand internationally. Our revenue from customers outside of our North America segment has grown from $10.4 million in 2008 to $16.8 million in 2010, an increase of 62%. We plan to increase our international presence, primarily by growing our presence in the approximately 65 countries in which we have customers.

Summary Risk Factors

We are subject to a number of risks, including risks that may prevent us from achieving our business objectives or may adversely affect our business, financial condition, results of operations, cash flows and prospects. You should carefully consider these risks, including those highlighted in the section entitled “Risk Factors,” before investing in our common stock. Risks relating to our business include, among others, the following:


	•	our business and results of operations could be materially adversely affected if PCI is changed, cancelled, replaced or not enforced, new or different technologies that minimize the need for PCI are widely adopted, or we lose any of our PCI certifications;

	•	the loss of a significant member or group of members of our partner network, the failure to engage new partners or the decision by one of our partners to use our products less or compete against us could materially adversely affect our operations and sales;


	•	if we are unable to develop and maintain relationships with businesses, government entities and other organizations within our existing partner network that have not enrolled their customers into TrustKeeper, or whose customers have enrolled but have not become subscribers, our operating results may decline;

	•	we face intense competition in our market, both from larger, better-known companies and from more targeted competitors, and we may lack sufficient financial or other resources to maintain or improve our competitive position;

	•	we may not be able to compete effectively with companies that integrate or bundle products similar to ours with their other product offerings;

	•	if we are not successful in executing our strategy to increase our sales to larger enterprises, our results of operations may suffer; or

	•	our efforts to expand our product and service offerings beyond the PCI market may not succeed.

Recapitalization

Prior to the completion of this offering, we intend to complete an internal recapitalization pursuant to which our outstanding shares of Class A common stock, Class B common stock, Series A-1 preferred stock, Series A-2 preferred stock and Series B preferred stock will be converted into a single class of common stock on a share-for-share basis and, immediately thereafter, we will effect a one-for- reverse stock split with respect to our outstanding common stock. For ease of reference, we collectively refer to our Series A-1 preferred stock, Series A-2 preferred stock and Series B preferred stock as our “preferred stock,” and to the conversion of all of our outstanding Class A common stock, Class B common stock and preferred stock into a single class of common stock and the one-for- reverse stock split in connection therewith as the “Recapitalization.”

Upon completion of the Recapitalization, our authorized capital stock will consist of shares of common stock, par value $0.01 per share, and 5,000,000 shares of undesignated preferred stock, par value $0.01 per share. In connection with the Recapitalization, each outstanding option to purchase Class A common stock or Class B common stock and each outstanding warrant exercisable for shares of Class A common stock will relate to shares of our common stock and otherwise be adjusted appropriately to give effect to the reverse stock split.

Additional Information

The issuer of the common stock in this offering was originally incorporated as a Delaware corporation in 2005. Our corporate headquarters are located at 70 W. Madison Street, Suite 1050, Chicago, Illinois 60602. Our telephone number is (312) 873-7500. Our website address is www.trustwave.com. The information on our website is not deemed, and you should not consider such information, to be part of this prospectus.

THE OFFERING


Common stock offered		shares.

Common stock to be outstanding immediately after this offering		shares.

Option to purchase additional shares		shares.

Use of proceeds		We estimate that the net proceeds from this offering will be approximately $ million, or approximately $ million if the underwriters exercise their over-allotment option in full, assuming an initial public offering price of $ per share, which is the midpoint of the price range set forth on the cover of this prospectus, after deducting underwriting discounts and commissions and estimated offering expenses payable by us. We expect to use substantially all of the net proceeds from this offering for general corporate purposes. We have not allocated the net proceeds from this offering for any specific purpose at this time. See “Use of Proceeds.”

Risk factors		Investing in shares of our common stock involves a high degree of risk. See “Risk Factors” beginning on page 11 of this prospectus for a discussion of factors you should carefully consider before investing in shares of our common stock.

Proposed stock exchange symbol		“ .”

Unless otherwise indicated, all information in this prospectus relating to the number of shares of common stock outstanding immediately after this offering:


	•	gives effect to the Recapitalization, including the conversion of our outstanding Class A common stock, Class B common stock and preferred stock into a single class of common stock and the one-for- reverse stock split;

	•	assumes the effectiveness of our amended and restated certificate of incorporation and amended and restated bylaws;

	•	excludes: (i) shares of our common stock issuable upon the exercise of outstanding stock options at a weighted average exercise price of $ per share as of December 31, 2010; (ii) shares of our common stock issuable upon the exercise of outstanding warrants at a weighted average exercise price of $ per share as of December 31, 2010; and (iii) an aggregate of shares of our common stock reserved for future grants under our 2001 Stock Incentive Plan and under our 2011 Incentive Plan that we intend to adopt in connection with this offering; and

	•	assumes: (i) no exercise by the underwriters of their option to purchase up to additional shares from us; and (ii) an initial public offering price of $ per share, which is the midpoint of the initial public offering price range indicated on the cover of this prospectus.

SUMMARY HISTORICAL AND PRO FORMA CONSOLIDATED FINANCIAL DATA

The following tables summarize our financial data as of the dates and for the periods indicated. We have derived the summary consolidated financial data for the years ended December 31, 2008, 2009 and 2010 from our audited consolidated financial statements for such years. Our audited consolidated financial statements as of December 31, 2009 and 2010 and for the years ended December 31, 2008, 2009 and 2010 have been included in this prospectus.

The unaudited pro forma as adjusted consolidated statement of operations data set forth below for the year ended December 31, 2010 gives effect to (i) the acquisitions of Intellitactics, Inc. or “Intellitactics,” and Breach Security, Inc., or “Breach Security,” (ii) the Recapitalization, including the conversion of all of the outstanding shares of our Class A common stock, Class B common stock and preferred stock into a single class of common stock and the one-for- reverse stock split, and (iii) our issuance and sale of shares of common stock in this offering at an assumed public offering price of $ per share, which is the midpoint of the price range listed on the cover page of this prospectus, after deducting underwriting discounts and commissions and estimated offering expense payable by us, as if all such transactions had occurred on January 1, 2010. The operating results for Intellitactics and Breach Security are included in our statement of operations data for the year ended December 31, 2010 from their acquisition dates of March 1, 2010 and June 18, 2010, respectively.

The selected unaudited pro forma balance sheet data set forth below as of December 31, 2010 gives effect to the Recapitalization, including the conversion of all of the outstanding shares of our Class A common stock, Class B common stock and preferred stock into a single class of common stock and the one-for- reverse stock split, and the selected unaudited pro forma as adjusted balance sheet data set forth below as of December 31, 2010 also gives effect to our issuance and sale of shares of common stock in this offering at an assumed initial public offering price of $ per share, which is the midpoint of the price range listed on the cover page of this prospectus, after deducting underwriting discounts and commissions and estimated offering expenses payable by us, in each case as if such transactions had occurred on such date.

The unaudited pro forma consolidated financial data is provided for informational purposes only, does not necessarily present our financial position or results of operations as they would have been if the companies involved had constituted one entity for the period presented and is not necessarily indicative of our future results of operations or the results that might have occurred if the forgoing transactions had been consummated on the indicated date.

The summary historical and pro forma consolidated data presented below should be read in conjunction with the sections entitled “Risk Factors,” “Unaudited Pro Forma Consolidated Financial Data,” “Selected Historical Consolidated Financial Data,” “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and the consolidated financial statements and the related notes thereto and other financial data included elsewhere in this prospectus.


	For the Year Ended December 31,
	2008			2009			2010
										Pro Forma
							Actual			as Adjusted
	(in thousands, except share and per share data)

Statement of Operations Data:
Revenue:
Subscription revenue	$	44,356		$	56,708		$	81,677		$
Professional services		13,219			15,056			19,639
Product sales		753			1,343			10,187

Total revenue		58,328			73,107			111,503

Cost of sales:
Service delivery, excluding depreciation and amortization		22,525			26,431			33,415
Product sales, excluding depreciation and amortization		440			481			1,715
Depreciation and amortization		591			718			1,403

Total cost of sales		23,556			27,630			36,533

Gross profit		34,772			45,477			74,970

Operating expenses:
Product development		6,749			9,146			20,112
Sales and marketing		14,059			17,388			29,264
General and administrative		16,030			20,511			29,602

Total operating expenses		36,838			47,045			78,978

Loss from operations		(2,066	)		(1,568	)		(4,008	)
Interest expense, net		(151	)		(112	)		(87	)
Other income (loss), net		193			(304	)		(155	)
Gain on acquisition		—			552			—

Loss before income taxes		(2,024	)		(1,432	)		(4,250	)
Income tax expense		(22	)		(114	)		(372	)

Net loss	$	(2,046	)	$	(1,546	)	$	(4,622	)	$

Cumulative annual preferred dividends⁽¹⁾	$	(1,441	)	$	(1,800	)	$	(1,800	)

Net loss attributable to common shareholders	$	(3,487	)	$	(3,346	)	$	(6,422	)

Net loss per common share (basic and diluted)⁽²⁾	$	(0.05	)	$	(0.05	)	$	(0.07	)	$
Weighted-average number of shares used to compute net loss per common
share (basic and diluted)⁽²⁾		71,047,256			73,904,725			89,109,669
Other Data:
Adjusted EBITDA⁽³⁾	$	407		$	3,079		$	4,856		$
Net cash provided by (used in):
Operating activities		671			20,943			(10,212	)
Investing activities		(2,226	)		(2,292	)		8,581
Financing activities		6,668			(1,165	)		(7,495	)
Depreciation and amortization		2,136			3,012			4,970
Capital expenditures		1,786			2,743			4,273


	As of December 31, 2010
					Pro Forma
	Actual		Pro Forma		as Adjusted
	(in thousands)

Balance Sheet Data:
Cash and cash equivalents	$	14,558	$		$
Working capital⁽⁴⁾		256
Total assets		122,068
Total debt		—		—		—
Total convertible redeemable preferred stock⁽⁵⁾		21,434		—		—
Total stockholders’ equity		36,203


(1)		Represents the cumulative annual dividends payable on our outstanding preferred stock. Such dividends are payable only upon liquidation, dissolution or winding up of the Company or when and if declared by our board of directors. Our board of directors has not declared any dividends on our preferred stock and all accumulated dividends on such preferred stock will be extinguished in connection with the Recapitalization. For additional information regarding the terms of our existing preferred stock, see notes 13 and 14 to our consolidated financial statements included elsewhere in this prospectus.

(2)		Net loss per common share (basic and diluted) and the weighted average number of shares used to compute net loss per common share (basic and diluted) for the years ended December 31, 2008, 2009 and 2010 on an actual basis have been calculated without giving effect to the Recapitalization. Pro forma as adjusted net loss per common share (basic and diluted) and the weighted average number of shares gives effect to the Recapitalization and issuance and sale of shares in this offering.

(3)		We present Adjusted EBITDA, a non-GAAP measure, in this prospectus to provide investors with a supplemental measure of our operating performance. We believe that Adjusted EBITDA is a useful performance measure and is used by us to facilitate a comparison of our operating performance on a consistent basis from period-to-period and to provide for a more complete understanding of factors and trends affecting our business than GAAP measures can provide alone. Our board of directors and management also use Adjusted EBITDA as one of the primary methods for planning and forecasting overall expectations and for evaluating on a quarterly and annual basis actual results against such expectations, and as a performance evaluation metric in determining achievement of certain compensation programs and plans for employees, including our senior executives.

		We believe Adjusted EBITDA may be useful to investors in comparing our operating performance consistently over time as it removes from our operating results the impact of our capital structure, asset base (primarily depreciation and amortization), items outside the control of the management team (such as taxes or changes in foreign currency exchange rates) and other non-cash (purchase accounting adjustments) or non-recurring items, including the impact of non-cash stock-based compensation expense.

		We define Adjusted EBITDA, a non-GAAP financial measure, as net income (loss) before income tax expense (benefit), depreciation and amortization, net interest expense, stock-based compensation, gain (loss) on foreign currency exchange, severance and transition costs, and acquisition, transaction and integration expenses.

		The use of Adjusted EBITDA has limitations as an analytical tool and you should not consider this performance measure in isolation from, or as an alternative to, GAAP measures such as net income (loss). Adjusted EBITDA is not a measure of liquidity under GAAP or otherwise, and is not an alternative to cash flow from continuing operating activities. The limitations of Adjusted EBITDA include: (i) it does not reflect our cash expenditures or future requirements for capital expenditures or contractual commitments; (ii) it does not reflect changes in, or cash requirements for, our working capital needs; (iii) it does not reflect income tax payments we may be required to make; and (iv) although depreciation and amortization are non-cash charges, the assets being depreciated and amortized often will have to be replaced in the future, and Adjusted EBITDA does not reflect any cash requirements for such replacements.

		To properly and prudently evaluate our business, we encourage you to review our audited consolidated financial statements included elsewhere in this prospectus and the reconciliation to Adjusted EBITDA from net loss, the most directly comparable financial measure presented in accordance with GAAP, set forth in the table below. All of the items included in the reconciliation from net income to Adjusted EBITDA are either (i) non-cash items or (ii) items that management does not consider in assessing our on-going operating performance. In the case of the non-cash items, management believes that investors may find it useful to assess our comparative operating performance because the measures without such items are less susceptible to variances in actual performance resulting from depreciation, amortization and other non-cash charges and more reflective of other factors that affect operating performance. In the case of the other items that management does not consider in assessing our on-going operating performance, management believes that investors may find it useful to assess our operating performance if the measures are presented without these items because their financial impact may not reflect on-going operating performance.


	For the Year Ended December 31,
	2008			2009			2010
										Pro Forma
							Actual			as Adjusted
	(unaudited)
	(in thousands)

Net loss	$	(2,046	)	$	(1,546	)	$	(4,622	)	$
Income tax expense		22			114			372
Depreciation and amortization		2,136			3,012			4,970
Interest expense, net		151			112			87
Stock-based compensation expense^(a)		285			278			1,026
(Gain) loss on foreign currency exchange		(178	)		259			232
Severance and transition costs^(b)		—			948			1,268
Acquisition, transaction and integration expenses^(c)		37			(98	)		1,523

Total adjustments		2,453			4,625			9,478

Adjusted EBITDA	$	407		$	3,079		$	4,856		$

(footnotes continued on following page)


	(a)	Represents non-cash compensation expense.

	(b)	Represents severance and transition payments made to employees that were terminated as a result of acquisitions and to certain members of our senior management team whose positions were restructured in contemplation of this offering.

	(c)	Represents costs and expenses associated with acquisitions, transactions and integration activities during the period, including the following:


	For the Year Ended December 31,
	2008		2009			2010
								Pro Forma
						Actual		as Adjusted
	(unaudited)
	(in thousands)

Acquisition costs⁽ⁱ⁾	$	3	$	271		$	261	$
Transaction costs for potential acquisitions⁽ⁱⁱ⁾		34		5			494
Financial reporting costs for acquired companies⁽ⁱⁱⁱ⁾		—		113			195
Lease abandonment^(iv)		—		—			342
Post acquisition purchase accounting adjustments^(v)		—		65			231
Gain on acquisition^(vi)		—		(552	)		—

Total acquisition, transaction and integration expenses	$	37	$	(98	)	$	1,523	$


	(i)	Represents legal fees incurred in connection with acquisitions during the period.

	(ii)	Represents legal, accounting and other consulting fees incurred in connection with transactions that were not completed.

	(iii)	Represents valuation services and audits of acquired companies.

	(iv)	Represents the lease abandonment accrual for our facility in Carlsbad, California.

	(v)	Represents certain adjustments relating to the purchased assets and assumed liabilities of Mirage Networks, Inc., BitArmor Systems, Inc. and Breach Security, Inc. which we identified subsequent to finalizing the purchase accounting for such acquisitions.

	(vi)	Represents the gain on acquisition of Mirage Networks, Inc.


(4)		Working capital is the amount by which current assets exceed current liabilities.

(5)		Our Series A-1 preferred stock and Series A-2 preferred stock can be redeemed upon the written request of the holders of two-thirds of our Series A-1 preferred stock or Series A-2 preferred stock, respectively, at an amount equal to their respective liquidation preferences. Since this redemption feature is not in our control, and does not have a date certain or event certain redemption requirement, we have classified our Series A-1 preferred stock and Series A-2 preferred stock as temporary equity on our consolidated balance sheet. For additional information regarding the terms of our preferred stock, see note 14 to the notes to our consolidated financial statements included elsewhere in this prospectus.

RISK FACTORS

Investing in our common stock involves a high degree of risk. You should carefully consider the risks described below, together with the financial and other information contained in this prospectus, before you decide to purchase shares of our common stock. If any of the following risks actually occurs, our business, financial condition, results of operations, cash flow and prospects could be materially and adversely affected. As a result, the trading price of our common stock could decline and you could lose all or part of your investment in our common stock. Before deciding whether to invest in our common stock, you should also refer to the other information contained in this prospectus, including our consolidated financial statements and related notes.

Risks Relating to Our Business

A substantial portion of our revenue is derived from our solutions that help organizations validate, achieve and maintain PCI compliance and, as a result, our business and results of operations could be materially adversely affected if PCI is changed, cancelled, replaced or not enforced, new or different technologies that minimize the need for PCI are widely adopted, or we lose any of our PCI certifications.

We generate a substantial portion of our revenues from our solutions that help organizations achieve and maintain compliance with PCI, and we expect that will continue for the foreseeable future. Our PCI compliance solutions, including our TrustKeeper solution, are based on the PCI security standards developed and maintained by the PCI Security Standards Council, or the “PCI Council.” The PCI Council may adopt significant changes to PCI with little or no notice, including changes that could make PCI more or less onerous for businesses. Governments may also adopt laws or regulations that conflict with PCI. If we are unable to timely adapt our compliance solutions to such changes, our subscribers and members of our partner network may lose confidence in our products and could switch to products offered by our competitors. If security standards are changed in a manner that makes them less onerous, our subscribers and members of our partner network may view PCI compliance as less critical to their businesses, and our partner network members may be less aggressive in requiring validation with PCI and in recommending our products to their customers.

Our growth strategy depends to a significant extent on our ability to cross-sell our compliance enablement solutions to subscribers who utilize our compliance management solutions. If the PCI Council were to prohibit or limit us from cross-selling our enablement solutions to subscribers who utilize our compliance management solutions, we would be unable to pursue a significant aspect of our growth strategy, which could have a material adverse effect on our growth prospects and our results of operations.

The introduction of products and services embodying new technologies could render our existing products and services obsolete and unmarketable. Other payment security technologies exist or could be developed in the future, and our business could be materially negatively affected if such technologies are widely adopted. For example, businesses in the United Kingdom utilize the “chip and pin” smartcard payment system in which payment cards are embedded with a microchip and are authenticated automatically using a personal identification number. This technology has been adopted in other countries, particularly in Europe, and we expect that this trend will continue. Although we believe the “chip and pin” technology does not replace or eliminate the need for our compliance solutions, customers and potential customers may nevertheless view our solutions as less critical to their businesses. Other security technologies not based on PCI could also be developed and adopted by businesses, which could result in our customers switching to those alternative technologies. We may not be able to successfully anticipate or adapt to changing technology or customer requirements on a timely basis, or at all. If we fail to keep up with technological changes or to convince our customers and potential customers of the value of our solutions even in light of new technologies, our business and financial condition could be materially adversely affected.

In addition, domestic or international jurisdictions could adopt new laws or regulations that conflict with or minimize the importance of PCI. If we are unable to timely and effectively respond to any changes in the laws or regulations governing data security compliance, our business could be negatively affected.

Another important aspect of our growth strategy is the expansion of our international operations. Although PCI applies globally, compliance may be enforced less aggressively in international jurisdictions as compared to the U.S. or businesses in international jurisdictions may be less sensitive to data security compliance. As a result, we

could expend considerable time and resources on our international growth strategy without any assurances of success, or our international sales may grow more slowly than we expect. In addition, international jurisdictions may have laws or regulations that conflict with PCI, and we may be unable to adapt our solutions to such laws or regulations, which could limit our opportunities for international expansion.

We also hold certain certifications under the requirements of the PCI Council, including “Qualified Security Assessor,” “Approved Scanning Vendor” and “Qualified PCI Forensic Investigator.” If we were to lose any or all of these certifications, whether due to changes in PCI, the failure of our products to comply with PCI or for any other reason, our ability to operate our business could be materially adversely affected.

The loss of a significant member or group of members of our partner network, the failure to engage new partners or the decision by one of our partners to use our products less or compete against us, could materially adversely affect our operations and sales.

We derive a substantial portion of our revenue from our relationships with our partner network, which includes financial institutions, payment service providers and other organizations influential to the compliance and data security mandates of their customers. We expect to continue to depend on a relatively small number of organizations in our partner network for a significant percentage of our revenue for the foreseeable future. Our agreements with the members of our partner network are non-exclusive, and if they choose to use our products less or place greater emphasis on compliance solutions offered by our competitors, or if they otherwise fail to enroll their customers in our compliance solutions, our ability to grow our sales and customer base may be adversely affected. The unforeseen loss of one or more of our major partners, or the decision of one or more of our major partners to emphasize our competitors’ products or develop their own products, could seriously harm our business.

In addition, our continued revenue growth will depend in part on our ability to expand our partner network. Engaging new partners requires the expenditure of a considerable amount of time and resources by our management, sales force and other key employees, and we cannot assure you that our efforts will prove successful. To the extent we are unable to enter into arrangements with new partners, our ability to sell our solutions to new customers will be harmed, and our results of operations and financial condition could be negatively affected.

If we are unable to develop and maintain relationships with businesses, government entities and other organizations within our existing partner network that have not enrolled their customers into TrustKeeper, or whose customers have enrolled but have not become subscribers, our operating results may decline.

Our growth strategy depends to a significant extent on our ability to enroll our existing partner network’s customers into our TrustKeeper solution. We depend on our partners to help us identify these potential enrollees, enroll them in TrustKeeper and encourage them to become subscribers. We and our partners may be unsuccessful in obtaining new enrollees or converting enrollees to subscribers, which could negatively affect our results of operations.

We face intense competition in our market, both from larger, better-known companies and from more targeted competitors; we may lack sufficient financial or other resources to maintain or improve our competitive position.

We compete with a large and broad array of established and emerging compliance and data security vendors in a highly fragmented and competitive environment. Our principal competitors vary across our suite of data security solutions and between our enterprise and small- and medium-sized business customers. We principally compete with hundreds of smaller, private companies and, to a lesser extent, a more limited number of larger, more established companies. A few of our larger competitors have a broad array of compliance enablement solutions and other security software products and may be able to offer products or functionality similar to ours at a more attractive price by integrating or bundling them more effectively than we can. Our competitors may attempt to further expand their presence in the data security compliance market and compete more directly against one or more of our products, services or solutions.

Some of these existing and potential competitors may enjoy competitive advantages such as:


	•	greater name recognition and longer operating histories;

	•	larger sales and marketing budgets and resources;

	•	broader distribution and established relationships with network partners and customers;

	•	access to larger customer bases;

	•	greater customer support resources;

	•	greater resources to make acquisitions;

	•	lower labor and development costs or increased economies of scale; and

	•	substantially greater financial, technical and other resources.

Some of our competitors have substantially larger installed customer bases beyond the data security compliance market and leverage their relationships based on other products, services or solutions or incorporate data security functionality into their existing products or services in a manner that may discourage users from purchasing our products or solutions. These larger competitors may also have more diversified businesses that allow them to better withstand significant reduction in capital spending by customers in a number of markets.

Conditions in our markets could change rapidly and significantly as a result of technological advancements or market consolidation. Our current and potential competitors may also establish cooperative relationships among themselves or with third parties that may further enhance their resources and product and services offerings in the markets we address. In addition, current or potential competitors may be acquired by third parties with greater available resources. As a result of such acquisitions, our current or potential competitors might be able to adapt more quickly to new technologies and customer needs, devote greater resources to the promotion or sale of their products and services, initiate or withstand substantial price competition, and more readily develop and expand their product and service offerings. These competitive pressures in our market or our failure to compete effectively may adversely affect our operating results and market share.

We may not be able to compete effectively with companies that integrate or bundle products similar to ours with their other product offerings, and consolidation within our industry may heighten this risk.

Many large, integrated software companies offer suites of products that include software applications for security and compliance management. In addition, hardware vendors, including diversified, global concerns, offer products that address the security and compliance needs of certain enterprises that comprise our target market. Further, several companies currently sell software products that our customers and potential customers have broadly adopted, providing them a substantial advantage when they sell products that perform functions substantially similar to some of our products. Competitors that offer a large array of security or software products may be able to offer products or functionality similar to ours at a more attractive price than we can by integrating or bundling them with their other product offerings. Consolidation in our industry increases the likelihood of competition based on integration or bundling. Customers may also increasingly seek to consolidate their enterprise-level software purchases with a small number of larger companies that can purport to satisfy a broad range of their requirements. If we are unable to sufficiently differentiate our products from the integrated or bundled products of our competitors, such as by offering enhanced functionality, performance or value, we may see a decrease in demand for our products, which would adversely affect our business, operating results and financial condition. Similarly, if customers seek to concentrate their software purchases with a few large providers, we may be at a competitive disadvantage.

those products, which would adversely affect our business, operating results and financial condition. Further, it is possible that continued industry consolidation may impact customers’ perceptions of the viability of smaller or even medium-sized firms and consequently customers’ willingness to purchase from such firms. Similarly, if customers seek to concentrate their software purchases in the product portfolios of a few large providers, we may be at a competitive disadvantage notwithstanding the superior performance that we believe our products can deliver.

If we are not successful in executing our strategy to increase our sales to larger enterprises, our results of operations may suffer.

Part of our growth strategy is to increase sales of our compliance solutions to enterprise customers. Sales to enterprise customers involve risks that may not be present, or that are present to a lesser extent, with sales to small- and medium-sized organizations. These risks include:


	•	increased competition from larger competitors that traditionally target enterprises, service providers and government entities and that may already have purchase commitments from those customers;

	•	increased purchasing power and leverage held by large customers in negotiating contractual arrangements with us;

	•	more stringent requirements in our support service contracts, including stricter support response times, and increased penalties for any failure to meet support requirements; and

	•	longer sales cycles and the associated risk that substantial time and resources may be spent on a potential customer who elects not to purchase our products and services.

Large enterprises often undertake a significant evaluation process that results in a lengthy sales cycle. We may spend substantial time, effort and money in our sales efforts without being successful in producing any sales. In addition, product and service purchases by enterprises are frequently subject to budget constraints, multiple approvals, and unplanned administrative, processing and other delays. Finally, enterprises typically have longer implementation cycles, require greater product functionality and scalability and a broader range of services (including design services), demand that vendors such as us take on a larger share of risks, sometimes require acceptance provisions that can lead to a delay in revenue recognition and expect greater payment flexibility. All of these factors can add further risk to business conducted with these customers. If sales expected from a large customer for a particular quarter are not realized in that quarter or at all, our business, operating results and financial condition could be materially adversely affected.

Our efforts to expand our product and service offerings beyond the PCI market may not succeed.

One aspect of our growth strategy is the expansion of our partner network in health care and government services in order to facilitate the distribution of solutions that address regulations and standards other than PCI, such as HIPAA and FISMA. Our experience with compliance solutions for such regulations and standards is limited. This strategy will likely require us to invest a significant amount of time and resources with no assurances of success. Our product and service offerings for non-PCI markets may not be adopted by potential customers or may otherwise fail to achieve commercial success. In addition, we may be unable to develop a partner network for these solutions similar to the network we have developed for our PCI compliance solutions. If we are not successful in executing on this aspect of our growth strategy, our business, operating results and financial condition could be materially adversely affected.

Defects or vulnerabilities in our products or services or the failure of our products to adequately prevent a data security breach or protect data assets could harm our reputation and sales of our products and services and expose us to liability for losses.

Because our products are complex, undetected errors, failures or bugs may occur, especially when products are first introduced or when new versions are released despite our efforts to test those products and enhancements prior to release. Defects, errors or vulnerabilities may make our products susceptible to hacking or electronic break-ins or otherwise cause them to fail to help secure data. Any such failures may temporarily or permanently expose our

customers’ data, leaving their data unprotected against the latest security threats. We may not be able to correct defects, errors, vulnerabilities or failures promptly, or at all.

In addition, our products or services could be perceived to be ineffective for a variety of reasons outside of our control. Hackers could circumvent our customers’ security measures, and customers may misuse our products resulting in a security breach or perceived product failure. We provide an enterprise-grade security compliance solution that integrates with a variety of other elements in a customer’s IT and security infrastructure, and we may receive blame for a security breach that was the result of the failure of one of the other elements. The occurrence of a breach, whether or not caused by our products, could delay or reduce market acceptance of our products, and have an adverse effect on our business and financial performance, and any necessary revisions to our products may cause us to incur significant expenses.

Any defects, errors, vulnerabilities or failures in our products or services could result in:


	•	expenditure of significant financial and product development resources in efforts to analyze, correct, eliminate or work-around errors or defects or to address and eliminate vulnerabilities;

	•	loss of existing or potential partners or customers;

	•	loss or disclosure of confidential information or our proprietary technology;

	•	delayed or lost revenue;

	•	delay or failure to attain market acceptance;

	•	lost market share;

	•	negative publicity, which will harm our reputation; and

	•	litigation, regulatory inquiries or investigations that may be costly and harm our reputation.

In addition, an actual or perceived security breach of the data of one of our customers or our own systems, regardless of whether the breach is attributable to the failure of our products to prevent the security breach, could adversely affect the market’s and our customers’ perception of us as a leading data security compliance company or of our security products and services. Such an occurrence could result in negative press coverage and negatively affect our reputation. Any reputational harm to our company or our brand, or to any of our security products and services, may result in the loss of existing customers or make it more difficult for us to engage new customers.

With respect to enterprise customers, our qualified security assessors could also unintentionally provide erroneous compliance validations. If that were to occur, we could be exposed to liability, suffer reputational damage or, if we do not timely rectify the issue, be placed on a remediation list by PCI or lose or Qualified Security Assessor certification.

Although we have limitation of liability provisions in our standard terms and conditions of sale, they may not fully or effectively protect us from claims as a result of federal, state or local laws or ordinances or unfavorable judicial decisions in the United States or other countries. In addition, some of our customer agreements may require us to indemnify our customers for any claims or losses resulting from defects, errors or vulnerabilities in, or infringement by, our products. The sale and support of our products also entail the risk of product liability claims. We maintain insurance to protect against certain claims associated with the use of our products, but our insurance coverage may not adequately cover any claim asserted against us. In addition, even claims that ultimately are unsuccessful could result in our expenditure of funds in litigation and divert management’s time and other resources.

If we fail to timely update our products in response to new security threats or to detect security attacks, our customers’ systems and data could be compromised.

The threats facing our customers are constantly evolving and the techniques used by attackers to access or sabotage data change frequently. Our signature operations team develops signatures for new and emerging malicious code and malware. When incorporated into certain of our products, the signatures identify malicious code or malware and prevent the threat from affecting our customer’s systems and data. If we fail to timely update

signatures, such that new or modified malicious code or malware are not detected by our products, our customers who utilize those products may suffer a data security breach, which could cause damage to their network and systems and loss of their data.

In addition, our teams that support our compliance enablement solutions provide real-time threat monitoring and detection for our customers. If we fail to discover a security attack against a customer, whether due to defects or vulnerabilities in our systems or our failure to timely update our threat protection systems in response to new threats, or fail to notify a customer of an attack, such customer’s network could be compromised, potentially resulting in damage to their network and systems and loss of their data.

Any such security incidents could result in the loss of customers or partners and harm our brand and reputation, which could have a material adverse effect on our business and results of operations.

If our internal network system is compromised by computer hackers, public perception of our security products and services will be harmed.

We will not succeed unless the marketplace is confident that we provide effective security protection. Because we provide security products, we may be a more attractive target for attacks by computer hackers. If an actual or perceived breach of network security occurs in our internal systems, it could adversely affect the market perception of our products and services, and may expose us to the loss of information, litigation and possible liability. In addition, such a security breach could impair our ability to operate our business, including our ability to provide support services to our customers. If this happens, our revenue could decline and our business could suffer.

Damage or disruptions to our facilities, including our corporate headquarters and third-party data center hosting facility, could impair the delivery of our products and services and materially adversely affect our business, operating results and financial condition.

Most of our sales, finance and administrative operations, and a portion of our development operations, are conducted at our corporate headquarters in Chicago, Illinois. Although we take precautions to safeguard our Chicago facility, including through physical security measures, insurance, security procedures, health and safety protocols and off-site back up of computer data, any loss of or damage or disruption to this facility could harm our ability to timely and effectively meet our customers’ data security compliance requirements, which in turn could materially adversely affect our business, operating results and financial condition.

In addition, we currently serve a substantial portion of our customers from a third-party data center hosting facility. As part of our current disaster recovery arrangements, our production environment and all of our business critical data is replicated in near real-time to our secondary data center in our corporate headquarters. Any damage to, or failure of, our data center hosting facility or recovery facility could result in interruptions in our products and services. As we add data centers and add capacity in our existing primary data center, we may move or transfer our data and our customers’ data. Despite precautions taken during this process, any unsuccessful data transfers may impair the delivery of our service. Interruptions in our service may reduce our revenue and harm our ability to attract new customers. Our business will also be harmed if our customers and potential customers believe our service is unreliable. Despite precautions taken at our third-party data center hosting facility, the occurrence of a natural disaster or an act of terrorism, a decision to close the facility without adequate notice or other unanticipated problems at that facility could result in lengthy interruptions in our service.

We cannot be certain that our development activities will be successful or will not incur delays or cost overruns.

While our management team is committed to enhancing our current product and services offerings and introducing innovative new products and services, we cannot be certain that our development activities will be successful or that we will not incur delays or cost overruns. Furthermore, we may not have sufficient financial resources to identify and develop new technologies and bring product enhancements or new products and services to market in a timely and cost effective manner. New technologies and product enhancements could be delayed or cost more than we expect, and we cannot ensure that any such products or services will be commercially successful if and when they are introduced.

The data security compliance industry is rapidly evolving and the complex technology integrated in our products makes them difficult to develop. If we do not accurately predict, prepare for and respond promptly to technological and market developments and changing customer needs and develop corresponding products, our competitive position and prospects will be harmed.

Our future success depends on our ability to respond to the rapidly changing needs of our customers by developing or introducing new products, product upgrades, services and solutions in a timely manner. We have in the past incurred, and will continue to incur, development expenses as we strive to remain competitive. New product development and introduction involves a significant commitment of time and resources and is subject to a number of risks and challenges including:


	•	managing the length of the development cycle for new products and product enhancements;

	•	adapting to emerging and evolving industry standards and to technological developments by our competitors and customers;

	•	entering into new or unproven markets with which we have limited experience;

	•	managing new product and service strategies;

	•	integrating acquired products and technologies;

	•	trade compliance issues affecting our ability to ship new or acquired products;

	•	protecting our intellectual property and other proprietary rights;

	•	developing or expanding efficient sales channels and partners; and

	•	obtaining sufficient licenses to technology and technical access from operating system software vendors on reasonable terms to enable the development and deployment of interoperable products, including source code licenses for certain products with deep technical integration into operating systems.

In addition, the data security compliance industry is expected to continue to evolve rapidly. Many of our customers operate in dynamic and rapidly changing markets that require them to continuously evolve their IT infrastructure, including adding numerous network access points and adapting increasingly complex enterprise networks, integrating a variety of hardware, software applications, operating systems and networking protocols. In addition to the rapidly changing network environments, computer hackers and others who try to attack networks are employing increasingly sophisticated techniques to gain access to and attack systems and networks. In order to remain competitive, we need to accurately anticipate changes in IT infrastructure that our customers will deploy, the security vulnerabilities of such infrastructure as well as likely attack techniques, and to continue to develop and introduce solutions that successfully address the evolving threats while minimizing the impact on IT infrastructure performance.

Although the market expects rapid development and commercial introduction of new products or product enhancements to respond to changing infrastructure and evolving threats, the development of these products is difficult and the timeline for their release and availability can be uncertain. We have in the past and may in the future experience unanticipated delays in the availability of new products and services and fail to meet previously announced timetables for such availability. If we do not quickly respond to the rapidly changing and rigorous needs of our customers by timely developing and releasing new products and services or enhancements that can respond adequately to new security threats, our competitive position and business prospects could be materially harmed.

If our new products and product enhancements do not achieve sufficient market acceptance, our results of operations and competitive position will suffer.

We spend substantial amounts of time and money to develop new products or enhanced versions of our existing products to integrate additional features, improved functionality or other enhancements in order to meet our customers’ rapidly evolving demands for data security compliance in our highly competitive industry. When we develop a new product or an enhanced version of an existing product, we typically incur expenses and expend resources upfront to market, promote and sell the new offering. Therefore, when we develop and introduce new or

enhanced products, they must achieve high levels of market acceptance in order to justify the amount of our investment in developing and bringing them to market.

Our new products or product enhancements could fail to attain sufficient market acceptance for many reasons, including:


	•	delays in releasing our new products or enhancements to the market;

	•	failure to accurately predict changes in the laws, regulations and industry standards applicable to digital data, particularly payment card processing data;

	•	failure to adapt the functionality of our products in a timely fashion in response to changes in laws, regulations and industry standards;

	•	inability to interoperate effectively with the networks or applications of our prospective customers;

	•	inability to protect against new types of attacks or techniques used by hackers;

	•	defects, errors or failures;

	•	negative publicity about their performance or effectiveness;

	•	introduction or anticipated introduction of competing products by our competitors;

	•	easing of regulatory requirements around security; and

	•	reluctance of customers to purchase products incorporating open source software.

If our new products or enhancements do not achieve adequate acceptance in the market, our competitive position will be impaired, our revenue will be diminished and the effect on our operating results may be particularly acute because of the significant research, development, marketing, sales and other expenses we incurred in connection with the new product or enhancement.

If we fail to effectively manage our growth, our business and operating results could be harmed.

We have experienced, and we expect to continue to experience, rapid growth in our operations, which will continue to place significant demands on our management, employees and operational and financial infrastructure. As we continue to grow, we must effectively integrate, develop and motivate a large number of new employees, and we must maintain the beneficial aspects of our corporate culture. In particular, we intend to continue to make substantial investments to expand our product development, sales and general and administrative organizations, and our international operations. To attract top talent, we have had to offer, and believe we will need to continue to offer, highly competitive compensation packages. The risks of over-hiring or over-compensating and the challenges of integrating a rapidly growing employee base into our corporate culture may be exacerbated by our international expansion. Additionally, we may not be able to hire new employees, particularly product development specialists and sales personnel, quickly enough to meet our needs. If we fail to effectively manage our hiring needs and successfully integrate our new hires, our efficiency and ability to meet our forecasts and our employee morale, productivity and retention could suffer, and our business and operating results could be adversely affected.

Additionally, if we do not effectively manage the growth of our business and operations, the quality and effectiveness of our solutions could suffer, which could negatively affect our brand, operating results and overall business. To effectively manage this growth, we will need to continue to improve our operational, financial and management controls, and our reporting systems and procedures by, among other things:


	•	improving our IT infrastructure to maintain the effectiveness of our solutions;

	•	enhancing our internal controls to ensure timely and accurate reporting of all of our operations; and

	•	appropriately documenting our IT systems and our business processes.

These systems enhancements and improvements will require significant capital expenditures and allocation of management and employee resources, and there are no assurances that any enhancements or improvements will be sufficient to keep up with our growth. If we fail to implement these enhancements and improvements effectively,

our ability to manage our expected growth and comply with the rules and regulations that are applicable to public companies will be impaired.

We do not expect that our revenue growth will continue at historical rates.

Over the last five years, our net revenue has grown at a compound annual growth rate of 43% and, for the year ended December 31, 2010, we reported total revenue of $111.5 million, representing an increase of 53% and 91% as compared to the years ended December 31, 2009 and December 31, 2008, respectively. Although we believe our revenue will continue to increase in the near term as we implement our growth strategy and benefit from the increasing demand for data security compliance solutions and the key differentiators of our solutions, we do not expect that our revenue growth will continue at these historical rates due, in part, to the increasing size of our revenue base that will be used for comparison purposes. In addition, our expectation that our revenue will continue to increase in the near term is based on a number of important assumptions and subject to a number of risks and uncertainties, many of which are outside of our control. As a result, we cannot provide any assurances that such assumptions will ultimately turn out to be correct and that our revenue will continue to increase in the near term, either on a year-over-year or a sequential quarterly basis.

We have a history of losses, and we are unable to predict the extent of any future losses or when, if ever, we will achieve profitability in the future.

We have incurred net losses in recent years, including net losses of $1.5 million in 2009 and $4.6 million in 2010. As a result, we had an accumulated deficit of $24.1 million at December 31, 2010. Although we have been profitable in certain periods in the past, we may not be able to achieve or sustain profitability in future periods. Achieving profitability will require us to increase revenue, manage our cost structure, including the borrowing costs on our debt, and not experience unanticipated liabilities. Revenue growth may slow or revenue may decline for a number of possible reasons, including slowing demand for our products or services, increasing competition, a decrease in the growth of our overall market, or if we fail for any reason to continue to capitalize on growth opportunities. Any failure by us to obtain and sustain profitability, or to continue our revenue growth, could cause the price of our common stock to decline significantly.

The market for on-demand applications may develop more slowly than we expect.

The market for on-demand application products is not as mature as the market for packaged software, and it is uncertain whether these products will achieve and sustain high levels of demand and market acceptance. Our success will depend, to a large extent, on the willingness of businesses, large and small, to accept and increase their use of on-demand data security compliance solutions. Many larger enterprises may have invested substantial effort and financial resources to integrate traditional enterprise software into their businesses and may be reluctant or unwilling to switch to a different solution or to migrate these applications to on-demand services. Furthermore, some enterprises may be reluctant or unwilling to use enterprise on-demand application services because they have concerns regarding the risks associated with security capabilities, among other things, of the technology delivery model associated with these products. If enterprises do not perceive the benefits of enterprise on-demand application products, then the market for these products may not develop at all, or it may develop more slowly than we expect, either of which would significantly adversely affect our operating results. In addition, we may make errors in predicting and reacting to relevant business trends, which could harm our business. The market for our solutions may not develop further, or may develop more slowly than we expect, either of which would harm our business.

If we are unable to hire, retain and motivate qualified personnel, our business will suffer.

Our future success depends, in part, on our ability to continue to attract and retain highly skilled personnel. The loss of the services of any of our key personnel, the inability to attract or retain qualified personnel, or delays in hiring required personnel, particularly in product development and sales, may seriously harm our business, financial condition and results of operations. None of our key employees has an employment agreement for a specific term, and any of our employees may terminate their employment at any time. Our ability to continue to attract and retain highly skilled personnel will be critical to our future success. Competition for highly skilled personnel is frequently

intense and we may not be successful in attracting, assimilating or retaining qualified personnel to fulfill our current or future needs.

Our ability to operate our business effectively could be impaired if we fail to retain our senior management.

Our future performance depends on the continued services and continuing contributions of our senior management to execute on our business plan, and to identify and pursue new opportunities and product innovations. Our management team has significant industry experience and would be difficult to replace. These individuals possess sales, marketing, product development, technical, financial and administrative skills and relationships that are critical to the operation of our business. The loss of any of our senior managers could significantly delay or prevent the achievement of our development and strategic objectives. In addition, members of our senior management may be distracted by activities unrelated to our business. The loss of the services, or distraction, of our senior management for any reason could adversely affect our business, financial condition and results of operations.

We face numerous risks relating to the protection and enforceability of our intellectual property rights and our use of third-party intellectual property, many of which could result in the loss of our intellectual property rights as well as other material adverse impacts on our business and financial results and condition.

We rely on a combination of contractual rights, trademarks, trade secrets, patents and copyrights to establish and protect our intellectual property rights in our technology and products. However, despite these measures, our intellectual property rights could be challenged, invalidated, circumvented or misappropriated. Competitors may independently develop technologies or products that are substantially equivalent or superior to our products or that inappropriately incorporate our proprietary technology into their products. Competitors may hire our former employees who may misappropriate our proprietary technology. Certain jurisdictions may not provide adequate legal infrastructure for effective protection of our intellectual property rights. Changing legal interpretations of liability for unauthorized use of our technologies or products or lessened sensitivity by corporate, government or institutional users to refraining from intellectual property piracy or other infringements of intellectual property could also harm our business. We also rely on key technologies developed or licensed by third parties, and we may not be able to obtain or renew such licenses from these third parties at all or on reasonable terms.

With respect to some of our proprietary technologies, we have filed patent applications and obtained patents to protect our intellectual property rights in these technologies as well as the interests of our licensees. There can be no assurance that our patent applications will be approved, that any patents issued will adequately protect our intellectual property rights, or that such patents will not be challenged by third parties or found by a judicial authority to be invalid or unenforceable.

We rely on several registered and unregistered trademarks to protect our brand. Third parties may use trademarks similar to our trademarks in different fields of use and any potential confusion as to the source of goods or services could have a material adverse effect on our business, financial condition and results of operation.

Litigation may be necessary to enforce and protect our trade secrets, patents and other intellectual property rights. Similarly, we may be required to defend against claimed infringement.

In order to enforce and protect our intellectual property rights, it may be necessary for us to initiate litigation against third parties, such as patent infringement suits or interference proceedings. Any lawsuits that we initiate could be expensive, take significant time and divert management’s attention from other business concerns. Litigation also puts our patents at risk of being invalidated or interpreted narrowly and our patent applications at risk of not issuing. Additionally, we may provoke third parties to assert counterclaims against us. We may not prevail in any lawsuits that we initiate and the damages or other remedies awarded, if any, may not be commercially valuable. The occurrence of any of these events may adversely affect our financial condition and results of operations.

Some of our products have been, and in the future could be, alleged to infringe existing intellectual property rights of third parties. Even if we believe that such claims are without merit, we cannot be certain that we will prevail in any intellectual property dispute.

The costs of defending litigation, and engaging in intellectual property litigation generally, may be substantial regardless of the merit of the claim or the outcome. Defending such intellectual property litigation can also distract management’s attention and resources. Successfully prosecuted claims of intellectual property infringement against us might also cause us to lose our proprietary rights, prevent us from developing or selling our products, redesign affected products, require us to enter into costly settlement agreements or to obtain licenses to patents or other intellectual property rights that our products are alleged to infringe. Such licenses may not be available on reasonable commercial terms, or at all.

The data security industry has increasingly been subject to patent and other intellectual property rights litigation, particularly from special purpose or so-called “non-practicing” entities that seek to monetize their intellectual property rights by asserting claims against others. We expect this trend to continue and, as we become a larger and more visible company, we expect this trend may accelerate with respect to us specifically. The litigation process is costly and subject to inherent uncertainties, and we may not prevail in litigation matters regardless of the merits of our position.

In addition, because we incorporate technology from third parties in our products, our exposure to infringement actions may increase because we must rely upon these third parties to verify the origin and ownership of such technology. Even if we have an agreement for such a third party to indemnify us against such costs, the indemnifying party may be unable to uphold its contractual obligations. If we cannot or do not license the infringed technology at all or on reasonable terms, or substitute similar technology from another source, our business and results of operations could be adversely impacted.

If we are unable to protect the confidentiality of our proprietary information and know-how, the value of our products could be adversely affected.

In addition to patented technology, we rely on our unpatented proprietary technology, trade secrets, processes and know-how. We generally seek to protect this information by confidentiality, non-disclosure and assignment of invention agreements with our employees, consultants and third parties. However, these agreements may be inadequate to protect our proprietary information and intellectual property rights. Moreover, those agreements may be breached and we may not have adequate remedies for any such breach. In addition, our trade secrets may be disclosed to or otherwise become known or be independently developed by competitors. To the extent that our employees, consultants or contractors use intellectual property owned by others in their work for us, disputes may arise as to the rights in related or resulting know-how and inventions. If we are unable to maintain the proprietary nature of our technologies, our business could be materially adversely affected.

Some of our products contain “open source” software, and any failure to comply with the terms of one or more of these open source licenses could adversely affect our business.

Certain of our products are distributed with software licensed by its authors or other third parties under “open source” licenses. Some of these licenses contain requirements that we make available our proprietary source code for modifications or derivative works we create based upon the open source software, and that we license such modifications or derivative works under the terms of a particular open source license or other license granting third parties certain rights of further use. If we combine our proprietary software with open source software in a certain manner, we could, under certain of the open source licenses, be required to release the source code of our proprietary software. In addition to risks related to license requirements, usage of open source software can lead to greater risks than use of third party commercial software, as open source licensors generally do not provide warranties or controls on origin of the software. We have established processes to help alleviate these risks, including a review process for screening requests from our development organizations for the use of open source, but we cannot be sure that all open source is submitted for approval prior to use in our products. In addition, many of the risks associated with usage of open source cannot be eliminated, as use of open source in our products could inadvertently occur, in part because open source license terms are often ambiguous. Companies that incorporate open source software into their products have, in the past, faced claims seeking enforcement of open source license provisions and claims asserting ownership of open source software incorporated into their products. Defending such claims or being required to disclose or make available our proprietary source code pursuant to an open source license could materially adversely affect our business.

We may be subject to claims that our employees or we have inadvertently or otherwise used or disclosed alleged trade secrets or other proprietary information of former employers of our employees.

We employ individuals who were previously employed at other technology companies, including our competitors or potential competitors. Therefore, we face exposure to infringement actions if those employees inadvertently or deliberately incorporate proprietary technology of our competitors into our products despite efforts by our competitors and us to prevent such misuse. Litigation may be necessary to defend against such claims, which could be costly and divert management’s attention. If any such claims are successfully asserted against us, we could be required to pay substantial damages or could be prevented from selling some or all of our products. If we are prevented from selling some or all of our products, our business and results of operations would be materially adversely affected.

We may be exposed to certain claims and liabilities if a consumer suffers a loss resulting from a data security breach involving a subscriber who displays our “Trustwave Trusted Commerce Seal” or if a consumer misinterprets our seal.

Our subscribers who maintain a website which accepts payment cards are permitted to display our Trustwave Trusted Commerce seal on their website. Displaying the seal is not meant to convey that the subscriber is PCI compliant; rather, the Trustwave Trusted Commerce seal directs the website user to click on the seal in order to obtain more information about steps that the subscriber has taken, if any, to validate compliance with PCI. Although the Trustwave Trusted Commerce seal contains a limitation of liability disclaimer, that disclaimer may not fully or effectively protect us from claims if a consumer relies on the seal in connection with a transaction and subsequently suffers a loss that results from a data security breach involving the subscriber. Furthermore, we could be subject to claims if a consumer misinterprets the display of the seal on a subscriber’s website to mean that the subscriber is PCI compliant. Any such claims could divert our management’s attention, require us to expend considerable resources in defending against such claims or otherwise materially harm our reputation, business, results of operations or financial condition.

We face a number of risks associated with our international revenue and operations, any or all of which could result in a disruption in our business and a decrease in our revenue.

During each of 2009 and 2010, 15% of our revenue was generated outside of North America. In that regard, we generated a significant amount of this revenue from sales into the United Kingdom, Sweden, Brazil, South Africa and Australia. We plan to expand our international operations, but such expansion is contingent upon the financial performance of our existing international operations as well as our identification of growth opportunities. Our revenue from international sales may fluctuate significantly or grow at a slower pace than we expect due to less enforcement of PCI in international markets or the use of other payment security technologies, for example, the “chip and pin” smartcard payment system in the United Kingdom.

As of December 31, 2010, we served customers in approximately 65 countries. Our international operations and expansion plans are subject to risks not typically associated with our domestic operations, including:


	•	potential loss of proprietary information due to misappropriation or laws that may be less protective of our intellectual property rights than U.S. laws or may not be adequately enforced;

	•	multiple, conflicting and changing governmental laws and regulations, including employment, tax, privacy and data protection laws and regulations;

	•	regulations or restrictions on the use, import, or export of encryption technologies that could delay or prevent the acceptance and use of encryption products and public networks for secure communications;

	•	fluctuations in currency exchange rates and economic instability such as higher interest rates in the U.S. and inflation;

	•	difficulties and costs of staffing and managing international operations;

	•	potentially adverse tax consequences;


	•	wage and price controls;

	•	differing technology standards;

	•	reduced sales due to the failure to obtain any required export approval of our technologies, particularly our encryption technologies;

	•	costs and delays associated with developing software and providing support in multiple languages; and

	•	political and social unrest, war or terrorism.

In addition, if we become unable to obtain foreign regulatory approvals on a timely basis, our business in the affected countries would no longer exist and our revenue could decrease significantly. Certain of our products are subject to export controls under U.S. law. The list of products and countries for which export approval is required, and the regulatory policies with respect thereto, may be revised from time to time and our inability to obtain required approvals under these regulations could materially and adversely affect our ability to make international sales.

We are subject to foreign exchange risks because the majority of our costs are denominated in U.S. dollars, whereas a significant portion of the sales and expenses of our international operations are denominated in various foreign currencies. A decrease in the value of any of these foreign currencies relative to the U.S. dollar could affect the profitability in U.S. dollars of our products sold in these markets. We do not currently hold forward exchange contracts to exchange foreign currencies for U.S. dollars to offset currency rate fluctuations.

We have a large amount of goodwill and other intangible assets and our earnings will be harmed if we suffer an impairment of our goodwill or other intangible assets.

We have a large amount of goodwill and other intangible assets and are required to perform an annual assessment for possible impairment for accounting purposes. At December 31, 2010, we had goodwill of $42.1 million and intangible assets of $17.5 million. If we do not achieve our planned operating results or other factors impair these assets, we may be required to incur a non-cash impairment charge. Any impairment charges in the future will adversely affect our results of operations or financial condition. See “Management’s Discussion and Analysis of Financial Condition and Results of Operations-Critical Accounting Policies and Estimates-Goodwill, Intangible Assets and Business Combinations.”

Our ability to sell our products is dependent in part on the quality of our technical support services, and our failure to offer high quality technical support services would have a material adverse effect on our sales and results of operations.

Our customers depend on our technical support services to resolve any issues relating to our products. If we do not effectively assist our customers with resolving questions or issues relating to our products and provide effective ongoing support, our ability to sell additional products and services to existing customers would be adversely affected and our reputation with potential customers could be damaged. Many enterprise customers require higher levels of support than small-or medium-sized businesses. If we fail to meet the requirements of enterprise customers, it may be more difficult to execute on our strategy to increase our penetration with such customers.

We rely significantly on revenue from subscriptions which may decline, and, because we generally recognize revenue from subscriptions over the term of the relevant service period, downturns or upturns in sales are not immediately reflected in full in our operating results.

Subscription revenue accounts for a significant portion of our revenue, comprising 76%, 78% and 73% of our total revenue in the years ended December 31, 2008, 2009 and 2010, respectively. Sales of new or renewal subscription contracts may decline and fluctuate as a result of a number of factors, including subscribers’ level of satisfaction with our products and services, the prices of our products and services, the prices of products and services offered by our competitors or reductions in our subscribers’ spending levels. If our sales of new or renewal subscription contracts decline, our revenue and revenue growth may decline and our business will suffer. In addition we recognize subscription revenue monthly over the term of the relevant subscription period, which is typically

one year but has been as long as five years. As a result, a certain amount of the revenue we report each quarter is the recognition of deferred revenue from subscription contracts entered into during previous quarters. Consequently, a decline in new or renewed subscription contracts in any one quarter will not be fully reflected in revenue in that quarter, but will negatively affect our revenue in future quarters. Accordingly, the effect of significant downturns in new or renewed sales of our subscriptions is not reflected in full in our results of operations until future periods. Our subscription revenue also makes it difficult for us to rapidly increase our revenue through additional subscription sales in any period, as revenue from new and renewal subscription contracts must be recognized over the applicable subscription period. Furthermore, increases in the average term of subscription contracts would result in revenue for subscription contracts being recognized over longer periods of time.

The average sales prices of our products may decrease, which may reduce our gross profits and adversely impact our financial results.

While we expect that our average sales prices will decline as we continue to execute on our strategy to target the small- and medium-sized business, or “SMB,” market, the average sales prices for our products may also decline for a variety of other reasons, including competitive pricing pressures, discounts we offer, a change in our mix of products, anticipation of the introduction of new products or promotional programs. Competition continues to increase in the market segments in which we participate and we expect competition to further increase in the future, thereby leading to increased pricing pressures. Larger competitors with more diverse product offerings may reduce the price of products that compete with ours in order to promote the sale of other products or may bundle them with other products. Additionally, although we typically price our products and services worldwide in U.S. dollars, currency fluctuations in certain countries and regions may negatively impact actual prices that partners and subscribers are willing to pay in those countries and regions. Furthermore, we anticipate that the average sales prices and gross profits for our products will decrease over product life cycles. We cannot assure you that we will be successful in developing and introducing new offerings with enhanced functionality on a timely basis, or that our product offerings, if introduced, will enable us to maintain our prices and gross profits at levels that will allow us to maintain profitability.

We cannot accurately predict subscription renewal rates or the rate at which subscribers will purchase additional or enhanced products or services from us, or the impact these rates may have on our future revenue and operating results.

Our subscribers have no obligation to renew their subscriptions for our products and services after the expiration of their initial subscription period, which is typically one year but has been as long as five years, or to purchase additional products or services from us. In addition, our subscribers may renew for fewer subscriptions, renew for shorter contract lengths, or renew for lower cost editions of our products. We cannot accurately predict renewal rates and our renewal rates may decline or fluctuate as a result of a number of factors, including subscriber dissatisfaction with our products, subscribers’ ability to continue their operations and spending levels and deteriorating general economic conditions. If our subscribers do not renew their subscriptions for our products, our revenue may decline and our business may suffer.

Our future success also depends in part on our ability to sell additional features, products and services or enhanced versions of our products and services to our current subscribers. This may also require increasingly sophisticated and costly sales efforts. Similarly, the rate at which our subscribers purchase new or enhanced products depends on a number of factors, including general economic conditions. If our efforts to sell new or enhanced products and services to our subscribers are not successful, our business may suffer.

A portion of our revenue is generated by sales to government entities, which are subject to a number of challenges and risks.

Sales to U.S. and foreign federal, state and local governmental agency customers have accounted for a portion of our revenue in past periods, and we may in the future increase sales to government entities. Sales to government entities are subject to a number of risks. Selling to government entities can be highly competitive, expensive and time consuming, often requiring significant upfront time and expense without any assurance that we will win a sale. Government demand and payment for our products and services may be impacted by public sector budgetary cycles

and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our products. Governments routinely investigate and audit government contractors’ administrative processes, and any unfavorable audit could result in the government refusing to continue buying our products and services, a reduction of revenue or fines or civil or criminal liability if the audit uncovers improper or illegal activities. Any such penalties could materially adversely impact our results of operations. Finally, for purchases by the U.S. government, the government may require certain products to be manufactured in the United States and other high cost manufacturing locations, and we may not manufacture all products in locations that meet the requirements of the U.S. government.

Failure to comply with laws or regulations applicable to our business could cause us to lose U.S. government customers or our ability to contract with the U.S. government.

We must comply with laws and regulations relating to the formation, administration and performance of U.S. government contracts, which affect how we do business with U.S. government agencies. These laws and regulations may impose added costs on our business, and failure to comply with these or other applicable regulations and requirements, including non-compliance in the past, could lead to penalties, termination of contracts and suspension or debarment from government contracting for a period of time with U.S. government agencies. Any such damages, penalties, disruption or limitation in our ability to do business with the U.S. government could have a material adverse effect on our business, operating results and financial condition.

We have grown, and may continue to grow, through acquisitions that give rise to risks and challenges that could adversely affect our future financial results.

We have grown, and may continue to grow, through acquisitions of other businesses, business units and technologies. Most recently, we acquired BitArmor Systems, Inc., Intellitactics and Breach Security in 2010. Any future acquisitions will depend on our ability to identify suitable acquisition candidates, to negotiate acceptable terms for their acquisition and to finance those acquisitions. There are no assurances that we will be successful in finding suitable acquisition candidates. When and if we are able to identify candidates, we will likely face competition from other potential acquirers that may increase our costs. Acquisitions can involve a number of special risks and challenges, including:


	•	complexity, time, and costs associated with these acquisitions, including the integration of acquired business operations, workforce, products and technologies into our existing business, sales force, employee base, product lines and technology;

	•	diversion of management time and attention from our existing business and other business opportunities;

	•	difficulties in retaining key personnel of the acquired business and additional costs that may be incurred as a result;

	•	loss or termination of employees, including costs associated with the termination or replacement of those employees;

	•	inability to maintain key pre-acquisition customer, supplier and employee relationships;

	•	assumption of debt or other liabilities of the acquired business, including litigation related to the acquired business or intellectual property assets acquired in connection with such acquisitions;

	•	increased expenses and working capital requirements;

	•	the addition of acquisition-related debt; and

	•	dilution of stock ownership of existing stockholders.

Integrating acquired businesses has been and will continue to be a complex, time consuming, and expensive process, and can also impact the effectiveness of our internal control over financial reporting. To integrate acquired businesses, we must implement our technology systems in the acquired operations and integrate and manage the personnel of the acquired operations. We also must effectively integrate the different cultures of acquired business organizations into our own in a way that aligns various interests, and may need to enter new markets in which we have no or limited experience and where competitors in such markets have stronger market positions.

Any of the foregoing, and other factors, could harm our ability to achieve anticipated levels of profitability from acquired businesses or to realize other anticipated benefits of such acquisitions. In addition, because acquisitions of technology companies are inherently risky, no assurance can be given that our previous or future acquisitions will be successful and will not adversely affect our business, operating results or financial condition.

We may also seek to restructure our business in the future by disposing of certain of our assets. There can be no assurance that any restructuring of our business will not adversely affect our business, operating results or financial condition. In addition, any significant restructuring of our business will require significant managerial attention which may be diverted from our operations and may require us to accept non-cash consideration for any sales of our assets, the market value of which may fluctuate.

Adverse conditions in the national and global economies and financial markets may adversely affect our business and financial results.

National and global economies and financial markets have experienced a downturn stemming from a multitude of factors, including adverse credit conditions impacted by the sub-prime mortgage crisis, slower or receding economic activity, concerns about inflation and deflation, fluctuating energy costs, high unemployment, decreased consumer confidence, reduced corporate profits and capital spending, adverse business conditions and liquidity concerns and other factors. The severity or length of time these economic and financial market conditions may persist is unknown. During challenging economic times, periods of high unemployment and in tight credit markets, many customers may delay or reduce technology purchases. This could result in reductions in sales of our products, longer sales cycles, difficulties in collection of accounts receivable, slower adoption of new technologies and increased price competition. These results may persist even if a number of economic conditions improve. Specific economic trends, such as declines or softness in government or corporate IT spending, would have a more direct impact on our business. Any of these events would likely harm our business, operating results, cash flows and financial condition.

We may need additional capital in the future and our failure to obtain capital could interfere with our growth strategy.

We may need additional capital in the future to execute on our growth strategy. Our ability to obtain financing will depend on a number of factors, including market conditions, our operating performance and investor interest. These factors may make the timing, amount, terms and conditions of any financing unattractive. They may also result in our incurring additional indebtedness or accepting stockholder dilution. As of December 31, 2010, we had no outstanding borrowings and $2.0 million of outstanding letters of credit under our $20.0 million loan agreement. If adequate funds are not available or are not available on acceptable terms, we may have to forego strategic acquisitions or investments, defer our product development activities, or delay the introduction of new or enhanced products.

Our estimates or judgments relating to our critical accounting policies are based on assumptions that may change or prove to be incorrect, and this may have an adverse effect on our results of operations or financial condition.

The preparation of financial statements in conformity with generally accepted accounting principles requires management to make estimates and assumptions that affect the amounts reported in the consolidated financial statements and accompanying notes. We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, the results of which form the basis for making judgments about the carrying values of assets and liabilities that are not readily apparent from other sources. Our operating results may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our operating results to fall below the expectations of securities analysts and investors.

We may not be able to utilize a significant portion of our net operating loss carry-forwards, which could adversely affect our results of operations.

Due to losses recognized for federal and state income tax purposes in prior periods, we have generated significant federal and state net operating loss carry-forwards that may expire before we are able to utilize them. In addition, under U.S. federal and state income tax laws, if over a rolling three-year period, the cumulative change in our ownership exceeds 50%, our ability to utilize our net operating loss carry-forwards to offset future taxable income may be limited. Changes in ownership can occur due to transactions in our stock or the issuance of additional shares of our common stock or, in certain circumstances, securities convertible into our common stock. We have exceeded this 50% cumulative change threshold in prior periods, which has limited our ability to use a portion of our net operating loss carry-forwards. The effect of these transactions or future transactions on our cumulative change in ownership may further limit our ability to utilize our net operating loss carry-forwards to offset future taxable income. Furthermore, it is possible that transactions in our stock that may not be within our control may cause us to exceed the 50% cumulative change threshold and may impose a limitation on the utilization of our net operating loss carry-forwards in the future. Also, the existing net operating loss carry-forwards of corporations we have acquired may be subject to substantial limitations arising from ownership changes prior to or in connection with their acquisition by us or may expire prior to our ability to utilize them. In the event the usage of our net operating loss carry-forwards is subject to limitation and we are profitable, our results of operations could be materially adversely affected.

Risks Relating to this Offering and Ownership of Our Common Stock

An active, liquid trading market for our common stock may not develop following this offering, which could limit your ability to sell your shares of our common stock at an attractive price, or at all.

Prior to this offering, there has been no public market for our common stock. We cannot predict the extent to which investor interest in our company will lead to the development of an active trading market in our common stock or how liquid that market might become. An active public market for our common stock may not develop or be sustained after the offering. If an active public market does not develop or is not sustained, it may be difficult for you to sell your shares of common stock at a price that is attractive to you, or at all. The market price for shares of our common stock may decline below the initial public offering price, and you may not be able to resell your shares of common stock at or above the initial public offering price.

Market volatility may affect our stock price and the value of your investment.

Following the completion of this offering, the market price for our common stock is likely to be volatile, in part because our shares have not been previously traded publicly. In addition, the market price of our common stock may fluctuate significantly in response to a number of factors, most of which we cannot predict or control, including:


	•	announcements of new product launches, commercial relationships, acquisitions or other events by us or our competitors;

	•	failure of any of our products to achieve commercial success;

	•	fluctuations in stock market prices and trading volumes of securities of similar companies;

	•	general market conditions and overall fluctuations in U.S. equity markets;

	•	variations in our operating results, or the operating results of our competitors;

	•	changes in our financial guidance to investors and analysts or our failure to achieve such expectations;

	•	delays in or our failure to provide financial guidance;

	•	changes in securities analysts’ estimates of our financial performance or our failure to achieve such estimates;

	•	sales of large blocks of our common stock, including sales by our executive officers, directors and significant stockholders;


	•	additions or departures of any of our key personnel;

	•	announcements related to litigation;

	•	changes in accounting principles or methodologies;

	•	changing legal or regulatory developments in the U.S. and other countries; and

	•	discussion of us or our stock price by the financial press and in online investor communities.

In addition, the stock market in general has experienced substantial price and volume volatility that is often seemingly unrelated to the operating performance of particular companies. These broad market fluctuations may cause the trading price of our common stock to decline. In the past, securities class action litigation has often been brought against a company after a period of volatility in the market price of its common stock. We may become involved in this type of litigation in the future. Any securities litigation claims brought against us could result in substantial expenses and the diversion of our management’s attention from our business.

If you purchase shares of common stock sold in this offering, you will incur immediate and substantial dilution.

If you purchase shares of common stock in this offering, you will incur immediate and substantial dilution in the amount of $ per share, because the initial public offering price of $ per share is substantially higher than the pro forma net tangible book value per share of our outstanding common stock. In addition, you may also experience additional dilution upon future equity issuances or the exercise of stock options to purchase common stock granted to our employees, executive officers, consultants and directors under our stock option and equity incentive plans. For additional information, see “Dilution.”

We do not expect to pay any cash dividends for the foreseeable future.

We do not anticipate that we will pay any cash dividends on shares of our common stock for the foreseeable future. Any determination to pay dividends in the future will be at the discretion of our board of directors and will depend upon results of operations, financial condition, contractual restrictions, restrictions imposed by applicable law and other factors our board of directors deems relevant. Additionally, we are currently prohibited from paying cash dividends by the loan agreement governing our $20.0 million revolving credit facility, and we expect these restrictions to continue in the future. Accordingly, if you purchase shares in this offering, realization of a gain on your investment will depend on the appreciation of the price of our common stock, which may never occur. Investors seeking cash dividends in the foreseeable future should not purchase our common stock.

Following this offering, investment funds managed by affiliates of FTV Capital, MBK Ventures, LLC and Richard Kiphart will own a substantial percentage of our common stock, which may prevent new investors from influencing significant corporate decisions.

Upon completion of this offering, (i) investment funds managed by Financial Technology Management II, L.L.C. and FTVentures Management III, L.L.C., or collectively “FTV Capital,” will beneficially own approximately shares, or %, of our outstanding common stock, (ii) MBK Ventures, LLC, or “MBK Ventures,” which is beneficially owned by Robert McCullen and Andrew Bokor, each of whom is an executive officer and director, will beneficially own approximately shares, or %, of our outstanding common stock, and (iii) Richard Kiphart, one of our directors, will beneficially own approximately shares, or %, of our outstanding common stock. In the event that the underwriters exercise their over-allotment option in full, FTV Capital, MBK Ventures and Mr. Kiphart will own approximately %, % and % of our outstanding common stock, respectively. As a result, FTV Capital, MBK Ventures and Mr. Kiphart will, for the foreseeable future, have significant influence over all matters requiring stockholder approval, including the election of directors, adoption of or amendments to equity-based incentive plans, amendments to our amended and restated certificate of incorporation and certain mergers, acquisitions and other change-of-control transactions. The ownership of a large amount of our voting power by FTV Capital, MBK Ventures and Mr. Kiphart may have an adverse effect on the price of our common stock. FTV Capital, MBK Ventures and Mr. Kiphart may have divergent interests among themselves, and their interests may not be consistent with your interests as a stockholder.

Future sales of our common stock, or the perception in the public markets that these sales may occur, may depress our stock price.

Upon completion of this offering, there will be shares of our common stock outstanding. Of these, shares being sold in this offering (or shares if the underwriters exercise their over-allotment option in full) will be freely tradable immediately after this offering (except for any shares purchased by affiliates, if any) and shares may be sold upon expiration of lock-up agreements 180 days after the date of this prospectus (subject in some cases to volume limitations). In addition, as of December 31, 2010, we had outstanding options to purchase shares of common stock that, if exercised, will result in these additional shares becoming available for sale upon expiration of the lock-up agreements. A large portion of these shares and options are held by a small number of persons and investment funds. Sales by these stockholders or option holders of a substantial number of shares after this offering could significantly reduce the market price of our common stock. Moreover, certain holders of shares of common stock have rights, subject to some conditions, to require us to file registration statements covering the shares they currently hold, or to include these shares in registration statements that we may file for ourselves or other stockholders.

We also intend to register all common stock that we may issue under our 2001 Stock Incentive Plan and the 2011 Incentive Plan. Effective upon the completion of this offering, an aggregate of shares of our common stock will be reserved for future issuance under the 2011 Incentive Plan, plus shares reserved but unissued under our 2001 Stock Incentive Plan. Once we register these shares, which we plan to do shortly after the completion of this offering, they can be freely sold in the public market upon issuance, subject to the lock-up agreements referred to above. If a large number of these shares are sold in the public market, the sales could reduce the trading price of our common stock.

Our future operating results may fluctuate significantly and our current operating results may not be a good indication of our future performance. Fluctuations in our quarterly financial results could affect our stock price in the future.

Our revenues and operating results have historically varied from period-to-period, and we expect that they will continue to do so as a result of a number of factors, many of which are outside of our control. If our quarterly financial results or our predictions of future financial results fail to meet the expectations of securities analysts and investors, our stock price could be negatively affected. Any volatility in our quarterly financial results may make it more difficult for us to raise capital in the future or pursue acquisitions that involve issuances of our stock. Our operating results for prior periods may not be effective predictors of our future performance.

Factors associated with our industry, the operation of our business and the markets for our products may cause our quarterly financial results to fluctuate, including:


	•	slower than expected conversion of enrollees to subscribers;

	•	failure to expand our partner network;

	•	loss of a significant member or group of members from our partner network;

	•	entry of new competition into our markets;

	•	the level of demand for our products and services;

	•	competitive pricing pressure for one or more of our products, services or solutions;

	•	our ability to timely complete the release of new or enhanced versions of our products;

	•	failure to successfully execute our cross-sell strategy;

	•	changes in laws or industry standards relating to privacy or data security compliance, or enforcement thereof;

	•	fluctuations in foreign currency exchange rates;

	•	the number, severity and timing of threat outbreaks, which may fluctuate from period-to-period;


	•	changes in interest rates;

	•	changes in the competitive landscape of our industry, including consolidation among our competitors and customers;

	•	our ability to control costs, including operating expenses;

	•	our ability to hire, train and retain key personnel;

	•	political and military instability, which could slow spending within our target markets, delay sales cycles, and otherwise adversely affect our ability to generate revenues and operate effectively;

	•	deferral of orders from customers in anticipation of new products or product enhancements announced by us or our competitors;

	•	budgetary cycles and constraints of customers, which are influenced by corporate earnings and government budget cycles and spending objectives;

	•	insolvency or credit difficulties confronting our customers, affecting their ability to purchase or pay for our products and services;

	•	seasonal buying patterns;

	•	changes in subscriber renewal rates for our services;

	•	acts of war or terrorism; and

	•	intentional disruptions by third parties.

Any one of the factors above or the cumulative effect of some of the factors referred to above may result in significant fluctuations in our quarterly financial and other operating results, including fluctuations in our key metrics. This variability and unpredictability could result in our failing to meet our internal operating plan or the expectations of securities analysts or investors for any period. If we fail to meet or exceed such expectations for these or any other reasons, the market price of our shares could fall substantially and we could face costly lawsuits, including securities class action suits. In addition, a significant percentage of our operating expenses are fixed in nature and based on forecasted revenue trends. Accordingly, in the event of revenue shortfalls, we are generally unable to mitigate the negative impact on margins in the short term.

Anti-takeover provisions in our charter documents and Delaware law might discourage or delay acquisition attempts for us that you might consider favorable.

Our amended and restated certificate of incorporation and amended and restated bylaws will contain provisions that may make the acquisition of our company more difficult without the approval of our board of directors. These provisions include:


	•	a classified board of directors so that not all members of our board of directors are elected at one time;

	•	authorization of the issuance of undesignated preferred stock, the terms of which may be established and the shares of which may be issued without stockholder approval, and which may include super voting, special approval, dividend, or other rights or preferences superior to the rights of the holders of common stock;

	•	prohibition on stockholder action by written consent unless such action is recommended by all directors then in office, which requires that all stockholder actions not so approved be taken at a meeting of our stockholders;

	•	requirement that two-thirds of our stockholders approve certain amendments to our amended and restated certificate of incorporation or amended and restated bylaws;

	•	special meetings of our stockholders may only be called by a resolution adopted by a majority of our directors then in office;


	•	express authorization for our board of directors to make, alter, or repeal our amended and restated bylaws; and

	•	advance notice requirements for nominations for elections to our board of directors or for proposing matters that can be acted upon by stockholders at stockholder meetings.

In addition, we will be governed by the provisions of Section 203 of the Delaware General Corporation Law, or the “DGCL,” which limits the ability of stockholders owning in excess of 15% of our outstanding voting stock to merge or combine with us. Although we believe these provisions collectively provide for an opportunity to obtain greater value for stockholders by requiring potential acquirers to negotiate with our board of directors, they would apply even if an offer rejected by our board were considered beneficial by some stockholders. In addition, these provisions may frustrate or prevent any attempts by our stockholders to replace or remove our current management by making it more difficult for stockholders to replace members of our board of directors, which is responsible for appointing the members of our management.

These anti-takeover provisions and other provisions under Delaware law could discourage, delay or prevent a transaction involving a change in control of our company, even if doing so would benefit our stockholders. These provisions could also discourage proxy contests and make it more difficult for you and other stockholders to elect directors of your choosing and to cause us to take other corporate actions you desire.

If we fail to maintain an effective system of internal controls, we may not be able to report our financial results on time, and current and potential investors could lose confidence in our financial reporting.

Effective internal controls are necessary for us to provide reliable financial reports. If we cannot provide reliable financial reports, our business and operating results could be negatively impacted. The need for improvements in our system of internal controls has been identified in the past and may be identified in the future. During our 2010 audit, a material weakness in our system of internal controls over financial reporting was identified which may impact our ability to produce financial statements consistent with the requirements of a public company. This weakness related to the sufficiency of our processes and procedures in place to ensure an accurate and timely financial reporting close process, primarily processes and procedures related to timely and accurate reporting from some of our smaller foreign subsidiaries. In addition, we have identified a significant deficiency regarding the need to improve interim period reporting procedures and controls. A material weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of our financial statements will not be prevented, or detected and corrected on a timely basis. A significant deficiency is a deficiency, or combination of deficiencies, in internal control over financial reporting that is less severe than a material weakness, yet important enough to merit attention by those charged with governance.

Any failure to implement and maintain the improvements in our system of internal controls over financial reporting, or difficulties encountered in the implementation of these improvements in our system of internal controls, could cause us to fail to meet our reporting obligations. Any failure to improve our system of internal controls to address the identified material weaknesses could also cause investors to lose confidence in our reported financial information, which could have a negative impact on our company.

We have begun implementing measures and plan to take additional steps to remediate the underlying causes of the material weakness. In particular, we intend to improve our internal control over financial reporting by adding resources to our accounting and finance team, implementing controls over the monitoring and reporting of our foreign subsidiaries and implementing controls commensurate with our quarterly reporting requirements. However, there can be no assurance that we will be able to effectively remediate the identified material weakness or that additional material weaknesses will not be identified in the future relative to our system of internal controls over financial reporting.

We are not currently required to comply with the rules of the Securities and Exchange Commission, or the “SEC,” implementing Section 404 of the Sarbanes-Oxley Act of 2002, or the “SO Act,” and are therefore not required to make a formal assessment of the effectiveness of our internal control over financial reporting for that

purpose. Upon becoming a public company, we will be required to comply with the SEC’s rules implementing Section 302 and 404 of the SO Act, which will require management to certify financial and other information in our quarterly and annual reports and provide an annual management report on the effectiveness of controls over financial reporting. Though we will be required to disclose changes made in our internal controls and procedures on a quarterly basis, we will not be required to make our first annual assessment of our internal control over financial reporting pursuant to Section 404 until the year following our first annual report required to be filed with the SEC. To comply with the requirements of being a public company, we may need to undertake various actions, such as implementing new internal controls and procedures and hiring accounting or internal audit staff.

Our independent registered public accounting firm is not required to formally attest to the effectiveness of our internal controls over financial reporting until the year following our first annual report required to be filed with the SEC. At such time, our independent registered public accounting firm may issue a report that is adverse, in the event it is not satisfied with the level at which our controls are documented, designed or operating. Our remediation efforts may not enable us to avoid a material weakness in the future.

We will incur significant increased costs as a result of operating as a public company, and our management will be required to divert attention from operational and other business matters to devote substantial time to public company requirements.

As a public company, we will incur significant legal, accounting and other expenses that we did not incur as a private company. For example, we will be required to comply with the requirements of the SO Act, as well as rules and regulations subsequently implemented by the SEC and our stock exchange, including the establishment and maintenance of effective disclosure and financial controls and changes in corporate governance practices. We expect that compliance with these requirements will increase our legal and financial compliance costs and will make some activities more time-consuming and costly. In addition, we expect that our management and other personnel will need to divert attention from operational and other business matters to devote substantial time to these public company requirements. In particular, we expect to incur significant expenses and devote substantial management effort toward ensuring compliance with the requirements of Section 404 of the SO Act. In that regard, we currently do not have an internal audit function, and we will need to hire additional accounting and financial staff with appropriate public company experience and technical accounting knowledge. We also expect that operating as a public company will make it more difficult and more expensive for us to obtain director and officer liability insurance, and we may be required to accept reduced policy limits and coverage or incur substantially higher costs to obtain the same or similar coverage. As a result, it may be more difficult for us to attract and retain qualified people to serve on our board of directors, our board committees or as executive officers.

We will have broad discretion in how we use the proceeds of this offering and we may not use these proceeds effectively. This could affect our profitability and cause our share price to decline.

Our management and board of directors will have considerable discretion in the application of the net proceeds of this offering, and you will not have the opportunity, as part of your investment decision, to assess whether we are using the proceeds appropriately. We currently intend to use the net proceeds for general corporate purposes, which could include a variety of uses such as funding working capital, operating expenses, the continued development of our new or enhanced versions of our products and technology and the selective pursuit of business development opportunities. From time to time, for example, we will consider acquisitions or investments if a suitable opportunity arises, in which case a portion of the proceeds may be used to fund such an acquisition or investment. We have no commitments or understandings to make any such acquisition or investment. We may use the net proceeds for corporate purposes that do not improve our profitability or increase our market value, which could cause our share price to decline. See “Use of Proceeds.”

Our business and stock price may suffer as a result of our lack of public company operating experience. In addition, if securities or industry analysts do not publish research or publish inaccurate or unfavorable research about our business, our stock price and trading volume could decline.

We have never operated as a public company. Our lack of public company operating experience may make it difficult to forecast and evaluate our future prospects. If we are unable to execute our business strategy and grow our

business, either as a result of our inability to manage our current size, effectively manage the business in a public company environment or manage our future growth or for any other reason, our business, prospects, financial condition and results of operations may be harmed.

In addition, as a new public company we do not currently have and may never obtain research coverage by securities and industry analysts. If no securities or industry analysts commence coverage of our company, the trading price for our stock would be negatively impacted. If we obtain securities or industry analyst coverage and if one or more of the analysts who covers us downgrades our stock or publishes inaccurate or unfavorable research about our business, our stock price would likely decline. If one or more of these analysts ceases coverage of us or fails to publish reports on us regularly, demand for our stock could decrease, which could cause our stock price and trading volume to decline.

FORWARD-LOOKING STATEMENTS

This prospectus contains forward-looking statements that are subject to risks and uncertainties. All statements other than statements of historical fact included in this prospectus are forward-looking statements. Forward-looking statements give our current expectations and projections relating to our financial condition, results of operations, plans, objectives, future performance and business. You can identify forward-looking statements by the fact that they do not relate strictly to historical or current facts. These statements may include words such as “anticipate,” “estimate,” “expect,” “project,” “forecast,” “continue,” “plan,” “intend,” “believe,” “may,” “will,” “should,” “can have,” “likely” and other words and terms of similar meaning in connection with any discussion of the timing or nature of future operating or financial performance or other events. For example, all statements we make relating to our estimated and projected costs, expenditures, cash flows, growth rates and financial results, our plans and objectives for future operations, growth or initiatives, strategies or the expected outcome or impact of pending or threatened litigation are forward-looking statements. All forward-looking statements are subject to risks and uncertainties that may cause actual results to differ materially from those that we expected, including:


	•	PCI may be changed, cancelled, replaced or not enforced, new or different technologies that minimize the need for PCI may be widely adopted, or we may lose certain of our PCI certifications;

	•	we may lose a significant member or group of members of our partner network, fail to engage new partners or one of our partners may decide to use our products less or compete against us;

	•	we may be unable to develop and maintain relationships with businesses, government entities and other organizations within our existing partner network that have not enrolled their customers into TrustKeeper, or whose customers have enrolled but have not become subscribers;

	•	we may lack sufficient financial or other resources to maintain or improve our competitive position;

	•	we may not be able to compete effectively with companies that integrate or bundle products similar to ours with their other product offerings;

	•	we may not be successful in executing our strategy to increase our sales to larger enterprises;

	•	our efforts to expand our product and service offerings beyond the PCI market may not succeed;

	•	defects or vulnerabilities in our products or services or the failure of our products to adequately prevent a security breach or protect data assets;

	•	we may fail to timely update our products in response to new security threats or to detect security attacks;

	•	our internal network system could be compromised by computer hackers, which would harm public perception of our security products and services;

	•	damage or disruptions to our facilities, including our corporate headquarters and third-party data center hosting facility, which could impair the delivery of our products and services;

	•	delays or cost overruns related to our development activities;

	•	we may fail to accurately predict, prepare for and respond promptly to technological and market developments and changing customer needs and develop corresponding products;

	•	our new products and product enhancements may not achieve sufficient market acceptance;

	•	we may fail to effectively manage our growth; and

	•	the other risks set forth in the section entitled “Risk Factors” in this prospectus.

We derive many of our forward-looking statements from our operating budgets and forecasts, which are based upon many detailed assumptions. While we believe that our assumptions are reasonable, we caution that it is very difficult to predict the impact of known factors, and it is impossible for us to anticipate all factors that could affect our actual results. Important factors that could cause actual results to differ materially from our expectations, or cautionary statements, are disclosed under the sections entitled “Risk Factors” and “Management’s Discussion and Analysis of Financial Condition and Results of Operations” in this prospectus. All written and oral forward-looking

statements attributable to us, or persons acting on our behalf, are expressly qualified in their entirety by the cautionary statements as well as other cautionary statements that are made from time to time in our other SEC filings and public communications. You should evaluate all forward-looking statements made in this prospectus in the context of these risks and uncertainties.

We caution you that the important factors described in the sections in this prospectus entitled “Risk Factors” and “Management’s Discussion and Analysis of Financial Condition and Results of Operations” may not be all of the factors that are important to you. In addition, we cannot assure you that we will realize the results or developments we expect or anticipate or, even if substantially realized, that they will result in the consequences or affect us or our operations in the way we expect. The forward-looking statements included in this prospectus are made only as of the date hereof. We undertake no obligation to publicly update or revise any forward-looking statement as a result of new information, future events or otherwise, except as otherwise required by law.

MARKET AND INDUSTRY DATA AND FORECASTS

Market data and certain industry data and forecasts that we have included in this prospectus were obtained from internal company surveys, market research, consultant surveys, publicly available information, reports of governmental agencies and industry publications and surveys. We have relied upon publications of IDC as our primary source for third-party industry data and forecasts. Industry surveys, publications, consultant surveys and forecasts generally state that the information contained therein has been obtained from sources believed to be reliable, but that the accuracy and completeness of such information is not guaranteed. We have not independently verified any of the data from third-party sources, nor have we ascertained the underlying economic assumptions relied upon therein. Similarly, internal surveys, industry forecasts and market research, which we believe to be reliable based upon our management’s knowledge of the industry, have not been independently verified. Forecasts are particularly likely to be inaccurate, especially over long periods of time. In addition, we do not know what assumptions regarding general economic growth were used in preparing the forecasts we cite. Statements as to our market position are based on recently available data. While we are not aware of any misstatements regarding our industry data presented herein, our estimates involve risks and uncertainties and are subject to change based on various factors, including those discussed under the heading “Risk Factors” appearing elsewhere in this prospectus. While we believe our internal business research is reliable and market definitions are appropriate, neither such research nor definitions have been verified by any independent source. This prospectus may only be used for the purpose for which it has been published.

USE OF PROCEEDS

We estimate that the net proceeds from our issuance and sale of shares of common stock in this offering will be approximately $ million, assuming an initial public offering price of $ per share, which is the midpoint of the price range listed on the cover page of this prospectus, and after deducting underwriting discounts and commissions and estimated offering expenses payable by us.

A $1.00 increase (decrease) in the assumed initial public offering price of $ per share would increase (decrease) our net proceeds from this offering by approximately $ million, assuming that the number of shares offered by us, as set forth on the cover page of this prospectus, remains the same and after deducting the underwriting discounts and commissions and estimated offering expenses payable by us.

If the underwriters exercise their over-allotment option in full, we estimate that the net proceeds from this offering will be approximately $ million, assuming an initial public offering price of $ per share, which is the midpoint of the price range listed on the cover page of this prospectus, and after deducting underwriting discounts and commissions and estimated offering expenses payable by us.

The principal purposes of this offering are to obtain additional capital to fund our operations and growth, to create a public market for our common stock and to facilitate our future access to the public equity markets.

We expect to use substantially all of the net proceeds for general corporate purposes, which we expect to include funding working capital, operating expenses, the continued development of our products and services, the strengthening of our existing commercial organization and the selective pursuit of business development opportunities, which could include acquisitions of other companies. At this time, we have not specifically identified a large single use for which we intend to use the net proceeds, and, accordingly, we are not able to allocate the net proceeds among any of these potential uses in light of the variety of factors that will impact how such net proceeds are ultimately utilized by us. Such factors include how quickly we are able to begin to generate operating profits, whether our revenues continue to increase and, if so, the rate of any such increase, and business development opportunities that may arise in the future. As a result, our management will retain broad discretion over the allocation of the net proceeds from this offering.

Pending use of the proceeds from this offering, we intend to invest the proceeds in short-term, investment-grade and interest-bearing instruments or money market funds.

DIVIDEND POLICY

We have never paid any dividends on our Class A common stock, Class B common stock or preferred stock. We currently intend to retain all available funds and any future earnings to fund the development and growth of our business and therefore we do not anticipate paying any cash dividends in the foreseeable future. We are currently prohibited from paying cash dividends on or making any distributions with respect to our capital stock under the terms of our loan agreement, and we expect these restrictions to continue in the foreseeable future. For additional information, see “Description of Certain Indebtedness.” Any future determination to pay dividends will be at the discretion of our board of directors, subject to compliance with covenants in current and future agreements governing our indebtedness, and will depend upon our results of operations, financial condition, capital requirements and other factors that our board of directors deems relevant.

CAPITALIZATION

The following table sets forth our cash and cash equivalents and our consolidated capitalization as of December 31, 2010 on:


	•	an actual basis;

	•	a pro forma basis to give effect to the Recapitalization, including the conversion of all of the outstanding shares of our Class A common stock, Class B common stock and preferred stock into shares of common stock, and the one-for- reverse stock split; and

	•	a pro forma as adjusted basis also gives effect to our issuance and sale of shares of common stock in this offering at an assumed initial public offering price of $ per share, which is the midpoint of the price range listed on the cover page of this prospectus, after deducting underwriting discounts and commissions and estimated offering expenses payable by us.

You should read the following table in conjunction with the sections entitled “Use of Proceeds,” “Unaudited Pro Forma Consolidated Financial Data,” “Selected Historical Consolidated Financial Data,” “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and our consolidated financial statements and related notes thereto included elsewhere in this prospectus.


	As of December 31, 2010
						Pro Forma as
	Actual			Pro Forma		Adjusted
				(unaudited)		(unaudited)
	(in thousands, except share data)

Cash and cash equivalents	$	14,558		$		$

Revolving credit facility⁽¹⁾	$	—		$	—	$	—
Convertible redeemable preferred stock⁽²⁾⁽³⁾:
Series A-1, $0.0001 par value, 10,952,633 shares authorized; 10,952,633 shares issued and outstanding, actual; no shares authorized, issued or outstanding, pro forma and pro forma as adjusted		13,541			—		—
Series A-2, $0.0001 par value, 11,505,258 shares authorized; 11,505,258 issued and outstanding, actual; no shares authorized, issued or outstanding, pro forma and pro forma as adjusted		7,893			—		—
Stockholders’ equity⁽³⁾:
Series B preferred stock, $0.0001 par value, 5,882,353 shares authorized; 5,882,351 issued and outstanding, actual; no shares authorized, issued or outstanding, pro forma and pro forma as adjusted		10,000			—		—
Class B common stock, $0.0001 par value, 6,174,654 shares authorized; 3,233,288 shares issued and outstanding, actual; no shares authorized, issued or outstanding, pro forma and pro forma as adjusted		—			—		—
Class A common stock, $0.0001 par value, 125,175,210 shares authorized; 91,353,635 issued and outstanding, actual; no shares authorized, issued or outstanding, pro forma and pro forma as adjusted		9			—		—
Common stock, $0.01 par value per share; no share authorized, no shares issued and outstanding, actual; shares authorized, pro forma and pro forma as adjusted; shares issued and outstanding, pro forma; and shares issued and outstanding pro forma as adjusted		—
Preferred stock, $0.01 par value per share; no shares authorized, no shares issued and outstanding, actual; 5,000,000 shares authorized, no shares issued and outstanding, pro forma and pro forma as adjusted		—			—		—
Additional paid-in capital		50,501
Accumulated deficit		(24,147	)
Accumulated other comprehensive income		(160	)

Total stockholders’ equity		36,203

Total capitalization	$	57,637		$		$


(1)		The revolving credit facility under our loan agreement provides for aggregate borrowings of up to $20.0 million. See “Description of Certain Indebtedness-Amended and Restated Loan and Security Agreement.”
(2)		Our Series A-1 preferred stock and Series A-2 preferred stock can be redeemed upon the written request of holders of two-thirds of the Series A-1 preferred stock or Series A-2 preferred stock, respectively, at an amount equal to their respective liquidation preference. Since this redemption feature is not in our control, we have classified our Series A-1 preferred stock and Series A-2 preferred stock as temporary equity on our consolidated balance sheets. For additional information regarding the terms of our preferred stock, see note 14 to the notes to our consolidated financial statements included elsewhere in this prospectus.
(3)		The number of our authorized and outstanding preferred stock, Class A common stock and Class B common stock as of December 31, 2010 on an actual basis have not been adjusted to give effect to the Recapitalization.

A $1.00 increase (decrease) in the assumed initial public offering price of $ per share, the midpoint of the price range set forth on the cover page of this prospectus, would increase (decrease) the pro forma as adjusted amount for each of cash and cash equivalents, additional paid-in capital, total stockholders’ equity and total capitalization by approximately $ million, assuming that the number of shares offered by us, as set forth on the cover of this prospectus, remains the same and after deducting the estimated underwriting discounts and commissions and estimated offering expenses payable by us.

The number of shares of common stock to be outstanding after this offering is based on shares outstanding as of December 31, 2010. This number excludes:


	•	shares of our common stock issuable upon the exercise of outstanding stock options at a weighted average exercise price of $ per share as of December 31, 2010;

	•	shares of our common stock issuable upon the exercise of outstanding warrants at a weighted average exercise price of $ per share as of December 31, 2010; and

	•	an aggregate of shares of our common stock reserved for future issuance under our 2001 Stock Incentive Plan and under the 2011 Incentive Plan that we intend to adopt in connection with this offering.

DILUTION

After giving effect to the Recapitalization, our pro forma net tangible book value as of December 31, 2010 was approximately $ million, or approximately $ per share. Pro forma net tangible book value per share represents the amount of our total tangible assets less the amount of our total liabilities, divided by the number of shares of common stock outstanding at December 31, 2010, prior to the sale of shares of common stock offered in this offering, but assuming the completion of our Recapitalization. Dilution in pro forma net tangible book value per share represents the difference between the amount per share paid by investors in this offering and the net tangible book value per share of our common stock outstanding immediately after this offering.

After giving effect to the completion of the Recapitalization and the sale of shares of common stock in this offering, based upon an assumed initial public offering price of $ per share, the midpoint of the range set forth on the cover of this prospectus, after deducting underwriting discounts and commissions and estimated expenses payable by us in connection with this offering, our pro forma as adjusted net tangible book value as of December 31, 2010 would have been approximately $ million, or $ per share of common stock. This represents an immediate decrease in pro forma net tangible book value of $ per share to existing stockholders and immediate dilution of $ per share to new investors purchasing shares of common stock in this offering at the initial public offering price.

The following table illustrates this per share dilution:


Assumed initial public offering price per share		$
Pro forma net tangible book value (deficit) per share as of December 31, 2010 (which gives effect to the Recapitalization)	$
Increase in net tangible book value per share attributable to new investors

Pro forma as adjusted net tangible book value (deficit) per share as of December 31, 2010 (which gives effect to the Recapitalization and this offering)

Dilution per share to new investors		$

The following table summarizes, as of December 31, 2010, on a pro forma as adjusted basis giving effect to the Recapitalization and the sale of shares of common stock in this offering, the number of shares of our common stock purchased from us, the aggregate cash consideration paid to us and the average price per share paid to us by existing stockholders and to be paid by new investors purchasing shares of our common stock from us in this offering. The table assumes an initial public offering price of $ per share, the midpoint of the range set forth on the cover of this prospectus, after deducting estimated underwriting discounts and commissions and estimated offering expenses payable by us in connection with this offering.


									Average
									Price
	Shares Purchased				Total Consideration				Per
	Number	Percentage			Amount	Percentage			Share

Existing stockholders				%	$			%	$
New investors

Total			100	%	$		100	%

A $1.00 increase (decrease) in the assumed initial public offering price of $ per share, the midpoint of the price range set forth on the cover of this prospectus, would increase (decrease) the total consideration paid by investors participating in this offering by $ million, or increase (decrease) the percent of total consideration paid by investors participating in this offering by %, assuming that the number of shares offered by us, as set forth on the cover of this prospectus, remains the same and after deducting the estimated underwriting discounts and commissions and estimated offering expenses payable by us.

Except as otherwise indicated, the discussion and tables above assume no exercise of the underwriters’ option to purchase additional shares and no exercise of any outstanding options. If the underwriters’ option to purchase

additional shares is exercised in full, our existing stockholders would own approximately % and our new investors would own approximately % of the total number of shares of our common stock outstanding after this offering.

The tables and calculations above are based on shares of common stock outstanding as of December 31, 2010 (after giving effect to the Recapitalization) and exclude:


	•	shares of our common stock issuable upon the exercise of outstanding stock options at a weighted average exercise price of $ per share as of December 31, 2010;

	•	shares of our common stock issuable upon the exercise of outstanding warrants at a weighted average exercise price of $ per share as of December 31, 2010; and

	•	an aggregate of shares of common stock reserved for issuance under our 2001 Stock Incentive Plan and under the 2011 Incentive Plan that we intend to adopt in connection with this offering.

To the extent that any outstanding options are exercised or if new options or other equity incentive grants are issued in the future with an exercise price or purchase price below the initial public offering price, new investors will experience further dilution.

UNAUDITED PRO FORMA CONSOLIDATED FINANCIAL DATA

The following table sets forth our unaudited consolidated statement of operations for the year ended December 31, 2010 on a pro forma basis to give effect to (i) the acquisition of Breach Security, which was completed on June 18, 2010, and Intellitactics, which was completed on March 1, 2010, as if each of these acquisitions had occurred on January 1, 2010 and (ii) the Recapitalization, including the conversion of all of the outstanding shares of our Class A common stock, Class B common stock and preferred stock into a single class of common stock and the one-for- reverse stock split, and on a pro forma as adjusted basis to also give effect to our issuance and sale of shares of common stock in this offering at an assumed public offering price of $ per share, which is the midpoint of the price range listed on the cover page of this prospectus, after deducting underwriting discounts and commissions and estimated offering expense payable by us, as if all such transactions had occurred on January 1, 2010. In connection with the acquisitions, all of our assets and liabilities were revised to reflect the fair values on the date of acquisition, based upon our allocation of the overall purchase price to the underlying net assets acquired.

The unaudited pro forma financial information is based on our historical financial statements and the historical financial statements of Breach Security and Intellitactics, and certain adjustments which we believe to be reasonable, to give effect to these transactions, which are described in the notes to our consolidated financial statements referenced below.

The unaudited pro forma consolidated statement of operations does not give effect to the acquisition of BitArmor, which was completed on January 6, 2010, as its pre-acquisition results are not significant. The unaudited pro forma consolidated statement of operations is presented for informational purposes only and does not purport to represent the financial position and results of operations that would have been achieved had the acquisitions been completed as of the date indicated or our future financial position or results of operations.

The following unaudited pro forma consolidated statement of operations should be read in conjunction with:


	•	the accompanying notes to the unaudited pro forma consolidated statement of operations;

	•	our consolidated financial statements for the year ended December 31, 2010, and the notes relating thereto, included elsewhere in this prospectus;

	•	the consolidated financial statements of Breach Security for the period from January 1, 2010 through March 31, 2010, and the notes relating thereto, included elsewhere in this prospectus;

	•	the consolidated financial statements of Intellitactics for the period January 1, 2010 through February 28, 2010, and the notes relating thereto, included elsewhere in this prospectus; and

	•	the sections entitled “Selected Historical Consolidated Financial Data” and “Management’s Discussion and Analysis of Financial Condition and Results of Operations,” included elsewhere in this prospectus.

The impacts of the acquisitions of Breach Security and Intellitactics are already reflected in our consolidated balance sheet as of December 31, 2010. See “Capitalization” for additional information regarding the effects of the Recapitalization and the issuance and sale of shares of common stock in this offering on our cash and cash equivalents, convertible redeemable preferred stock and stockholders’ equity.

TRUSTWAVE HOLDINGS, INC.

UNAUDITED PRO FORMA CONSOLIDATED STATEMENT OF OPERATIONS

For the Year Ended December 31, 2010


				Breach
				Security and
	Trustwave			Intellitactics			Recapitalization					Offering	Pro Forma As
	Historical			Adjustments^(A)			Adjustments^(B)		Pro Forma			Adjustments^(C)	Adjusted
	(in thousands, except share and per share data)

Statements of Operations Data:
Revenue:
Subscription revenue	$	81,677		$	3,169		$		$	84,846		$	$
Professional services		19,639			473					20,112
Product sales		10,187			870					11.057

Total revenue		111,503			4,512					116,015

Cost of sales:
Service delivery, excluding depreciation and amortization		33,415			1,069					34,484
Product sales, excluding depreciation and amortization		1,715			79					1,794
Depreciation and amortization⁽¹⁾		1,403			65					1,468

Total cost of sales		36,533			1,213					37,746

Gross profit		74,970			3,299					78,269

Operating expenses:
Product development		20,112			1,931					22,043
Sales and marketing		29,264			2,853					32,117
General and administrative⁽¹⁾⁽²⁾		29,602			3,920					33,522

Total operating expenses		78,978			8,704					87,682

Loss from operations		(4,008	)		(5,405	)				(9,413	)
Interest income (expense), net⁽³⁾		(87	)		3					(84	)
Other income (loss), net		(155	)		235					80

Loss before income taxes		(4,250	)		(5,167	)				(9,417	)
Income tax expense		(372	)		(23	)				(395	)

Net loss	$	(4,622	)	$	(5,190	)			$	(9,812	)	$	$

Cumulative annual preferred dividends		(1,800	)		—			1,800		—

Net loss attributable to common shareholders	$	(6,422	)	$	(5,190	)	$	1,800	$	(9,812	)	$	$

Net loss per common share (basic and diluted)	$	(0.07	)										$
Weighted-average number of shares used to compute net loss per common share (basic and diluted)		89,109,669

See accompanying notes to unaudited pro forma consolidated statement of operations.

NOTES TO UNAUDITED PRO FORMA CONSOLIDATED STATEMENT OF OPERATIONS
(dollars in thousands)

(A)

The table set forth below includes the historical operating results of Breach Security from January 1, 2010 to June 17, 2010 and Intellitactics from January 1, 2010 to February 28, 2010. The results of Breach Security and Intellitactics operations subsequent to the acquisition dates of June 18, 2010 and March 1, 2010, respectively, have been included in our audited consolidated historical financial statements included elsewhere in this prospectus.


	Breach			Breach			Breach															Total
	Security			Security			Security						Intellitactics			Intellitactics						Breach
	Historical			Historical			Purchase			Total			Historical			Purchase						Security
	January 1, 2010			April 1, 2010			Accounting and			Breach			January 1, 2010			Accounting and			Total			and
	to			to			Other			Security			to			Other			Intellitactics			Intellitactics
	March 31, 2010			June 17, 2010			Adjustments			Adjustments			February 28, 2010			Adjustments			Adjustments			Adjustments
	(in thousands)

Statement of Operations Data:
Revenue:
Subscription revenue	$	1,264		$	864		$	—		$	2,128		$	1,041		$	—		$	1,041		$	3,169
Professional services		34			84			—			118			355			—			355			473
Product sales		4			2			—			6			864			—			864			870

Total revenue		1,302			950			—			2,252			2,260			—			2,260			4,512

Cost of sales:
Service delivery, excluding depreciation and amortization		421			328						749			320			—			320			1,069
Product sales, excluding depreciation and amortization		—			—			—			—			79			—			79			79
Depreciation and amortization⁽¹⁾		—			—			(13	)		(13	)		—			78			78			65

Total cost of sales		421			328			(13	)		736			399			78			477			1,213

Gross profit		881			622			13			1,516			1,861			(78	)		1,783			3,299

Operating expenses:
Product development		735			698			—			1,433			498			—			498			1,931
Sales and marketing		1,182			1,042			—			2,224			629			—			629			2,853
General and								57									97
administrative⁽¹⁾⁽²⁾		620			1,634			(118	)		2,193			1,759			(129	)		1,727			3,920

Total operating expenses		2,537			3,374			(61	)		5,850			2,886			(32	)		2,854			8,704

Loss from operations		(1,656	)		(2,752	)		74			(4,334	)		(1,025	)		(46	)		(1,071	)		(5,405	)
Interest income (expense), net⁽³⁾		(222	)		(235	)		460			3			(123	)		123			—			3
Other income (loss), net		(3	)		46			—			43			192			—			192			235

Loss before income taxes		(1,881	)		(2,941	)		534			(4,288	)		(956	)		77			(879	)		(5,167	)
Income tax expense		(8	)		(15	)		—			(23	)		—			—			—			(23	)

Net loss	$	(1,889	)	$	(2,956	)	$	534		$	(4,311	)	$	(956	)	$	77		$	(879	)	$	(5,190	)


(1)		Reflects the pro forma impact of the recognized intangible assets of the Breach Security and Intellitactics acquisitions. Amortization expense is related to capitalized customer relationships amortized over five to ten years, capitalized trade names amortized over one to nine years and capitalized acquired proprietary technology amortized over four to eight years. The incremental amortization expense from the pro forma presentation results in an additional $219 in amortization expense for the year ended December 31, 2010. This increase in amortization was attributable to $142 for customer relationships, $65 for proprietary technology and $12 for trademarks.

(2)		We incurred transaction-related costs of $118 and $129 for the Breach Security and Intellitactics acquisitions, respectively. A pro forma adjustment has been made to eliminate these costs.


(3)		The Breach Security and Intellitactics acquisitions included the settlement of acquiree debt. A pro forma adjustment has been made to eliminate the historical interest expense of $460 and $123 for Breach Security and Intellitactics, respectively.


(B)	Gives effect to the Recapitalization, including the conversion of all of the outstanding shares of our Class A common stock, Class B common stock and preferred stock into a single class of common stock and the one-for- reverse stock split. Our outstanding preferred stock accrues cumulative annual dividends, which are payable only upon liquidation, dissolution or winding up of the Company or when and if declared by our board of directors. Our board of directors has not declared any dividends on our preferred stock and all accumulated dividends on such preferred stock will be extinguished in connection with the Recapitalization. In addition, the reverse stock split that will be implemented as part of the Recapitalization will decrease the weighted-average number of shares used to compute net loss per common share.

(C)	Gives further effect to our issuance and sale of shares of common stock in this offering at an assumed initial public offering price of $ per share, which is the midpoint of the price range listed on the cover page of this prospectus, after deducting underwriting discounts and commissions and estimated offering expenses payable by us, in each case as if such transactions had occurred on such date and the application of the net proceeds therefrom as set forth under “Use of Proceeds.” The offering will increase the weighted-average number of shares used to compute net loss per common share.

SELECTED HISTORICAL CONSOLIDATED FINANCIAL DATA

The following table sets forth our selected historical consolidated financial data as of and for the periods indicated. We have derived the selected historical consolidated financial data as of and for the years ended December 31, 2006, 2007, 2008, 2009 and 2010 from our audited consolidated financial statements for such period or years, as applicable. For comparison purposes, certain balances with respect to the financial data for the years ended December 31, 2006 and 2007 have been reclassified in order to conform with the presentation for the years ended December 31, 2008, 2009 and 2010. Our audited consolidated financial statements as of December 31, 2009 and 2010 and for each of the three years in the period ended December 31, 2010 have been included in this prospectus. Our historical results are not necessarily indicative of the operating results that may be expected in the future.

The selected historical consolidated data presented below should be read in conjunction with the sections entitled “Management’s Discussion and Analysis of Financial Condition and Results of Operations,” and the consolidated financial statements and related notes thereto included elsewhere in this prospectus.


	For the Year Ended December 31,
	2006			2007			2008			2009			2010
	(in thousands, except share and per share data)

Statement of Operations Data:
Revenue:
Subscription revenue	$	18,220		$	33,996		$	44,356		$	56,708		$	81,677
Professional services		4,603			9,096			13,219			15,056			19,639
Product sales		4,103			2,423			753			1,343			10,187

Total revenue		26,926			45,515			58,328			73,107			111,503

Cost of sales:
Service delivery, excluding depreciation and amortization		8,578			16,443			22,525			26,431			33,415
Product sales, excluding depreciation and amortization		3,206			1,615			440			481			1,715
Depreciation and amortization		120			396			591			718			1,403

Total cost of sales		11,904			18,454			23,556			27,630			36,533

Gross profit		15,022			27,061			34,772			45,477			74,970

Operating expenses:
Product development		1,517			4,184			6,749			9,146			20,112
Sales and marketing		7,079			11,689			14,059			17,388			29,264
General and administrative		9,527			12,989			16,030			20,511			29,602

Total operating expenses		18,123			28,862			36,838			47,045			78,978

Loss from operations		(3,101	)		(1,801	)		(2,066	)		(1,568	)		(4,008	)
Interest income (expense), net		51			(84	)		(151	)		(112	)		(87	)
Other income (loss), net		(269	)		(23	)		193			(304	)		(155	)
Gain on acquisition		—			—			—			552			—

Loss before income taxes		(3,319	)		(1,908	)		(2,024	)		(1,432	)		(4,250	)
Income tax expense		—			—			(22	)		(114	)		(372	)

Net loss	$	(3,319	)	$	(1,908	)	$	(2,046	)	$	(1,546	)	$	(4,622	)

Cumulative annual preferred dividends⁽¹⁾	$	(1,000	)	$	(1,000	)	$	(1,441	)	$	(1,800	)	$	(1,800	)

Net loss attributable to common shareholders	$	(4,319	)	$	(2,908	)	$	(3,487	)	$	(3,346	)	$	(6,422	)

Net loss per common share (basic and diluted)⁽²⁾		(0.10	)		(0.04	)		(0.05	)		(0.05	)		(0.07	)
Weighted-average number of shares used to compute net loss per common share (basic and diluted)⁽²⁾		41,595,263			68,746,161			71,047,256			73,904,725			89,109,669
Other Data:
Net cash provided by (used in):
Operating activities	$	1,243		$	(462	)	$	671		$	20,943		$	(10,212	)
Investing activities		159			(4,796	)		(2,226	)		(2,292	)		8,581
Financing activities		(652	)		1,483			6,668			(1,165	)		(7,495	)
Depreciation and amortization		1,233			1,747			2,136			3,012			4,970
Capital expenditures		507			1,771			1,786			2,743			4,273


	As of December 31,
	2006		2007			2008		2009		2010
	(in thousands)

Balance Sheet:
Cash and cash equivalents	$	5,235	$	1,441		$	6,594	$	23,916	$	14,558
Working capital⁽³⁾		2,948		(5,199	)		2,391		9,659		256
Total assets		35,208		45,272			55,021		86,675		122,068
Total debt⁽⁴⁾		1,283		5,533			2,083		1,000		—
Total convertible redeemable preferred stock⁽⁵⁾		17,434		18,434			19,434		20,434		21,434
Total stockholders’ equity		6,550		5,914			12,845		14,382		36,203


(1)		Represents the cumulative annual dividends payable on our outstanding preferred stock. Such dividends are payable only upon liquidation, dissolution or winding up of the Company or when and if declared by our board of directors. Our board of directors has not declared any dividends on our preferred stock and all accumulated dividends on such preferred stock will be extinguished in connection with the Recapitalization. For additional information regarding the terms of our existing preferred stock, see notes 13 and 14 to our consolidated financial statements included elsewhere in this prospectus.

(2)		Net loss per common share (basic and diluted) and the weighted average number of shares used to compute net loss per common share (basic and diluted) for the years ended December 31, 2008, 2009 and 2010 on an actual basis have been calculated without giving effect to the Recapitalization.

(3)		Working capital is the amount by which current assets exceed current liabilities.

(4)		Total debt includes notes payable, both current and non-current.

(5)		Our Series A-1 preferred stock and Series A-2 preferred stock can be redeemed upon the written request of the holders of two-thirds of our Series A-1 preferred stock or Series A-2 preferred stock, respectively, at an amount equal to their respective liquidation preferences. Since this redemption feature is not in our control, and does not have a date certain or event certain redemption requirement, we have classified our Series A-1 preferred stock and Series A-2 preferred stock as temporary equity on our consolidated balance sheet. For additional information regarding the terms of our preferred stock, see note 14 to the notes to our consolidated financial statements included elsewhere in this prospectus.

MANAGEMENT’S DISCUSSION AND ANALYSIS OF
FINANCIAL CONDITION AND RESULTS OF OPERATIONS

The following discussion and analysis of our financial condition and results of operations should be read in conjunction with “Selected Historical Consolidated Financial Data” and our consolidated financial statements and related notes appearing elsewhere in this prospectus. In addition to historical information, this discussion and analysis contains forward-looking statements that involve risks, uncertainties and assumptions. Our actual results may differ materially from those anticipated in these forward-looking statements as a result of certain factors. We discuss factors that we believe could cause or contribute to these differences below and elsewhere in this prospectus, including those set forth under “Risk Factors.”

Overview

Trustwave is a leading provider of on-demand data security compliance solutions that enable businesses and other organizations of all sizes to efficiently achieve and maintain compliance with regulatory requirements and industry standards. Our compliance management solutions, including our easy-to-use software-as-a-service TrustKeeper offering, have helped hundreds of thousands of organizations simplify the complex process of validating compliance. Additionally, our broad suite of compliance enablement solutions remediates data security deficiencies, allowing our customers to achieve and maintain compliance in a cost effective manner. These solutions assist our subscribers in comprehensively securing their network infrastructure, data communications and sensitive information assets, protecting them against the increasing threats of unauthorized access, fraudulent activity and other intrusions or breaches. We have been successful in rapidly expanding our customer base across a broad range of industries as a result of our differentiated partner network, which is comprised of many of the world’s largest financial institutions and other organizations influential to the compliance and data security mandates of their customers.

Our solutions include our industry leading software-as-a-service TrustKeeper compliance management offering along with a comprehensive suite of proprietary compliance enablement solutions. TrustKeeper and the TrustKeeper Agent assist organizations in validating compliance by analyzing, aggregating and reporting on prohibited data storage, systems configurations and security policy settings on subscribers’ systems or in centralized or distributed IT environments. In addition, our compliance enablement offerings provide a comprehensive, integrated turnkey suite of data security solutions, including encryption, extensible threat management, security information and event management, network access control, web application firewalls and data loss prevention. These solutions help address vulnerabilities detected by TrustKeeper, allowing our customers to achieve and maintain compliance.

We conduct our operations through four geographic operating segments, which are North America (U.S. and Canada), Europe Middle East and Africa, or “EMEA,” Latin America and the Caribbean, or “LAC,” and Asia Pacific, or “APAC.” Each of our operating segments offers both compliance management and compliance enablement solutions.

Important Factors Affecting Our Operating Results and Financial Condition

We believe our operating results and financial condition will continue to be affected by the following factors:

Increasing Demand For Data Security Compliance Solutions. We believe that the need for on-demand, scalable, automated and cost-effective data security compliance solutions will continue to increase as organizations

address a number of challenges of achieving and maintaining compliance with regulatory requirements and industry standards, including:


	•	increasing data security threats, which have led to a heightened regulatory and compliance environment;

	•	regulatory and compliance requirements that are becoming increasingly complex and difficult to achieve and maintain; and

	•	many existing compliance and data security solutions that are highly complex and expensive.

In addition, we believe that the number of locations where data is stored or transmitted, and consequently require protection, will continue to increase for financial transactions, as well as health care, government and other services. We believe we are well-positioned to benefit from this increasing demand for data security compliance solutions due to a number of key differentiators of our solutions, including that they simplify complex compliance processes, are cost-effective, scalable and flexible, comprehensive and integrated, well-known and trusted and utilize our proprietary knowledge and technology.

Continued Development of Our Partner Network. We have developed a partner network comprised of organizations influential to the compliance and data security mandates of their customers. These organizations, including many of the world’s leading financial institutions and other payment service providers, serve as differentiated and cost effective distribution partners for us, and we typically co-brand and co-market with these organizations to their customers. Many of our partners are in the midst of a multi-year effort to monitor and enforce PCI compliance among their payment card accepting customers. Historically, our partners started this process with their enterprise customers and in recent years they have expanded their focus to include small- and medium-sized business payment card accepting customers. As a result, we initially targeted the sale of our compliance management solutions to enterprise customers. Revenues from these enterprise customers accounted for a majority of our growth in 2008. Since then, our partner network has enabled us to expand into the SMB market, which contributed to a substantial increase in our 2009 and 2010 revenue. Going forward, we intend to focus on increasing our subscriber base globally by converting more of our PCI partner network payment card acceptance locations into TrustKeeper subscriptions.

Sales to New Customers and Additional Sales to Our Existing Customers. In addition to adding subscribers through our partner network, we have been successful at expanding our subscriber base through our direct sales efforts that have been principally focused on adding enterprise customers. We intend to continue to focus our direct sales efforts on such enterprises and, in that regard, intend to add new sales representatives, both domestically and internationally, as well as to expand into new compliance regimes and standards. Additionally, we believe that our compliance management solutions will continue to generate cross-selling opportunities to our installed base of our comprehensive suite of compliance enablement solutions as subscribers seek to remediate vulnerabilities identified by the compliance management process.

Introduction of New Products and Further Expansion into Specific Sectors. We believe it is important that we continue to develop new and enhanced solutions to enable us to capitalize on increasing demand for data security compliance solutions. For example, we recently introduced our end-to-end encryption and tokenization solutions, which were specifically designed to protect cardholder and other sensitive data. Additionally, we intend to continue to expand our offerings tailored to specific sectors, such as health care and government, which we believe will allow us to better address their specific compliance needs and further increase our presence in these sectors.

Improvement in our Operating Performance. Our recent operating results reflect our success in expanding our subscriber base through our partner network and direct sales efforts as well as increasing sales of our compliance enablement solutions to existing subscribers through our added capabilities from recent acquisitions. Our revenue increased from $58.3 million in 2008 to $73.1 million in 2009 and $111.5 million in 2010. During the same periods, our gross margin has expanded from 60% in 2008 to 62% in 2009 and 67% in 2010. Our net loss was $2.0 million in 2008, $1.5 million in 2009 and $4.6 million in 2010, while our Adjusted EBITDA increased from $0.4 million in 2008 to $3.1 million in 2009 and $4.9 million in 2010. Although we believe our revenue will continue to increase in the near term as we implement our growth strategy and benefit from the increasing demand for data security compliance solutions and the key differentiators of our solutions, we do not expect that our revenue growth will continue at these historical rates due, in part, to the increasing size of our revenue base that will be used for

comparison purposes. To support our recent and expected revenue growth and geographic expansion, we have recently hired a number of employees in our finance, human resource and IT departments, which has contributed to an increase in our general and administrative expenses.

Selective Pursuit of Acquisitions. An important part of our strategy to date has been the selective acquisition of compliance enablement technologies to enhance our ability to offer a cost-effective, comprehensive suite of data security compliance solutions to our customers. In the last three years, we acquired six companies with complementary technologies and we are utilizing these acquired technologies to enhance the capabilities of our overall product suite. For example, we introduced our DataControl solution, which combines our data loss prevention and persistent file encryption technologies, we incorporated new value-added features into our extensible threat management solution, and we developed our 360 Application Security Program, which combines our SpiderLabs services with web application firewalls. For additional information regarding these recent acquisitions, see “-Recent Acquisitions” set forth below. Going forward, we plan to continue to selectively pursue acquisitions of technologies that bolster and complement our data security solutions.

Revenue Composition. Our revenue composition across subscription revenue, professional services, and product sales has and will continue to vary from period-to-period. Our subscription revenue in any particular period is influenced by a number of factors, including the number of new subscribers added, whether through our partner network or direct sales efforts, the percentage of subscriber turnover, and the terms of new contracts. Our professional services revenue in any given period is typically impacted by the level of demand for our security consulting services, as well as our ability to hire, train and retain security professionals. Our product sales are generally dependent on recent bookings trends, which can be affected by a number of factors, such as customer budget cycles, seasonality, buying preferences of customers and the introduction of new solution offerings by us. Our revenue composition has also been affected by our recent acquisitions and may be impacted by any future acquisitions we may complete. For example, our product sales in 2010 significantly increased as compared to prior periods primarily as a result of our acquisition of Intellitactics on March 1, 2010. The table below sets forth the amount of our subscription revenue, professional services and product sales as a percentage of revenue for each of our last three years:


	For the Year Ended December 31,
	2008			2009			2010

Revenue:
Subscription revenue		76.0	%		77.6	%		73.3	%
Professional services		22.7			20.6			17.6
Product sales		1.3			1.8			9.1

Total		100.0	%		100.0	%		100.0	%

As compared to 2010, we expect that our subscription revenue will represent a greater percentage of our total revenue over the longer term as a result of our focus in expanding our subscriber base and cross-selling our subscription compliance enablement solutions to our subscribers. We believe our subscription revenue provides us with a significant level of visibility with respect to our overall revenue for the next 12 months. The gross margins associated with these revenue categories vary and, as a result, our gross margin will be impacted by period-to-period changes in our revenue composition.

Foreign Currency Exchange Rates. As a result of our international operations, we generate a portion of our revenue and incur a portion of our expenses in currencies other than the U.S. dollar, including the euro, the British pound sterling, the Swedish krona, the Brazilian real, the South African rand and the Australian dollar. Our results of operations are impacted by currency exchange rate fluctuations to the extent that we are unable to match net revenues received in foreign currencies with expenses incurred in the same currency. For example, where we have significantly more expenses than net revenues generated in a foreign currency, our profit from operations in that location would be adversely affected in the event that the U.S. dollar depreciates against that foreign currency. Although we are not currently engaged in any financial hedging transactions, we may seek to mitigate the cash

effect of exchange rate fluctuations through the use of derivative financial instruments. We record the effects from changes in foreign currency exchange rates in our consolidated statement of operations in other income (loss), net.

We present our consolidated financial statements in U.S. dollars. As a result, we must translate the assets, liabilities, net revenues and expenses of all of our operations into U.S. dollars at applicable exchange rates. Consequently, increases or decreases in the value of the U.S. dollar may affect the value of these items with respect to our non-U.S. dollar businesses in our consolidated financial statements, even if their value has not changed in their local currency. For example, a stronger U.S. dollar will reduce the relative value of reported results of non-U.S. dollar operations and, conversely, a weaker U.S. dollar will increase the relative value of the non-U.S. dollar operations. These translations could significantly affect the comparability of our results between financial periods or result in significant changes to the carrying value of our assets, liabilities and stockholders’ equity.

Recent Acquisitions

We believe that our ability to offer cost effective, comprehensive compliance enablement solutions to help our customers remediate vulnerabilities identified by our compliance management solutions is a critical step toward achieving our longer term growth strategy. In order to accelerate the time to market of our compliance enablement offerings and take advantage of the growth in our compliance management subscriber base, we decided to acquire a number of the technologies required to address certain data security requirements, specific customer needs and evolving security threats. Our acquisitions have enabled us to acquire a broad suite of core, enterprise-grade security technologies and capabilities that we have been able to successfully integrate into our overall solutions.

During the last three fiscal years, we have completed the following acquisitions:

Breach Security, Inc. On June 18, 2010, we acquired Breach Security, a provider of web application firewall technology, or “WAF,” which provides protection for web applications, such as e-commerce sites, against attacks. WAF helps organizations using active web applications to safely maintain the flow of critical network traffic into and out of their organizations and enables compliance with multiple requirements of PCI as well as requirements of other regulatory standards. We have utilized this technology as part of our 360 Application Security Program.

Intellitactics, Inc. On March 1, 2010, we acquired Intellitactics, a provider of security information and event management, or “SIEM,” technology. This solution provides comprehensive reporting of events logged in networks, systems, applications and databases, and is a critical component of robust security architectures, as well as a requirement of many information security regulations and industry standards. SIEM technology can be integrated with our other solutions at customer sites to enable real-time analysis and reaction to security threats through policy-based event monitoring. Also, the SIEM solution is used internally by our secure operations centers and plays a key role in the delivery of our managed security services.

BitArmor Systems, Inc. On January 6, 2010, we acquired BitArmor Systems, Inc., or “BitArmor,” a provider of data encryption solutions, including full disk encryption and persistent file encryption. Encrypting sensitive information is a key component to complying with many data security standards, including PCI. The acquired technology has also served as a foundation for both our DataControl solution and our end-to-end encryption product.

Vericept Corporation. On August 26, 2009, we acquired Vericept Corporation, or “Vericept,” to provide our customers access to advanced data loss prevention solutions. These solutions detect and analyze sensitive data that may be traveling over corporate networks or that may be stored on various enterprise devices. As part of a comprehensive data protection technology suite, this acquired technology can assist companies in meeting their security and compliance objectives. This technology has also served as a foundation for our DataControl solution.

Mirage Networks, Inc. On February 1, 2009, we acquired Mirage Networks, Inc., or “Mirage Networks,” a provider of network access control solutions. These solutions provide a means for customers to govern who connects to their network, which devices they use and which IT resources they are permitted to access. The acquired technology meets one of the PCI requirements and can be used to aid compliance with three other requirements by enforcing policies with respect to server roles, host-based anti-virus and operating system patch application. A

lightweight network access control solution, known as NAC Express, is integrated into our extensible threat management solution.

ControlPath Inc. On August 18, 2008, we acquired ControlPath Inc., a provider of solutions to manage and automate enterprise governance, risk management and compliance of multiple regulatory regimes. Since the data security requirements across compliance initiatives are relatively uniform, it is significantly more efficient to address them through a single, unified compliance solution. We plan to integrate components of this acquired technology to further expand our offerings in other data security regimes such as HIPAA and FISMA, among others.

Acquisition Accounting and Related Matters

We accounted for each of the acquisitions described above using the purchase method of accounting. As a result, the purchase prices for each of these acquisitions were allocated to the tangible and intangible assets acquired and liabilities assumed based upon their respective fair values as of the date of each acquisition. The excess of the purchase price over the fair value of assets and liabilities was assigned to goodwill, which is not amortized for accounting purposes, but is subject to testing for impairment at least annually. At December 31, 2010, we had goodwill of $42.1 million and intangible assets of $17.5 million. The application of purchase accounting resulted in an increase in amortization and depreciation expense in the periods subsequent to such acquisitions relating to our acquired intangible assets. For more information regarding our accounting for such acquisitions, see note 2 to the notes to our consolidated financial statements included elsewhere in this prospectus.

In connection with such acquisitions, we incurred acquisition, transaction and integration expenses as well as severance and transition costs. We have added these costs and expenses back to our net loss in calculating Adjusted EBITDA. For more information regarding our integration charges, see note 11 to the notes to our consolidated financial statements included elsewhere in this prospectus. In certain instances, we have experienced increases in our sales and marketing and product development expenses in periods following certain acquisitions as a result of adding additional sales and marketing and product development personnel from those acquired businesses.

Important Components of Our Statement of Operations

Revenues

Subscription Revenue. Subscription revenue includes compliance management and compliance enablement solutions sold under subscription arrangements. Our subscription revenue is driven primarily by the number and type of services to which our subscribers subscribe and is not concentrated within one subscriber or group of subscribers. A majority of our subscription revenue has been related to PCI compliance, including through our TrustKeeper and Compliance Validation solutions, which is expected to remain the main driver of subscription revenue in the foreseeable future. We offer a variety of billing options from monthly to annually depending on the size of the contract and we initially record a subscription fee as deferred revenue and then recognize it ratably over the subscription period. The amount of deferred revenue recorded depends on the invoicing terms as more frequent invoicing cycles will not materially affect our deferred revenue balance while less frequent invoicing cycles will affect such balance.

Professional Services. Services revenue includes consulting, implementation, training and other services. We recognize professional services revenue as the services are performed. We offer a variety of billing options including up front, milestone or percent completion. Depending on the billing option, we may or may not record any deferred revenue.

Product Sales. Product sales includes the sale of perpetual software licenses and related hardware, such as our security information and event management, web application firewall and network access control solutions. We recognize product revenue upon delivery or acceptance (deemed or explicit) depending on the specific contract language.

Cost of Sales

Service Delivery, Excluding Depreciation and Amortization. Cost of service delivery includes the cost of generating subscription revenue and professional services revenue. Cost of service delivery, excluding depreciation and amortization, primarily consists of expenses related to delivery to and support of our compliance management and compliance enablement customers. These expenses include salaries, benefits, bonuses and stock-based compensation, commissions, travel costs, outside service providers and data center costs. In general, we do not allocate overhead such as rent, IT costs and certain benefit program costs to cost of services but instead we recognize these costs as general and administrative expenses.

Product Sales, Excluding Depreciation and Amortization. Cost of product sales consists primarily of the expense associated with third party license fees and related hardware.

Depreciation and Amortization. Depreciation and amortization consists primarily of depreciation expense related to customer premise equipment for our compliance enablement offerings where any managed device resides at a customer location and amortization expense for certain acquired intangible assets.

We expect that these costs will continue to increase in absolute dollars in the event our revenue continues to increase. As a percentage of revenue, however, we expect these costs are likely to continue to decrease as we improve our overall gross margin through favorable changes in our revenue composition. Cost of sales as a percentage of revenue could vary from period-to-period depending on a number of factors, including the timing and pace of additional employee hiring and fluctuations in outside vendor costs.

Operating Expenses

Product Development. Our product development expense consists primarily of personnel and related expense for our product development and product management teams, including salaries, benefits, bonuses and stock-based compensation, commissions, travel costs, outside service providers and recruiting costs. We have focused our development efforts primarily to enhancing the functionality and expanding the capabilities of our compliance management and compliance enablement solutions. As a percentage of revenue, our product development expense was 12%, 13% and 18% of revenue in 2008, 2009 and 2010, respectively. We expect to continue to invest in product development to expand the functionality and enhance the ease of use of our compliance management and compliance enablement solutions. In the near term, we expect that our product development expense is likely to continue to increase in absolute dollars but that it will remain relatively consistent with prior periods as a percentage of revenue.

Sales and Marketing. Our sales and marketing expense consists primarily of personnel and related expense for our direct sales team, our sales engineers, our team that recruits, enables and supports our partner network and our marketing team. This expense includes salaries, benefits, bonuses, stock-based compensation, commissions, travel costs, outside service providers and recruiting costs. As a percentage of revenue, our sales and marketing expenses were 24%, 24% and 26% in 2008, 2009 and 2010, respectively, primarily due to our ongoing efforts to expand our subscriber base. We intend to continue to invest in sales and marketing to add new subscribers, increase penetration in our existing subscriber base, build brand awareness and sponsor additional marketing events and programs. In the near term, we expect that our sales and marketing expenses will continue to increase in absolute dollars but that it will remain relatively consistent with prior periods as a percentage of revenue.

General and Administrative. Our general and administrative expense consists primarily of personnel and related expense for our executive, finance, legal, human resources, IT and administrative personnel, including salaries, benefits, bonuses and stock-based compensation, commissions, travel costs, outside service providers and recruiting costs. We also group support expense such as facilities, legal, accounting, other professional service fees, corporate expense and depreciation and amortization in general and administrative. As a percentage of revenue, general and administrative expense was 27%, 28% and 27% in 2008, 2009 and 2010, respectively.

Going forward, we expect to continue to incur higher costs associated with being a public company, including higher legal, corporate insurance and accounting expenses and the additional costs of achieving and maintaining compliance with Section 404 of the Sarbanes-Oxley Act and related regulations. We currently anticipate that we will be required to begin to comply with Section 404 of the Sarbanes-Oxley Act in 2012. We expect that general and

administrative expenses will increase in the near term in absolute dollars because of these public company costs and our efforts to expand our international operations. However, over time we believe our general and administrative costs will decline as a percentage of revenues as we expect to derive greater efficiencies from our corporate infrastructure.

Gain on Acquisition

Gain on acquisition was the result of our acquisition of Mirage Networks on February 1, 2009. The total purchase price consisted of the assumption of short-term liabilities and resulted in a $0.6 million bargain purchase gain, which was recorded as a gain on acquisition in our consolidated statement of operations in 2009.

Income Tax Expense

We estimate actual current tax expense together with assessing temporary differences resulting from differing treatment of items, such as accruals and allowances not currently deductible for tax purposes. These differences result in deferred tax assets and liabilities, which are included in our consolidated balance sheets. In general, deferred tax assets represent future tax benefits to be received when certain expenses previously recognized in our consolidated statements of operations become deductible expenses under applicable income tax laws or loss or credit carry forwards are utilized. Accordingly, realization of our deferred tax assets is dependent on future taxable income against which these deductions, losses and credits can be utilized. We must assess the likelihood that our deferred tax assets will be recovered from future taxable income and to the extent we believe that recovery is not more likely than not, we must establish a valuation allowance.

Management judgment is required in determining our provision for income taxes, our deferred tax assets and liabilities and any valuation allowance recorded against our net deferred tax assets. For deferred tax assets generated in the U.S., the United Kingdom, Brazil, Canada, Hong Kong, India and Singapore, we recorded a full valuation allowance as of December 31, 2008, 2009 and 2010. Based on the available evidence, we believed at that time it was more likely than not that we would not be able to utilize all of our deferred tax assets in the future. We intend to maintain the valuation allowance until sufficient evidence exists to support the reversal of the valuation allowance, either as a result of establishing a pattern of profitability or the possible result of a to be developed tax strategy assessing the need for the valuation allowance. In that event, we would make an adjustment to the allowance for the deferred tax asset, which would increase income in the period that determination was made. At December 31, 2010, we had federal net operating loss carry-forwards of $45.3 million available to reduce future taxable income in the United States.

We underwent a change in ownership for purposes of Section 382 of the Internal Revenue Code of 1986, as amended, or the “Code,” as a result of our merger with Ambiron in 2005. As a result, the amount of our pre-change net operating losses, or “NOLs,” and other tax attributes that are available to offset future taxable income of $5.8 million are subject to an annual limitation of $0.7 million per year. Section 382 of the Code also limited the annual deduction related to $10.5 million of accumulated net operating losses acquired through the acquisition of Secure Pipe, Inc in December, 2006 to approximately $0.5 million per year. The annual limitation is based on the value of the corporation as of the effective date of the transaction. The ownership change and the resulting annual limitation on use of NOLs are not expected to result in the expiration of our NOL carry forwards if we are able to generate sufficient future taxable income within the carry forward periods. However, the limitation on the amount of NOLs available to offset taxable income in a specific year may result in the payment of income taxes before all NOLs have been utilized. Additionally, a subsequent ownership change may result in further limitation on the ability to utilize existing NOLs and other tax attributes. Our NOLs are subject to expiration from 2022 through 2029. For more information regarding income taxes, see note 8 to the notes to our consolidated financial statements included elsewhere in this prospectus.

Adjusted EBITDA

We present Adjusted EBITDA, a non-GAAP financial measure, in this prospectus to provide investors with a supplemental measure of our operating performance. We believe that Adjusted EBITDA is a useful performance measure and is used by us to facilitate a comparison of our operating performance on a consistent basis from

period-to-period and to provide for a more complete understanding of factors and trends affecting our business than GAAP measures can provide alone. Our board of directors and management also use Adjusted EBITDA as one of the primary methods for planning and forecasting overall expectations and for evaluating on a quarterly and annual basis actual results against such expectations, and as a performance evaluation metric in determining achievement of certain compensation programs and plans for employees, including our senior executives.

We believe Adjusted EBITDA may be useful to investors in comparing our operating performance consistently over time as it removes from our operating results the impact of our capital structure, asset base (primarily depreciation and amortization), items outside the control of the management team (such as taxes or changes in foreign currency exchange rates) and other non-cash (such as purchase accounting adjustments) or non-recurring items, including the impact of non-cash stock-based compensation expense.

We define Adjusted EBITDA, a non-GAAP financial measure, as net income (loss) before income tax expense (benefit), depreciation and amortization, net interest expense, stock-based compensation, gain (loss) on foreign currency exchange, severance and transition costs, and acquisition, transaction and integration expenses.

The use of Adjusted EBITDA has limitations as an analytical tool and you should not consider this performance measure in isolation from, or as an alternative to, GAAP measures such as net income/(loss) or loss from operations. Adjusted EBITDA is not a measure of liquidity under GAAP or otherwise, and is not an alternative to cash flow from continuing operating activities. The limitations of Adjusted EBITDA include: (i) it does not reflect our cash expenditures or future requirements for capital expenditures or contractual commitments; (ii) it does not reflect changes in, or cash requirements for, our working capital needs; (iii) it does not reflect income tax payments we may be required to make; and (iv) although depreciation and amortization are non-cash charges, the assets being depreciated and amortized often will have to be replaced in the future, and Adjusted EBITDA does not reflect any cash requirements for such replacements.

To properly and prudently evaluate our business, we encourage you to review our audited consolidated financial statements included elsewhere in this prospectus and the reconciliation to Adjusted EBITDA from net loss, the most directly comparable financial measure presented in accordance with GAAP, set forth in the table below. All of the items included in the reconciliation from net loss to Adjusted EBITDA are either (i) non-cash items or (ii) items that management does not consider in assessing our on-going operating performance. In the case of the non-cash items, management believes that investors may find it useful to assess our comparative operating performance because the measures without such items are less susceptible to variances in actual performance resulting from depreciation, amortization and other non-cash charges and more reflective of other factors that affect operating performance. In the case of items not considered in assessing our on-going operating performance, management believes that investors may find it useful to assess our operating performance if the measures are presented without these items because their financial impact may not reflect ongoing operating performance.

Results of Operations

The following table sets forth a summary of our consolidated statements of operations in thousands of dollars and as a percentage of total revenue. We have derived the data for the years ended December 31, 2008, 2009 and 2010 from the audited consolidated financial statements included elsewhere in this prospectus. The table below also presents a reconciliation of Adjusted EBITDA to net loss. See “-Adjusted EBITDA.” Amounts and percentages in the table below have been calculated based on unrounded numbers. Accordingly, certain amounts may not add to the totals due to the effect of rounding.


	For the Year Ended December 31,
	2008						2009						2010
				Percent of						Percent of						Percent of
	Amount			Revenue			Amount			Revenue			Amount			Revenue
	(dollars in thousands)

Statement of Operations Data:
Revenue:
Subscription revenue	$	44,356			76.0	%	$	56,708			77.6	%	$	81,677			73.3	%
Professional services		13,219			22.7			15,056			20.6			19,639			17.6
Product sales		753			1.3			1,343			1.8			10,187			9.1

Total revenue		58,328			100.0			73,107			100.0			111,503			100.0

Cost of sales:
Service delivery, excluding depreciation and amortization⁽¹⁾		22,525			38.6			26,431			36.1			33,415			30.0
Product sales, excluding depreciation and amortization		440			0.8			481			0.7			1,715			1.5
Depreciation and amortization		591			1.0			718			1.0			1,403			1.3

Total cost of sales		23,556			40.4			27,630			37.8			36,533			32.8

Gross profit		34,772			59.6			45,477			62.2			74,970			67.2

Operating expenses:
Product development		6,749			11.5			9,146			12.5			20,112			18.0
Sales and marketing		14,059			24.1			17,388			23.8			29,264			26.2
General and administrative		16,030			27.5			20,511			28.0			29,602			26.6

Total operating expenses		36,838			63.1			47,045			64.3			78,978			70.8

Loss from operations		(2,066	)		(3.5	)		(1,568	)		(2.1	)		(4,008	)		(3.6	)
Interest expense, net		(151	)		(0.3	)		(112	)		(0.1	)		(87	)		(0.1	)
Other income (loss), net		193			0.3			(304	)		(0.5	)		(155	)		(0.1	)
Gain on acquisition		—			—			552			0.7			—			—

Loss before income taxes		(2,024	)		(3.5	)		(1,432	)		(2.0	)		(4,250	)		(3.8	)
Income tax expense		(22	)		N/M			(114	)		(0.1	)		(372	)		(0.3	)

Net loss	$	(2,046	)		(3.5	)%	$	(1,546	)		(2.1	)%	$	(4,622	)		(4.1	)%

Reconciliation of non-GAAP measure:
Income tax expense	$	22			N/M		$	114			0.1	%	$	372			0.3	%
Depreciation and amortization		2,136			3.7			3,012			4.1			4,970			4.5
Interest expense, net		151			0.2			112			0.1			87			0.1
Stock-based compensation expense⁽²⁾		285			0.5			278			0.4			1,026			0.9
(Gain) loss on foreign currency exchange		(178	)		(0.3	)		259			0.4			232			0.2
Severance and transition costs⁽³⁾		—			—			948			1.3			1,268			1.1
Acquisition, transaction and integration expenses⁽⁴⁾		37			0.1			(98	)		(0.1	)		1,523			1.4

Adjusted EBITDA⁽⁵⁾	$	407			0.7	%	$	3,079			4.2	%	$	4,856			4.4	%

“N/M” indicates the percentage is not meaningful.


(1)		Calculated based upon a percentage of total subscription and professional services, as the costs to deliver these product lines originate from the same Company resources.
(2)		Represents non-cash compensation expense.


(3)		Represents severance and transition payments made to employees that were terminated as a result of acquisitions and to certain members of our senior management team whose positions were restructured in contemplation of this offering.

(4)		Represents costs and expenses associated with acquisitions, transactions and integration activities during the period, including the following:


	For the Year Ended December 31,
	2008		2009			2010
	(in thousands)

Acquisition costs⁽ⁱ⁾	$	3	$	271		$	261
Transaction costs for potential acquisitions⁽ⁱⁱ⁾		34		5			494
Financial reporting costs for acquired companies⁽ⁱⁱⁱ⁾		—		113			195
Lease abandonment^(iv)		—		—			342
Post acquisition purchase accounting adjustments^(v)		—		65			231
Gain on acquisition^(vi)		—		(552	)		—

Total acquisition, transaction and integration expenses	$	37	$	(98	)	$	1,523


	(i)	Represents legal fees incurred in connection with acquisitions during the period.

	(ii)	Represents legal, accounting and other consulting fees incurred in connection with transactions that were not completed.

	(iii)	Represents valuation services and audits of acquired companies.

	(iv)	Represents the lease abandonment accrual for our facility in Carlsbad, California.

	(v)	Represents certain adjustments relating to the purchased assets and assumed liabilities of Mirage Networks, BitArmor and Breach Security which we identified subsequent to finalizing the purchase accounting for such acquisitions.

	(vi)	Represents the gain on acquisition of Mirage Networks.


(5)		For more information regarding Adjusted EBITDA, a non-GAAP measure, see “— Adjusted EBITDA.”

Comparison of the Years Ended December 31, 2009 and 2010

Revenue


	For the Year Ended December 31,
	2009					2010					Period-to-Period Change
			Percent of					Percent of
	Amount		Revenue			Amount		Revenue			Amount		Percent
	(dollars in thousands)

Revenue:
Subscription revenue	$	56,708		77.6	%	$	81,677		73.3	%	$	24,969		44.0	%
Professional services		15,056		20.6			19,639		17.6			4,583		30.4
Product sales		1,343		1.8			10,187		9.1			8,844		N/M

Total revenue	$	73,107		100.0	%	$	111,503		100.0	%	$	38,396		52.5	%

North America	$	61,936		84.7	%	$	94,706		84.9	%	$	32,770		52.9	%
EMEA		9,957		13.6			13,509		12.1			3,552		35.7
LAC		579		0.8			1,980		1.8			1,401		N/M
APAC		635		0.9			1,308		1.2			673		106.0

Total revenue	$	73,107		100.0	%	$	111,503		100.0	%	$	38,396		52.5	%

“N/M” indicates the percentage is not meaningful.

Revenue was $111.5 million in 2010 compared to $73.1 million in 2009, an increase of $38.4 million, or 53%. Subscription revenue increased by $25.0 million, or 44%, due to several factors. We increased our revenue from the sale of our compliance management solutions as a result of a significant increase in our subscribers from our partner network as well as our ongoing direct sales efforts. We also increased our revenue from the sale of compliance enablement solutions as a result of acquiring additional customer relationships and technologies primarily through

our acquisition of Intellitactics in 2010, as well as increasing our customers and device counts through our own direct sales efforts. Professional services revenue increased by $4.6 million, or 30%, because of increased demand for our SpiderLabs services as well as additional installation work associated with our product sales. Product sales increased by $8.8 million, representing significant growth from the prior year, primarily due to our acquisition of Intellitactics. In 2010, revenue generated by recently acquired businesses through the first anniversary of their respective acquisition dates was $19.2 million. Excluding this revenue, our revenue increased in 2010 by 26% as compared to our comparable revenue in 2009.

We increased revenue in 2010 by $32.8 million, or 53%, in our largest geographic market, North America, due to a significant increase in our subscriber base through our partner network and direct sales efforts and our acquisition of Intellitactics. Our EMEA revenue increase was primarily related to an increase in subscribers for our partner network.

Cost of Sales and Gross Profit


	For the Year Ended December 31,
	2009					2010					Period-to-Period Change
			Percent of					Percent of
	Amount		Revenue			Amount		Revenue			Amount		Percent
	(dollars in thousands)

Cost of sales:
Service delivery, excluding depreciation and amortization	$	26,431		36.1	%	$	33,415		30.0	%	$	6,984		26.4	%
Product sales, excluding depreciation and amortization		481		0.7			1,715		1.5			1,234		N/M
Depreciation and amortization		718		1.0			1,403		1.3			685		95.4

Total cost of sales		27,630		37.8	%		36,533		32.8	%		8,903		32.2	%

Gross profit	$	45,477		62.2	%	$	74,970		67.2	%	$	29,493		64.9	%

“N/M” indicates that the percentage is not meaningful.

Cost of sales was $36.5 million in 2010 compared to $27.6 million in 2009, an increase of $8.9 million, or 32%. Cost of sales as a percent of revenue declined from 38% in 2009 to 33% in 2010. Service delivery cost increased $7.0 million, or 26%, primarily as a result of $5.8 million, or 25%, increase in salary and associated employee expense for tax, benefits, bonus, travel and entertainment expense. There was also an increase of $0.5 million due to increased use of outsourced call center capabilities. The increase in employees and associated expense is due to ramping up our delivery and support capabilities to support our customer and product growth.

Product sales cost increased $1.2 million, primarily as a result of our increased product sales related to our security information & event management, web application firewall and network access control solutions, and their associated hardware and other costs.

Depreciation and amortization expense increased $0.7 million as a result of a $0.2 million increase in depreciation expense for customer premise equipment and a $0.5 million increase in amortization expense primarily due to our 2010 acquisitions.

Gross profit increased to $75.0 million in 2010 compared to $45.5 million in 2009, an increase of $29.5 million, or 65%, as our revenue mix moved towards higher margin products and other offerings and the benefits of economies of being a larger organization.

Operating Expenses


	For the Year Ended December 31,
	2009					2010					Period-to-Period Change
			Percent of					Percent of
	Amount		Revenue			Amount		Revenue			Amount		Percent
	(dollars in thousands)

Operating expenses:
Product development	$	9,146		12.5	%	$	20,112		18.0	%	$	10,966		119.9	%
Sales and marketing		17,388		23.8			29,264		26.2			11,876		68.3
General and administrative		20,511		28.0			29,602		26.6			9,091		44.3

Total operating expenses	$	47,045		64.3	%	$	78,978		70.8	%	$	31,933		67.9	%

Product Development. Product development expenses increased by $11.0 million, or 120%, primarily related to headcount expansion both from integrating the development teams from the three companies we acquired in 2010, as well as other hiring. Salary and associated employee expense increased $10.2 million, or 114%. There was also an increase of $0.3 million in the use of temporary employees on a project basis and an increase of $0.5 million in other costs.

Sales and Marketing. Sales and marketing expenses increased by $11.9 million, or 68%, primarily as a result of our retaining sales resources from our 2010 acquisitions. Employee related expense, excluding commissions and referral fees, increased by $6.0 million, or 60%. Commissions and referral fees increased by $4.3 million, or 76%, primarily the result of legacy commission plans from the acquired entities and by selling more products than the prior year. Third party marketing expense increased by $1.1 million as a result of increased advertising and presence at industry trade shows and similar events.

General and Administrative. General and administrative expenses increased by $9.1 million, or 44%. This increase was due to an increase in employee related expense of $2.5 million, or 33%, as a result of hiring employees in our finance, human resource and IT departments. There was also an increase of $1.2 million in legal, accounting and third party support fees primarily related to our three acquisitions in 2010. Real estate costs increased by $1.1 million, which includes a write-off of $0.3 million related to an office we closed after an acquisition. Bad debt expense increased by $0.8 million to $1.5 million in 2010 as a result of the associated increase in our revenue and the broader geographic scope of our subscriber base. Telecommunications costs increased by $0.9 million to $1.7 million in 2010 primarily due to hiring employees, office expansion and upgrading our systems. Certain gross receipt tax expenses increased by $0.5 million to $0.6 million in 2010 as a result of filing in more tax jurisdictions. Depreciation and amortization expense increased $1.3 million primarily as a result of capital expenditures and the acquisitions completed in 2010.

Other Income (Loss), Net

Other income (loss), net was a loss of $0.2 million in 2010 compared to an expense of $0.3 million in 2009. The change was the result of an improvement in our foreign currency exchange rates and other income of $0.1 million.

Income Tax Expense

We recorded an income tax expense of $0.1 million in 2009 as compared to $0.4 million in 2010. We had an effective tax expense rate of (8.0)% for 2009 and (8.8)% in 2010. For 2010, we applied a valuation allowance against certain of our deferred tax assets, including net operating loss carry forwards, which reduced the effective tax benefit rate from the expected statutory rate. In accordance with authoritative accounting guidance, a valuation allowance is required unless it is more likely than not that future taxable income or the reversal of deferred tax liabilities will be sufficient to recover deferred tax assets. In addition, certain state taxes are calculated on bases different than pre-tax loss. This resulted in us recording income tax expense for these states, which also lowered our effective tax benefit rate in 2009 and 2010 compared to the statutory rate.

Adjusted EBITDA


	For the Year Ended December 31,												Period-to-Period
	2009						2010						Change
				Percent of						Percent of
	Amount			Revenue			Amount			Revenue			Amount			Percent
	(dollars in thousands)

Segment Reported Adjusted EBITDA:
North America	$	4,175			5.7	%	$	7,111			6.4	%	$	2,936			70.3	%
EMEA		329			0.5			492			0.4			163			49.5
LAC		(624	)		(0.9	)		(1,817	)		(1.6	)		(1,193	)		191.2
APAC		(801	)		(1.1	)		(930	)		(0.8	)		(129	)		16.1

Total adjusted EBITDA⁽¹⁾	$	3,079			4.2	%	$	4,856			4.4	%	$	1,777			57.7	%

Income tax expense	$	(114	)		(0.1	)%	$	(372	)		(0.3	)%	$	(258	)		N/M
Depreciation and amortization		(3,012	)		(4.1	)		(4,970	)		(4.5	)		(1,958	)		65.0
Interest expense, net		(112	)		(0.1	)		(87	)		(0.1	)		25			(22.3	)
Stock-based compensation expense⁽²⁾		(278	)		(0.4	)		(1,026	)		(0.9	)		(748	)		N/M
Gain (loss) on foreign currency exchange		(259	)		(0.4	)		(232	)		(0.2	)		27			(10.4	)
Severance and transition costs		(948	)		(1.3	)		(1,268	)		(1.1	)		(320	)		33.8
Acquisition transaction and integration expenses⁽³⁾		98			0.1			(1,523	)		(1.4	)		(1,621	)		N/M

Net loss	$	(1,546	)		(2.1	)%	$	(4,622	)		(4.1	)%	$	(3,076	)		199.0	%

“N/M” indicates the percentage is not meaningful.


(1)		For more information regarding Adjusted EBITDA, a non-GAAP measure, see “-Results of Operations” and “-Adjusted EBITDA.”
(2)		Represents non-cash compensation expense.
(3)		Represents costs and expenses associated with acquisitions, integration activities and restructuring during the period, including legal, diligence and audit expenses, severance expenses and restructuring charges. For more information, see “-Recent Acquisitions.”

Adjusted EBITDA increased by $1.8 million, or 58%, to $4.9 million as a result of our gross profit excluding depreciation and amortization increasing by $30.2 million, or 65%, largely due to our increase in subscribers in North America and our acquisitions during the period. This was offset by a net increase of $27.9 million in operating expenses excluding depreciation and amortization, stock-based compensation and acquisition, transaction, integration and severance costs, that resulted from increased hiring, additional sales and marketing activities to support our revenue growth and other factors.

Comparison of the Years Ended December 31, 2008 and 2009

Revenue


	For the Year Ended December 31,
	2008					2009					Period-to-Period Change
			Percent of					Percent of
	Amount		Revenue			Amount		Revenue			Amount		Percent
	(dollars in thousands)

Revenue:
Subscription revenue	$	44,356		76.0	%	$	56,708		77.6	%	$	12,352		27.8	%
Professional services		13,219		22.7			15,056		20.6			1,837		13.9
Product sales		753		1.3			1,343		1.8			590		78.4

Total revenue	$	58,328		100.0	%	$	73,107		100.0	%	$	14,779		25.3	%

North America	$	47,932		82.2	%	$	61,936		84.7	%	$	14,004		29.2	%
EMEA		9,640		16.5			9,957		13.6			317		3.3
LAC		268		0.5			579		0.8			311		116.0
APAC		488		0.8			635		0.9			147		30.1

Total revenue	$	58,328		100.0	%	$	73,107		100.0	%	$	14,779		25.3	%

Revenue was $73.1 million in 2009 compared to $58.3 million in 2008, an increase of $14.8 million, or 25%. Subscription revenue increased by $12.4 million, or 28%, primarily as a result of a substantial increase in our revenue from sales of our compliance management solutions through our successful expansion into the SMB market through our partner network in 2009. Professional services revenue increased by $1.8 million, or 14%, because of increased demand for our services work as well as additional installation work associated with our product sales. Product sales increased by $0.6 million primarily as a result of the acquisition of Mirage Networks. In 2009, revenue generated by recently acquired businesses through the first anniversary of their respective acquisition dates was $3.4 million. Excluding this revenue, our revenue increased in 2009 by 20% as compared to our comparable revenue in 2008.

Revenue increased $14.0 million, or 29%, in our largest geographic market, North America, due to our successful expansion into the SMB market through our partner network and acquisitions we completed in 2009.

Cost of Sales and Gross Profit


	For the Year Ended December 31,
	2008					2009					Period-to-Period Change
			Percent of					Percent of
	Amount		Revenue			Amount		Revenue			Amount		Percent
	(dollars in thousands)

Cost of sales:
Service delivery, excluding depreciation and amortization	$	22,525		38.6	%	$	26,431		36.1	%	$	3,906		17.3	%
Product sales, excluding depreciation and amortization		440		0.8			481		0.7			41		9.3
Depreciation and amortization		591		1.0			718		1.0			127		21.5

Total cost of sales	$	23,556		40.4	%	$	27,630		37.8	%	$	4,074		17.3	%

Gross profit	$	34,772		59.6	%	$	45,477		62.2	%	$	10,705		30.8	%

Cost of sales was $27.6 million in 2009 compared to $23.6 million in 2008, an increase of $4.1 million, or 17%. Cost of sales as a percent of revenue declined from 40% in 2008 to 38% in 2009. Service delivery cost increased $3.9 million, or 17%, primarily as a result of $3.7 million, or 19%, increase in salary and associated employee

expense for tax, benefits, bonus, travel and entertainment expense. There was also a $0.1 million increase in data licenses and other costs to support our compliance enablement solutions. The increase in employees and associated expense is due to ramping up our delivery and support capabilities to support our customer and product growth.

Product sales cost increased $0.04 million, or 9%, primarily as a result of increased hardware costs related to increased sales.

Depreciation and amortization expense increased $0.1 million as a result of an increase in depreciation expense for customer premise equipment and an increase in amortization expense primarily due to our 2009 acquisitions.

Gross profit increased to $45.5 million in 2009 compared to $34.8 million in 2008, an increase of $10.7 million, or 31%, as our revenue mix moved towards higher margin solutions and we experienced economies of scale from our revenue growth. Our gross margin increased from 60% in 2008 to 62% 2009.

Operating Expenses


	For the Year Ended December 31,
	2008					2009					Period-to-Period Change
			Percent of					Percent of
	Amount		Revenue			Amount		Revenue			Amount		Percent
	(dollars in thousands)

Operating expenses:
Product development	$	6,749		11.5	%	$	9,146		12.5	%	$	2,397		35.5	%
Sales and marketing		14,059		24.1			17,388		23.8			3,329		23.7
General and administrative		16,030		27.5			20,511		28.0			4,481		28.0

Total operating expenses	$	36,838		63.1	%	$	47,045		64.3	%	$	10,207		27.7	%

Product Development. Product development expenses increased $2.4 million, or 36%, primarily related to hiring additional employees as well as adding the development teams from two companies we acquired in 2009. Salary and associated employee expense increased $2.6 million, or 41%, which was offset by a $0.2 million reduction in outside consultants costs.

Sales and Marketing. Sales and marketing expenses increased by $3.3 million, or 24%, primarily as a result of retaining sales personnel from our 2009 acquisitions. Employee related expenses, excluding commission expense and referral fees, increased by $2.0 million, or 24%. Commission expense and referral fees increased by $1.3 million, or 28%, primarily as a result of increased sales activity. Third party marketing expense increased by $0.1 million as a result of increased advertising and presence at industry trade shows and similar events, which was partially offset by a $0.1 million reduction in expense associated with third party consultants and miscellaneous other expense.

General and Administrative. General and administrative expenses increased by $4.5 million, or 28%, in 2009. This increase was due to an increase in employee-related expense of $1.0 million, or 16%, primarily as a result of hiring employees in finance and other support groups. There was also an increase of $1.0 million in legal, accounting and third party fees directly related to the two acquisitions. Real estate and other facilities related costs increased by $1.5 million as we expanded our headquarters in Chicago. Bad debt expense increased by $0.2 million as our business and our associated accounts receivable increased. Depreciation and amortization expense increased $0.9 million primarily due to increased equipment and leasehold improvement depreciation.

Other Income (Loss), Net

Other income (loss), net was a loss of $0.3 million in 2009 compared to income of $0.2 million in 2008. The change was primarily the result of a change in foreign currency exchange rates.

Income Tax Expense

We recorded an income tax expense of $0.1 million and $0.02 million in 2009 and 2008, respectively. We had an effective tax expense rate was (8.0)% for 2009 and (1.0)% in 2008. Our effective tax rate differs substantially from the federal statutory rate primarily due to the application of a valuation allowance that reduced the recognized benefit of our deferred tax assets. In addition, certain state income taxes are calculated on bases different than pre-tax income (loss). This resulted in recording income tax expense in certain states that experience a pre-tax loss.

Adjusted EBITDA


	For the Year Ended December 31,
	2008						2009						Period-to-Period Change
				Percent of						Percent of
	Amount			Revenue			Amount			Revenue			Amount			Percent
	(dollars in thousands)

Segment Reported Adjusted EBITDA:
North America	$	959			1.6	%	$	4,175			5.7	%	$	3,216			N/M
EMEA		8			N/M			329			0.5			321			N/M
LAC		(254	)		(0.4	)		(624	)		(0.9	)		(370	)		145.7
APAC		(306	)		(0.5	)		(801	)		(1.1	)		(495	)		161.8

Total adjusted EBITDA⁽¹⁾	$	407			0.7	%	$	3,079			4.2	%	$	2,672			N/M

Income tax expense	$	(22	)		N/M		$	(114	)		(0.1	)%	$	(92	)		N/M
Depreciation and amortization		(2,136	)		(3.7	)		(3,012	)		(4.1	)		(876	)		41.0
Interest expense, net		(151	)		(0.2	)		(112	)		(0.1	)		39			(25.8	)
Stock-based compensation expense⁽²⁾		(285	)		(0.5	)		(278	)		(0.4	)		7			(2.5	)
Gain (loss) on foreign currency exchange		178			0.3			(259	)		(0.4	)		(437	)		N/M
Severance and transition costs		—			—			(948	)		(1.3	)		(948	)		N/M
Acquisition transaction and integration expenses⁽³⁾		(37	)		(0.1	)		98			0.1			135			N/M

Net loss	$	(2,046	)		(3.5	)%	$	(1,546	)		(2.1	)%	$	500			(24.4	)%

“N/M” indicates the percentage is not meaningful.


(1)		For more information regarding Adjusted EBITDA, a non-GAAP measure, see “— Results of Operations” and “— Adjusted EBITDA.”
(2)		Represents non-cash compensation expense.
(3)		Represents costs and expenses associated with acquisitions, integration activities and restructuring during the period, including legal, diligence and audit expenses, severance expenses and restructuring charges. For more information, see “-Recent Acquisitions.”

Adjusted EBITDA increased by $2.7 million to $3.1 million as a result of gross profit excluding depreciation and amortization increasing by $10.8 million, or 31%, largely due to increased traction with our enterprise customers and subscribers in North America. This was offset by a net increase of $8.6 million in operating expenses excluding depreciation and amortization, stock-based compensation and acquisition, transaction, integration and severance costs that resulted from increased hiring, sales and marketing activities and infrastructure expansion.

Seasonality

Historically, our business has experienced a limited degree of seasonality with fourth quarter typically being our largest in terms of revenue due to our customers’ annual budget cycle and other market driven deadlines.

Liquidity and Capital Resources

Since our inception, we have financed our operations through the sale of preferred stock and common stock, cash flows generated by operations and borrowings under debt instruments. Most recently, we raised $10 million through the sale of Series B preferred stock in the second quarter of 2008. In November 2010, we renewed our loan

agreement under which the total limit on the lines of credit and short term capital loans were increased from $10.0 million to $20.0 million. This agreement requires us to comply with certain financial covenants, including minimum levels of liquidity and EBITDA and limits on capital expenditures. Interest on outstanding borrowings under this line of credit is based on a floating rate that was 4.5% on December 31, 2010 and includes a fee of 0.25% on unused portions of the revolving line. The line of credit is scheduled to mature on November 30, 2011. We had no outstanding borrowings and $2.0 million of outstanding letters of credit under this agreement as of December 31, 2010. We are prohibited from paying cash dividends on or making any other distributions with respect to our capital stock under the terms of our loan agreement. See “Description of Certain Indebtedness” for additional information regarding the terms of this loan agreement.

As of December 31, 2010, we had cash and cash equivalents totaling $14.6 million, net accounts receivable of $32.1 million and $0.3 million of working capital.

Capital expenditures for 2010 were $4.3 million, comprised primarily of additional leasehold improvements, furniture and fixtures and computer equipment. We believe that our cash and cash equivalents following the completion of this offering together with our cash flow from operations will be sufficient to fund our operations and to meet our expected capital expenditure needs of $4.5 to $6.5 million during the next 12 months. Our future capital requirements will depend on many factors, including our rate of revenue growth, if any, the expansion of our sales and marketing activities, the timing and extent of spending to support product development efforts and expansion into new territories, the timing of introductions of new solutions and enhancements to existing solutions and the continuing market acceptance of our compliance management and compliance enablement offerings.

The following table shows selected balance sheet data as of the end of the period presented as well as our cash flows from operating activities, investing activities and financing activities for the periods presented:


	As of and for the Year Ended December 31,
	2008			2009			2010
	(in thousands)

Cash and cash equivalents	$	6,594		$	23,916		$	14,558
Accounts receivable, net		14,777			16,621			32,099
Cash provided by (used in):
Operating activities		671			20,943			(10,212	)
Investing activities		(2,226	)		(2,292	)		8,581
Financing activities		6,668			(1,165	)		(7,495	)
Effect of changes in exchange rates on cash flows		40			(164	)		(232	)

Net increase (decrease) in cash and cash equivalents	$	5,153		$	17,322		$	(9,358	)

Cash and Cash Equivalents

Our cash and cash equivalents at December 31, 2010 were held for working capital purposes and were invested primarily in money market accounts. We do not enter into investments for trading or speculative purposes.

Accounts Receivable, net

Our accounts receivable balance fluctuates from period-to-period which affects our cash flow from operating activities. The fluctuations vary depending on the timing of our billing activity, cash collections and changes to our allowance for doubtful accounts. Our allowance for doubtful accounts represents our best estimate of the amount of probable credit losses.

Cash Flows

Cash Provided by (Used in) Operating Activities

Net cash provided by operating activities was $0.7 million and $20.9 million for the years ending December 31, 2008 and 2009, and net cash used in operating activities was $10.2 million in the year ending December 31, 2010.

The cash provided by our operating activities in 2008 was a result of our net loss of $2.0 million, adjusted for an increase in deferred revenue of $4.2 million and an increase in accrued expenses of $2.1 million, offset by a net increase in accounts receivable of $4.4 million, an increase in prepaid expenses of $0.6 million and a decrease in accounts payable of $0.8 million. Deferred revenue increased primarily due to an increase in compliance management subscribers at favorable billing terms. The increase in accounts receivable and accrued wages and other accrued expenses was due to our 28% increase in revenue and the increase in customers and employees throughout the year.

The cash provided by our operating activities in 2009 was a result of our net loss of $1.5 million, adjusted for an increase in deferred revenue of $22.2 million, an increase in other long-term liabilities of $1.9 million and a $0.2 million decrease in prepaid expenses. This was offset by a decrease in accrued expenses of $3.9 million, a decrease in accounts payable of $0.6 million and a net increase in accounts receivable of $0.1 million. Deferred revenue increased primarily as a result of favorable billing terms for a large partner relationship for a compliance management program. Accounts receivable and other accrued expenses increased due to our 25% increase in revenue and the increase in customers and employees throughout the year.

The cash used by our operating activities in 2010 was primarily a result of our net loss of $4.6 million, adjusted for an increase in accrued expenses of $2.4 million, as well as a $0.4 million expense associated with inventory impairment and the disposal of equipment. This was offset by a net increase in accounts receivable of $11.5 million, an increase in prepaid expenses of $1.2 million, a decrease in accounts payable of $1.3 million and a decrease in deferred revenue of $1.0 million. The increase in accounts receivable came from organic growth and the customers we added from our acquisitions of Breach Security, Intellitactics and BitArmor.

Cash Provided by (Used in) Investing Activities

Net cash used in investing activities was $2.2 million and $2.3 million for the years ending December 31, 2008 and 2009, respectively, and the cash provided from investing activities was $8.6 million for the year ending December 31, 2010. Capital expenditures were $1.8 million, $2.7 million and $4.3 million for the years ending December 31, 2008, 2009 and 2010, respectively. In 2008, there was a net outflow of $0.4 million spent on our acquisitions while in 2009 the cash gained from our two acquisitions was $0.5 million. In 2010, there was a net inflow of $12.9 million in cash associated with the acquisitions of Breach Security, Intellitactics and BitArmor.

Cash Provided by (Used in) Financing Activities

We have not generally utilized borrowings to finance our operations as cash from operations and two sales of our equity securities have provided us with sufficient liquidity to meet our growth needs. Net cash provided by financing activities for the year ending December 31, 2008 was $6.7 million and the cash used in financing activities was $1.2 million and $7.5 million for the years ended December 31, 2009 and 2010, respectively. Net cash provided by financing activities in 2008 was due to a $10.0 million financing in which we issued Series B preferred stock, plus $0.2 million of cash generated from stock option exercises, which was partially offset by the $2.5 million payment of an outstanding line of credit with our bank, and a $1.0 million payment of a stockholder note associated with a previous acquisition. The cash used in 2009 was primarily due to the payment of $1.1 million on a stockholder note associated with a previous acquisition, $0.2 million of capital lease payments and a partial offset of $0.1 million received from stock option exercises. The cash used in 2010 was the final $1.0 million payment on a stockholder note associated with a previous acquisition, combined with our repayment of a total of $6.3 million on notes acquired in connection with our acquisitions of Breach Security, Intellitactics and BitArmor. Additionally, there was $0.3 million of capital lease payments, which was partially offset by receiving $0.1 million from stock option exercises.

Quantitative and Qualitative Disclosures about Market Risk

Interest Rate Sensitivity. We had cash and cash equivalents of $6.6 million, $23.9 million, and $14.6 million at December 31, 2008, 2009 and 2010, respectively. We held these amounts primarily in money market funds. We hold cash and cash equivalents for working capital purposes so we do not have material exposure to market risk with respect to investments. We do not use derivative financial instruments for speculative or trading purposes; however, we may adopt specific hedging strategies in the future. Any declines in interest rates, however, will effect payments for outstanding debt. As of December 31, 2010, we did not have any outstanding borrowings. We do, however, have a loan agreement in place that provides us with available borrowings of up to $20.0 million. Although we do not currently anticipate accessing this loan agreement other than for $2.0 million of letters of credit outstanding under this agreement, we may choose to do so in the future. Changes in interest rates will have an impact on any future borrowings we may incur as well as the interest we may earn on our cash and cash equivalents, including the cash we will receive from the net proceeds of this offering. See “Use of Proceeds.”

Foreign Currency Risk. We market our products in North America, EMEA, APAC and LAC and develop our products in the United States, Canada and Israel. As a result of our business activities in foreign countries, our financial results could be affected by factors such as changes in foreign currency exchange rates or economic conditions in foreign markets, and there is no assurance that exchange rate fluctuations will not harm our business in the future. We sell our products in certain countries in the local currency for the respective country. This provides some natural hedging because most of our subsidiaries’ operating expenses are denominated in their local currencies. Regardless of this natural hedging, our results of operations may be adversely impacted by the exchange rate fluctuation. Although we will continue to monitor our exposure to currency fluctuations and, where appropriate, may use financial hedging techniques in the future to minimize the effect of these fluctuations, we are not currently engaged in any financial hedging transactions.

Contractual Obligations and Commitments

We generally do not enter into long-term minimum purchase commitments. Our principal commitments, in addition to those related to the line of credit discussed above, consist of obligations under facility leases for office space.

The following table summarizes our outstanding contractual obligations as of December 31, 2010:


	Payments Due by Period
	Total		Less than 1 Year		1-3 Years		3-5 Years		More than 5 Years
	(in thousands)

Operating leases	$	10,121	$	2,499	$	2,607	$	1,811	$	3,204
Capital leases		832		498		334		—		—

Total	$	10,953	$	2,997	$	2,941	$	1,811	$	3,204

Off-Balance Sheet Arrangements

During the years ended December 31, 2008, 2009 and 2010, we did not have any relationships with unconsolidated organizations or financial partnerships, such as structured finance or special purpose entities, that would have been established for the purpose of facilitating off-balance sheet arrangements or other contractually narrow or limited purposes.

Effects of Inflation

Our results of operations and financial condition are presented based on historical costs. While it is difficult to accurately measure the impact of inflation due to the imprecise nature of the estimates required, we believe that the effects of inflation, if any, on our results of operations and financial condition have been immaterial.

Critical Accounting Policies and Estimates

Our consolidated financial statements have been prepared in accordance with accounting principles generally accepted in the United States, which requires us to make estimates and judgments that affect the reported amounts of assets and liabilities and the disclosure of contingent assets and liabilities at the date of the financial statements as well as the reported amounts of revenues and expenses during the reporting period. We base our estimates and judgments on our historical experience, knowledge of current conditions and our beliefs regarding likely occurrences in the future, given available information. Actual results may differ from those estimates, and any differences may be material to our financial statements. Further, if we apply different factors, or change the method by which we apply the various factors that are used, in making our critical estimates and judgments, our reported operating results and financial condition could be materially affected.

We consider the following accounting policies to be both those most important to the portrayal of our results of operations and financial condition and those that require the most subjective judgment:


	•	revenue recognition;

	•	accounts receivable and allowance for doubtful accounts;

	•	goodwill, intangible assets and business combinations;

	•	income taxes; and

	•	stock-based compensation.

Revenue Recognition

We generate revenue from subscription services, professional services and product sales. We recognize revenue when persuasive evidence of an arrangement exists, delivery has occurred, the sales price is fixed or determinable, and collection is probable. Product is considered delivered to the customer once it has been shipped and title and risk of loss have been transferred. Revenues related to subscription contracts are recognized ratably over service, maintenance or subscription period. Revenues from professional services are recognized at the time service is performed. Revenues from sales of perpetual software licenses and related hardware are recognized upon delivery, assuming all other conditions for revenue recognition noted above have been met.

For multiple deliverable arrangements we allocate revenue to all deliverables based on their relative selling prices. In such circumstances, we use a hierarchy to determine the selling price to be used for allocating revenue to deliverables: (i) vendor-specific objective evidence of fair value, or “VSOE,” (ii) third-party evidence of selling price, or “TPE,” and (iii) best estimate of the selling price, or “BESP.” VSOE generally exists only when we sell the deliverable separately and is the price actually charged by us for that deliverable. BESPs reflect our best estimates of what the selling prices of elements would be if they were sold regularly on a stand-alone basis.

Our process for determining our BESP for deliverables without VSOE or TPE involves management’s judgment. Our process considers multiple factors that may vary depending upon the unique facts and circumstances related to each deliverable. Key factors primarily considered in developing BESP include prices charged by us for similar offerings when sold separately, pricing policies and approvals for discounts from standard pricing and other business objectives. We may also consider additional factors as appropriate, including the pricing of competitive alternatives and product-specific business objectives. If the facts and circumstances underlying the factors considered change, or if we consider additional factors, our BESP may change.

From time to time, we sell on-demand software or compliance solutions with professional services. In such cases, we allocate arrangement consideration based on our estimated selling price of the on-demand software or compliance solution and VSOE of the selling price of the professional services. Hardware with embedded software is treated as a single unit of accounting when they operate together to deliver the essential functionality of the hardware.

Accounts Receivable and Allowance for Doubtful Accounts

We extend trade credit to a substantial portion of our customers in the normal course of business. The standard credit terms are net 30 days. Unbilled receivables represent revenue primarily from time and materials arrangements for labor hours provided but not yet billed.

We record an allowance for doubtful accounts for estimated probable losses on uncollectible accounts receivable. A portion of our customers make recurring payments using credit cards, which reduces our exposure for uncollectible accounts receivable. For the customers that are billed for services rendered, management considers the following factors in assessing collectability: (i) our historical write-offs, (ii) the aging of the accounts receivable including trends within the ratios involving the age of the accounts receivable, (iii) change in the credit-worthiness of customers, and (iv) general economic conditions. In cases where we are aware of circumstances that may impair a specific customers ability to meet their obligations to us, we record a specific allowance against amounts due from customers. Management has reduced the recognized receivables to the amounts it reasonably believes will ultimately be collected.

Goodwill, Intangible Assets and Business Combinations

When we acquire businesses, we allocate the purchase price to tangible assets and liabilities and identifiable intangible assets acquired. Any residual purchase price is recorded as goodwill. The allocation of the purchase price requires management to make significant estimates in determining the fair values of assets acquired and liabilities assumed, especially with respect to intangible assets. These estimates are based on information obtained from management of the acquired companies and historical experience. These estimates can include, but are not limited to, the cash flows that an asset is expected to generate in the future, and the cost savings expected to be derived from acquiring an asset. These estimates are inherently uncertain and unpredictable, and if different estimates were used the purchase price for the acquisition could be allocated to the acquired assets and liabilities differently from the allocation that we have made. In addition, unanticipated events and circumstances may occur which may affect the accuracy or validity of such estimates, and if such events occur we may be required to record a charge against the value ascribed to an acquired asset or an increase in the amounts recorded for assumed liabilities.

Goodwill

We review goodwill for impairment on an annual basis in the fourth quarter of each year, and on an interim basis whenever events or changes in circumstances indicate that the carrying value may not be recoverable, at the reporting unit level. Our reporting units are consistent with our operating segments. Before performing the goodwill impairment test, we first assess the value of long-lived assets in each reporting unit, including tangible and intangible assets. We then perform a two-step impairment test on goodwill. In the first step, we compare the estimated fair value of equity of each reporting unit to its allocated carrying value (book value) of equity. If the carrying value of the reporting unit exceeds the fair value of the equity associated with that unit, there is an indicator of impairment and we must perform the second step of the impairment test. This second step involves determining the implied fair value of that reporting unit’s goodwill in a manner similar to the purchase price allocation for an acquired business, using the reporting unit’s calculated fair value as an assumed purchase price. If the carrying value of the reporting unit’s goodwill exceeds its implied fair value, then we would record an impairment loss equal to the excess.

The process of estimating the fair value and carrying value of our reporting units’ equity requires significant judgment at many points during the analysis. Many assets and liabilities, such as accounts receivable and property and equipment, are not specifically allocated to an individual reporting unit, and therefore, we apply judgment to allocate the assets and liabilities, and this allocation affects the carrying value of the respective reporting units. Similarly, we use judgment to allocate goodwill to the reporting units based on relative fair values. The use of relative fair values has been necessary for certain reporting units due to changes in our operating structure in prior years. To determine a reporting unit’s fair value, we use the income approach under which we calculate the fair value of each reporting unit based on the estimated discounted future cash flows of that unit. Applying the income approach requires that we make a number of important estimates and assumptions and we evaluate the reasonableness of this approach with the market approach, which involves a review of the carrying value of our assets

relative to our market capitalization and to the valuation of publicly traded companies operating in the same or similar lines of business.

We estimate the future cash flows of each reporting unit based on historical and forecasted revenue and operating costs. This, in turn, involves further estimates, such as estimates of future revenue and expense growth rates and foreign exchange rates. In addition, we apply a discount rate to the estimated future cash flows for the purpose of the valuation. This discount rate is based on the estimated weighted-average cost of capital for each reporting unit and may change from year to year. For example, in our valuation process in the fourth quarter of 2010 we used a lower discount rate than in the prior year due to stabilized risk associated with the global economic conditions. Changes in these key estimates and assumptions, or in other assumptions used in this process, could materially affect our impairment analysis for a given year.

As of December 31, 2010, our goodwill balance was $42.1 million. Based on the impairment analysis performed in the fourth quarter, we determined that the fair value of each of our reporting units substantially exceeded the carrying value of the unit. While discount rates are only one of several important estimates used in the analysis, we determined that an increase of one percentage point in the discount rate used for each respective reporting unit would not have resulted in an impairment indicator for any unit at the time of this analysis.

A number of factors, many of which we have no ability to control, could affect our financial condition, operating results and business prospects and could cause actual results to differ from the estimates and assumptions we employed. These are detailed in the section entitled “Risk Factors,” included elsewhere in this prospectus.

Intangible Assets

We assess the impairment of intangible assets whenever events or changes in circumstances indicate that an asset group’s carrying amount may not be recoverable due to changes in business conditions such as lower than expected sales or significant changes in the economy. An impairment loss would be recognized when the sum of the undiscounted estimated future cash flows expected to result from the use of the asset group and its eventual disposition is less than its carrying amount. Such impairment loss would be measured as the difference between the carrying amount of the asset group and its fair value. Our cash flow assumptions are based on historical and forecasted revenue, operating costs, and other relevant factors. If management’s estimates of future operating results change, or if there are changes to other assumptions, the estimate of the fair value of our intangible assets could change significantly. Such change could result in impairment charges in future periods, which could have a significant impact on our operating results and financial condition.

Income Taxes

We use the asset and liability method of accounting for income taxes. Under this method, we record deferred income taxes based on temporary differences between the financial reporting and tax bases of assets and liabilities and use enacted tax rates and laws that we expect will be in effect when we recover those assets or settle those liabilities, as the case may be, to measure those taxes. In cases where the expiration date of tax carryforwards or the projected operating results indicate that realization is not likely, we provide for a valuation allowance.

We have deferred tax assets, resulting from deductible temporary differences that may reduce taxable income in future periods. A valuation allowance is required when it is more likely than not that all or a portion of a deferred tax asset will not be realized. In assessing the need for a valuation allowance, we estimate future taxable income, considering the feasibility of ongoing tax-planning strategies and the realizability of tax loss carryforwards. Valuation allowances related to deferred tax assets can be impacted by changes in tax laws, changes in statutory tax rates and future taxable income levels. If we were to determine that we would not be able to realize all or a portion of our deferred tax assets in the future, we would reduce such amounts through a charge to income in the period in which that determination is made. Conversely, if we were to determine that we would be able to realize our deferred tax assets in the future in excess of the net carrying amounts, we would decrease the recorded valuation allowance through an increase to income in the period in which that determination is made. Based on the assessment, we recorded a valuation allowance of $24.4 million at December 31, 2010 and $6.5 million at December 31, 2009. We provided a valuation allowance in 2010 and 2009 related to certain federal and state income tax attributes we did not believe we could utilize within the tax carryforward periods.

In the ordinary course of business there is inherent uncertainty in quantifying our income tax positions. We assess our income tax positions and record tax benefits for all years subject to examination based upon management’s evaluation of the facts, circumstances and information available at the reporting date. For those tax positions where it is more likely than not that a tax benefit will be sustained, we have recorded the highest amount of tax benefit with a greater than 50% likelihood of being realized upon ultimate settlement with a taxing authority that has full knowledge of all relevant information. For those income tax positions where it is not more likely than not that a tax benefit will be sustained, no tax benefit has been recognized in the financial statements. See note 8 to the notes to our consolidated financial statements for further discussion.

Stock-Based Compensation

Common Stock

We recognize stock-based compensation expense for stock-based compensation awards granted to our employees, consultants and other service providers that can be settled in shares of our common stock. Compensation expense for all stock-based compensation awards granted is based on the grant date fair value estimate for each award as determined by our board of directors or the compensation committee of our board of directors. We recognize these compensation costs on a straight-line basis over the requisite service period of the award, which is generally four years. As stock-based compensation expense recognized is based on awards ultimately expected to vest, such expense is reduced for estimated forfeitures. Stock-based compensation expense related to employee stock options that can be settled in our common stock during the years ended December 31, 2008, 2009 and 2010, was $0.3 million, $0.3 million and $1.0 million, respectively.

As of December 31, 2010, there was $1.2 million of unrecognized stock-based compensation expense related to non-vested stock option awards that we expect to be recognized over a weighted average vesting period of 1.4 years.

As of each stock option grant date, we considered the fair value of the underlying common stock, determined as described below. Management determined the estimated per share fair value of the common stock at such dates using contemporaneous valuations consistent with the American Institute of Certified Public Accountants Practice Aid, “Valuation of Privately-Held Company Equity Securities Issued as Compensation,” or the “AICPA Practice Aid”. With respect to each such valuation, management obtained a contemporaneous valuation.

Determination of the Fair Value of Common Stock

Valuations Between July 2008 to March 2010

For valuations conducted prior to June 2010, a multi-step process of valuation was employed. First, our management established our enterprise value using generally accepted valuation methodologies, including the income approach in the form of the discounted cash flow, or “DCF,” method and the market approach in the form of the guideline public company method and the guideline transactions method. Next, available cash and proceeds from redemptions of “in-the-money” options were added to the enterprise value, and total outstanding debt was deducted, to determine our total equity value. Then, management allocated the total equity value among the securities that comprise our capital structure using the Option-Pricing Method, as described in the AICPA Practice Aid. Each of the steps and the methods within each step are discussed in greater detail below.

For the DCF method, our management prepared detailed annual projections of future cash flows over a period of ten years (the “discrete projection period”), and applied a terminal value assumption to the final year within the discrete projection period to estimate the total value of the cash flows beyond the final year. Projections of future cash flows were based on the estimated net debt-free cash flows. These cash flows were then discounted to their present value as of the valuation date at an estimated cost of capital. The estimated cost of capital was derived by a weighted average cost of capital, or “WACC,” using the capital asset pricing model, or “CAPM,” based in part on guideline publicly-traded companies. The terminal value was estimated using the Gordon Growth model, which is based on the expected cash flows of the last year in the discrete projection period, the expected long-term growth rate, and the WACC.

For the guideline public company method, our management selected a group of publicly-traded companies that were deemed comparable to us, or the “Guideline Public Companies.” The Guideline Public Companies selected were primarily businesses with significant presence in the information security and transaction processing compliance industry. The valuation multiples considered for providing indicated values were trailing 12 months, or “TTM,” sales as well as estimated future sales, EBITDA, and earnings before interest and taxes, or “EBIT.”

For the guideline transactions method, closed transactions representing a change of control (majority interest acquired) occurring within five years prior to the valuation date were selected where the target had significant presence in the information security and transaction processing compliance industry. A range of implied revenue multiples reflecting the ratio of the purchase price paid in the transactions to the target companies’ TTM revenue prior to the acquisition date was determined. Our actual TTM revenue was then applied to these multiples to provide an indicated range of value.

The valuation ranges resulting from calculations using the aforementioned methodologies were then averaged to determine an estimated overall enterprise value, to which cash and the proceeds from redemptions of “in-the-money” options were added, and total outstanding debt was deducted to determine the aggregate equity value available to our preferred and common equity holders. The aggregate equity value was allocated to the equity holders using the Option-Pricing Method.

The Option-Pricing Method treats common stock and preferred stock as call options on our total equity value, with exercise prices based on the value thresholds at which the allocation among the various holders of our securities changes. To apply the Option-Pricing Method, the rights and preferences of the various securities that make up our capital structure were first established. Then, the various strike prices, or points at which the sharing percentages changed among our securities, were calculated. The strike prices were determined based on the liquidation preferences of our various preferred series shares as well as the various thresholds where stock options would be motivated to exercise their rights. The volatility of our equity was determined by examining the prevailing standard deviation of the Guideline Public Companies. Finally, the term of the options was determined by our management based on an estimate of when an expected liquidity event would take place.

The following table provides a summary of the key assumptions, indicated results, and valuation conclusions as well as a discussion of the factors that influenced changes to the valuation assumptions and conclusions as of the various valuation dates after July 21, 2008. Specific amounts set forth in the table reflect the mid-point of ranges considered and the ranges included in the table reflect the low and high points of the range.

Valuation Dates

July 21,

February 27,

August 27,

January 7,

March 2,

June 21,

December 5,

2008

2009

2010

(dollars in millions, except per share data)

Discounted Cash Flow Analysis:

Long-term growth rate

4.0%

n/a

Discount rate

17.5%

18.0%

17.0%

n/a

Indicated value

$98 - $120

$89 - $120

$104 - $130

$120 - $154

$122 -$157

n/a

Guideline Public Companies:

TTM sales multiples

1.90x

1.75x

1.50x

1.70x

n/a

Projected sales

1.50x

1.40x

1.25x

1.30x

n/a

Projected EBITDA

11.0x

8.5x

9.0x

9.8x

9.5x

n/a

Projected EBIT

n/a

9.5x

11.5x

n/a

Indicated value

$95 - 115

$86 - 104

$99 - 119

$121 - 160

$121 - 167

n/a

Guideline Transactions:

TTM sales multiples

2.0x - 2.25x

1.5x - 2.0x

1.4x - 1.8x

1.6x - 2.0x

1.6x -2.0x

n/a

Indicated value

$104 - $117

$88 - $117

$93 - $120

$118 - $148

$122 -$152

n/a

Valuation Conclusions:

Enterprise value

$99 - $117

$87 - $109

$99 - $123

$120 - $154

$122 -$159

n/a

Aggregate equity value

$99 - $117

$93 - $115

$107 - $132

$151 - $185

$148 -$185

n/a

Equity Allocation:

Option Pricing Method:

Volatility

45%

35%

32%

24%

n/a

Term

3.0

1.00

n/a

Risk-free rate

2.82%

1.40%

0.46%

0.36%

0.30%

n/a

Concluded value per Class A common share

$0.78

$0.72

$0.79

$1.15

$1.08

n/a

Concluded value per Class B common share

$0.73

$0.69

$0.78

$1.15

$1.08

n/a

PWERM Method:

Sale/merger-sales multiples

n/a

2.5x - 3.5x

2.5x - 4.5x

Sale/merger-per share value

n/a

$1.91

$2.77

IPO-sales multiples

n/a

2.5x - 3.5x

2.5x - 4.5x

IPO-per share value

n/a

$2.19

$2.93

Concluded value per Class A common share

n/a

$2.05

$2.89

Concluded value per Class B common share

n/a

$2.05

$2.89

Set forth below for each valuation date after July 21, 2008 is a brief overview of the factors considered by management in determining the estimated value of our common stock.

February 27, 2009 Valuation

The primary factors that supported this estimate, and which contributed to a decrease in the estimated value of the common stock between July 21, 2008 and February 27, 2009 were:


	•	lower than expected operating results, including revenue and profitability metrics, for the year ended December 31, 2008;

	•	expectations for increased capital expenditures needs;


	•	increased market risk and uncertainty associated with broader economic trends occurring between July 2008 and February 2009, including: (i) the contraction of the worldwide credit markets in the fall of 2008; (ii) substantially decreased acquisition activity; and (iii) lack of support for initial public offerings in the equity markets;

	•	substantial declines in the equity valuations of the Guideline Public Companies; and

	•	widespread, significant reluctance of institutional and other investors to invest capital in private companies on acceptable terms, if at all.

August 27, 2009 Valuation

The primary factors that supported this estimate, and which contributed to an increase in the estimated value of the common stock between February 27, 2009 and August 27, 2009 were:


	•	improving capital markets;

	•	increased focus and demonstrated traction in the market for smaller businesses, which was expected to drive increases in growth and profitability;

	•	acquisition of Vericept, which was expected to increase sales through expanded data loss prevention technology offerings;

	•	expectations for projected declining levels of net working capital (increasing levels of negative net working capital), which were expected to increase free cash flows;

	•	decreased market risk and uncertainty associated with improving economic trends; and

	•	increases in the equity valuations of the Guideline Public Companies.

January 7, 2010 Valuation

The primary factors that supported this estimate, and which contributed to an increase in the estimated value of the common stock between August 27, 2009 and January 7, 2010 were:


	•	higher than expected operating results for the year ended December 31, 2009 primarily driven by stronger than anticipated profitability;

	•	improving capital markets;

	•	continued strong demand from smaller businesses to meet compliance requirements;

	•	increased profitability expectations;

	•	acquisition of BitArmor, which was expected to increase sales through add-on products related to encryption technology;

	•	projected further declining levels of net working capital (increasing levels of negative net working capital), which were expected to increase free cash flows;

	•	increased retention of cash;

	•	decreased market risk and uncertainty associated with continuing improvement of economic trends;

	•	increased merger and acquisition activity including the acquisitions of two of the previously identified guideline public companies; and

	•	increases in the equity valuations of the Guideline Public Companies.

March 2, 2010 Valuation

The primary factors that supported this estimate, and which contributed to a slight decrease in the estimated value of the common stock between January 7, 2010 and March 2, 2010 were:


	•	slightly lower than than expected operating results for the TTM ended February 28, 2010;

	•	decrease in available cash; and

	•	dilutive impact of the issuance of Class A common stock or stock options on Class A common stock as part of recent acquisitions that were either exercised or were “in-the-money” and thus considered part of the common shares outstanding.

Valuations Between June 2010 and December 2010

Starting in mid-2010, management began using the Probability-Weighted Expected Return Method, or “PWERM,” as outlined in the AICPA Practice Aid, for the contemporaneous valuations of the common stock due to:


	•	our improved financial results as demonstrated by strong sales growth and improving profitability;

	•	our favorable growth prospects and expectations for continued improvement in profitability; and

	•	the software acquisition market was picking up.

The PWERM estimates the value of the common stock-based upon an analysis of future values of the enterprise assuming various outcomes. Share value is based upon the probability-weighted present value of expected future investment returns, considering each of the possible future outcomes available to the enterprise, as well as the rights of each share class.

June 21, 2010 Valuation

In the second quarter, our management was in preliminary stages of assessing the prospects of an initial public offering while paying attention to the software acquisition/merger markets. We had strong prospects for a near-term liquidity event and we expected that such a liquidity event would take place in the following 3 to 18 months. Accordingly, a 50% weight was assigned for the sale/merger scenario and a 50% weight was assigned to the IPO scenario.

Sale/Merger Scenarios — Based on three possible exit dates: September 2010, December 2010, and December 2011. For each of the sale/merger scenarios, based on prevailing market multiples, we assumed that, on an enterprise basis, we would be valued in the range of 2.5x to 3.5x estimated TTM sales as of the exit date.

IPO Scenarios — Based on two possible exit dates: December 2010 and December 2011. Under the IPO scenarios, based on their respective terms, all preferred shares would automatically convert to common stock. For each of the IPO scenarios, based on prevailing market multiples, we assumed that, on an enterprise basis, we would be valued in the range of 2.5x to 3.5x estimated TTM sales as of the exit date.

The primary factors that contributed to the increase in the estimated fair value of the common stock from the March 2, 2010 valuation were:


	•	improved guideline public company valuations;

	•	improving capital markets; and

	•	increased merger and acquisition activity in our industry resulting in higher multiples and greater prospects for liquidity.

December 5, 2010 Valuation

During the latter half of 2010, our management undertook a process to evaluate underwriters for a potential IPO. Accordingly, our management continued its use of the PWERM to estimate the value of the common stock as

of December 5, 2010. Based on the continued strong prospects of a near-term liquidity event, with a strong likelihood of an IPO event, a 75% weight was assigned to the IPO scenarios and a 25% weight was assigned to the sale/merger scenarios.

IPO Scenarios — Based on three possible exit dates: June 2011, December 2011, and December 2012. For each of the IPO scenarios, based on prevailing market multiples, we assumed that, on an enterprise basis,we would be valued in the range of 2.5x to 4.5x estimated TTM sales as of the exit date.

Sale/Merger Scenarios — Based on three possible exit dates: June 2011, December 2011, and December 2012. For each of the sale/merger scenarios, based on prevailing market multiples, we assumed that, on an enterprise basis, we would be valued in the range of 2.5x to 4.5x estimated TTM sales as of the exit date.

The primary factors that contributed to the increase in the estimated fair value of the common stock from the June 21, 2010 valuation were:


	•	improved guideline public company valuations;

	•	continued improvement in the capital markets;

	•	increased merger and acquisition activity in our industry including the acquisition of previously identified guideline public companies acquired at significantly higher multiples than their publicly-traded multiples as of the previous valuation; and

	•	efforts undertook to prepare for a possible IPO of the common stock.

Recent Accounting Pronouncements

In December 2010, the Financial Accounting Standards Board provided clarification regarding the acquisition date that should be used for reporting pro forma financial information disclosures required by Topic 805 when comparative financial statements are presented. This guidance also required entities to provide a description of the nature and amount of material, nonrecurring pro forma adjustments that are directly attributable to the business combination.

BUSINESS

Overview

Trustwave is a leading provider of on-demand data security compliance solutions that enable businesses and other organizations of all sizes to efficiently achieve and maintain compliance with regulatory requirements and industry standards. Our compliance management solutions, including our easy-to-use software-as-a-service TrustKeeper offering, have helped hundreds of thousands of organizations simplify the complex process of validating compliance. Additionally, our broad suite of compliance enablement solutions remediates data security deficiencies, allowing our customers to achieve and maintain compliance in a cost effective manner. These solutions assist our subscribers in comprehensively securing their network infrastructure, data communications and sensitive information assets, protecting them against the increasing threats of unauthorized access, fraudulent activity and other intrusions or breaches. We have been successful in rapidly expanding our customer base across a broad range of industries as a result of our differentiated partner network, which is comprised of many of the world’s largest financial institutions and other organizations influential to the compliance and data security mandates of their customers.

Our data security compliance solutions can be applied to address many regulations and standards, including PCI, HIPAA, FISMA and a number of other federal, state and international regulations and standards. To date, we have primarily focused on PCI compliance, as it is among the best defined and broadest reaching data security standards. Through this effort, we have become a leader in facilitating PCI compliance, helping organizations address the risks and challenges associated with payment card fraud and compromise. Financial institutions are generally responsible for the risk of payment card fraud or compromise and security breaches involving their payment card accepting customers to the extent they are unable to recover losses from them or other parties. In turn, many of these institutions rely on our knowledge and proprietary technology to help their customers validate, achieve and maintain compliance.

Our solutions include our industry leading software-as-a-service TrustKeeper compliance management offering along with a comprehensive suite of proprietary compliance enablement solutions. TrustKeeper and the TrustKeeper Agent assist organizations in validating compliance by analyzing, aggregating and reporting on prohibited data storage, systems configurations and security policy settings on subscribers’ systems in centralized or distributed IT environments. In addition, our compliance enablement offerings provide a comprehensive, integrated turnkey suite of data security solutions, including encryption, extensible threat management, security information and event management, network access control, web application firewalls and data loss prevention. These solutions help address vulnerabilities detected by TrustKeeper, allowing our customers to achieve and maintain compliance.

plan to expand our partner network in health care, government services and other sectors, facilitating the distribution of our solutions that address relevant regulations and standards, such as HIPAA and FISMA.

We had approximately 1.6 million enrollees in our TrustKeeper solution as of December 31, 2010. These primarily consisted of payment card acceptance locations, the majority of which were identified by our partner network as requiring PCI compliance services. Each payment acceptance location of a subscriber is generally counted as a separate TrustKeeper subscription when either one of our partners or the subscriber has initiated payment for our service. As of December 31, 2010, over 900,000 of our enrollees had TrustKeeper subscriptions.

Set forth below in alphabetical order is a representative sample of our customers by the geography in which we primarily serve them:


North America	American Express*	JPMorgan Chase*
	Banc of America Merchant Services*	MICROS Systems*
	Discover*	Moneris*
	EVO	Sage Payment Solutions*
	Fifth Third Processing Solutions*	TSYS Merchant Solutions*
	First American Payment Systems*	U.S. Bank*
	First Data Corporation*	Visa
	Global Payments*	Wells Fargo*


Rest of World	Atos Worldline*	Nordea Bank*
	Barclays Capital Services	Redecard
	China UnionPay Data	Swedbank*
	Cielo	Transbank
	First National Bank (South Africa)

* Indicates a member of our partner network.

We estimate that there were approximately 6 million payment card acceptance locations within our existing PCI partner network as of December 31, 2010. A number of our partners are in the midst of a multi-year effort to monitor and enforce PCI compliance among their payment card accepting customers, and in turn we expect the number of subscriptions to increase, although we do not expect this effort will result in all of them becoming enrollees and some may already be covered by our enterprise arrangements.

Industry Background

Increasing data security threats have led to a heightened regulatory and compliance environment

Organizations are generating, using and storing escalating volumes of digital data, which can be accessed on an increasing number and variety of endpoint access devices. IDC estimates that the amount of digital content created in 2020 will be nearly 44 times that created in 2009. As society continues to become more comfortable digitizing sensitive and proprietary data such as financial data, medical records and trade secrets, there is an increasing need for data protection and security. IDC estimates that almost 50% of the information created in 2020 will require a level of IT-based security beyond a baseline level of virus protection and physical protection, up from 30% in 2009. Organizations are also increasingly reliant on interconnected IT and business infrastructure to efficiently and

competitively run their operations. As the number of endpoint access devices grows and organizations open their networks to more seamlessly conduct business with partners, customers and suppliers, they expose their IT infrastructure and data to increased security risks. In addition, the rise of mobile devices and social networking poses new challenges for organizations by facilitating the ability of employees to access and expose sensitive information with greater ease and unintended consequences.

Concurrent with the proliferation of digital data, security threats continue to become more sophisticated, numerous and severe. Threats emanate from many internal and external sources, including organized cyber-criminals, hostile governments, disgruntled employees and unintended internal errors. Although many are not reported or well publicized, some security breaches have made headlines, such as the publishing of government and business documents by WikiLeaks. A breach of an organization’s IT infrastructure can lead to significant economic losses, reputational damage, unavailability of critical business systems and loss or compromise of confidential data. According to the U.S. Director of National Intelligence, as of February 2011, almost two-thirds of U.S. companies reported being victims of cybersecurity incidents or information breaches in the past year. In the past five years, the top 10 largest reported security breaches resulted in the loss of over 400 million records, including payment card numbers, social security numbers and banking information. These security breaches come at a significant cost. Data breaches cost companies an average of $214 per record, including $141 of indirect costs such as higher turnover of customers, according to the Ponemon Institute. As a result, we believe organizations are increasingly investing in their data security initiatives to protect their information assets. In addition, regulatory bodies and industry standards groups are creating compliance requirements designed to help combat ever-evolving security threats by creating a baseline for data security.

Regulatory and compliance requirements are becoming increasingly complex and challenging to achieve and maintain

Existing and expanding laws, regulations and industry standards mandate that organizations protect the information transmitted and stored on their systems. These laws, regulations and standards were created to safeguard the privacy of individuals, protect against fraudulent acts, ensure trust in processes and systems and increase awareness of data security threats.

In order to protect constituents from the continuously evolving and changing threat landscape, these compliance rules are frequently updated and revised, posing serious challenges for organizations to reach and maintain compliance. Based on data compiled by the United Compliance Framework, the number of regulations, standards, guidelines, best practices and audit guides for addressing data security and breach notifications increased almost eight-fold from 119 documents released before 2006 to 890 documents released as of March 31, 2011. Important data security laws, regulations and standards include:

Payment Card Industry Data Security Standards. Many risks and challenges associated with payment card fraud or compromise exist, such as the monetization of payment card data by hackers, mass consumer impact of security breaches, on-line payment card processing and a historical lack of focus on data security by retailers and other merchants. To address these risks and challenges, a set of detailed requirements for enhancing data security throughout the global payment system was created by the PCI Council, an industry organization founded by American Express, Discover, JCB International, MasterCard and Visa. The PCI standards apply globally to all organizations that accept, store or transmit cardholder data, regardless of the size of the organization or the number of transactions they process.

Health Insurance Portability and Accountability Act. HIPAA privacy and security rules were created to address the risks and challenges associated with the misuse of confidential patient records. This invasion of privacy can result in adverse consequences, such as discrimination due to illness or disabilities and exclusion of health coverage for preexisting health conditions. HIPAA provides federal protections for personal health information held by covered entities and gives patients an array of rights with respect to that information. The security rules specify a series of administrative safeguards for covered entities such as hospitals, doctors’ offices and health insurance providers in order to protect patient health information.

Federal Information Security Management Act. Misappropriation of government information can facilitate terrorism, propagate national security threats and compromise confidentially of contracts. To address

these risks and challenges, FISMA requires each federal agency to develop, document and implement an agency-wide program to provide data security for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor or other source.

Other Federal, State and International Laws. States have begun enacting stricter and more comprehensive data security laws, with at least three states having codified all or some portion of the PCI standards. A number of states have adopted more comprehensive data security laws that range from statutes that create a liability safe harbor for PCI compliant businesses, to laws requiring companies to implement comprehensive information security programs. Over 45 states have enacted legislation requiring notification of security breaches involving personal information. In addition, there are numerous other federal and state data security laws, including the Gramm-Leach-Bliley Act and state privacy laws. Privacy laws have been adopted in a number of other countries, most notably in Europe. The European Union has adopted a data privacy directive that requires member states to impose restrictions on the collection and use of personal data that, in some respects, are more stringent and impose more significant burdens on subject businesses than current privacy standards in the U.S.

While all of these standards and regulations are becoming more pervasive, PCI has been among the best defined and broadest reaching data security standards thus far. PCI compliance is required for any business, government entity or other organization that wishes to accept payment cards, and financial institutions are increasingly enforcing PCI among their payment card accepting customers. Many of the major data security regulations that were introduced prior to PCI, namely the Gramm-Leach-Bliley Act, HIPAA and regulations by the Federal Financial Institutions Examination Council primarily focused on the financial and healthcare industries, which we believe represents less than 15% of all U.S. firms based on an analysis of 2007 U.S. Census Bureau statistics of U.S. firms by NAICS classification codes. Given the wide range of industries accepting payment card transactions, including retail, hospitality, healthcare, government, education, utilities and petroleum, we estimate the introduction of PCI dramatically increased the number of organizations subject to a data security compliance standard to more than 50% of all U.S. firms, making PCI one of the broadest reaching data security standards to date. Notwithstanding these controls, payment card information continues to be an increasingly popular target for sophisticated hackers. As a result, the PCI Council frequently updates the requirements for organizations to achieve and maintain PCI compliance.

PCI compliance benefits businesses, organizations, banks, payment service providers and consumers by strengthening the card payment system. Compliance helps prevent fraud and compromise, increases the confidence of all parties in the payment system, and reduces the time and other resources involved in replacing payment cards and otherwise dealing with payment card fraud and compromise situations.

The consequences of PCI non-compliance impact a number of the participants in the payment card system. Financial institutions are generally responsible for the risk of payment card fraud or compromise and security breaches involving their payment card accepting customers to the extent they are unable to recover losses from them or other parties. In addition, in certain cases payment service providers, which offer businesses and other organizations services for accepting electronic payments, are also responsible for such losses. Managing and ensuring PCI compliance among their customers is important to financial institutions and payment service providers as they seek to manage and reduce their risk profiles. The consequences of PCI non-compliance for their payment card accepting customers include the risk of financial loss, bankruptcy, additional fees, brand damage, business disruption and the inability to accept payment cards from their customers.

Incorporating regulatory requirements into governance and business processes requires deep knowledge of the regulations, industry standards and potential implications to an organization’s IT infrastructure. In addition, working through any compliance initiative can consume an organization’s personnel and financial resources. Many of these affected organizations, especially small- and medium-sized businesses and local storefronts of distributed organizations, may not have fully addressed data security prior to PCI, and therefore may lack the knowledge and tools needed to identify and remediate increasingly complex threats.

Many existing compliance and data security solutions are highly complex and expensive

Challenges of many existing data security compliance solutions include that they are:

Highly complex and inflexible. Compliance management and enablement may involve the need to conduct lengthy evaluations and apply multiple on-premise point products often from different vendors, as many vendors lack an integrated suite solution to address compliance. In addition, there are limited on-demand solutions that provide the flexibility that comes from modular functionality, which would enable businesses to access real-time, service-based solutions as needed.

Expensive and resource intensive. Attaining and maintaining compliance can be difficult, time consuming and expensive and involve multiple on-premise point products from different vendors. In addition, ongoing maintenance and upgrades may be costly, adding to the high total cost of ownership of a comprehensive solution. Further, compliance management and enablement usually requires the assistance of an IT staff with extensive knowledge of the regulations, industry standards and potential implications for IT infrastructure.

Not designed to facilitate ongoing compliance. Many organizations discover that they have few, if any, solutions to effectively help them manage and maintain compliance after undertaking the costly and time-consuming task of achieving compliance. As data security threats become more sophisticated and compliance requirements evolve, significant financial and personnel resources may be required to ensure compliance is maintained.

Challenging to deploy within distributed, heterogeneous environments and small- and medium-sized organizations. Controlling and monitoring common standards across multiple locations requires monitoring the equipment deployed, security policies enforced and data stored at each location. Implementing a centralized compliance resource to monitor and inventory each system of a multi-site organization is costly to implement and maintain. In addition, the cost, complexity, required security and compliance know-how, as well as resource-intensive and time consuming implementation, of most existing solutions make them impractical for many organizations.

Market opportunity

We believe there is an increasing need for on-demand, scalable, automated and cost-effective data security compliance solutions that can help organizations address these challenges in real time and simplify the process for validating, achieving and maintaining compliance. Organizations of all sizes face similar regulatory and compliance requirements. In addition, these organizations confront a similar threat landscape, which raises the importance of heightened security.

We believe the market for compliance management and compliance enablement solutions represents a large and growing market opportunity. According to IDC, the total governance, risk and compliance infrastructure software market is expected to grow from $17.3 billion in 2009 to $34.5 billion in 2014, representing a compound annual growth rate of 14.8%. We believe that the governance, risk and compliance infrastructure software market, and the software market generally, will continue to see increased growth and adoption of on-demand solutions as compared to traditional on-premise solutions. According to IDC, the software-as-a-service, or on-demand, software market is expected to grow from $13.1 billion in 2009 to $40.5 billion in 2014, representing a compound annual growth rate of 25.3%.

With respect to PCI, we believe compliance represents a particularly large addressable market. For example, MasterCard estimates that its payment cards were accepted at approximately 30 million locations worldwide as of December 31, 2010. We believe that the number of locations where data is stored or transmitted, and consequently require protection, will continue to increase for financial transactions, as well as health care services, government and other services.

Our Solutions

Our enterprise-grade suite of data security compliance solutions enables organizations of all sizes to meet the challenges of securing their critical data, and to validate, achieve and maintain compliance with industry standards

and regulations. Our solutions comprise both compliance management and compliance enablement offerings and some include a service component through our security professionals or secure operations centers. Our easy-to-use compliance management solutions simplify this complex process by analyzing and reporting on a business’s adherence to data security standards and regulations. These compliance management solutions can check for prohibited data storage, systems configurations and security policy settings on a multitude of systems utilized by small through large enterprises, including those that operate from numerous sites. Our compliance enablement offerings comprise a broad suite of integrated data security solutions tailored to help businesses become compliant in a cost-effective manner without the need to deploy and integrate multiple point products.

Key differentiators of our solutions include:

Simplifying complex compliance processes. Our on-demand solutions simplify and automate complex compliance processes by facilitating completion of compliance assessments, automating the diagnosis of an organization’s security posture and providing easy-to-understand actionable information. Our TrustKeeper solution translates lengthy, technical questionnaires into intuitive questions on basic business operations. As we gain insight into the security posture of a business through our automated process, we offer the required solutions and services to remediate identified vulnerabilities and achieve and maintain compliance throughout the contract term. Many of our solutions are delivered as a service, simplifying implementation and facilitating use, which is particularly important to businesses and other organizations with limited IT resources and personnel.

Scalable and flexible. Our solutions are designed to satisfy our customers’ needs as their businesses grow and to address the needs of organizations with complex, geographically dispersed and heterogeneous IT infrastructures, regardless of size. As organizations expand, and their security requirements increase, we are able to satisfy our customers’ demands throughout their lifecycle. In addition, our solutions are designed to be rolled-out to thousands of branches or offices of large enterprises.

Cost-effective to achieve and maintain compliance. We provide our customers with many cost-effective solutions delivered as a service, eliminating much of the need for up-front infrastructure costs to achieve and maintain compliance. Our integrated solutions identify and help remediate security vulnerabilities and non-compliant policies, and reduce the need for in-house personnel resources and out-of-pocket costs to monitor and demonstrate on-going compliance.

Comprehensive and integrated solutions. We offer a broad suite of compliance solutions that typically work together in an integrated fashion to identify non-compliant areas and remediate data security vulnerabilities utilizing a variety of delivery options, including multi-tenant on-demand, software agent or software management systems, hardware appliances and managed options. Our solutions analyze, aggregate and report on prohibited data storage, systems configurations and security policy settings on systems across centralized or distributed IT environments with enhanced reporting and tracking capabilities. Up-to-date information is routed to a centralized management solution, thereby providing real-time compliance monitoring.

Trusted brand. We are a leading provider of on-demand data security compliance solutions, endorsed by and marketed through many of the world’s largest, most trusted financial institutions and other well-known organizations with whom we partner to deliver our solutions. Our payment services customers include financial institutions, such as Banc of America Merchant Services, Barclays Capital Services, JPMorgan Chase, First National Bank (South Africa), Nordea Bank, Swedbank, Transbank, U.S. Bank and Wells Fargo; American Express, Discover, Visa and other major payment card companies; and other members of the payment and IT ecosystem, such as Atos Worldline, China UnionPay Data, Cielo, EVO, Fifth Third Processing Solutions, First American Payment Systems, First Data Corporation, Global Payments, Moneris, MICROS Systems, Redecard, Sage Payment Solutions and TSYS Merchant Solutions. Many of these organizations are also members of our partner network and market our solutions to their payment card accepting customers to help them achieve and maintain compliance. Use of our solutions by Fortune 500 enterprise customers enhances our credibility in the marketplace and our ability to effectively market to organizations of all sizes. Additionally, organizations are able to communicate to their customers the steps that they have taken to protect sensitive data by displaying the Trustwave Trusted Commerce seal, which had approximately 4.5 billion impressions in 2010. Our brand credibility is further supported by our SpiderLabs team, a leader in analyzing security threats and incident response. Members of our

SpiderLabs team are often featured as speakers at significant industry events, such as the Black Hat Technical Security and DEF CON conferences.

Differentiated proprietary knowledge and technology. Our large, global customer footprint gives us visibility into existing and potential threats. Our threat visibility is enhanced by our SpiderLabs team, which performed approximately 150 security breach investigations and approximately 1,400 ethical hacking projects in 2010. This allows us to proactively develop our solutions to address specific customer needs and protect against the latest security threats. We have earned numerous industry awards and certifications, including recognition as a leader in data security compliance. Our proprietary technology is based on a broad portfolio of intellectual property, which includes 18 issued patents and 28 patent applications pending in the United States.

Our Business Model

To complement our data security compliance solutions, we have developed a differentiated business model that has the following attributes:

Differentiated go-to-market strategy. We have developed a partner network comprised of a number of the world’s largest financial institutions, payment service providers and other organizations influential to the compliance and data security mandates of their customers. These organizations serve as differentiated and cost effective distribution partners for us, and we typically co-brand and co-market with these organizations to their customers. Financial institutions are generally responsible for the risk of payment card fraud or compromise and security breaches involving their payment card accepting customers to the extent they are unable to recover losses from them or other parties, and many of them rely on our knowledge and proprietary technology to help these customers validate, achieve and maintain compliance. A number of our current enterprise customers with multiple franchises or locations, such as restaurant chains, retailers and hospitality chains, also serve as key distribution partners when central management rolls-out or recommends our solution to their numerous locations.

On-demand delivery model. Many of our solutions are delivered on-demand, including our software-as-a-service TrustKeeper solution, which is offered through a subscription over the Internet using a multi-tenant architecture. This model allows us to quickly deliver a modular service to which organizations can easily subscribe without significant upfront capital investment or the requirement for professional services to integrate software or appliances into their environment. Our subscribers can be up and running quickly after contracting with us, and generally need no prior training to use our solutions. Our on-demand solutions enable small- and medium-sized organizations with more limited resources to effectively adhere to today’s complex security and compliance standards. Our subscription-based model provides us with a significant level of revenue visibility.

Initiate and build upon subscriber relationships. We typically initiate a relationship with a subscriber through one of our network partners by offering our compliance management solution. We then build upon our relationship by offering our subscribers integrated compliance enablement solutions to cost-effectively enhance their security posture and help them achieve and maintain data security compliance. Further, through our subscribers’ use of our compliance management offerings, we gain insight into their data security compliance requirements and can efficiently and effectively offer them the most appropriate solutions that address their needs. This model drives an efficient sales and marketing function and allows us to achieve lower sales and marketing costs as a percentage of sales compared to many of our on-demand peers.

Global delivery capabilities. As of December 31, 2010, we served customers in approximately 65 countries through employees and dedicated third-party support located in approximately 20 countries, and we offered our TrustKeeper solution in nine different languages. We believe our on-demand delivery model allows us to efficiently serve organizations of all sizes worldwide. For the year ended December 31, 2010, 15% of our revenue was generated outside of North America.

Our Growth Strategy

Our goal is to be the leading global provider of data security compliance solutions. The following are key elements of our growth strategy:

Grow subscriber base within existing partner network. We plan to grow our subscriber base globally by converting more of our PCI partner network payment card acceptance locations into TrustKeeper subscriptions. We estimate that there were approximately 6 million payment card acceptance locations within our existing PCI partner network as of December 31, 2010. A number of our network partners are in the midst of a multi-year effort to monitor and enforce PCI compliance among their payment card accepting customers, and in turn we expect the percentage of these locations enrolled to increase, although we do not expect this effort will result in all of them becoming enrollees and some may already be covered by our enterprise arrangements. We had approximately 1.6 million enrollees in our TrustKeeper solution as of December 31, 2010. These primarily consisted of payment card acceptance locations, the majority of which were identified by our partner network as requiring PCI compliance services. Each payment card acceptance location of a subscriber is generally counted as a separate TrustKeeper subscription when either one of our partners or the subscriber has initiated payment for our service. As of December 31, 2010, we had over 900,000 TrustKeeper subscriptions, and approximately 700,000 enrollees that did not have a subscription. We plan to continue our marketing efforts to many of the enrollees who have not elected to become subscribers as well as other potential customers in the markets we serve.

Build upon relationships with existing subscriber base. Our subscribers and our partner network benefit from effective, affordable and easy-to-deploy security solutions to attain and maintain compliance with the myriad regulations and standards in effect today. We believe that our compliance management solutions will continue to generate cross-selling opportunities to our installed base of our comprehensive suite of compliance enablement solutions as subscribers seek to remediate vulnerabilities identified by the compliance management process. In addition, we anticipate further expansion into the network of branches and franchises of our distributed enterprise customers.

Expand portfolio of new technologies. Our large, global customer footprint gives us visibility into existing and potential threats, which is enhanced by our SpiderLabs team. As a result, we expect to continue to enhance our solutions to address specific customer needs and the latest security threats. For example, we plan to develop solutions with more advanced authentication and end-to-end encryption that further enable secure point-to-point communications. The capabilities and knowledge we have developed are also applicable to other data security regulatory requirements, as many of these data security regimes are based on similar underlying requirements. We plan to leverage our expertise in addressing PCI compliance to further expand our offerings in other data security regulatory regimes such as HIPAA and FISMA, among others. In addition, we plan to continue to selectively pursue acquisitions of technologies that bolster and complement our data security compliance solutions.

Extend our partner network. We plan to continue to seek additional partners to reach more payment card acceptance locations worldwide. We believe that an increasing number of our current enterprise customers with multiple franchises or locations, such as restaurant chains, retailers and hospitality chains, will also serve as key distribution partners, when central management rolls-out or recommends our solutions to their numerous locations. Additionally, we plan to develop partner networks in health care, government services and other sectors, facilitating the distribution of our solutions that address relevant regulations and standards, such as HIPAA and FISMA.

Expand internationally. Our revenue from customers outside of North America has grown from $10.4 million in 2008 to $16.8 million in 2010, an increase of 62%. We plan to increase our international presence, primarily by growing our presence in the approximately 65 countries in which we have customers. We also plan to selectively introduce our services in additional countries where the scope and adoption of security and compliance solutions continue to increase, largely by leveraging our partner network.

Products and Services

We offer a broad suite of compliance management and compliance enablement solutions through a number of delivery methods. These delivery methods include:


	•	Multi-tenant on-demand: Our solutions are often delivered on-demand over the Internet during the subscription period. This simplifies implementation and use, which is particularly important to businesses and other organizations with limited IT resources and personnel.

	•	Software agent or software management system: Certain of our applications require software to be downloaded over the Internet or shipped and installed on the customer’s IT systems. For some applications, this software can relay information to us, thereby improving our ability to monitor our customers’ operations and to integrate our solutions more effectively.

	•	Hardware appliance: In certain cases, we offer hardware appliances that are deployed at a customer’s site, consisting of hardware devices that run proprietary Trustwave software that can be configured for those devices. Our customers are able to purchase these appliances through us, but the hardware we use, such as servers acquired from third-party providers, is typically commercially available without custom-built components.

	•	Trustwave-managed option: We are able to assist, in many cases remotely, in the initial configuration, delivery, ongoing maintenance and event monitoring for many of our solutions, thereby simplifying the deployment and administration of those solutions. This service is offered on a subscription basis.

The table below identifies our compliance management and compliance enablement solutions and their respective delivery methods:


	Delivery Method
		Software Agent		Trustwave-
	Multi-Tenant	Or Software	Hardware	Managed
Solutions	on-Demand	Management System	Appliance	Option

*Compliance Management:*
TrustKeeper	ü
TrustKeeper Agent	ü	ü
Compliance Validation Services				ü
*Compliance Enablement:*
Security Information & Event Management		ü	ü	ü
Intrusion Prevention and Intrusion Detection			ü	ü
Unified Threat Management and Extensible Threat Management			ü	ü
Web Application Firewall			ü	ü
SSL Certificates	ü
SSL Lifecycle Manager	ü
Two-Factor Authentication	ü
Full Disk Encryption	ü	ü		ü
Persistent File Encryption	ü	ü		ü
End-to-End Encryption		ü
Tokenization		ü
Data Loss Prevention		ü	ü
DataControl		ü
Network Access Control			ü	ü
Secure Email	ü
Internal Vulnerability Scanning			ü	ü
External Vulnerability Scanning	ü

While our compliance management and compliance enablement capabilities can be sold individually, many times they are bundled together in a subscription offering to provide subscribers with a more comprehensive and cost-effective solution to validate, achieve and maintain compliance with data security regulatory requirements and industry standards. Additionally, the insights we gain through our SpiderLabs team and other security consulting services are leveraged across many of our products to enhance their effectiveness.

Compliance Management Capabilities

TrustKeeper^®

TrustKeeper, our SaaS compliance management solution, is an easy to use, highly-scalable, centralized solution that analyzes an organization’s network infrastructure and security practices and profile in order to detect security vulnerabilities and compliance with data security standards and regulations. TrustKeeper is designed for users without specialized computer, compliance or data security training or expertise. Without a solution such as TrustKeeper, organizations would typically need to complete lengthy, technical questionnaires and assessments about their network and security practices in order to assess whether they are compliant with regulatory requirements and industry regulations. TrustKeeper is available to subscribers throughout the term of their subscription period, which often is one year.

TrustKeeper provides actionable information to help a subscriber understand its risk profile and actions that may be necessary to remediate any vulnerabilities or non-compliant areas. In the case of PCI, TrustKeeper simplifies the compliance process by guiding the user through a series of simple questions designed to identify how the organization accepts and processes payments. Based on the user’s responses, TrustKeeper determines the appropriate compliance questionnaire, analyzes the organization’s network infrastructure and security practices and automatically populates answers to the questionnaire based on information gathered during the analysis. TrustKeeper utilizes our vulnerability scanning engine which tests for critical system, network and application-level vulnerabilities, and is constantly updated based on new information from the National Vulnerability Database, our vendor partnerships and original research by our SpiderLabs team. The scan engine’s adaptive capability allows it to discover and apply information about a network environment to the scans, reducing the number of false vulnerabilities.

TrustKeeper provides a compliance status report to the user, and when the analysis detects deficiencies and vulnerabilities, TrustKeeper provides remediation recommendations to help the organization become PCI compliant. The reports prioritize scan findings in order to provide timely, actionable information to help users manage vulnerabilities efficiently.

TrustKeeper is currently available in nine languages, including English, Spanish, French, Portuguese, Swedish, Norwegian, Polish, German and Dutch, and we are actively working to add four additional languages, including Japanese and Chinese, by the end of 2011.

TrustKeeper^® Agent

Our TrustKeeper^® Agent solution can be downloaded over the Internet and works in tandem with TrustKeeper to continuously monitor network and system compliance policies and to accelerate an organization’s compliance process. TrustKeeper Agent can be installed on systems, such as point-of-sale terminals, to perform local policy checks and inspections. These assessments complement the TrustKeeper network vulnerability scans. Whereas TrustKeeper assesses the security and vulnerability of an organization’s network and systems from the outside (for example, from the perspective of a hacker), TrustKeeper Agent inspects and monitors the data security of an organization from the inside.

TrustKeeper Agent facilitates compliance by enabling: (i) the scanning of systems for forbidden data, such as payment card track data; (ii) the reporting of a systems’ security settings such as passwords, user accounts, configurations and other settings; (iii) the automatic detection of which payment application and version is installed and reporting on whether that application is a PCI compliant payment application; (iv) the validation of security settings against specific compliance requirements; (v) the monitoring of locations and networks for the presence of unauthorized devices, such as an unauthorized wireless access point; (vi) external vulnerability scanning of locations that connect to the Internet through broadband Internet service providers (ISPs) and as a result have dynamic IP addresses; (vii) file integrity monitoring to detect unauthorized modifications to sensitive files, such as operating system files; and (viii) the collection, transport, and management of log data. Because TrustKeeper Agent can scan, aggregate and report back on individual terminals and devices, it is particularly helpful to the compliance initiatives of enterprises, acquiring banks and other large organizations in managing compliance among a large group of departments, franchises or retail outlets.

Compliance Validation Services

Enterprise customers present more complicated security and compliance challenges due to their complex IT environments. In particular, in addition to the other requirements covered as part of their subscription, large organizations and service providers are also required to obtain an on-site validation by a Qualified Security Assessor in order to become and remain compliant under PCI. Our security professionals are able to guide enterprise customers through the compliance validation process by leveraging TrustKeeper and a purpose-built compliance validation solution manager tool that customers can utilize to monitor compliance throughout the subscription period. Our approximately 85 security professionals have, on average, 11 years of security experience, and most have achieved one or more of the following certifications: Qualified Security Assessor, Certified Information Systems Security Professional, Certified Information Security Manager and Certified Information Security Auditor.

Compliance Enablement Capabilities

Our compliance enablement solutions help organizations of all sizes secure their sensitive data, enhance their overall security posture and meet ongoing data security compliance requirements in a cost-effective and efficient manner. Our solutions can be delivered in concert to provide a comprehensive compliance solution through a set of management platforms that allow them to be monitored and managed from integrated consoles by both customers and our managed services personnel. Our enablement solutions are often delivered as a service, simplifying implementation and facilitating use, which is particularly important to organizations with limited IT resources and personnel. We are able to remotely assist in the initial configuration, ongoing maintenance and event monitoring for many of our solutions. In addition, certain of our enablement solutions are offered through perpetual software licenses, coupled in certain cases with the sale of associated hardware appliances. Our compliance enablement solutions are discussed below.

Security Information & Event Management

Our security information & event management, “SIEM,” solution collects streaming activity data, often referred to as “events” and “logs,” from the devices, applications and other elements in an organization’s IT infrastructure and consolidates and translates the streaming data into a common format to enable analysis. A single device or application can generate thousands of events in a single day, most of which are low priority and typically provide information about a narrow aspect of the infrastructure. Only a portion of events are associated with threats or compliance risks. Our SIEM solution, through sophisticated correlation technology, analyzes captured events and logs to identify and prioritize high-risk activity and present a consolidated view of IT security threats to the business. By providing visibility into diverse devices, applications and networks, our SIEM solution helps businesses achieve more effective identification and mitigation of security threats and compliance validation with numerous regulatory requirements and industry standards. In addition, adhering to forensic quality standards, Trustwave Security Data Warehouse^tm will file, secure, monitor and retain log data to satisfy regulatory standards using optimized data compression and indexing techniques. Our SIEM solution can be integrated with our other solutions or solutions from third-party vendors to enable real-time analysis and reaction to security threats through policy-based event monitoring.

Intrusion Prevention and Detection

Our intrusion prevention and intrusion detection solution is an easy-to-deploy and adaptive enforcement technology that complements an organization’s firewall perimeter. This solution supports real-time updates to address vulnerabilities specific to a customer’s network, thereby strengthening perimeter defenses while cutting down on false threats that can interfere with legitimate traffic. At the same time, our intrusion prevention and detection solution monitors a customer’s network and systems for evidence of attacks. This solution helps control the risks associated with common vulnerabilities such as email-borne viruses, infected laptops and human factors. The intrusion prevention system is often installed near a network gateway to inspect traffic and react in real time, and the intrusion detection system is usually deployed to passively perform analysis functions.

Unified Threat Management and Extensible Threat Management

Our unified threat management, or “UTM,” solutions and our extensible threat management, or “XTM,” solutions provide multiple network security capabilities consolidated in a single customer-deployed hardware appliance. In particular, our UTM and XTM solutions perform firewall, log collection, gateway anti-virus, virtual private network enablement, intrusion prevention, remote access control and web content filtering functions. In addition, we believe our XTM solutions are more comprehensive than certain unified threat management products offered by other vendors because our solutions also provide internal vulnerability scanning and network access control functionality.

Web Application Firewall

Our Web Application Firewall, or “WAF,” solution utilizes bi-directional traffic analysis, automated behavioral profiling and multiple collaborative detection engines to identify and protect against threats that can affect the security, functionality and availability of a customer’s web applications. This solution can be configured for a customer’s specific

web applications in order to provide more advanced and comprehensive protection than can be provided by a general network threat management system. Our web application firewall solution is deployed using a set of commercially available appliances that run Trustwave-built software, and multiple appliances can be deployed at a customer site to scale with the number of web applications and servers in use. This solution can be deployed and administered directly by the customer or by our Managed Security Services team on the customer’s behalf.

SSL Certificates and SSL Lifecycle Manager

Secure Sockets Layer, or “SSL,” certificates are electronic documents which use a digital signature to bind together a public cryptographic key with an identity and are used to confirm the identity of a website or server, encrypt data during transmission, and help ensure the integrity of transmitted data. Our SSL certificates are used by organizations worldwide to secure critical business information across numerous communication protocols including email, web transactions and management server interactions. SSL certificates perform cryptographic authentication and encryption operations to realize certain security goals, including data confidentiality and machine authentication. Businesses use SSL certificates to assure consumers of the validity, credibility and security of their websites. As one of the top 10 global Certificate Authorities, our SSL certificates are trusted by more than 99% of web browser installations. We also offer Extended Validation SSL certificates, which we believe are among the most trusted and stringently-validated certificates available today. To enhance trust in websites, the use of an Extended Validation SSL certificate will result in the shading of the Internet-address bar in the visitors’ web browser to green to communicate the security of the site.

In addition, our SSL Lifecycle Manager solution monitors SSL certificates deployed across an organization’s network, whether they were issued by us or another Certificate Authority. This solution alleviates the burden of managing large deployments of SSL certificates by automating the entire certificate lifecycle, including discovery, analysis and management.

Two-Factor Authentication

In addition to a username and password, our authentication service utilizes our SSL digital certificate technology to provide a managed two-factor authentication system that works without the need for hardware tokens. The solution leverages a customer’s current virtual private network authentication infrastructure, including its corporate directory system and virtual private network hardware, and software allows users to provision certificates over the Internet through our management portal. The web portal allows administrators to enroll and revoke access for an organization’s remote workforce quickly and easily.

Full Disk Encryption and Persistent File Encryption

Our full disk encryption solution enables the complete encryption of disk drives on laptops, desktops and servers using government-standardized algorithms to provide high degrees of protection. With this solution, all data, including the operating system itself, is protected. Without the password, an unauthorized user is unable to extract any information from a protected disk drive. Our full disk encryption solution provides an intuitive reporting system that allows enterprises to validate device encryption for the purpose of complying with breach notification laws and other regulations.

Our persistent file encryption, or “PFE,” solution utilizes patent pending Smart Tag^® technology to provide convenient and continuous protection for files, folders, email attachments and removable device data. Once a file or other data is protected, it remains protected as it travels from servers and file shares in data centers to endpoint devices (such as laptops and desktops), and it continues to be secured as it exits the enterprise through email or removable media. Our Smart Tag^® technology enables persistent protection for files without requiring software applications to be modified or requiring users to perform manual actions to encrypt or decrypt data. Our persistent file encryption solution provides other features as well, such as fine-grained, dynamic, cryptographically-enforced file access control, which enables an administrator to enable or limit the access of users to specific files, and file usage logging and reporting. The solution can be delivered as an on-premise solution or a fully managed solution. If protected data is shared outside the enterprise, we also offer a web-downloadable application, Control Sentry, which

allows authorized partners and home users to access and modify sensitive files. Control Sentry can also be automatically embedded in removable media devices like USB drives to enable use of portable protected data.

End-to-End Encryption

Our recently introduced end-to-end encryption solution helps ensure the confidentiality of payment transaction data and other data exchanges, such as medical record exchanges. This solution consists of three major components: a software-driven encryption component, an array of decryption systems and a remotely accessible management system. Other specialized hardware security modules may be deployed as well for the protection of certain highly sensitive information associated with the encryption process. Upon deployment to a device, the software-driven encryption component identifies, intercepts and encrypts transaction data that is processed at the device. In a PCI scenario, this is often a 16-digit payment card number that is entered into a point-of-sale system. The data remains encrypted across multiple devices, networks and applications until it reaches the decryption systems. This continuous protection overcomes deficiencies of combinations of traditional encryption solutions that require data to be decrypted and re-encrypted at various points along the path of a transaction. Customers may deploy the solution on point-of-sale devices without necessarily requiring explicit integration with payment application software or point-of-sale platforms, bundle the solution with TrustKeeper compliance management services, and enable data to be encrypted without changing the format or size of the data, which is often critical to practical implementations.

Tokenization

Our recently introduced tokenization solution enables the protection of sensitive data by representing selected data with a unique corresponding identifier, i.e., a “token,” for storage and data analysis purposes. Our tokenization solution manages the conversion of sensitive data, such as payment card numbers, into tokens. The process of creating tokens is “one way,” in that the underlying technology seeks to prevent unauthorized users from utilizing a token to obtain or compute corresponding original sensitive data. In addition, our solution creates tokens using the same encoding schema and size of the original sensitive data to enable easier integration with existing data analytics systems and databases. The tokenization system can also be delivered within our end-to-end encryption solution to complement the transaction security provided by that solution.

Data Loss Prevention

Our data loss prevention, or “DLP,” solution detects and analyzes sensitive data that is traveling over corporate networks or stored on various enterprise devices. The key capabilities of our DLP solution include monitoring and reporting suspicious network behavior by a customer’s employees and preventing unauthorized data sharing activities. Also, our DLP solution is capable of identifying files, database records and email communications containing cardholder data and intellectual property. An appliance-based version of the solution is deployed near Internet gateways to monitor web, email and other network communication with the outside world. A software version of the solution can be installed on data center servers or endpoint devices such as laptops and desktops to periodically scan stored data, such as files, for sensitive content. Using a configuration that is tailored to each customer, upon detecting sensitive data or misuse, this solution acts on policies for protection, which may include quarantining, blocking or informing on the existence of sensitive data.

DataControl

Our DataControl solution combines features of our DLP solution and our PFE solution to provide enhanced data protection. DataControl utilizes our DLP solution to scan enterprise devices for sensitive data and, upon finding such data, executes on policies to automatically encrypt and protect those files through our PFE solution. This solution can be implemented without requiring any user or administrator interaction. After sensitive files are protected, they can be freely shared inside and outside of the enterprise while guaranteeing compliance and achieving strong security. Policies can be configured to align with regulatory standards such as PCI and HIPAA, and a customer can generate reports on all activity.

Network Access Control

Our Network Access Control, or “NAC,” solution allows a customer to govern who connects to its network, which devices they use and which IT resources they are permitted to access. The enterprise NAC solution is deployed with a distributed set of sensor appliances that are all managed by a central management server. With a proprietary method of detecting rogue routers and user- and device-level authentication capabilities, our NAC solution enables compliance with certain PCI requirements. Our NAC product is a full-cycle solution, capable of performing post-admission behavioral monitoring as well as pre-admission checks, such as checks of open service ports, Windows patches and the existence of firewalls, anti-virus and anti-spyware capabilities.

Secure Email

Through encryption, archiving and filtering, our on-demand mailMAX solution mitigates exposure to risks associated with confidential information sent through email, email-based viruses, inappropriate content and spam. With this solution, a subscriber’s email traffic is routed through Trustwave servers running mailMAX software, thereby avoiding the need for subscribers to deploy on-premise equipment.

Vulnerability Scanning

Our internal and external vulnerability scanning, or “IVS” and “EVS,” respectively, solutions secure an organization’s network and information by proactively identifying weaknesses in its security posture. Our IVS and EVS solutions are offered as fully managed services, with a customer portal available for tasking, configuration and remediation of findings. EVS is incorporated into our TrustKeeper solution and views and scans customers’ infrastructures from the outside. IVS, on the other hand, views and scans network assets from behind the corporate perimeter firewall, providing a comprehensive view of the customer’s IT environment. IVS software is deployed on a Trustwave-provided hardware appliance. Both services allow customers to maintain an enterprise-wide scanning policy within a unified portal framework by grouping scanning parameters into a set of user-defined profiles.

Technology Platforms for Integrated Product Delivery

We have built a set of management platforms that allow various compliance enablement solutions to be monitored and managed from integrated consoles by both customers and our managed services team. These integrated consoles allow us to deliver security capabilities as an integrated solution and at a lower cost than loose bundles of security products. In addition to the TrustKeeper portal, our web-based integrated management platforms can be used by our personnel or by customers to monitor product configurations, device status information and events.

Trusted Commerce^® Website Seal

Another component of some of our solutions is the Trustwave Trusted Commerce^® website seal. By displaying the Trusted Commerce seal on their public-facing websites, subscribers are able to communicate to visitors of those websites steps they have taken to protect sensitive data. The Trusted Commerce seal can indicate whether subscribers have enrolled in TrustKeeper to initiate the PCI compliance process, if they have completed the steps to validate compliance and whether they have taken steps to verify the identity and security of their websites by using Trustwave SSL certificates. The Trusted Commerce seal had approximately 4.5 billion impressions in 2010.

SpiderLabs and Other Security Consulting

We offer a wide range of security consulting services to help businesses analyze and test their current information security controls and to provide guidance in remediating deficiencies. Our SpiderLabs team offers forensic services and “white hat” or “ethical hacking” services such as penetration testing (network, wireless and application level) and social engineering to identify any weaknesses in a customer’s IT infrastructure that can be exploited by hackers. Our SpiderLabs team performed approximately 150 data security breach investigations and approximately 1,400 ethical hacking exercises in 2010.

We also leverage the experiences and insights of our SpiderLabs team and security consultants to enhance our solutions. For example, we offer a 360 Application Security program pursuant to which SpiderLabs conducts secure code development training and performs application code reviews and penetration testing of a customer’s applications. Using the results, we configure and deploy a WAF to address the customer’s specific security needs. The WAF includes a virtual patching capability that enables the solution to adapt in real time to new emerging threats. We believe our ability to combine our security consulting expertise with our compliance enablement capabilities enhances our customers’ data security and is a significant competitive advantage for us. We intend to continue to look for opportunities to integrate our enablement capabilities with our security consulting expertise.

Customers

Our customers include subscribers, which are businesses, government entities and other organizations that purchase our subscription services either directly or are provided our service through a member of our partner network, as well as purchasers of our professional services or perpetual-licensed products. We serve customers of all sizes, from eight of the top ten Fortune 500 companies in 2010 to small- and medium-sized businesses and other organizations. Examples of our customers include financial services companies, franchised restaurants, hospitality chains, hospitals and physician networks, technology, media and telecommunications companies, educational organizations and retail operations of all sizes, from multi-national entities to single-location small businesses.

As of December 31, 2010, we had over 900,000 subscriptions. For the years ended December 31, 2008, 2009 and 2010, our top ten customers accounted for 11%, 19% and 23% our of revenue, respectively. Many of our top 10 customers are network partners who purchase our compliance management solution for their own businesses as well as on behalf of their organizational customers. No single customer represented more than 10% of our revenue in 2010.

Some representative examples of customer-use cases we address include:

Partner Network. Our partner network, which includes many existing direct customers, primarily represents the largest channel relationships for enrolling new businesses, government entities and other organizations into our TrustKeeper compliance management solution. We have established partner network programs with members of the financial and payment industries as well as the IT ecosystem, where the partners offer our TrustKeeper portal. While partner programs differ, the initial contract term for a typical partner program contract is three years, with automatic renewal provisions. Each program has a set schedule of per-client pricing for the TrustKeeper solution and typically includes a co-marketing program to promote the service to the network partners’ customers. Pricing for the partner program depends on numerous factors, including the number of the partner’s customers who are enrolled in the TrustKeeper portal each year, the level of commitment or expectation by the partner to enroll or pay for additional customers in current or future years, the level of support required, and the specific services and products offered within the program.

SMB. Many of our small- and medium-sized subscribers are introduced to us through our partner network. These businesses and other organizations typically have limited, if any, dedicated security and compliance staff. Although their IT systems may be on a smaller scale than our larger enterprise customers, they face many of the same threats and are subject to many of the same regulatory requirements and industry standards as larger organizations. A typical small- and medium-sized business subscriber is a privately-held company, such as a barber shop, doctor’s office, retail store or golf course. Through co-marketing campaigns with our network partner, the subscriber learns about our easy-to-use TrustKeeper portal and can access the portal online to begin the compliance validation process. Although many of these subscribers outsource their IT support, they use our TrustKeeper solution to analyze their network infrastructure and security practices in order to detect security vulnerabilities and compliance with data security standards and regulations throughout the subscription period. TrustKeeper provides actionable information to help the subscriber understand its risk profile and the actions that may be necessary to remediate any vulnerabilities or non-compliant areas. At that point, the subscriber may contract with us directly to purchase compliance enablement solutions to remediate any of the identified vulnerabilities or non-compliant areas.

Enterprise. One of our direct sales professionals initiated a relationship with a large enterprise customer in the food manufacturing industry. Through the subsequent compliance management relationship, we identified certain security vulnerabilities and offered several of our compliance enablement solutions as options to assist the

customer in remediating them. The customer then decided to purchase several of our offerings through a three year bundled subscription service, including our compliance validation, TrustKeeper Agent, network access control, intrusion detection and vulnerability scanning solutions.

Distributed Enterprise. Through one of our direct sales professionals, we initiated a relationship with a large distributed enterprise customer in the hospitality industry when it engaged us to help validate, achieve and maintain PCI compliance at its corporate data center. After our review of the corporate office, we tailored a program to assist the customer in validating compliance at hundreds of its remote locations through our TrustKeeper solution. To remediate a number of identified security vulnerabilities, the customer then elected to roll out our managed UTM service to many of its international locations. We anticipate providing this solution to additional sites going forward.

Sales and Marketing

Partner Network

Our partner network is comprised of a number of the world’s largest financial institutions and other organizations influential to the compliance and data security mandates of their customers. As of December 31, 2010, our partner network was comprised of approximately 75 organizations. Most of these organizations utilize our solutions themselves, and often recommend us as the preferred compliance solution provider to their customers. We often co-brand and co-market our solutions with these organizations to their customers, which serves as a differentiated and cost effective distribution method for us. Our partner network is the primary distribution channel for our software-as-a-service TrustKeeper solution, especially for small- and medium-sized businesses. In addition, we work with system integrators and other technological resellers and associations that provide complementary skills and expertise in certain industries or regions in order to provide an additional distribution channel for our compliance enablement solutions.

As of December 31, 2010, we employed a team of approximately 20 individuals that provides a structured framework to recruit, enable and support our partner network. This team provides technical support, education and training to our partner network, and assists our partners with designing customized marketing programs to increase compliance awareness.

Direct Sales

As of December 31, 2010, our direct sales force was comprised of approximately 75 sales professionals, including our sales team for enterprises, governments and other organizations, our inside sales force for small- and medium-sized business and our presales and sales support operations. Our direct sales teams are supported by marketing and product specialists, as well as sales engineers that have in-depth knowledge about the functions and features of our products. Our sales engineers assist in the sales process with demonstrations, proof of concepts and implementation discussions with prospective customers. Sales cycles vary considerably by solution and by the size and technical sophistication of the prospective customer. To support our growth plans, we intend to continue to increase the size of our direct sales force and the number of sales support personnel.

Marketing

To support our network partners and our direct sales effort, we perform a number of additional marketing activities each year to increase brand awareness and generate qualified leads, including webinars focused on education; email campaigns; tradeshows and conferences targeted toward horizontal and vertical market segments; advertising and internet marketing programs leveraging internet search engines and optimization programs to drive traffic to our websites; and other brand awareness marketing endeavors such as social media.

Product Development

To offer our customers solutions that address the evolving security threat environment and regulatory landscape and to remain competitive in the data security compliance market, we make substantial investments in product development. Our efforts are focused on adding new features to existing solutions, increasing the levels of integration between our suite of solutions, making our solutions easier to use for small- and medium-sized organizations, improving the efficiency of our service delivery platform and developing new solutions. We identify

and develop new and enhanced features, products and services based on our insights into future security threats and vulnerabilities and input from our product managers, who receive continuing feedback from our customers. In addition, our SpiderLabs team is responsible for identifying emerging threats and security vulnerabilities and working with our product development team to incorporate features into our solutions that are responsive to the changing threat environment. Our success in designing, developing and selling new and enhanced solutions will depend on a variety of factors, including our ability to identify market demand, timely implementation of product design and development, product performance and our sales and marketing efforts.

Our product development organization is organized around small, focused teams, including a dedicated architecture team that is responsible for the development and maintenance of common services that are shared across products. As of December 31, 2010, our product development team, including product engineering and product management and strategy personnel, was comprised of approximately 150 individuals. During 2008, 2009 and 2010, we invested $6.7 million, $9.1 million and $20.1 million, respectively, in product development activities.

Operations and Technology

We maintain two data centers in the United States and a satellite location in London, England. Our primary production data center is located in suburban Chicago, Illinois and features backup power, redundant network circuits and 24x365 system monitoring to help ensure application availability. Our backup data center is located in downtown Chicago, Illinois and is used for limited production services, disaster recovery, testing and development purposes. Our backup data center has a dedicated fiber connection and provides near-real time data replication from our primary facility and has sufficient capacity to handle our production data volumes in the event that the primary facility becomes unavailable for any reason. For our on-demand applications, we offer service level commitments of at least 99.5% uptime every month, excluding designated maintenance periods.

We have six customer support centers located in Chicago, Illinois; Denver, Colorado; Austin, Texas; Reston, Virginia; Cambridge, Ontario and Warsaw, Poland. Through these centers, approximately 100 full-time professionals provide 24x365, multi-language support of our solutions for our customers. We also utilize an outsourcing arrangement to provide additional overload coverage during peak call periods for certain product offerings. Four of the support centers house secure operation centers staffed by our managed security services team to support our managed services offerings. This team performs event and device management and monitoring, customer threat analysis and escalation, provisioning and project management for customers with large deployments and service level agreement monitoring.

The principal technologies upon which our solutions are designed and built are discussed below.

Compliance Management Solutions

TrustKeeper is delivered as a multi-tenant architecture, providing single sign-on and presenting the user with purchased applications based on the subscriber’s profile. The entire TrustKeeper architecture is services based and has been designed to be flexible and scalable. The user interface is web-based and designed to eliminate cross-browser compatibility issues and support modular applications that fit seamlessly into the overall TrustKeeper framework. For scalability and performance reasons, all of the core TrustKeeper services are stateless in design, with strict separation between service interfaces and implementations, which allows service enhancements to be deployed without intrusion. The back-end technology stack runs on commercially available hardware. All applications share a set of standardized, common services, which allows for the rapid development and deployment of new applications and helps ensure that applications behave consistently and integrate seamlessly.

TrustKeeper Agent is installed locally on a Microsoft Windows PC. TrustKeeper Agent communicates with TrustKeeper for configuration information and to receive software updates. As its various modules run, TrustKeeper Agent sends critical security and compliance information to the main TrustKeeper servers for further analysis and reporting of results to subscribers.

Compliance Enablement Solutions

Our solutions are written in industry standard languages including Java, C++ and C#, and many of our solutions, such as our SIEM, WAF, SSL, NAC and secure email solutions, utilize the MySQL database for

persistence throughout all of the components of the solution. In cases where we manage a customer’s security solutions, appliances installed at the customer’s site connect to our cloud-based management infrastructure using secure reverse shell tunnels to reduce the need for direct external access to these devices.

Development Methodology

Our solutions are developed using an agile software methodology that relies heavily on collaborative design, rapid prototyping, iterative development and automated unit and integration testing. In addition to using recognized software quality assurance testing practices, prior to release our solutions are subjected to rigorous security code reviews and penetration tests by our SpiderLabs team. All production software releases are deployed during scheduled change windows.

Competition

The market for data security compliance, including both compliance management and compliance enablement, encompasses a wide range of solutions, extends globally to both small and large businesses and is subject to rapid changes in technology and regulation. We therefore compete with a large and broad array of established and emerging compliance and data security vendors in a highly fragmented and competitive environment.

Our principal competitors vary across our suite of data security solutions and between our enterprise and small- and medium-sized business customers. We principally compete with hundreds of smaller, private companies and, to a lesser extent, a more limited number of larger, more established companies. We believe only a few of our competitors have an automated compliance management offering like our TrustKeeper solution or otherwise possess the breadth of compliance enablement solutions that we can offer our customers. A few of our larger competitors that do have a broad array of compliance enablement solutions and other security software products may be able to offer products or functionality similar to ours at a more attractive price by integrating or bundling them more effectively than we can.

We believe our recent revenue growth is attributable to our success in competing against both small and large companies. If our target market continues to grow, small, highly specialized competitors may continue to emerge, and large software vendors may continue to integrate or bundle their array of security and compliance products with their other product offerings.

Mergers, acquisitions or consolidations by and among actual and potential competitors present heightened competitive challenges to our business. The consolidation in our industry increases the likelihood of competition based on integration or bundling, particularly where competitors’ products and offerings are effectively integrated, and we believe that consolidation in our industry may increase the competitive pressures we face on all our products. If we are unable to sufficiently differentiate our products from the integrated or bundled products of our competitors, such as by offering enhanced functionality, performance or value, we may see a decrease in demand for those products, which would adversely affect our business, operating results and financial condition. Further, it is possible that continued industry consolidation may impact customers’ perceptions of the viability of smaller or even medium-sized firms and consequently customers’ willingness to purchase from such firms. Similarly, if customers seek to concentrate their software purchases in the product portfolios of a few large providers, we may be at a competitive disadvantage notwithstanding the superior performance that we believe our products can deliver.

Another source of competition is represented by the custom efforts undertaken by potential customers to analyze and manage the information produced from their existing devices and applications to identify and remediate threats and satisfy compliance requirements. In addition, some organizations have outsourced these functions to managed security services providers.

We believe we face potential competition from other sources, including our network partners, that could become effective competitors. The introduction of alternative technologies and integration of security and compliance functionality into existing solutions like payment processing infrastructures and similar core processing platforms in other industries could decrease the demand for our products and services.

We believe the principal competitive factors in our markets include the following:


	•	breadth of product offering;


	•	price of products and total cost of ownership;

	•	ease of use;

	•	distribution capabilities, including relationships with partner network members;

	•	security effectiveness;

	•	delivery method and speed and ease of implementation;

	•	brand and reputation;

	•	scalability;

	•	customer service and support;

	•	professional services capabilities; and

	•	financial resources.

While many of our competitors enjoy certain competitive advantages over us, such as greater brand recognition, wider geographic presence and greater financial, technical and other resources, we believe that our large subscriber base, efficient customer acquisition model and broad suite of cost effective data security compliance solutions enable us to compete favorably with respect to these factors.

Intellectual Property

Our intellectual property rights are important to our business. We rely on a combination of patent, trademark, copyright and trade secret laws in the United States and other intellectual property laws, confidentiality agreements and license agreements to protect our intellectual property. It is our policy that our employees and independent contractors involved in development are required to sign agreements acknowledging that all inventions, trade secrets, works of authorship, developments, concepts, improvements and other processes generated by them on our behalf are our property, and assigning to us any ownership that they may claim in those works.

Despite our efforts, the steps we have taken to protect our proprietary rights may not be adequate to preclude misappropriation of our proprietary information or infringement of our intellectual property rights, and our ability to police such misappropriation or infringement is uncertain, particularly in countries outside of the United States. United States patent filings are intended to provide the holder with a right to exclude others from making, using, selling or importing in the United States the inventions covered by the claims of granted patents. Our granted United States patents, and to the extent any future patents are issued, any such future patents may be contested, circumvented or invalidated in the future. Moreover, the rights granted under any issued patents may not provide us with proprietary protection or competitive advantages, and we may not be able to prevent third parties from infringing these patents. Therefore, the exact effect of our patents and the other steps we have taken to protect our intellectual property cannot be predicted with certainty.

We have 18 issued patents and 28 patent applications pending in the United States. We do not know whether any of our patent applications will result in the issuance of a patent or whether the examination process will require us to narrow our claims, except that some of our patent applications have received office actions and in some cases we have modified the claims. Although we actively attempt to utilize patents to protect our technologies, we believe none of our patents, individually or in the aggregate, are material to our business. We will continue to file and prosecute patent applications when appropriate to attempt to protect our rights in our proprietary technologies.

Our industry is characterized by the existence of a large number of patents and frequent claims and related litigation regarding patent and other intellectual property rights. In particular, leading companies in the software industry have extensive patent portfolios. From time to time, third parties, including certain of these leading companies, may assert patent, copyright, trademark or other intellectual property claims against us, our partners or our customers. Successful claims of infringement by a third party could prevent us from distributing certain products or performing certain services or require us to pay substantial damages (including treble damages if we are found to have willfully infringed patents or copyrights), royalties or other fees. Even if third parties may offer a license to their technology, the terms of any offered license may not be acceptable and the failure to obtain a license or the costs associated with any license could cause our business, operating results or financial condition to be materially and adversely affected.

We also rely on several registered and unregistered trademarks to protect our brand. We have registered the Trustwave^®, TrustKeeper^®, SpiderLabs^®, ModSecurity^®, TrustedApp^®, TrustedSentry^®, Smart Tag^®, Trusted Commerce^® Trustwave Security Data Warehouse^tm and WebDefend^® trademarks in the U.S. in certain classes of goods and services applicable to our business. Third parties may use trademarks similar to our trademarks in other fields of use.

Employees

As of December 31, 2010, we had approximately 550 employees, of which approximately 430 were located in the United States, 40 were located in each of the United Kingdom and Canada and the remainder were located in various other locations globally, including Australia, Austria, Brazil, Chile, China, Colombia, France, Germany, India, Israel, Mexico, Russia, South Africa, Sweden and Ukraine. We consider our relationship with our employees to be good. None of our employees is represented by a labor union or covered by a collective bargaining agreement.

Facilities

Our worldwide corporate headquarters and executive offices are located in Chicago, Illinois, where we occupy approximately 48,500 square feet of office space under a lease that expires on October 31, 2019. The lease for approximately 5,200 square feet of this office space expires on July 31, 2011. In addition to serving as our corporate headquarters, our Chicago office also supports our sales and development operations, as well as a 24x7 customer support and operations center. The table below lists information about our other principal operating and support facilities, all of which we occupy under leases.


	Approximate Square
Location	Footage		Lease Expiration Date

Austin, Texas		9,400	July 31, 2011
Cambridge, Canada		9,200	April 30, 2015
Greenwood Village, Colorado		6,850	April 30, 2019
London, England		4,150	March 2021
Pittsburgh, Pennsylvania		7,800	September 30, 2011
Reston, Virginia		8,700	August 31, 2015*
Sao Paulo, Brazil		2,260	September 15, 2013
Waltham, Massachusetts		8,400	March 31, 2016


*		The lease for a portion of the space (approximately 2,900 square feet) expires August 31, 2011 and the lease for the remaining space (approximately 5,800 square feet) expires in September 2015.

Our leases have been pledged as collateral under our loan agreement. See “Description of Certain Indebtedness.” We believe that our existing facilities are adequate for our current needs and that suitable additional or alternative space will be available on commercially reasonable terms if and when it becomes needed.

Legal Proceedings

We are occasionally involved in claims and litigation matters in the ordinary course of business. These claims may include assertions that our products infringe existing patents or other intellectual property rights of third parties. We intend to defend vigorously any such litigation that may arise under all defenses that would be available to us. At this time, there are no proceedings of which management is aware that will have a material adverse effect on the consolidated financial position or results of operations.

On September 7, 2010, WordCheck Tech, LLC, or “WordCheck,” filed a complaint against us and more than 60 other entities in the United States District Court for the Eastern District of Texas alleging infringement of its word checking technology. The complaint seeks a judgment in favor of WordCheck that the defendants have infringed WordCheck’s patent. We filed an answer and counterclaim on November 18, 2010. This litigation matter is still in the early stages, and we intend to vigorously defend ourselves in such litigation.

MANAGEMENT

Below is a list of the names and ages, as of March 31, 2011, of our executive officers, certain key employees and directors and a brief summary of their business experience.


Name	Age		Position

Robert J. McCullen		47	Chairman of the Board of Directors, Chief Executive Officer and President
Andrew Bokor		42	Executive Director, EMEA & APAC and Director
Justin C. Choi		45	Executive Vice President, General Counsel and Secretary
Mark Iserloth.		47	Chief Financial Officer
Douglas Klotnia		42	Executive Vice President, Payment Services and Channel Sales
James Kunkel		45	Executive Vice President, Corporate Development and Emerging Technology
David Parkinson		55	Executive Vice President, Field Operations, Americas
J. Lawrence Podmolik		47	Chief Technology Officer
Kevin Bradford		55	Director
Richard Garman		54	Director
Stuart C. Harvey Jr.		49	Director
Richard Kiphart		69	Director
Timothy Nicholson		63	Director
Joseph Patanella		49	Director
Howard Smith		41	Director

Executive Officers

Robert J. McCullen has served as our Chief Executive Officer since March 2005 and as our Chairman of the Board, Chief Executive Officer and President since May 2007. Mr. McCullen was a co-founder and one of the two Managing Partners of Ambiron, which merged with Trustwave in March 2005. Prior to co-founding Ambiron in 2002, Mr. McCullen was a Senior Director at VeriSign, Inc., a provider of global digital trust services, where he was responsible for product management, product marketing and strategy for the division. Immediately prior to VeriSign, Mr. McCullen was a founding Partner of Exault, a data security services firm, managing the company’s marketing, strategy and Western region operations before its subsequent acquisition by VeriSign in August 2001.

Mr. McCullen brings significant senior leadership, operational and technical experience to our board of directors. He has extensive knowledge of the data security compliance industry, including its historical development, and important relationships with our partner network members and customers. Mr. McCullen has been an important contributor to the expansion of our business through both organic growth and acquisitions, and as CEO, Mr. McCullen has direct responsibility for our strategy and operations.

Andrew Bokor has served as our Executive Director, EMEA & APAC since January 2010 and a director since May 2005. Mr. Bokor previously served as our Chief Operating Officer since May 2005. Mr. Bokor was a co-founder and one of the Managing Partners of Ambiron. Prior to co-founding Ambiron, Mr. Bokor was the Director of Consulting for North America for VeriSign, Inc., a provider of Internet infrastructure services, since August 2001.

Mr. Bokor has more than 15 years of technical and management experience in the data security compliance industry, including his role in co-founding Ambiron. In addition, Mr. Bokor has been an important contributor to the expansion of our business through both organic growth and acquisitions.

Justin C. Choi has served as our Executive Vice President, General Counsel and Secretary since January 2011. Prior to joining Trustwave, Mr. Choi was a private legal consultant from January 2008 to December 2010, and previously served as Senior Vice President, General Counsel and Secretary of Andrew Corporation, a supplier of communications systems and services, from March 2006 to December 2007, and Vice President, Law, Corporate and Securities of Avaya, a business communications company, from September 2000 to February 2006.

Mark Iserloth has served as our Chief Financial Officer since April 2008. Previously, Mr. Iserloth served as the Chief Financial Officer of Initiate Systems, a data management software company, since October 2000. Prior to joining Initiate Systems, Mr. Iserloth served in a number of executive finance positions with GD Searle, a pharmaceutical company, and its parent, the Monsanto Company, including as head of Financial Planning and Analysis from March 1998 through September 1999 and acting Chief Financial Officer of GD Searle from March 2000 through October 2000.

Key Employees

Douglas Klotnia has served as our Executive Vice President, Payment Services and Channel Sales since January 2009. Previously, Mr. Klotnia led our Global Sales since January 2004. Prior to joining Trustwave, Mr. Klotnia served as Director Strategic Alliances for Internet Security Systems, a data security company, from January 2001 to November 2003.

James Kunkel has served as our Executive Vice President, Corporate Development and Emerging Technology since June 2004. Prior to joining Trustwave, Mr. Kunkel served in strategic management roles at several payment card processing companies including Electronic Payment Services, Inc. (now part of First Data Corporation) and most recently at VITAL Processing Services (now part of TSYS Merchant Services), where he served as Vice President of Business Development from August 2001 to June 2004.

David Parkinson joined Trustwave in August 2009 and currently serves as our Executive Vice President, Field Operations, America. Prior to joining Trustwave, Mr. Parkinson served as the President, Chief Executive Officer and Director of Vericept Corporation, a provider of compliance and data loss prevention solutions, from September 2005 to August 2009. Between January 2001 and August 2005, Mr. Parkinson was an Executive in Residence with Sigma Venture Partners, holding management positions in their portfolio companies.

J. Lawrence Podmolik has served as our Chief Technology Officer since June 2007. Prior to joining Trustwave, Mr. Podmolik served as the President and Chief Technology Officer of Redpoint Technologies, a technology consulting company, since December 1999 and the Chief Technology Officer of nVisia, an IT consulting firm, from September 1995 to November 1999. Previously, Mr. Podmolik was with Anderson Consulting (now Accenture), where he led the firm’s advanced architecture group.

Directors

We believe our board of directors should be comprised of individuals with sophistication and experience in many substantive areas that impact our business. We believe experience, qualifications or skills in the following areas are most important: software development; sales and marketing; accounting, finance and capital structure; strategic planning and leadership of complex organizations; legal, regulatory and government affairs; people management; and board practices of other entities. We believe that all of our current board members possess the professional and personal qualifications necessary for board service and have highlighted particularly noteworthy attributes for each board member in the individual biographies below, or above in the case of Messrs. McCullen and Bokor.

Prior to the completion of this offering, we expect that certain of the directors named below will resign from our board and new directors will be appointed to replace such directors. We intend to add at least one director who will qualify as an “audit committee financial expert” as such term is defined in Item 401(h) of Regulation S-K. The timing of such changes to our board of directors are still being finalized but in any event will be made in order to comply with applicable rules and regulations of the stock exchange on which are our common stock will be listed upon completion of this offering.

Kevin Bradford has been a director of the Company since April 2004. Mr. Bradford served as our Chief Executive Officer from April 2004 to March 2005 and as Chairman of our board of directors from April 2004 to May 2007. Mr. Bradford has served as a Senior Advisor to FTV Capital since April 2005. Mr. Bradford has served as the Managing Partner for NWM Restaurant Services, LLC since February 2007. Prior to Trustwave, during his 30 year career in business services and financial services, Bradford held positions at companies such as VITAL Processing Services (now part of TSYS Merchant Solutions), Electronic Payment Services, Inc. (now part of First Data Corporation), BISYS Group, Inc. (now part of Citigroup), First Financial Management Corporation (now part of First Data Corporation), First Data Management Corporation and Union Bank.

As the former chief executive officer of Trustwave and senior executive with numerous other companies, Mr. Bradford brings to our board significant experience in the data security compliance industry, extensive knowledge of our company and leadership skills gained through his business and executive experience. In addition, Mr. Bradford brings to our board a strong finance and business operations background.

Richard Garman has been a director of the Company since April 2004. Mr. Garman joined FTV Capital, a private equity firm, in 1999 and has served as its Managing Partner since September 2004. Prior to joining FTV Capital, Mr. Garman served as President and Chief Executive Officer of Electronic Payment Systems beginning in 1995. Previously, Mr. Garman was a partner with Montgomery Securities where he had corporate finance responsibility for the computer services sector.

Mr. Garman brings to our board extensive experience in finance, mergers and acquisitions and corporate strategy development, and deep knowledge of the financial technology and services industry. In addition, having held senior management positions with several companies, Mr. Garman brings to the board practical management and operations experience.

Stuart C. Harvey Jr. has been a director of the Company since September 2008. Mr. Harvey is President and Chief Executive Officer of Ceridian Corporation, which provides human resources, payroll, benefits and payment solutions to businesses, since August 2010. Prior to joining Ceridian, Mr. Harvey served as the President and Chief Executive Officer of Elavon Global Acquiring Solutions, a wholly owned subsidiary of US Bancorp, since April 2008. Elavon is a global provider of integrated payment processing services. Mr. Harvey also served as President of Nova Information Systems, Inc. (which later became Elavon Global Acquiring Solutions) from July 2005 to April 2008 and as Executive Vice President for International Business Development from April 2003 to July 2005. Mr. Harvey also served on the board of directors of Elavon.

Having served as the chief executive officer of two companies, Mr. Harvey brings to our board senior leadership experience and significant expertise in corporate operations and finances. Mr. Harvey also has experience leading the international expansion of a multinational company, including business development and mergers and acquisitions.

Richard Kiphart has been a director of the Company since March 2005. Mr. Kiphart has been the head of the Private Client Advisors group of William Blair & Company, L.L.C., an investment banking firm, since March 2009. He joined William Blair & Company, L.L.C. in 1965, became a Partner of the firm in 1973 and was in the Corporate Finance Department from 1980 to March 2009. Mr. Kiphart currently serves as Chairman of the board of directors of Lime Energy, a public company, and Ranir LLC, a private company, and previously served on the boards of First Data Corp. and Concord EFS, Inc. and as Chairman of the board of directors of Nature Vision, Inc. (now Swordfish Financial, Inc.). In addition, Mr. Kiphart currently serves as the President and Chief Executive Officer of Lyric Opera of Chicago.

Mr. Kiphart brings to the board vast experience in investment banking, finance and management of complex organizations as well as experience as a director of payment services companies. Mr. Kiphart also has extensive experience serving on the boards of numerous public and private companies and charitable organizations.

Timothy Nicholson has been a director of the Company since August 2005. Mr. Nicholson has served as the Chief Executive Officer of Lyric Healthcare, LLC, a provider of long term nursing care, special hospital and assisted living care, which he founded, since April 1998.

100

Mr. Nicholson brings to the board senior management and human resources experience, specifically related to healthcare and start-up businesses, and particular knowledge of strategic planning.

Joseph Patanella has been a director of the Company since November 1995. Mr. Patanella founded Trustwave in 1995 and served as our President and Chief Executive Officer until April 2004. He became the President of Trustwave in March 2005 when we merged with Ambiron. Prior to founding Trustwave, Mr. Patanella spent over 18 years with the National Security Agency and during his last government assignments served as the National Security Agency’s Technology Liaison to the U.S. Congress and as its representative to the Senate Intelligence Committee’s Technical Advisory Group.

Mr. Patanella brings to the board a keen understanding of information assurance, data security and regulatory compliance, as well as significant leadership and operational experience as a senior executive. Mr. Patanella has also been a key contributor to the development and expansion of our business.

Howard Smith has been a director of the Company since December 2006. Since 2006, Mr. Smith has served as a Managing Director coordinating investment and research in the IT sector at First Analysis Corporation, a private equity and venture capital firm. Mr. Smith joined First Analysis in January 1994. Prior to joining First Analysis Corporation, Mr. Smith was a senior tax consultant with Arthur Andersen & Co. since September 1991.

Mr. Smith brings to the board deep knowledge of our industry and experience with financing. In addition, Mr. Smith has provided strategic advice to numerous technology companies in capital raising and buy- and sell- side merger and acquisition transactions.

Family Relationships

There are no family relationships between any of our executive officers or directors.

Corporate Governance

Board Composition

Substantially all of our directors have been nominated and elected to our board of directors pursuant to board rights granted to certain of our stockholders in the Stockholders Agreement. For additional information, see “Certain Relationships and Related Party Transactions-Stockholders Agreement.” The Stockholders Agreement will terminate in accordance with its terms upon the completion of this offering.

Our amended and restated certificate of incorporation that will be in effect upon completion of this offering will eliminate our existing classes of preferred stock and common stock, and as a result, subject to any future issuances of preferred stock, holders of our common stock will be entitled to one vote for each share of common stock held by them in the election of our directors. Our amended and restated certificate of incorporation will provide that our board of directors shall consist of such number of directors as determined from time to time by resolution adopted by a majority of the total number of directors then in office. Any additional directorships resulting from an increase in the number of directors may only be filled by the directors then in office. The term of office for each director will be until the earlier of his or her death, resignation or removal. Stockholders will elect directors each year at our annual meeting. Upon completion of this offering, our board of directors will consist of members.

Our amended and restated certificate of incorporation will provide that our board of directors will be divided into three classes, with each director serving a three-year term, and one class of directors being elected at each year’s annual meeting of stockholders. Any change in the number of directorships resulting from an increase or decrease in the number of directors will be distributed among the three classes so that, as nearly as possible, each class will consist of one-third of the total number of directors. Prior to the completion of this offering, we will determine the composition of these three classes of directors.

We believe that all of our existing directors, other than Messrs. McCullen and Bokor, will be “independent directors” as defined under the rules of our stock exchange upon completion of this offering. In addition, we believe that Messrs. will be “independent directors” as defined under the rules of the SEC and our stock exchange for purposes of serving on our audit committee.

101

Board Committees

We currently have an Audit Committee and a Compensation Committee. Prior to the completion of this offering, our board of directors will establish a new Audit Committee and a new Compensation Committee which will replace our current committees, and we will establish a new Nominating and Corporate Governance Committee. Each of the committees will report to the board of directors as they deem appropriate and as the board may request. The expected composition, duties and responsibilities of these committees are set forth below. In the future, our board may establish other committees, as it deems appropriate, to assist it with its responsibilities.

The SEC rules and the rules of our stock exchange on which our common stock will be listed upon completion of this offering require us to have one independent member of each of the committees set forth below upon the listing of our common stock on such stock exchange and a majority of independent directors within 90 days of the date of the completion of this offering. All of the members of these committees must be independent within one year of the date of the completion of this offering. We intend to comply with the independence requirements within the specified time periods.

Audit Committee

The Audit Committee will be responsible for, among other matters: (1) appointing, retaining, terminating, and evaluating our independent registered public accounting firm and approving all services to be performed by them; (2) overseeing our independent registered accounting firm’s qualifications, independence and performance; (3) overseeing the financial reporting process and discussing with management and our independent registered public accounting firm the interim and annual financial statements that we file with the SEC; (4) reviewing and monitoring our accounting principles, accounting policies, financial and accounting controls and compliance with legal and regulatory requirements; (5) establishing procedures for the confidential anonymous submission of concerns regarding questionable accounting, internal controls or auditing matters; and (6) reviewing and approving related person transactions.

Upon completion of this offering, our Audit Committee will consist of Messrs. , and and will serve as the chairman of such committee. will qualify as an independent director according to the rules and regulations of the SEC and and we believe will qualify as our “audit committee financial expert,” as such term is defined in Item 401(h) of Regulation S-K. We expect to add another independent director to our Audit Committee within 90 days of the effectiveness of the registration statement of which this prospectus is a part and a third independent director to our Audit Committee within one year after the effective date of the registration statement. Our board of directors will adopt a new written charter for the Audit Committee, which will be available on our corporate website at www.trustwave.com upon the completion of this offering. The information on our website is not part of this prospectus.

Compensation Committee

The Compensation Committee will be responsible for, among other matters: (1) reviewing key employee compensation goals, policies, plans and programs; (2) reviewing and approving the compensation of our directors, chief executive officer and other executive officers; (3) reviewing and approving employment agreements and other similar arrangements between us and our executive officers; and (4) administering our stock plans and other incentive compensation plans.

Upon completion of this offering, our Compensation Committee will consist of Messrs. , and and will serve as the chairman of such committee. will qualify as an independent director according to the rules and regulations of the SEC and our stock exchange. Our board of directors will adopt a new written charter for the Compensation Committee, which will be available on our corporate website at www.trustwave.com upon the completion of this offering. The information on our website is not part of this prospectus.

102

Nominating and Corporate Governance Committee

The Nominating and Corporate Governance Committee will be responsible for, among other matters: (1) identifying individuals qualified to become members of our board of directors, consistent with criteria approved by our board of directors; (2) overseeing the organization of our board of directors to discharge the board’s duties and responsibilities properly and efficiently; (3) identifying best practices and recommending corporate governance principles; and (4) developing and recommending to our board of directors a set of corporate governance guidelines and principles applicable to us and (5) reviewing and monitoring compliance with our code of ethics and our insider trading policy.

Upon completion of this offering, our Nominating and Corporate Governance Committee will consist of Messrs. , and and will serve as the chairman of such committee. At least one of those directors will qualify as an independent director according to the rules and regulations of the SEC and our stock exchange. Our board of directors will adopt a written charter for the Nominating and Corporate Governance Committee, which will be available on our corporate website at www.trustwave.com upon the completion of this offering. The information on our website is not part of this prospectus.

Risk Oversight

The board of directors oversees the risk management activities designed and implemented by our management. The board of directors executes its oversight responsibility for risk management both directly and through its committees. The full board of directors considers specific risk topics, including risks associated with our strategic plan, business operations and capital structure. In addition, the board of directors receives detailed regular reports from members of our senior management and other personnel that include assessments and potential mitigation of the risks and exposures involved with their respective areas of responsibility.

The board has delegated to the Audit Committee oversight of our risk management process. Our other board committees also consider and address risk as they perform their respective committee responsibilities. All committees report to the full board as appropriate, including when a matter rises to the level of a material or enterprise level risk.

Compensation Committee Interlocks and Insider Participation

None of our executive officers currently serves, or in the past year has served, as a member of the board of directors or compensation committee of any entity that has one or more executive officers serving on our board of directors or compensation committee.

Code of Ethics

We will adopt a code of business conduct and ethics applicable to our principal executive, financial and accounting officers and all persons performing similar functions. A copy of that code will be available on our corporate website at www.trustwave.com upon completion of this offering. We expect that any amendments to the code, or any waivers of its requirements, will be disclosed on our website. The information on our website is not part of this prospectus.

103

EXECUTIVE COMPENSATION

Compensation Discussion and Analysis

This Compensation Discussion and Analysis describes the compensation arrangements we have with our executive officers listed in the Summary Compensation Table set forth below, which we refer to as our “named executive officers.” This section discusses the objectives and philosophy underlying our compensation policies for our named executive officers, our compensation decisions with respect to our named executive officers during 2010 and the factors relevant to an analysis of these decisions.

This Compensation Discussion and Analysis contains forward-looking statements that are based on our current plans and expectations regarding future compensation plans and arrangements. The actual compensation plans and arrangements that we adopt may differ materially from the currently anticipated plans and arrangements as summarized in this discussion.

Executive Compensation Objectives and Philosophy

The key objectives of our executive compensation programs are to (1) fairly compensate our executive officers, (2) attract, motivate and retain highly qualified executive officers who contribute to the long-term success of our company; (3) achieve accountability for performance; (4) link future performance rewards to clearly defined corporate goals; and (5) align the interests of our executive officers and our stockholders through short- and long-term incentive compensation programs.

We seek to apply a consistent phi

Proposed Maximum

Amount of

Title of Each Class of

Aggregate

Registration

Securities to be Registered

Offering Price⁽¹⁾⁽²⁾

Fee⁽³⁾

Common Stock, $0.01 par value per share

$100,000,000

Trustwave Holdings, Inc. S-1