UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

WASHINGTON, D.C. 20549

FORM 10-Q

(Mark One)
ý		QUARTERLY REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

		For the quarterly period ended March 31, 2006

		OR

o		TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

		For the transition period from to

Commission File Number 000-23655

INTERNET SECURITY SYSTEMS, INC.

(Exact name of registrant as specified in its charter)

DELAWARE		58-2362189
(State or jurisdiction of incorporation or organization)		(I.R.S. Employer Identification No.)

6303 BARFIELD ROAD, ATLANTA, GEORGIA 30328

(Address of principal executive offices)

Registrant’s telephone number, including area code (404) 236-2600

Indicate by check mark whether the Registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the Registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ý No o

Indicate by a check mark whether the registrant is a large accelerated filer, an accelerated filer, or a non-accelerated filer. See definition of “accelerated filer and large accelerated filer” in Rule 12b-2 of the Exchange Act.

Large accelerated filer ý

Accelerated filer o

Non-accelerated filer o

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). Yes o No ý

Indicate the number of shares outstanding of each of the registrant’s classes of common stock, as of the latest practicable date.

Title of each class of common stock		Number of Shares Outstanding as of April 30, 2006
Common stock, $0.001 par value		44,726,017

		PAGE NUMBER

	PART I — FINANCIAL INFORMATION

Item 1	Consolidated Financial Statements (Unaudited:)

	Consolidated Balance Sheets at March 31, 2006 (unaudited) and December 31, 2005	3

	Consolidated Statements of Operations for the three months ended March 31, 2006 and March 31, 2005 (unaudited)	4

	Consolidated Statements of Cash Flows for the three months ended March 31, 2006 and March 31, 2005 (unaudited)	5

	Notes to Consolidated Financial Statements	6
Item 2	Management’s Discussion and Analysis of Financial Condition and Results of Operations	15

Item 3	Quantitative and Qualitative Disclosures about Market Risk	25

Item 4	Controls and Procedures	26

	PART II - OTHER INFORMATION

Item 1	Legal Proceedings	26

Item 1A	Risk Factors	27

Item 2	Unregistered Sale of Equity Securities and Use of Proceeds	34

Item 6	Exhibits	34

EX-31.1	SECTION 302 CERTIFICATION OF THE CEO

EX-31.2	SECTION 302 CERTIFICATION OF THE CFO

EX-32.1	SECTION 906 CERTIFICATION OF THE CEO

EX-32.2	SECTION 906 CERTIFICATION OF THE CFO

PART I. FINANCIAL INFORMATION

Item 1. Consolidated Financial Statements

INTERNET SECURITY SYSTEMS, INC.

CONSOLIDATED BALANCE SHEETS

(amounts in thousands, except share and per share amounts)

	March 31,			December 31,
	2006			2005
	(unaudited)
ASSETS
Current assets:
Cash and cash equivalents	$	226,801		$	238,893
Marketable securities	4,900			—
Accounts receivable, less allowance for doubtful accounts of $3,828 and $3,574 in 2006 and 2005, respectively	83,966			87,769
Inventory	6,428			3,076
Prepaid expenses and other current assets	11,311			10,305

Total current assets	333,406			340,043

Property and equipment:
Computer equipment and software	65,380			59,492
Office furniture and equipment	18,122			17,797
Leasehold improvements	21,026			20,948

	104,528			98,237
Less accumulated depreciation	71,203			67,754

	33,325			30,483

Restricted cash equivalents and marketable securities	8,600			8,600
Goodwill, less accumulated amortization of $27,381	220,613			220,224
Other intangible assets, less accumulated amortization of $29,372 and $27,490 in 2006 and 2005, respectively	9,329			10,913
Other assets	8,249			8,381

Total assets	$	613,522		$	618,644

LIABILITIES AND STOCKHOLDERS’ EQUITY
Current liabilities:
Accounts payable	$	9,369		$	11,261
Accrued expenses	26,188			35,019
Deferred revenues	75,938			74,577

Total current liabilities	111,495			120,857
Long-term deferred revenues	8,596			7,067
Other non-current liabilities	146			202
Commitments and contingencies
Minority interest	4,742			4,378

Stockholders’ equity:
Preferred stock, $.001 par value, 20,000,000 shares authorized, none issued or outstanding	—			—
Common stock, $.001 par value, 120,000,000 shares authorized, 52,438,000 and 52,204,000 issued in 2006 and 2005, respectively	52			52
Additional paid-in capital	530,088			524,105
Deferred compensation	—			(1,830		)
Accumulated other comprehensive income	2,246			1,058
Retained earnings	94,139			87,089
Treasury stock, at cost (7,717,000 and 7,129,000 shares in 2006 and 2005, respectively)	(137,982		)	(124,334		)

Total stockholders’ equity	488,543			486,140

Total liabilities and stockholders’ equity	$	613,522		$	618,644

See accompanying notes

INTERNET SECURITY SYSTEMS, INC.

CONSOLIDATED STATEMENTS OF OPERATIONS

(amounts in thousands, except per share amounts)

(unaudited)

	Three months ended March 31,
	2006			2005
Revenues:
Product licenses and sales	$	32,689		$	32,270
Subscriptions	42,698			38,838
Professional services	5,374			5,684

	80,761			76,792
Costs and expenses:
Cost of revenues:
Product licenses and sales	6,808			6,385
Amortization of acquired technology	1,720			1,786
Subscriptions and professional services	13,549			13,158

Total cost of revenues	22,077			21,329

Research and development	12,694			10,291
Sales and marketing	28,094			26,109
General and administrative	8,309			7,344
Amortization of other intangibles	40			44

	71,214			65,117

Operating income	9,547			11,675
Interest income	1,968			1,059
Other income (expense), net	(364		)	(539		)
Gain on issuance of subsidiary stock	44			63

Income before income taxes	11,195			12,258
Provision for income taxes	4,145			4,413

Net income	$	7,050		$	7,845

Basic net income per share of Common Stock	$	0.16		$	0.17

Diluted net income per share of Common Stock	$	0.15		$	0.16

Weighted average shares and equivalent shares:
Basic	44,713			45,495

Diluted	45,673			47,609

See accompanying notes

INTERNET SECURITY SYSTEMS, INC.

CONSOLIDATED STATEMENTS OF CASH FLOWS

(amounts in thousands)

(unaudited)

	Three months ended March 31,
	2006			2005
Operating activities
Net income	$	7,050		$	7,845
Adjustments to reconcile net income to net cash provided by operating activities:
Depreciation	3,377			2,629
Amortization of intangibles	1,760			1,830
Stock-based compensation expense	3,335			573
Income tax benefit from exercise of stock options	431			286
Accretion of discount on marketable securities	19			(231		)
Minority interest	332			10
Gain on issuance of subsidiary stock	(44		)	(63		)
Changes in assets and liabilities, excluding the effects of acquisitions:
Accounts receivable	4,527			2,203
Inventory	(3,305		)	(83		)
Prepaid expenses and other assets	(752		)	78
Accounts payable and accrued expenses	(11,661		)	(1,391		)
Deferred revenues	2,361			(197		)

Net cash provided by operating activities	7,430			13,489

Investing activities
Acquisitions, net of cash received	—			(764		)
Purchases of marketable securities	(5,900		)	(35,057		)
Net proceeds from maturity of marketable securities	1,665			36,352
Net proceeds from sales of marketable securities	—			29,750
Additions to cash equivalents in restricted cashand marketable securities	(684		)	—
Purchases of property, equipment, and software	(6,059		)	(1,224		)
Net proceeds from issuance of subsidiary stock	76			117

Net cash provided by (used in) investing activities	(10,902		)	29,174

Financing activities
Proceeds from exercise of stock options	3,739			1,847
Proceeds from issuance of common stock	—			732
Purchases of treasury stock	(13,648		)	(9,193		)
Excess tax benefits from stock option exercises	308			—

Net cash (used in) financing activities	(9,601		)	(6,614		)

Foreign currency impact on cash	981			(1,968		)

Net increase (decrease) in cash and cash equivalents	(12,092		)	34,081
Cash and cash equivalents at beginning of period	238,893			140,148

Cash and cash equivalents at end of period	$	226,801		$	174,229

Supplemental cash flow disclosure
Income taxes paid	$	12,080		$	1,999

See accompanying notes

INTERNET SECURITY SYSTEMS, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS

(unaudited)

Note 1. Significant Accounting Policies

Basis of Presentation

The consolidated financial statements of Internet Security Systems, Inc. (“ISS” or the “Company”) as of March 31, 2006 and for the three months ended March 31, 2006 and 2005 are unaudited and, in the opinion of management, contain all adjustments, consisting of normal recurring items, necessary for the fair presentation of the financial position and results of operations of the Company for the interim periods. The consolidated financial statements include the accounts of the Company and its majority-owned subsidiaries. The consolidated balance sheet at December 31, 2005 has been derived from the audited financial statements at that date but does not include all of the footnotes required by U.S. generally accepted accounting principles for complete financial statements.

These consolidated financial statements should be read in conjunction with the Consolidated Financial Statements and Notes thereto included in the Company’s Annual Report on Form 10-K for the year ended December 31, 2005. The results of operations for the three months ended March 31, 2006 are not necessarily indicative of the results to be expected for the entire year. All significant intercompany accounts and transactions have been eliminated.

The preparation of financial statements and related disclosures in conformity with U.S. generally accepted accounting principles requires management to make estimates and assumptions that affect the amounts reported in the financial statements and accompanying notes. Actual results will differ from those estimates, and such differences may be material to the consolidated financial statements.

Goodwill and Intangibles

Goodwill and intangible assets are comprised of the following, as of the dates indicated (in thousands):

	March 31, 2006					December 31, 2005
	Gross Carrying Amount		Accumulated Amortization			Gross Carrying Amount		Accumulated Amortization
Goodwill	$	247,994	$	(27,381	)	$	247,605	$	(27,381	)
Amortized intangible assets:
Core technology	$	3,853	$	(3,604	)	$	3,853	$	(3,483	)
Developed technology	32,825		(23,873		)	32,537		(22,158		)
Customer relationships	2,023		(1,895		)	2,013		(1,849		)
Total	$	38,701	$	(29,372	)	$	38,403	$	(27,490	)

The change in the carrying amounts of goodwill and developed technology from December 31, 2005 to March 31, 2006 was the result of currency translation adjustments for the acquisition of Cobion, a German content filtering and anti-spam provider.

We amortize intangible assets over their estimated useful lives of eight years for core technology, five years for developed technology and three years for customer relationships. Amortization related to core technology and developed technology is classified as a component of cost of revenues. Amortization expense of intangible assets is as follows (in thousands):

	Three months ended March 31,
	2006		2005
Core technology	$	121	$	120
Developed technology	1,599		1,666
Customer relationships	40		44

Total	$	1,760	$	1,830

The estimated future amortization expense of intangible assets as of March 31, 2006 is as follows (in thousands):

	Amount
Year ending December 31,
2006 (nine months)	$	3,168
2007	3,010
2008	2,991
2009	160

Total	$	9,329

Accounting for stock-based compensation

On January 1, 2006, we adopted Statement of Financial Accounting Standards No. 123 (revised 2004), Share-Based Payment, (“SFAS No. 123(R)”), which requires the measurement of compensation expense for all share-based payment awards made to employees and directors based on estimated fair values on date of grant and recognition of compensation over the service period for awards expected to vest. SFAS No. 123(R) supersedes our previous accounting under Accounting Principles Board Opinion No. 25, Accounting for Stock Issued to Employees (“APB No. 25”) and revises guidance in SFAS No. 123, Accounting for Stock-Based Compensation, (“SFAS No. 123”), for periods beginning in fiscal 2006. On March 29, 2005, the SEC published Staff Accounting Bulletin (“SAB”) No. 107, which provides the Staff’s views on a variety of matters relating to stock-based payments. We have applied the provisions of SAB 107 in our adoption of SFAS No. 123(R).

We adopted SFAS No. 123(R) using the modified prospective method, and accordingly, prior periods results have not been restated, and do not include, the impact of SFAS No. 123(R). The fair value of restricted stock is determined based on the number of shares granted and the quoted price of our common stock; the fair value of stock options is determined using the Black-Scholes valuation model, which is consistent with our valuation techniques previously utilized for options in footnote disclosures required under SFAS No. 123. Such value is recognized as expense over the service period, net of estimated forfeitures, using the straight-line single option method under SFAS No. 123(R). SFAS No. 123(R) requires forfeitures to be estimated at the time of grant and revised, if necessary, in subsequent periods if

actual forfeitures differ from those estimates. In our pro forma information required under SFAS No. 123 for the periods prior to fiscal 2006, we accounted for forfeitures as they occurred. Upon adoption of SFAS No. 123(R), we reclassified our current year unamortized deferred compensation related to the issuance of unvested restricted stock awards to additional paid-in capital in our balance sheet.

Stock-based compensation expense for the three months ended March 31, 2006 was $3,335,000, which consisted of expense related to employee stock options of $2,930,000 and expense related to restricted stock of $405,000. Stock-based compensation expense for the three months ended March 31, 2005 was $573,000, all related to restricted stock awards. Tax benefits recognized in the income statement related to stock-based compensation arrangements was $1,234,000 and $212,000 for the three months ended March 31, 2006 and 2005, respectively.

Tax benefits resulting from stock-based compensation deductions in excess of amounts reported for financial reporting purposes were $308,000 for the three months ending March 31, 2006. Prior to the adoption of SFAS No. 123(R), cash retained as a result of tax deductions relating to stock-based compensation was presented in operating cash flows, along with other tax cash flows, in accordance with the provisions of Emerging Issues Task Force (“EITF”) Issue No. 00-15, Classification in the Statement of Cash Flows of the Income Tax Benefit Received by a Company upon Exercise of a Nonqualified Employee Stock Option. SFAS No. 123(R) supersedes EITF No. 00-15, amends SFAS No. 95, Statement of Cash Flows, and requires tax benefits relating to excess stock-based compensation deductions to be prospectively presented in the statement of cash flows as financing cash inflows.

On November 10, 2005, the Financial Accounting Standards Board (“FASB”) issued FASB Staff Position No. FAS 123(R)-3 (“FSP 123(R)-3”), Transition Election Related to Accounting for Tax Effects of Share-Based Payment Awards. This Staff Position provides a simplified method to calculate the beginning pool of excess tax benefits and provides a method of determining the subsequent impact on the pool and statement of cash flows of awards that are outstanding and fully or partially vested upon the adoption of SFAS No. 123(R). FSP 123(R)-3 generally allows companies a year from the initial adoption of SFAS No. 123(R) to elect the methodology to compute the initial pool of excess tax benefits. We are currently evaluating the transition methods permitted under FSP 123(R)-3.

The application of SFAS No. 123(R) has the following effect on the first quarter of 2006 reported amounts relative to amounts that would have been reported using the intrinsic value method under previous accounting (in thousands, except per share amounts)

	Using Previous Accounting			SFAS 123(R) Impact			As Reported
Total revenues	$	80,761		$	—		$	80,761
Cost of revenues:
Product and licenses sales	6,794			14			6,808
Amortization of acquired technology	1,720			—			1,720
Subscriptions and professional services	13,193			356			13,549
Total costs of revenues	21,707			370			22,077
Research and development	11,891			803			12,694
Sales and marketing	27,108			986			28,094
General and administrative	7,538			771			8,309
Amortization of other intangibles	40			—			40
	68,284			2,930			71,214
Operating income	12,477			(2,930		)	9,547
Other, net	1,648			—			1,648
Income before income taxes	14,125			(2,930		)	11,195
Provision for income taxes	5,229			(1,084		)	4,145
Net income	$	8,896		$	(1,846	)	$	7,050

Basic net income per share of Common Stock	$	0.20		$	(0.04	)	$	0.16

Dilutive net income per share of Common Stock	$	0.19		$	(0.04	)	$	0.15

Cash flow from operating activities	$	7,738		$	(308	)	$	7,430
Cash flow from financing activities	$	(9,909	)	$	308		$	(9,601	)

Gain on issuance of subsidiary shares

The gain on issuance of subsidiary shares results from Internet Security Systems KK, our Asia/Pacific subsidiary (“ISS KK”), issuing shares related to the exercise of ISS KK stock options. In 2006, ISS KK has issued 169 shares at an average exercise price of approximately $449 per share. Our ownership percentage of the subsidiary remained at 87% at March 31, 2006. Deferred income taxes have been provided in the period in which the gain is recognized.

Note 2. Income Taxes

The Company recorded tax provisions of $4.1 million and $4.4 million for the three-month periods ended March 31, 2006 and 2005, respectively. The effective tax rate was approximately 37% for the three months ended March 31, 2006 and 36% for the three months ended March 31, 2005. The effective rates differ from the statutory rates due to the impact of acquisition-related intangibles and certain operating expenses that are not deductible for income tax purposes as well as federal and state tax credits.

Note 3. Business Acquisition

In August 2002, Internet Security Systems KK (“ISS KK”), our Asia-Pacific subsidiary, acquired a distributor in Singapore, TriSecurity Holdings Pte Ltd. (“TriSecurity”). TriSecurity was the sole distributor for ISS KK in Southeast Asia, including India, and its business was almost exclusively focused on ISS solutions. This acquisition provides our Asia-Pacific subsidiary direct support capabilities for their customers in Southeast Asia and allows ISS KK to expand its capabilities in this growing market. The consideration consisted of 1,000 shares of ISS KK stock and approximately $1.2 million of cash. Goodwill of approximately $4.0 million related to the purchase was recorded. During the first quarter of 2003, ISS KK amended the agreement and agreed to make payment of 490 shares of ISS KK in each of the first quarters of 2004 and 2005, relating to annual contingent consideration payments defined in the 2002 purchase agreement. Due to regulatory issues, the agreement was amended prior to the 2004 payment to make the 2004 and 2005 payments in cash in lieu of shares. Additional consideration of $764,000 and $498,000 was paid in February 2005 and 2004, respectively, based on the fair market value of the 490 shares, and is reflected in goodwill.

Note 4. Comprehensive Income

The components of comprehensive income are as follows (in thousands):

	Three months ended March 31,
	2006		2005
Net income, as reported	$	7,050	$	7,845
Change in cumulative translation adjustment	1,188		(4,159		)

Comprehensive income	$	8,238	$	3,686

Note 5. Income per Share

The following table sets forth the computation of basic and diluted net income per share (amounts in thousands, except per share amounts):

	Three months ended March 31,
	2006		2005
Numerator:
Net income	$	7,050	$	7,845

Denominator:
Denominator for basic net income per share - weighted average shares	44,713		45,495
Effect of dilutive stock options	960		2,114

Denominator for diluted net income per share - weighted average shares and equivalents	45,673		47,609

Basic net income per share	$	0.16	$	0.17

Diluted net income per share	$	0.15	$	0.16

In the three months ended March 31, 2006 and 2005, 4,476,000 and 3,559,000 options, respectively, were not included in the computation of diluted income per share because the options’ exercise price was greater than the average market price of the common shares, and their impact would have been anti-dilutive.

Note 6. Stock option plans

The Internet Security Systems, Inc. 2005 Stock Incentive Plan (“the Plan”) consists of equity programs that provide for the granting of qualified or non-qualified stock options, the issuance of stock and the automatic option grant program. Under the terms of the plan the exercise price of options granted shall not be less than the fair market value on the date of grant, the options have a maximum term of seven years and generally vest over a four-year period. Stock issued under the Plan generally vests over a period of service or attainment of specified performance objectives. The automatic option grant program is available to the non-employee member of the Company’s board of directors. At March 31, 2006 there were 7,146,000 shares reserved for future issuance. An additional 80,000 shares have been reserved for non-statutory options issued in 1997 to non-employee directors.

The fair value of options at date of grant was estimated using the Black-Scholes option pricing model with the following assumptions:

	Three months ended March 31,
	2006			2005
Expected life (years)	4.6			4.6
Risk free interest rate	4.28		%	3.83		%
Expected volatility	38		%	41		%
Expected dividend yield	—			—
Weighted-average fair value per share of options granted	$	8.57		$	8.52

Expected life represents the weighted average period of time that options granted are expected to be outstanding giving consideration to vesting schedules and our historical exercise patterns. Risk free interest rate is based on the U.S. Treasury yield curve in effect at the time of grant for periods corresponding with the expected life of the option. Expected volatilities are based on the implied volatility of public traded options for our common stock.

A summary of ISS’ stock option activity is as follows (number of options in thousands):

	Three months ended March 31, 2006
	Number of Shares		Weighted Average Exercise Price

Outstanding at January 1, 2006	9,327		$	21.93
Granted	95		22.32
Exercised	(234	)	15.98
Canceled:
Forfeited	(91	)	18.04
Expired	(103	)	32.69

Outstanding at March 31, 2006	8,994		$	22.00

Exercisable at March 31, 2006	5,571		$	24.06

The aggregate intrinsic value of options outstanding and exercisable was $51.0 million and $32.7 million as of March 31, 2006 and $26.9 million and $15.7 million as of March 31, 2005, respectively. The total intrinsic value of options exercised during the three months ended March 31, 2006 and 2005 was $1.7 million and $0.9 million, respectively. Unrecognized non-cash stock compensation expense related to unvested options outstanding as of March 31, 2006 was approximately $19.2 million and will be recorded over the remaining vesting period of four years.

The following table summarizes information about stock options outstanding at March 31, 2006 (option amounts in thousands):

	Options Outstanding				Options Fully Vested and Exercisable
	Number of	Weighted			Number
	Options	Average	Weighted		Exercisable	Weighted
	Outstanding at	Remaining	Average		At	Average
	March 31,	Contractual	Exercise		March 31,	Exercise
Range of Exercise Prices	2006	Life	Price		2006	Price

$.08-9.11	232	2.97	$	5.26	232	$	5.26
$10.00-19.98	4,437	6.10	14.62		2,647	14.20
$20.03-29.44	2,614	5.84	22.13		981	21.76
$30.63-39.75	1,063	5.66	33.05		1,063	33.05
$49.81-85.63	648	4.46	59.83		648	59.83

	8,994	5.77	$	22.00	5,571	$	24.06

Directors, officers and certain key employees of ISS were issued 0 and 56,000 restricted shares in the three months ended March 31, 2006 and the year-ended December 31, 2005, respectively. In 2005, 33,000

restricted shares were returned prior to vesting. The shares issued to directors vest quarterly over two years, and the shares issued to officers and certain key employees vest in two installments: 50% vests two years from the grant date, and the remaining 50% vests three years from the grant date.

Restricted Stock Summary	Restricted Stock		Weighted- Average Grant-Date Fair Value
Nonvested restricted stock at January 1, 2006	283,350		$	18.60
Granted	—		—
Vested	(114,375	)	17.73
Forfeited	—		—
Nonvested restricted stock at March 31, 2006	168,975		$	19.18

The total fair value of restricted stock which vested during the three months ended March 31, 2006 and 2005 was $2.5 million and $0, respectively. Unrecognized non-cash stock compensation expense related to unvested restricted stock outstanding as of March 31, 2006 was approximately $1.4 million and will be recorded over the remaining vesting period of approximately 2 years.

Stock-based compensation for 2005 was determined using the intrinsic value method. The following table provides supplemental information for the three months ended March 31, 2005 as if stock-based compensation had been computed under SFAS No. 123 (in thousands, except per share amounts):

	Three months ended March 31, 2005
Net income, as reported	$	7,845
Add: Stock-based compensation included in reported net income, net of income taxes	367
Less: Stock-based compensation expense computed under the fair value method, net of income taxes	(4,138		)

Pro forma net income	$	4,074

Basic net income per share of Common Stock
As reported	$	0.17

Pro forma	$	0.09

Diluted net income per share of Common Stock
As reported	$	0.16

Pro forma	$	0.09

Note 7. Segment and Geographic Information

ISS conducts business in one operating segment: providing information security management solutions. The Company does, however, prepare operating results for internal use on a geographic basis. These geographical based operating costs consist of direct sales expenses, infrastructure to support its employee and customer and partner base, supporting billing and financial systems, and a management team. Corporate expenses that are not charged directly to the other segments include research and development, general and administrative costs that support the global organization, amortization of acquired technology, amortization of licensed development source code, amortization of intangibles and stock based compensation and costs that are one-time in nature, such as acquired in-process research and development.

The accounting policies of the segments are the same as those described in the summary of significant accounting policies. There are no inter-segment sales. Our chief executive officer and chief financial officer evaluate performance based on operating profit or loss from operations, and trade accounts receivable for each segment. Other than trade accounts receivable, assets and liabilities are not discretely allocated or reviewed by segment.

In accordance with SFAS No. 131, “Disclosures about Segments of an Enterprise and Related Information,” the Company has included a summary of the segment financial information reported internally. The geographic segments are the Americas, Europe, Middle East and Africa (“EMEA”), and the Asia/Pacific region.

The following table presents ISS’s revenues, operating expenses and operating income (loss) by reportable geographic segment (in thousands):

	Americas		EMEA		Asia/Pacific		Unallocated			Total
As of or for the three months ended March 31, 2006
Revenues from external customers:
Product licenses and sales	$	20,272	$	6,736	$	5,681	$	—		$	32,689
Subscriptions	27,228		9,445		6,025		—			42,698
Professional services	3,686		416		1,272		—			5,374

Total revenue	51,186		16,597		12,978		—			80,761
Cost of revenues:
Product licenses and sales	3,808		1,442		1,117		441			6,808
Amortization of acquired technology	—		—		—		1,720			1,720
Subscriptions and professional services	9,413		1,067		2,693		376			13,549

Total cost of revenues	13,221		2,509		3,810		2,537			22,077
Operating expenses	18,170		7,389		2,535		21,043			49,137

Total expenses	31,391		9,898		6,345		23,580			71,214

Segment operating income (loss)	$	19,795	$	6,699	$	6,633	$	(23,580	)	$	9,547

Accounts receivable, net	$	51,773	$	18,133	$	14,060	$	—		$	83,966

Property and equipment, net	$	27,530	$	1,741	$	4,054	$	—		$	33,325

As of or for the three months ended March 31, 2005
Revenues from external customers:
Product licenses and sales	$	19,058	$	6,807	$	6,405	$	—		$	32,270
Subscriptions	24,758		9,148		4,932		—			38,838
Professional services	3,563		467		1,654		—			5,684

Total revenue	47,379		16,422		12,991		—			76,792
Cost of revenues:
Product licenses and sales	3,671		1,214		1,125		375			6,385
Amortization of acquired technology	—		—		—		1,786			1,786
Subscriptions and professional services	9,000		1,294		2,831		33			13,158

Total cost of revenues	12,671		2,508		3,956		2,194			21,329
Operating expenses	15,947		7,718		2,443		17,680			43,788

Total expenses	28,618		10,226		6,399		19,874			65,117

Segment operating income (loss)	$	18,761	$	6,196	$	6,592	$	(19,874	)	$	11,675

Accounts receivable, net	$	38,003	$	19,892	$	15,255	$	—		$	73,150

Property and equipment, net	$	26,211	$	1,602	$	5,222	$	—		$	33,035

Note 8. Commitments and Contingencies

Our sales agreements with customers generally contain infringement indemnity provisions. We have not previously incurred costs to settle claims or pay awards under these indemnification obligations. We have only incurred costs to defend ISS to date. As a result, we believe the estimated fair value of these obligations is nominal. Accordingly, we have no liabilities recorded for these agreements as of March 31, 2006. In addition, we warrant that our software products will perform in all material respects in accordance with our standard published specifications in effect at the time of delivery of the licensed products to the customer for ninety days. We also warrant that for one year after shipment, all hardware will be free from defects in materials and workmanship under normal authorized use, consistent with the instructions contained in the product documentation. Additionally, we warrant that our services will be performed consistent with generally accepted industry standards or specific service levels through completion of the agreed upon services. While these generally continue to be the performance warranties, there are variations arising from custom contracts. We have not incurred significant recurring expense under our product or service warranties and hardware warranties are covered by the manufacturer warranties. As a result, we believe the estimated fair value of these agreements is nominal. Accordingly, we have no liabilities recorded for these agreements as of March 31, 2006.

Payments for certain operating leases for our office space are secured by collateralized standby letters of credit totaling $7.3 million at March 31, 2006. These standby letters of credit guarantee payments on certain lease obligations and are renewed annually unless cancelled by either party. The lease obligations have terms that expire at various dates through 2013. The beneficiary of the standby letters of credit can draw on the letters of credit if we default on the related lease obligation. Each standby letter of credit is collateralized by securities. At March 31, 2006, $8.6 million of cash and marketable securities are pledged as collateral and are shown on the balance sheet as restricted cash and marketable securities.

On August 17, 2004, the Company’s Georgia operating subsidiary filed in the United States District Court for the Northern District of Georgia a declaratory judgment action (the “Georgia Action”) against SRI International, Inc. (“SRI”). The action seeks the court’s declaration that our products and services do not infringe any valid claim of five patents held by SRI and seeks declaration that certain claims of those patents are invalid. On August 26, 2004, SRI filed in the United States District Court for Delaware a complaint against the Company and Symantec Corporation (the “Delaware Action”). The complaint in the Delaware Action alleges that our SiteProtector and Proventia products infringe upon claims of two of the five patents at issue in the Georgia Action. The Delaware Action seeks unspecified damages and injunctive relief. On April 25, 2005, SRI filed an amended complaint adding the Company’s Georgia operating subsidiary as a separate defendant to the Delaware Action. The Company and its subsidiary answered SRI’s amended complaint on May 23, 2005, denying that they infringe the two patents asserted by SRI and asserting counterclaims seeking a declaration from the Delaware court that the five SRI patents are not infringed, and are invalid and unenforceable. On June 9, 2005, the Georgia court transferred the Georgia Action to the United States District Court for the District of Delaware. The transferred action was consolidated with the Delaware Action. On June 13, 2005, SRI answered the counterclaims asserted by the Company and its subsidiary, denying that the five patents are not infringed, invalid, and unenforceable. On August 5, 2005, SRI granted to the Company a covenant never to sue the Company, its distributors, customers, licensees or end users, for damages or any other form of legal or equitable relief based on or arising out of the alleged infringement of one of the five patents-in-suit as a result of the manufacture, use, sale, offer for sale, importation, maintenance, support or servicing of any Company product or service

existing on or before the effective date. The parties are currently engaged in discovery on the remaining claims, and trial has been scheduled to begin on or about October 30, 2006. We intend to defend the Delaware Action vigorously and believe we have meritorious defenses and counterclaims

Item 2. Management’s Discussion and Analysis of Financial Condition and Results of Operations

The following Management’s Discussion and Analysis of Financial Condition and Results of Operations should be read in conjunction with the Consolidated Financial Statements and related Notes thereto included elsewhere in this Form 10-Q.

Except for the historical financial information, many of the matters discussed in this Form 10-Q may be considered “forward-looking” statements. Forward-looking statements can be identified by the use of words such as “may,” “should,” “could,” “continue,” “future,” “potential,” “believe,” “project,” “plan,” “intend,” “seek,” “estimate,” “predict”, “expect”, “anticipate” and similar expressions, or the negative of such terms, or other comparable terminology. Forward-looking statements also include the assumptions underlying or relating to any of the foregoing statements. Such forward-looking statements are not guarantees of future performance and involve a number of risks and uncertainties. Our actual results could differ materially from those anticipated in these forward-looking statements as a result of various factors, including those set forth below under the caption “Risk Factors” and those otherwise described from time to time in our Securities and Exchange Commission reports filed after this Form 10-Q . All forward-looking statements included in this Form 10-Q are based on information available to us on the date hereof. We assume no obligation (except where required by law) to update any forward-looking statements for any events or circumstances occurring after the date of this Form 10-Q.

In this Form 10-Q, the words “Internet Security Systems,” “ISS,” “the Company,” “we,” “our,” “ours,” and “us” refer to Internet Security Systems, Inc., and its subsidiaries.

Internet Security Systems and SiteProtector are trademarks and service marks, and the Internet Security Systems logo, X-Force, Proventia and RealSecure are registered trademarks and service marks, of Internet Security Systems, Inc.

Overview

We focus on providing enterprise-wide pre-emptive protection. We provide such protection with our comprehensive line of products and services. These include a product family consisting of network and host intrusion prevention, network anomaly detection, integrated security appliances, desktop protection and vulnerability assessment and protection; ISS’ SiteProtector centralized management system; and ISS’ Managed Security Services and Professional Security Services. The integrated security appliance includes, in addition to intrusion prevention, firewalls, virtual private network features, anti-virus protection, content filtering, e-mail security, and anti-spam technology.

This combination of products and services forms our Proventia Enterprise Security Platform (ESP), which contributes to business process optimization by maintaining a delicate balance between IT-performance, availability and risk—ultimately stopping cyber threats before they impact operations. Unlike traditional approaches to security, which focus on improving reaction times, Proventia ESP is designed to avoid security incidents by combining continuous vulnerability assessment and threat prevention with enterprise-wide information management and reporting capabilities. Our objective is to enable companies to shield security vulnerabilities across their entire IT infrastructure—before attacks are released.

We currently plan to continue to evolve the Proventia Enterprise Security Platform by further automating enterprise security policy and delivering it within the context of existing IT processes.

Our managed services offerings currently provide remote management of our best-of-breed security technology, focusing on security assessment and intrusion detection, intrusion prevention and desktop

protection systems, and include firewalls, VPNs, anti-virus and URL filtering software. We focus on serving as the trusted security provider to our customers by maintaining within our existing products the latest counter-measures to security risks, creating new innovative products based on our customers’ needs and providing professional and managed services.

Many factors will affect our future financial performance, especially our ability to differentiate our offerings from competitors that include much larger companies with greater marketing capabilities, financial resources and brand recognition. In order to continue to create such differentiation, we expect to continue to expand our domestic and international sales and marketing operations’, seek acquisition candidates and alliances with partners whose products, technologies or service capabilities are complementary to our solutions and improve our internal operating and financial infrastructure in support of our strategic goals and objectives. At the same time, we expect to adjust our organization size in light of changing economic conditions and maintain emphasis on controlling discretionary spending and capital expenditures. While we believe in the long-term success of our business solutions, our prospects must be considered in light of the recent experience, risks and difficulties that are frequently encountered by companies serving rapidly evolving markets. See “Risk Factors”.

Critical Accounting Policies

The consolidated financial statements were prepared in conformity with U.S. generally accepted accounting principles (“GAAP”). As such, management is required to make certain estimates, judgments and assumptions it believes are reasonable based upon the information available. These estimates and assumptions affect the reported amounts of assets and liabilities at the date of the financial statements and the reported amounts of revenues and expenses during the periods presented. Actual results may differ significantly from these estimates under different assumptions, judgements, or conditions. The significant accounting policies which management believes are the most critical to aid in fully understanding and evaluating our reported financial results include the following:

Revenue recognition

We recognize revenue in the following categories:

• Product licenses and sales, which include revenue from sales of perpetual software licenses and products;

• Subscription revenues, which consists of customer support, including content updates and technical support, term licenses, subscription licenses and managed service arrangements; and

• Professional services revenues, which includes fee-based service engagements and training.

We recognize software license revenue under the American Institute of Certified Public Accountants’ Statement of Position (“SOP”) 97-2, Software Revenue Recognition, as modified by SOP 98-9, Software Revenue Recognition with Respect to Certain Transactions, when the following criteria have been met:

• persuasive evidence of an arrangement exists;

• delivery has occurred or services have been rendered;

• price is fixed or determinable; and

• collection is probable.

Product licenses and sales

We recognize perpetual software license revenues, assuming all other revenue recognition criteria are met, upon (1) delivery of the software and (2) issuance of the related license, assuming that no significant vendor obligations or customer acceptance rights exist. Where payment terms are extended over periods greater than twelve months, revenue is recognized as such amounts become due and payable. Revenue is also deferred when payment terms are extended for periods less than twelve months and such sales are deemed either not to be fixed or determinable or collection is not probable based on evaluation of all terms of the transaction.

Product sales consist primarily of appliances sold in conjunction with ISS licensed software. These sales are recognized upon shipment to the customer provided all other criteria for software license revenue recognition are met.

Sales of products are generated both through direct sales to end-users as well as through various partners, including system integrators, value-added resellers and distributors. Revenue from product licenses and sales is recognized when the sale has occurred for an identified end-user, provided all other revenue recognition criteria are met. At the point of delivery, the customer has no right of return. We offer evaluation software available via download from our website and evaluation units for appliance-based products that allow potential customers to see the functionality of the products on their own networks prior to purchase.

Subscription revenues

Subscription revenues consist of renewable customer support, term licenses, and security monitoring and management services. Renewable customer support is a separate element of sales of perpetual software licenses and products. Term licenses allow customers to use our products and receive product support coverage and content updates for a specified period, generally twelve months. We generally invoice for customer support and term licenses at the beginning of the term and recognize revenue ratably over the subscription term. Security monitoring and management services for information assets and systems are part of managed services and associated revenues are recognized as such services are rendered.

Historically, our software and intrusion prevention appliance sales have been accounted for primarily as revenue at the time of sale, with product support and content updates generally representing between 20% and 30% of the related license or product amount. Prior to the second quarter of 2005, the majority of the initial price paid by the customer for certain Proventia integrated security appliance models was for selected content updates (sometimes referred to as “blades”), which customers acquire for a specified term that is recognized over such term as subscription revenue. During the second quarter of 2005, we changed the pricing model for our Proventia integrated security appliances to our historical model under which customers acquire the appliance bundled with most content blades, which are recorded as product revenue at the time of sale, and pay annual customer support fees at an average rate of 22% of the related product price. This change did not have a material impact on our results.

Professional services revenues

Service engagements are typically billed on either a fixed fee or time-and-materials basis and primarily consist of security assessments of customer networks and the development of customers’ security policies. These offerings are intended to support our goal of providing products and managed services. We prefer to have our partners provide these services where practical. We recognize such professional services revenues as the related services are rendered.

Multiple element arrangements

Our sales of product and/or software licenses are multiple element arrangements that include product support and content updates and may include other subscription or professional services delivered after the sale of the product or software license. Revenue is generally recognizable before delivery of every element of the arrangement when all of the following requirements exist:

• vendor specific objective evidence (“VSOE”) of fair value exists for the undelivered elements;

• the functionality of the delivered elements is not dependent on the undelivered elements; and

• delivery of the delivered elements represents the culmination of the earnings process.

We recognize the difference between the total arrangement fee and the amount deferred for the undelivered elements as revenues by allocating revenue to the delivered products, licenses and services using the residual method. Under the residual method, we allocate discounts inherent in the arrangement to products and customer support associated with products that are initially delivered and recognize the other elements as they are delivered based on the VSOE of fair value, which is determined based on transactions

where the company sells those elements separately. We determine fair value of the undelivered elements based on historical evidence of our stand-alone sales of these elements to third parties.

Allowance for doubtful accounts

Our sales are global, with customers located in the Americas, EMEA, and Asia/Pacific regions. We perform periodic credit evaluations of our customer’s financial condition and do not require collateral. We provide for estimated credit losses as such losses become probable. We evaluate specific accounts when we become aware of a situation where a customer may not be able to meet its financial obligations due to deterioration of its liquidity or financial viability, credit ratings or bankruptcy. The allowance for doubtful accounts is established based on the best facts available to us and is reevaluated and adjusted as additional information is received. At March 31, 2006, the allowance for doubtful accounts totaled $3.8 million, or 4.3% of the $87.8 million of total trade receivables. This 4.3% allowance of receivables reflects our practice to leave accounts on our general ledger and provide reserves pending final resolution of collectibility rather than to write-off such accounts.

Our bad debt expense for the quarter ended March 31, 2006 amounted to $331,000 compared to $145,000 in the corresponding period of 2005.

While actual credit losses have historically been within management’s expectations and the provisions established, we cannot guarantee that we will continue to experience the same credit loss rates we have had in the past. If the financial condition of our customers were to deteriorate, resulting in an impairment of their ability to make payments, additional allowances may be required.

Impairment of goodwill and other long-lived and intangible assets

We review goodwill for impairment on an annual basis or on an interim basis whenever events or changes in circumstances indicate that the carrying amount of an asset may not be recoverable. All other long-lived and intangible assets are reviewed for impairment whenever events or circumstances indicate that the carrying amount of an asset may not be recoverable. Such impairment loss would be measured as the difference between the carrying amount of the asset and its fair value based on the present value of estimated future cash flows. Significant judgment is required in the forecasting of future operating results, which are used in the preparation of projected cash flows. Due to uncertain market conditions and potential changes in our strategy and products, it is possible that forecasts used to support our intangible assets may change in the future, which could result in significant non-cash charges that would adversely affect our results of operations.

We currently have goodwill and other acquisition related intangibles, net of accumulated amortization, of approximately $230 million, with $195 million of goodwill related to our June 2001 acquisition of Network ICE Corporation (“Network ICE”) and approximately $20 million of goodwill related to the January 2004 acquisition of Cobion, AG (“Cobion”). The determination of whether or not goodwill is impaired involves significant judgments based upon short and long-term projections of future performance. We have concluded that this amount is realizable based on forecasted discounted cash flows through 2009 and on our stock market valuation. Neither method indicated that our goodwill had been impaired and, as a result, we did not record any impairment losses related to goodwill during the quarter ended March 31, 2006. Other intangibles of approximately $9 million are principally acquired technology from the Network ICE and Cobion acquisitions that are components in our current product offerings.

Stock-based compensation

As of January 1, 2006, we adopted SFAS 123(R), which requires us to measure compensation cost for stock awards at fair value and recognize compensation over the service period for awards expected to vest. The estimation of stock awards that will ultimately vest requires judgment, and to the extent actual results or updated estimates differ from our current estimates, such amounts will be recorded as a cumulative adjustment in the period estimates are revised. We consider many factors when estimating awards

expected to vest including type of awards, employee class, and our historical experience. Actual results, and future changes in estimates, may differ substantially from our current estimates.

We use the Black-Scholes valuation model to determine the fair value of our stock options, and significant judgment is required in determining the inputs to the model, particularly for the expected volatility. We use the implied volatility of publicly traded options for our common stock to estimate expected volatility. Changes in the input assumptions, including expected volatility, can materially affect the fair value estimate of our stock options.

Results of Operations

The following table sets forth our consolidated historical operating information, as a percentage of total revenues, for the periods indicated:

	Three months ended March 31,
	2006		2005
Consolidated Statements of Operations Data:
Product licenses and sales	40	%	42	%
Subscriptions	53	%	51	%
Professional services	7	%	7	%

Total revenues	100	%	100	%

Cost of revenues:
Product licenses and sales	8	%	8	%
Amortization of acquired technology	2	%	3	%
Subscriptions and professional services	17	%	17	%

Total cost of revenues	27	%	28	%
Research and development	16	%	13	%
Sales and marketing	35	%	34	%
General and administrative	10	%	10	%
Amortization of other intangibles	—	%	—	%

Total costs and expenses	88	%	85	%

Operating income	12	%	15	%

Revenues

Product licenses and sales

Since the second quarter of 2003, we have offered the Proventia family of network protection appliances that collectively provides unified, multi-function protection capabilities designed to identify and prevent many forms of attack with minimal user intervention. These products are designed to operate in demanding network environments while being easy to deploy, easy to use and centrally managed, all in an effort to make our solution more cost-effective. The market response has been dramatic as Proventia grew from 23% of product license and sales revenues in its year of introduction to 71% in the first quarter of 2006.

Product licenses and sales in the three months ended March 31, 2006 increased by 1% compared with the three months ended March 31, 2005. The net increase was a result of increases in intrusion prevention appliance revenues offset by a decrease in legacy software revenue and intrusion detection appliances. The Proventia line grew to 71% of product license and sales in the first quarter of 2006 from 64% of product license and sales revenues in the first quarter of 2005. Product licenses and sales decreased slightly to 40% of total revenues in the first quarter of 2006 compared to 42% in the corresponding period of 2005 due to the higher growth rate of subscription revenues.

We believe our future growth is dependent on a continuation of the positive market response to our Proventia family of products. Our present product roadmap also focuses on product offerings and enhancements that will continue to improve central control and manageability, easier deployment and more refined information as well as broader Proventia appliance offerings. We expect that this focus will continue to make our products more cost effective to implement and maintain the goal of increasing the future level of product licenses and sales. This expected growth is critical as it represents not only product and license revenues, but also subscription revenues from product support and content updates.

Subscriptions

Subscription revenues consist of product support and content updates, security-monitoring fees for managed services offerings, and term licenses of products. Subscriptions grew 10% in the first quarter of 2006 compared to the first quarter of 2005, increasing to $42.7 million from $38.8 million. Subscriptions revenue represented 53% of total revenues in the first quarter of 2006 compared to 51% in the first quarter of 2005.

The largest component of subscription revenues, product content and support, increased to 36% of total revenues, in the first quarter of 2006 compared to 33% of total revenues, in the first quarter of 2005. Product content and support includes hardware support of our Proventia appliances, software updates, technical support and security content that includes advisory updates from X-Force, our internal team of security experts. Product content and support are provided to our customers through contracts executed with customers for a specified term and billed at the time of contract. Such billings are recorded as deferred revenues on our balance sheet and amortized as subscriptions revenue over the term of the contract. The increase of our product content and support revenues in the future is dependent on continued success with product sales and maintenance renewals.

Managed services revenues increased 10% from the first quarter of 2005. Managed services revenues were 15% of total revenues in the three months ended March 31, 2006, as compared with 14% of total revenues in the three months ended March 31, 2005. We believe these increases were due to a strong demand in the market for proven, financially sound, managed security service providers. We are marketing managed services both directly to end users and through partners, including a number of new arrangements with integrators and service providers that include managed services as a part of their service offerings to their customers.

Professional services

Professional services revenues decreased to $5.4 million in the first quarter of 2006 from $5.7 million in the first quarter of 2005. Professional services revenues were 7% of total revenues in both the first quarter of 2006 and 2005. We continue to focus on high-value offerings that utilize our X-Force expertise, and look to our system integration and channel partners to serve as the primary resource to fulfill the services and education needs of our customers.

Geographic regions

Geographically, we derived the majority of our revenues from sales to customers within the Americas region. Revenues by region represented the following percentages of total revenues for the periods indicated:

	Three months ended March 31,
	2006		2005
Americas	63	%	62	%
EMEA	21	%	21	%
Asia/Pacific	16	%	17	%

While there have been changes in the proportion of revenues generated by each region, all of the regions experienced growth in revenues in the local currency in 2006. Weakening exchange rates in EMEA and Asia/Pacific compared to the US dollar negatively impacted revenue growth in those theatres in U.S. dollars. The financial data for each segment can be found in Note 7 to the Consolidated Financial Statements.

Costs and Expenses

Personnel

Personnel and related costs represent our largest expense category. We ended the first quarter of 2006 with 1,270 employees, up approximately 7% from the first quarter of 2005. The majority of headcount growth occurred in quota-carrying sales personnel, marketing, managed security services operations, and engineering. Our headcount has fluctuated between approximately 1,150 and 1,270 over the last 3 years as we acquired and integrated acquisitions and continually refined our business targets in light of economic conditions during these years.

On January 1, 2006 we adopted SFAS No. 123(R), and as required we have recorded stock-based compensation expense starting in the first quarter of 2006. Previously we had accounted for stock options under APB No. 25, and as permitted, we had not recorded stock-based compensation expense for our options. We adopted SFAS No. 123(R) using the modified prospective method, and accordingly, prior period results have not been restated, and do not include, the impact of SFAS No. 123(R). Total stock-based compensation expense related to the expensing of stock options was approximately $2.9 million in the three months ended March 31, 2006 (3.6% of total revenues). This expense has affected the comparability to prior quarter for the majority of our expense categories as it has been recorded in the expense line in which the recipients of the options are placed. Unrecognized non-cash stock compensation expense related to unvested options outstanding as of March 31, 2006 was approximately $19.2 million and will be recorded over the remaining vesting period of four years.

We began to use restricted stock, in addition to stock options, as an equity component of compensation beginning in the first quarter of 2004. We recorded $0.4 million and $0.6 million of compensation expense in the three months ended March 31, 2006 and 2005, respectively, associated with restricted stock in the expense categories in which the recipients are placed. Unrecognized non-cash stock compensation expense related to unvested restricted stock outstanding as of March 31, 2006 was approximately $1.4 million and will be recorded over the remaining vesting period of approximately 2 years.

Cost of product licenses and sales

Cost of product licenses and sales consists of several components. Costs associated with licensing our software products are minor. The substantial portion of our cost of product licenses and sales represents the hardware cost of our Proventia appliances. As a percentage of product licenses and sales revenues, these costs increased slightly to 21% in the first quarter of 2006 from 20% in the first quarter of 2005. We also purchased development source code in the first quarter of 2006 and in 2004, which is being amortized as cost of products sold over its estimated useful life of four years.

We incurred approximately $1.7 million in the first quarter of 2006 and $1.8 million in the first quarter of 2005 of amortization expense related to core and developed technology that was recorded as a result of acquisitions accounted for under the purchase method of accounting.

Cost of subscriptions and professional services

Cost of subscriptions and professional services includes the cost of our technical support personnel who provide assistance to customers under product support agreements, the security operations center (“SOC”) costs of providing managed security monitoring services and the costs related to our professional services and training. These costs increased approximately $0.3 million to $13.5 million in the first quarter of 2006 from $13.2 million in the first quarter of 2005. The increase is due to stock-based compensation expense related to stock options with the adoption of SFAS No. 123(R). As a percentage of subscription and professional services revenues, these costs decreased to 28% in the first quarter of 2006 from 30% in the first quarter of 2005.

Costs associated with our technical support personnel and our security operations centers increased each year in 2005, 2004 and 2003 as we added personnel to handle additional customers. We gained efficiencies in our SOCs and restructured our support groups to be more productive so personnel increased at a much lower rate than revenue growth, contributing to the decrease in those costs as a percentage of total revenues. Additionally, our appliances typically require less technical support effort than our software products. While we continue to seek increased productivity, we do expect increase in costs with a continued increase in revenues in the future.

Research and development

Research and development expenses consist of salary and related costs of research and development personnel, including costs for employee benefits, and depreciation on computer equipment. These costs include those associated with maintaining and expanding the X-Force, our internal team of security experts. We believe our primary research and product development and managed service offerings are important to retaining our leadership position in the market.

We continue to add functionality to our product family, providing gateway, network, server and desktop-based solutions, as well as to our vulnerability assessment and security management applications. These improvements, as well as new offerings, are intended to provide our customers with more powerful and easier-to-use solutions for security management across the enterprise.

Research and development expenses increased $2.5 million to $12.7 million in the three months ended March 31, 2006 from $10.3 million in the three months ended March 31, 2005, representing 16% and 13% of total revenues for these periods, respectively. Approximately $0.8 million of the increase was related to stock options expense with the adoption of SFAS No. 123(R). The remaining increase is a result of additional engineering headcount as we continue to invest in our product offerings.

While we are committed to continue our investment in X-Force research and development capabilities, which we believe distinguishes ISS from its competitors, we intend to seek leverage in future periods in the research and development area while enhancing current technologies and developing new technologies.

Sales and marketing

Sales and marketing expenses consist of salaries, travel expenses, commissions, advertising, maintenance of our website, trade show expenses, costs of recruiting sales and marketing personnel and costs of marketing materials.

Sales and marketing expenses increased approximately $2.0 million to $28.1 million in the first three months of 2006 from $26.1 million in the first three months of 2005, and increased as a percentage of total revenues to 35% from 34%. The implementation of SFAS 123(R) on January 1, 2006 added approximately $1.0 million (approximately 1% of total revenues) of stock option expense for the three months ended March 31, 2006.. We added quota-carrying headcount, but gained leverage from our sales force as we continue to increase the percentage of sales fulfilled through our partner saleschannel. We also increased our advertising expenditures during the three months ended March 31, 2006 by approximately $380,000 when compared to the same period in 2005.

We expect to continue to achieve leverage in our sales efforts by focusing our direct sales force on large customers that are served either directly by us or through large systems integrators. Our partner sales channel, which includes systems integrators, value-added resellers and distributors, will continue to be of increasing importance to us, measured quantitatively by an increasing level of product revenue originating through it. This channel represented approximately 82% of our sales in the first quarter of 2006 as compared to 77% in 2005. We intend to use our channel’s capabilities to reach larger customers through joint selling efforts and to reach departmental and small companies.

General and administrative

General and administrative expenses consist of personnel-related costs for executive, administrative, finance and human resources, internal information systems and other support services costs, and legal, accounting and other professional service fees. General and administrative expenses were $8.3 million in the three months ended March 31, 2006 and $7.3 million in the three months ended March 31, 2005, representing approximately 10% of our total revenues in both 2006 and 2005.

The largest increase was approximately $0.8 million for the expensing of stock options due to the adoption of SFAS 123(R) on January 1, 2006.

Interest income

Interest income increased to $2.0 million in the quarter ended March 31, 2006 from $1.1 million in the comparable quarter of 2005 due to an increase in the yield on investment-quality commercial paper and similar investments to approximately 4.0% in the first quarter of 2006 compared to 2.5% during the first quarter of 2005.

Other income (expense), net

Other income (expense) primarily consisted of minority interest expense and foreign exchange currency losses of $332,000 and $23,000, respectively in 2006 and $10,000 and $535,000, respectively in 2005.

Gain on issuance of subsidiary shares

Provision for income taxes

Our effective tax rate was approximately 37% for the three months ended March 31, 2006 and 36% for the three months ended March 31, 2005. The effective rates differ from the Federal statutory rate due primarily to certain operating expenses that are not deductible for income tax purposes, state income taxes, foreign operations taxed at different rates and Federal tax credits

Liquidity and Capital Resources

Our financial position remained strong through the first three months of 2006. Our cash and cash equivalents and marketable security investments were $231.7 million at March 31, 2006. Our investments in marketable securities consisted solely of highly rated debt obligations with maturities of twelve months or less.

We continue to meet our working capital needs and capital equipment needs with cash provided by operations. Cash provided by operations in the first three months of 2006 totaled $7.4 million. The major components of cash flows provided by operating activities were net income of $7.1 million, non-cash depreciation and amortization expense charges of $5.1 million, non-cash stock-based compensation expense of $3.3 million, a decrease in accounts receivable of $4.5 million, offset by an increase in inventory of $3.3 million, and a decrease in accounts payable and accrued expenses of $11.7 million primarily for the payment of income taxes.

An important element of our liquidity is the collection of our accounts receivable. We measure our accounts receivable management by our day’s sales outstanding (“DSO”). This is a measurement of accounts receivable divided by billings in the quarter, represented by the sum of revenues plus the change in the deferred revenues liability account balance. This measurement was at 90 days at March 31, 2006, above our target range of 75 to 85 days primarily due to slower collections and the timing of revenue.

Our net cash used in investing activities was $10.9 million in the first three months of 2006. Investing activities included changes in our marketable securities that have quality characteristics similar to cash equivalents, except their maturities when we acquire them are longer than three months. The cash flow statement included the purchase of $5.9 million of intermediate term marketable securities, primarily interest-bearing government obligations and commercial paper, offset by net proceeds from the maturity of marketable securities of $1.7 million. Also included in cash flow from investing was the purchase of $6.1 million of property, equipment, and acquired source code due to continued investment in our business and infrastructure.

Our financing activities used $9.6 million of cash in the first three months of 2006. This was principally due to the repurchase of 588,000 shares of our common stock in the open market at an aggregate cost of $13.6 million. The previous stock repurchase plan expired in July 2005 and a new repurchase program to repurchase up to $100.0 million of our common stock through July 2006 was authorized by the Board of Directors in July 2005. Since the inception of the stock repurchase plans, we have purchased 7.7 million shares at an average cost of $17.88 per share for a total cash outlay of approximately $138.0 million. We can purchase up to an additional $54.8 million under the current program. Also, in the first three months of 2006, the exercise of stock options by our employees generated funds of approximately $3.7 million.

At March 31, 2006, we had $231.7 million of cash and cash equivalents. An additional $8.6 million of cash equivalents and marketable securities are pledged as collateral for stand-by letters of credit related to the operating leases of our facilities and are shown on the balance sheet as restricted marketable securities and cash equivalents. We believe that such cash and cash equivalents and marketable securities will be sufficient to meet our working capital needs and capital expenditures for the foreseeable future. Furthermore, we are not aware of any trends, events, or uncertainties that are reasonably likely to result in any significant change to our liquidity.

From time to time, we evaluate possible acquisition and investment opportunities in businesses, products or technologies that are complementary to ours. In the event we determine to pursue such opportunities, we may use our available cash and cash equivalents, marketable securities and take on debt for this purpose.

Off-Balance Sheet Arrangements

Item 3. Quantitative and Qualitative Disclosures About Market Risk

ISS is subject to foreign exchange risk as a result of exposures to changes in currency exchange rates. Our foreign operations are, for the most part, naturally hedged against exchange rate fluctuations since the majority of revenues and expenses of each foreign affiliate are denominated in the same currency. Therefore, we do not engage in formal hedging activities, but we do periodically review the potential impact of this risk to ensure that the risk of significant potential losses remains minimal. As a result, an unfavorable change in the exchange rate for any particular foreign subsidiary would result in lower revenues and expenses with regards to operating results, and lower assets and liabilities with regards to the balance sheet.

The Company’s operating results are affected by changes in exchange rates between the U.S. Dollar and the Euro and the Japanese Yen. When the U.S. Dollar strengthens against these foreign currencies, the value of our reporting currency revenues decreases. When the U.S. Dollar weakens, the value of our reporting currency revenues increases. Since much of our international operating expenses are also incurred in local currencies, which is the foreign subsidiaries functional currency, the impact of exchange rates on net income or loss is relatively less than the impact on revenue. Although our operating and pricing strategies take into account changes in exchange rates over time, our results of operations may be affected significantly in the short term by fluctuations in foreign currency exchange rates. A fluctuation of 10% in the average exchange rates of the Euros and Japanese Yen relative to the US dollar the first quarter of both 2006 and 2005 would have resulted in increases or decreases in operating income of approximately $1.3 million from the reported operating income.

During the first quarter of 2006, the Company recorded a net foreign exchange loss of $23,000. The nature and extent of the foreign currency risk faced by the Company depends on many factors that cannot be accurately predicted. These factors include significant changes in foreign currency market conditions, the Company’s inability to match foreign currency denominated revenues with costs denominated in the same currency, and changes in the amount or mix of revenues denominated in various foreign currencies. As a result of material unforeseen changes in these factors, the Company’s foreign currency risk could have a greater impact on the Company’s results of operations in the future.

Item 4. Controls and Procedures

Disclosure Controls and Procedures

ISS’ management, with the participation of the Chief Executive Officer and Chief Financial Officer, evaluated the effectiveness of our disclosure controls and procedures, as defined in Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934, as of March 31, 2006. No system of controls, no matter how well designed and operated, can provide absolute assurance that the objectives of the system of controls are met, and no evaluation of controls can provide absolute assurance that the system of controls has operated effectively in all cases. Our disclosure controls and procedures however are designed to provide reasonable assurance that the objectives of disclosure controls and procedures are met.

Based on such evaluation, these officers have concluded that, as of such date, our disclosure controls and procedures were effective to provide reasonable assurance that information required to be disclosed in the reports the Company files or submits under the Securities Exchange Act of 1934 is recorded, processed, summarized and reported on a timely basis.

Changes in Internal Control Over Financial Reporting

There have not been any changes in ISS’ internal control over financial reporting during the quarter ended March 31, 2006 that have materially affected, or are reasonably likely to materially affect, such controls.

PART II. OTHER INFORMATION

Item 1. Legal Proceedings

Item 1A. Risk Factors

There are many factors that affect ISS’ business and the results of its operations, some of which are beyond ISS’ control. The following is a description of some of the important factors that may cause the actual results of ISS’ operations in future periods to differ materially from those currently expected or desired. We encourage you to read this section carefully.

We Operate in a Rapidly Evolving Market

We operate in a rapidly evolving market and must, among other things:

• respond to competitive developments;

• continue to upgrade and expand our product and services offerings; and

• continue to attract, retain and motivate our employees.

We cannot be certain that we will successfully address these issues. As a result, we cannot assure our investors that we will be able to continue to operate profitably in the future.

We introduced our Proventia appliance line in April 2003 and continue to introduce new products in this line. While market response to these products has had a positive impact on our operating results, failure to continue to gain further market acceptance of new products could result in revenues below our expectations and our operating results could be adversely affected.

Our Future Operating Results Will Likely Fluctuate Significantly

We cannot predict our future revenues and operating results with certainty. However, we do expect our future revenues and operating results to fluctuate due to a combination of factors, including:

• the extent to which the public perceives that unauthorized access to and use of online information are threats to network security;

• customer budgets;

• the mix of product sales among the various products offered by ISS and whether revenue is recognized upon sale or deferred to subsequent periods;

• the volume and timing of orders, including seasonal trends in customer purchasing;

• our ability to develop and timely introduce new and enhanced product and managed service offerings;

• the introduction and acceptance rate of new ISS branded appliances, including related increased cost of goods sold;

• disruption in the sales cycle and supply chain management due to product introductions;

• our ability to accurately forecast and produce demanded quantities of our appliance products and models;

• availability of component parts of appliance products and reliance on contract manufacturers to produce such products;

• our ability to provide scalable managed services offerings in a cost effective manner;

• foreign currency exchange rates that affect our international operations;

• whether enterprises consolidate their security platforms with fewer vendors and whether ISS benefits from this;

• product and price competition in our markets; and

• general economic conditions, both domestically and in our foreign markets.

We focus our direct sales efforts on enterprise-wide security solutions, which consist of our entire product suite, professional services, and managed security services, rather than on the sale of component products. As a result, each sale requires substantial time and effort from our sales and support staff. In addition, the revenues associated with particular sales vary significantly depending on the number of products acquired by a customer and the number of devices used by the customer. Large individual sales, or even small delays in customer orders, can cause significant variation in our license revenues and results of operations for a particular period. The timing of large orders is usually difficult to predict and, like many software-based technology companies, many of our customers typically complete transactions in the last month of a quarter.

We cannot predict our operating expenses based on our past results. Instead, we establish our spending levels based in large part on our expected future revenues. As a result, if our actual revenues in any future period fall below our expectations, our operating results likely will be adversely affected because very few of our expenses vary with our revenues. Because of the factors listed above, we believe that our quarterly and annual revenues, expenses and operating results likely will vary significantly in the future.

Our ability to provide timely guidance and meet the expectations of investors with respect to our operating and financial results is affected by the tendency of a majority of our product and license sales to be completed in the last month of a quarter. We may not be able to determine whether we will experience material deviations from guidance or expectations until the end of a quarter.

Dependence on Third Party Suppliers and Manufacturers

We carry little inventory of our appliance products and we rely on suppliers to deliver necessary components to our contract manufacturers in a timely manner based on the forecasts we provide. We currently purchase some Proventia appliance components and contract manufacturing services from single or limited sources. If shortages occur, supplies are interrupted, or we underestimate demand for models, we may not be able to deliver products to our customers and our revenue and operating results would be adversely affected. We provide forecasts of our demand to our contract manufacturers. Because our supply of hardware is based on short-term forecasts and purchase orders, our contract manufacturers are not obligated to purchase components for greater quantities over longer periods. If we underestimate our requirements, our contract manufacturers may have an inadequate component inventory and, based on lead times, this could interrupt manufacturing and result in delays in shipments and revenues.

We Face Intense Competition in Our Market

The market for network security monitoring, detection, prevention and response solutions is intensely competitive, and we expect competition to increase in the future. We cannot guarantee that we will compete successfully against our current or potential competitors, especially those with significantly greater financial resources or brand name recognition. Our chief competitors generally fall within the following categories:

• large companies, including Symantec Corporation, Cisco Systems, Inc., Juniper Networks, Inc., 3Com Corporation, Check Point Software Technologies, LTD, and McAfee, Inc., that sell competitive products and offerings, as well as other large software companies that have the technical capability and resources to develop competitive products;

• software or hardware network infrastructure companies like Cisco Systems, Inc., 3Com Corporation, and Juniper Networks, Inc. that could integrate features that are similar to our products into their own products;

• smaller software companies offering relatively limited applications for network and Internet security; and

• small and large companies with competitive offerings to components of our managed services offerings.

Mergers or consolidations among these competitors, or acquisitions of small competitors by larger companies, represent risks. For example, Symantec Corporation., Cisco Systems, Inc., McAfee, Inc., 3Com Corporation, and Juniper Networks, Inc. have acquired during the past several years smaller companies,

which have network security technologies. These acquisitions will make these entities potentially more formidable competitors to us if such products and offerings are effectively integrated. Large companies may have advantages over us because of their longer operating histories, greater name recognition, larger customer bases or greater financial, technical and marketing resources. As a result, they may be able to adapt more quickly to new or emerging technologies and changes in customer requirements. They can also devote greater resources to the promotion and sale of their products than we can. In addition, these companies have reduced and could continue to reduce, the price of their security monitoring, detection, prevention and response products and managed security services, which increases pricing pressures within our market.

Several companies currently sell software products (such as encryption, firewall, operating system security and virus detection software) that our customers and potential customers have broadly adopted. Some of these companies sell products that perform the same functions as some of our products. In addition, the vendors of operating system software or networking hardware may enhance their products to include the same kinds of functions that our products currently provide. The widespread inclusion of comparable features to our software in operating system software or networking hardware could render our products less competitive or obsolete, particularly if such features are of a high quality. Even if security functions integrated into operating system software or networking hardware are more limited than those of our products, a significant number of customers may accept more limited functionality to avoid purchasing additional products.

In addition, with the introduction of our Proventia integrated security appliance, we have offerings that compete with vendors of firewalls, VPNs, anti-virus systems, and content and spam filtering products. These offerings are competitive with a broader spectrum of network security companies, as well as those that also offer integrated security appliances or broad product suites.

For the above reasons, we may not be able to compete successfully against our current and future competitors. Increased competition may result in price reductions, reduced gross margins and loss of market share.

We Face Risks Associated with Governmental Contracting

Our customers include the U.S. and other national government agencies and a significant number of other state and local governments or agencies.

• Procurement—Contracting with public sector customers is highly competitive and can be expensive and time-consuming, often requiring that we incur significant upfront time and expense without any assurance that we will win a contract;

• Budgetary Constraints and Cycles—Demand and payment for our products and services are impacted by public sector budgetary cycles and funding availability, with funding reductions or delays adversely impacting public sector demand for our products and services;

• Modification or Cancellation of Contracts—Public sector customers often have contractual or other legal rights to terminate current contracts for convenience or due to a default. If a contract is cancelled for convenience, which can occur if the customer’s product needs change, we may only be able to collect for products and services delivered prior to termination. If a contract is cancelled because of default, we may only be able to collect for products and alternative products and services;

• Governmental Audits—National governments and other state and local agencies routinely investigate and audit government contractors’ administrative processes. They may audit our performance and pricing and review our compliance with applicable rules and regulations. If they find that we improperly allocated costs, they may require us to refund those costs or may refuse to pay us for outstanding balances related to the improper allocation. An unfavorable audit could result in a reduction of revenue, and may result in civil or criminal liability if the audit uncovers improper or illegal activities.

We Face Rapid Technological Change in Our Industry and Frequent Introductions of New Products

Rapid changes in technology pose significant risks to us. We do not control nor can we influence the forces behind these changes, which include:

• the extent to which businesses and others seek to establish more secure networks;

• the extent to which hackers and others seek to compromise secure systems;

• evolving computer hardware and software standards;

• changing customer requirements; and

• frequent introductions of new products and product enhancements.

To remain successful, we must continue to change, adapt and improve our products in response to these and other changes in technology. Our future success hinges on our ability to both continue to enhance our current line of products and professional services and to introduce new products and services that address and respond to innovations in computer hacking, computer technology and customer requirements. We cannot be sure that we will successfully develop and market new products that do this. Any failure by us to timely develop and introduce new products, to enhance our current products or to expand our professional services capabilities in response to these changes could adversely affect our business, operating results and financial condition. In addition, introduction of new and successor products can disrupt sales of legacy products as customers await or evaluate the new products or inventories of legacy products are phased out.

Our products involve very complex technology and, as a consequence, major new products and product enhancements require a long time to develop and test before going to market. Because this amount of time is difficult to estimate, we have had to delay the scheduled introduction of new and enhanced products in the past and may have to delay the introduction of new and enhanced products in the future.

We are increasing our investment in engineering and customer support activities and these investments may achieve delayed, or lower than expected, benefits which could harm our operating results. We intend to continue to add personnel and other resources to our engineering and customer support functions as we continue developing advanced technologies. We are likely to recognize the costs associated with these investments earlier than some of the anticipated benefits and the return on these investments may be lower, or may develop more slowly, than we expect. If we do not achieve the benefits anticipated from these investments, or if the achievement of these benefits is delayed, our expected operating results may be adversely affected.

The techniques computer hackers use to gain unauthorized access to, or to sabotage, networks and intranets are constantly evolving and increasingly sophisticated. Furthermore, because new hacking techniques are usually not recognized until used against one or more targets, we are unable to anticipate most new hacking techniques. To the extent that new hacking techniques harm our customers’ computer systems or businesses, affected or prospective customers may believe that our products are ineffective, which may cause them or prospective customers to reduce or avoid purchases of our products.

Undetected Product Errors or Defects Could Result in Loss of Revenues, Delayed Market Acceptance and Claims Against Us

We offer warranties on our products, allowing the end customer to have any defective product repaired, or to receive a replacement product for it during the warranty period, or in certain circumstances return the product for a refund. Our products may contain undetected errors or defects. If there is a broad product failure across our customer base, we may decide to replace all affected products or we may decide to refund the purchase price for defective units. Such defects and actions may adversely affect our ability to record revenue. Some errors are discovered only after a product has been installed and used by end customers. Any errors discovered after commercial release could result in loss of revenues and claims against us.

We offer warranties on our service levels for managed security services. If we do not meet warranties, the customer generally may obtain credits for service.

If we are unable to fix errors or other product problems that later are identified after full deployment, or if we fail to meet our service levels for managed security services, in addition to the consequences described above, we could experience:

• failure to achieve market acceptance;

• loss of customers;

• loss of or delay in revenues and loss of market share;

• diversion of development resources;

• increased service and warranty costs;

• legal actions by our customers; and

• increased insurance costs.

Our Products are Complex and Are Operated in a Wide Variety of Computer Configurations, Which Could Result in Errors or Product Failures

Because we offer very complex products, undetected errors, failures or bugs may occur when they are first introduced or when new versions are released. Our products often are installed and used in large-scale computing environments with different operating systems, system management software and equipment and networking configurations, which may cause errors or failures in our products or may expose undetected errors, failures or bugs in our products. We discover errors, failures and bugs in certain of our product offerings after their introduction and have experienced delays and could experience lost revenues during the period required to correct these errors. Our customers’ computer environments are often characterized by a wide variety of standard and non-standard configurations that make pre-release testing for programming or compatibility errors very difficult and time-consuming. Despite testing, errors, failures or bugs may not be found in new products or releases until after commencement of commercial shipments. Errors, failures or bugs in products released by us could result in negative publicity, product returns, loss of or delay in market acceptance of our products or claims by customers or others.

In addition, if an actual or perceived breach of network security occurs in one of our end customer’s security systems, regardless of whether the breach is attributable to our products, the market perception of the effectiveness of our products could be harmed. Because the techniques used by computer hackers to access or sabotage networks change frequently and generally are not recognized until launched against a target, we may be unable to anticipate these techniques. Alleviating any of these problems could require significant expenditures of our capital and resources and could cause interruptions, delays or cessation of our product licensing, which could cause us to lose existing or potential customers and would adversely affect results of operations.

We Might Have to Defend Lawsuits or Pay Damages in Connection With Any Alleged or Actual Failure of Our Products and Services

Because our products and services provide and monitor network security and may protect valuable information, we could face claims for product liability, tort or breach of warranty. Anyone who circumvents our security measures could misappropriate the confidential information or other property of end customers using our products, or interrupt their operations. If that happens, affected end customers or others may sue us. In addition, we may face liability for breaches caused by faulty installation of our products by our service and support organizations. Provisions in our contracts relating to warranty disclaimers and liability limitations may be unenforceable. Some courts, for example, have found contractual limitations of liability in standard computer and software contracts to be unenforceable in some circumstances. Defending a lawsuit, regardless of its merit, could be costly and could divert management attention. Our business liability insurance coverage may be inadequate or future coverage may be unavailable on acceptable terms or at all.

Risks Associated with Our Global Operations

The expansion of our international operations includes our presence in dispersed locations throughout the world, including throughout EMEA and the Asia/Pacific and Latin America regions. Our international presence and expansion exposes us to risks not present in our U.S. operations, such as:

• the difficulty in managing an organization spread over various countries located across the world;

• compliance with, and unexpected changes in, a wide range of complex regulatory requirements in countries where we do business;

• duties and tariffs imposed on importation of our products in other jurisdictions where other manufacturers may not bear those same costs;

• increased financial accounting and reporting burdens;

• potentially adverse tax consequences;

• fluctuations in foreign currency exchange rates resulting in losses or gains from transactions and expenses denominated in foreign currencies;

• reduced protection for intellectual property rights in some countries;

• reduced protection for enforcement of creditor and contractual rights in some countries; and

• import and export license requirements and restrictions on the import and export of certain technology, especially encryption technology and trade restrictions.

Despite these risks, we believe that we must continue to expand our operations in international markets to support our growth. To this end, we intend to establish additional foreign sales operations, expand our existing offices, hire additional personnel, expand our international sales channels and customize our products for local markets. If we fail to execute this strategy, our international sales growth will be limited.

Our Networks, Products and Services May be Targeted by Hackers

Like other companies, our websites, networks, information systems, products and services may be targets for sabotage, disruption or misappropriation by hackers. As a leading network security solutions company, we are a high profile target. Although we believe we have sufficient controls in place to prevent disruption and misappropriation, and to respond to such situations, we expect these efforts by hackers to continue. If these efforts are successful, our operations, reputation and sales could be adversely affected.

We Must Successfully Integrate Acquisitions

As part of our growth strategy, we have and may continue to acquire or make investments in companies with products, technologies or professional services capabilities complementary to our solutions. When engaging in acquisitions, we could encounter difficulties in assimilating or completing the development of the technologies, new personnel and operations into our company. These difficulties may disrupt our ongoing business, distract our management and employees, increase our expenses and adversely affect our results of operations. These difficulties could also include accounting requirements, such as impairment charges related to goodwill or other intangible assets or expensing in-process research and development costs. We cannot be certain that we will successfully overcome these risks with respect to any future acquisitions or that we will not encounter other problems in connection with our recent or any future acquisitions. In addition, any future acquisitions may require us to incur debt or issue equity securities. The issuance of equity securities could dilute the investment of our existing stockholders.

We Have Authorized the Use of a Substantial Amount of Our Cash for the Repurchase of Our Shares, and This Use of Funds May Limit Our Ability to Complete Other Transactions or to Pursue Other Business Initiatives.

In July 2005, ISS announced a share repurchase program authorizing the use of up to $100 million in cash to repurchase outstanding shares of our common stock. We expect to repurchase shares for cash as business conditions warrant through July 19, 2006. The full implementation of this repurchase program

would use a significant portion of our cash reserves. This use of cash could limit our future flexibility to complete acquisitions of businesses or technology or other transactions.

Our Proprietary Rights May be Difficult to Enforce

We rely primarily on copyright, trademark, patent and trade secrets laws, confidentiality procedures and contractual provisions to protect our proprietary rights. We hold several United States patents, one Taiwanese patent, and have a number of patent applications pending. We also hold numerous United States and foreign trademarks and have a number of trademark applications pending. There can be no assurance that patents will be issued from pending applications, or that claims allowed on any patents will be sufficiently broad to protect our technology. There can be no assurance that any issued patents will not be challenged, invalidated or circumvented, or that any rights granted under these patents will actually provide competitive advantages to us. Despite our efforts to protect our proprietary rights, unauthorized parties may attempt to copy aspects of our products or to obtain and use information that we regard as proprietary. Policing unauthorized use of our products is difficult. While we cannot determine the extent to which piracy of our software products occurs, we expect software piracy to be a persistent problem. In addition, the laws of some foreign countries do not protect our proprietary rights to as great an extent as do the laws of the United States, and many foreign countries do not enforce these laws as diligently as U.S. government agencies and private parties. If we are unable to protect our proprietary rights to the totality of the features in our software and products (including aspects of our software and products protected other than by patent rights), we may find ourselves at a competitive disadvantage to others who need not incur the additional expense, time and effort required to create the innovative products that have enabled us to be successful.

We May Be Found to Infringe the Proprietary Rights of Others

Third parties may assert claims or initiate litigation related to exclusive patent, copyright, trademark and other intellectual property rights to technologies that are relevant to our business. Because of the large number of patents in the Internet, networking, security and software fields, the secrecy of some pending patents and the rapid rate of issuance of new patents, it is not economically practical (or even possible) to determine in advance whether a product (or any of its components) infringe or will infringe the patent rights of others. Third party asserted claims and/or initiated litigation can include claims against us or our manufacturers, suppliers, or customers, alleging infringement of proprietary rights with respect to our existing or future products (or components of those products). Regardless of the merit of these claims, they can be time-consuming, result in costly litigation and diversion of technical and management personnel, or require us to develop a non-infringing technology or enter into license agreements. There can be no assurance that licenses will be available on acceptable terms and conditions, if at all, in these circumstances, or that any indemnification that might be available to us would be adequate to cover our costs of defense. Furthermore, because of the potential for large judgments, which are not necessarily predictable, it is not unusual to find even arguably unmeritorious claims settled for significant funds. If any infringement or other intellectual property claims made against us by a third party is successful, or if we fail to develop non-infringing technology or license the proprietary rights on commercially reasonable terms and conditions, our business, operating results, financial condition and liquidity could be materially and adversely affected.

Some Provisions in the ISS Certificate of Incorporation and Bylaws Make a Takeover of ISS Difficult

Our certificate of incorporation and bylaws contain provisions that could have the effect of making it more difficult for a third party to acquire, or of discouraging a third party from attempting to acquire, control of ISS. These provisions:

• establish a classified board of directors;

• create preferred stock purchase rights that grant to holders of common stock the right to purchase shares of Series A Junior Preferred Stock in the event that a third party acquires 20% or more of the voting power of our outstanding common stock;

• prohibit the right of our stockholders to act by written consent;

• limit calling special meetings of stockholders; and

• impose a requirement that holders of 66²/₃% of the outstanding shares of common stock are required to amend the provisions relating to the classification of our board of directors and action by written consent of stockholders.

Item 2. Unregistered Sale of Equity Securities and Use of Proceeds

The following table provides information about purchases by the Company of its common stock during the three months ended March 31, 2006. All such purchases were made in open-market transactions pursuant to a repurchase plan publicly announced on July 27, 2005. Under this repurchase plan, the Company has been authorized by the Board to repurchase up to $100 million of its outstanding common stock over the 12 months ending July 19, 2006. The Company had prior repurchase plans in place that have terminated, and no further purchases can be made under those plans. Through March 31, 2006, the Company had purchased approximately 7.7 million shares at an aggregate cost of approximately $138.0 million under the current and prior repurchase plans.

Issuer Purchases of Equity Securities

Period	Total Number of Shares Purchased	Average Price Paid Per Share		Total Number of Shares Purchased as Part of Publicly Announced Plans or Programs	Approximate Dollar Value of Shares that May Yet Be Purchased Under the Plans or Programs
1/1/06-1/31/06	33,000	$	22.20	33,000	$	67,679,000
2/1/06-2/28/06	280,000	$	22.90	280,000	$	61,267,000
3/1/06-3/31/06	275,000	$	23.63	275,000	$	54,769,000

Item 6. Exhibits

10.1+		Form of Executive Incentive Plan (filed as Exhibit 10.1 to the Company’s Current Report on Form 8-K, filed May 4, 2006, and incorporated by reference herein).

11**	—	Computation of Per Share Earnings

31 .1*	—	Certification of principal executive officer pursuant to Section 302 of the Sarbanes-Oxley Act of 2002.

31 .2*	—	Certification of principal financial officer pursuant to Section 302 of the Sarbanes-Oxley Act of 2002.

32 .1*	—	Certification Pursuant to 18 U.S.C. Section 1350. as Adopted Pursuant to Section 906 of the Sarbanes-Oxley Act of 2002

32 .2*	—	Certification Pursuant to 18 U.S.C. Section 1350. as Adopted Pursuant to Section 906 of the Sarbanes-Oxley Act of 2002

* Identifies those filed exhibits with this Form 10-Q.

+ Management contract or compensatory plan

** Data required by SFAS No. 128, “Earnings Per Share”, is provided in Note 5 to the consolidated financial statements in this report.

SIGNATURES

Pursuant to the requirements of the Securities Exchange Act of 1934, the Registrant has duly caused this report to be signed on its behalf by the undersigned thereunto duly authorized.

	INTERNET SECURITY SYSTEMS, INC.
	(Registrant)

Date: May 5, 2006	By	/s/ Raghavan Rajaji
		Senior Vice President Finance and Administration
		and Chief Financial Officer (on behalf of registrant
		and as principal financial officer)

Table of Contents

INTERNET SECURITY SYSTEMS INC/GA 10-Q