e10vk
Table of Contents

UNITED STATES SECURITIES AND EXCHANGE COMMISSION
Washington, D.C. 20549
 
 
 
 
Form 10-K
 
     
(Mark One)    
þ
  ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934
    For the Fiscal Year Ended April 30, 2010
OR
o
  TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934
 
Commission file number: 001-33923
ArcSight, Inc.
(Exact name of registrant as specified in its charter)
 
     
Delaware   52-2241535
(State or Other Jurisdiction of
Incorporation or Organization)
  (I.R.S. Employer
Identification No.)
 
5 Results Way
Cupertino, California 95014
(Address of Principal Executive Offices, including Zip Code)
 
(408) 864-2600
(Registrant’s Telephone Number, including area code)
 
Securities registered pursuant to Section 12(b) of the Act:
 
         
Title of Each Class
 
Name of Each Exchange on Which Registered
Common Stock, par value $0.00001 per share     NASDAQ Global Market  
 
Securities registered pursuant to Section 12(g) of the Act:
 
None
(Title of Class)
 
Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act.  Yes o     No þ
 
Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act.  Yes o     No þ
 
Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days.  Yes þ     No o
 
Indicate by check mark whether the registrant has submitted electronically and posted on its corporate Web site, if any, every Interactive Data File required to be submitted and posted pursuant to Rule 405 of Regulation S-T (§ 232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit and post such files).  Yes o     No o
 
Indicate by check mark if disclosure of delinquent filers pursuant to Item 405 of Regulation S-K (§ 229.405) is not contained herein, and will not be contained, to the best of registrant’s knowledge, in definitive proxy or information statements incorporated by reference in Part III of this Form 10-K or any amendment to this Form 10-K.  þ
 
Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, or a smaller reporting company. See the definitions of “large accelerated filer,” “accelerated filer” and “smaller reporting company” in Rule 12b-2 of the Exchange Act. (Check one):
 
             
Large accelerated filer o
  Accelerated filer þ   Non-accelerated filer o   Smaller reporting company o
        (Do not check if a smaller reporting company)    
 
Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Act).  Yes o     No þ
 
The aggregate market value of voting stock held by non-affiliates of the registrant was $690,583,284 based upon the closing price on The NASDAQ Global Market on the last business day of the registrant’s most recently completed second fiscal quarter (October 31, 2009).
 
The number of outstanding shares of the registrant’s common stock as of July 1, 2010 was 34,449,065.
 
DOCUMENTS INCORPORATED BY REFERENCE
 
Portions of the definitive proxy statement for registrant’s 2010 Annual Meeting of Stockholders to be held on September 20, 2010 and to be filed pursuant to Regulation 14A within 120 days after registrant’s fiscal year ended April 30, 2010 are incorporated by reference into Part III of this Annual Report on Form 10-K.
 


 

 
(ARCSIGHT LOGO)
 
FISCAL 2010 ANNUAL REPORT ON FORM 10-K
 
TABLE OF CONTENTS
 
                 
        Page
 
PART I
  Item 1.     Business     4  
  Item 1A.     Risk Factors     14  
  Item 1B.     Unresolved Staff Comments     31  
  Item 2.     Properties     31  
  Item 3.     Legal Proceedings     31  
  Item 4.     (Removed and Reserved)     31  
 
PART II
  Item 5.     Market for Registrant’s Common Equity, Related Stockholder Matters and Issuer Purchases of Equity Securities     31  
  Item 6.     Selected Financial Data     35  
  Item 7.     Management’s Discussion and Analysis of Financial Condition and Results of Operations     36  
  Item 7A.     Quantitative and Qualitative Disclosures About Market Risk     59  
  Item 8.     Financial Statements and Supplementary Data     61  
  Item 9.     Changes in and Disagreements with Accountants on Accounting and Financial Disclosure     94  
  Item 9A.     Controls and Procedures     94  
  Item 9B.     Other Information     96  
 
PART III
  Item 10.     Directors, Executive Officers and Corporate Governance     96  
  Item 11.     Executive Compensation     96  
  Item 12.     Security Ownership of Certain Beneficial Owners and Management and Related Stockholder Matters     96  
  Item 13.     Certain Relationships and Related Transactions, and Director Independence     96  
  Item 14.     Principal Accounting Fees and Services     96  
 
PART IV
  Item 15.     Exhibits and Financial Statement Schedules     97  
Signatures     98  
 EX-10.13
 EX-10.14
 EX-21.1
 EX-23.1
 EX-31.01
 EX-31.02
 EX-32.01
 EX-32.02


2


Table of Contents

Forward Looking Statements
 
The information in this Annual Report on Form 10-K contains forward-looking statements within the meaning of Section 27A of the Securities Act of 1933, as amended, or the Securities Act, and Section 21E of the Securities Exchange Act of 1934, as amended, or the Exchange Act. Such statements are based upon current expectations that involve risks and uncertainties. Any statements contained herein that are not statements of historical facts may be deemed to be forward-looking statements. For example, words such as “may,” “will,” “should,” “estimates,” “predicts,” “potential,” “continue,” “strategy,” “believes,” “anticipates,” “plans,” “expects,” “intends” and similar expressions are intended to identify forward-looking statements. Our actual results and the timing of certain events may differ significantly from the results discussed in the forward-looking statements. Factors that might cause or contribute to such differences include, but are not limited to, those discussed elsewhere in this Annual Report on Form 10-K in the section titled “Risk Factors” and the risks discussed in our other filings with the Securities and Exchange Commission, or the SEC. We undertake no obligation to publicly release any revisions to the forward-looking statements after the date of this Annual Report on Form 10-K.


3


Table of Contents

 
PART I
 
Item 1.   Business
 
Overview
 
We are a leading provider of enterprise threat and risk management solutions that protect business and government enterprises. Our enterprise threat and risk management platform collects, consolidates and correlates network and user activity data across the enterprise so that businesses can rapidly detect, diagnose and manage both internal and external threats and risks across the organization for activities associated with critical assets and processes. With our enterprise threat and risk management platform and products, organizations can use the ArcSight platform to reduce risk, identify vulnerabilities, comply with regulations and protect their high-value digital assets from cyber-theft, cyber-fraud, cyber-warfare and cyber-espionage.
 
The ArcSight enterprise threat and risk management platform for monitoring threats and risks is designed to allow our customers to achieve complete visibility, improved uptime and streamlined compliance by:
 
  •  capturing event data from any network-connected system;
 
  •  managing and storing event data;
 
  •  analyzing events in real time;
 
  •  identifying unusual behavior; and
 
  •  responding quickly to prevent loss.
 
Our enterprise threat and risk management platform, as illustrated below, includes our connector products, which collect event information from security point solutions, network and computing devices, databases, applications and other elements in an organization’s IT architecture, which we refer to as event sources. A single device or application can generate thousands of events in a single day, most of which are low priority and typically provides information about a narrow aspect of the infrastructure or only a portion of the threat or compliance risk involved. That information is used in our flagship security information and event management, or SIEM, products where complex algorithms determine if events taking place conform to normal patterns of behavior, established security policies and compliance regulations, so that threats and risks are identified. The event information is concurrently stored in our log management products. These products in turn initiate our threat response management product, as well as providing the foundation for an application layer of solution packages that are directed at specific vertical applications, such as our Payment Card Industry (PCI) compliance solutions, or horizontal applications, such as our EnterpriseView family of applications that address threats and risks beyond the security and compliance matters traditionally addressed by our SIEM and log management products.


4


Table of Contents

ArcSight Enterprise Threat and Risk Management Platform
 
(FLOW CHART)
 
Our SIEM products, ArcSight ESM and ArcSight Express, deliver a centralized, real-time view of all activity or events across geographically dispersed and heterogeneous business and technology infrastructures. Our log management products collect and store activity and event data for regulatory compliance, reporting and forensic analysis. Working together, these products collect, consolidate and correlate massive amounts of activity data, in the form of log events, from thousands of security point solutions, network and computing devices, databases and applications, enabling intelligent identification, prioritization and response to compliance and corporate policy violations, and external and insider threats. Our specialized software and application packages deliver pre-packaged analytics and reports tailored to specific compliance and security initiatives, such as Sarbanes-Oxley (SOX), PCI, user monitoring and fraud detection.
 
We have designed our platform to support the increasingly complex business and technology infrastructure of our customers. Our platform includes over 300 pre-built software connectors, called SmartConnnectors, for products from more than 100 vendors. It also integrates easily with products for which we do not provide pre-built connectors and with proprietary enterprise applications to ensure that event logs from these products are seamlessly integrated into our platform for intelligent consolidation, correlation and analysis. As of April 30, 2010, we have sold our products to more than 1,000 customers across a number of industries and government agencies in the United States and internationally, including companies in the Fortune Top 5 of the aerospace and defense, energy and utilities, financial services, food production and services, healthcare, high technology, insurance, media and entertainment, retail and telecommunications industries.
 
No customer accounted for more than 10% of our revenues in fiscal 2010, 2009 or 2008. Our top ten customers accounted for 22%, 23% and 26% of our product revenues during fiscal 2010, 2009 and 2008, respectively. See Note 9 of the notes to our Consolidated Financial Statements for a discussion of total revenues by geographical region for fiscal 2010, 2009 and 2008.


5


Table of Contents

Our Strategy
 
Our objective is to be the leading provider of enterprise threat and risk management solutions that protect enterprises and government agencies. To achieve this goal, we plan to:
 
  •  grow our customer base by further penetrating the Global 2000, expanding into new geographies and continuing to reach into the mid-market;
 
  •  further penetrate our existing customers by expanding their use of our platform across the enterprise and extending their use of our products to new use cases;
 
  •  extend and broaden our partner network, in particular with systems integrators, and continue to improve the effectiveness of our channel partners;
 
  •  extend our expertise in security and compliance best practices and launch new and innovative applications that open up additional markets or address specific security and compliance needs and use cases;
 
  •  continue to extend our value proposition to business use cases beyond traditional IT security and compliance, as with our recent IdentityView and FraudView products;
 
  •  extend our product offerings so that they are available in the form factor desired by the customer, including both software and appliance versions.
 
Our Solutions and Products
 
The primary components of our enterprise threat and risk management platform are our SIEM products, ArcSight ESM and ArcSight Express, and our ArcSight Logger suite of log management products. These products collect streaming activity data from the devices, applications and other elements in an organization’s IT architecture, which we refer to as event sources, and consolidate and translate the streaming data into a common format. The formatted and categorized data is then processed by the correlation engine in ArcSight ESM and ArcSight Express, where complex algorithms determine if events taking place conform to normal patterns of behavior, established security policies and compliance regulations. That data is also stored in ArcSight Logger for compliance reporting and forensic analysis. A single device or application can generate thousands of events in a single day, most of which are low priority and typically provides information about a narrow aspect of the infrastructure or only a portion of the threat or compliance risk involved. Our SIEM products identify and prioritize high-risk activity and present a consolidated view of IT security threats, deviations in compliance controls threats to the business and in rich, graphical displays. In addition, through our log management products, we enable efficient and scalable collection, storage, analysis and reporting of terabytes of enterprise log data for compliance requirements or forensic analysis. Our customers enhance the value of other compliance and security products in their business and technology infrastructure by integrating them with our enterprise threat and risk monitoring platform. Key benefits of our solutions include:
 
  •  Enterprise-Class Technology and Architecture.  We design our solutions to serve the needs of the largest organizations, which typically have highly complex, geographically dispersed and heterogeneous business and technology infrastructures. We deliver enterprise-class solutions by providing interoperability, flexibility, scalability and efficient archiving.
 
  •  Intelligent Correlation.  Our correlation engine intelligently distills millions of events occurring daily into information that allows customers to identify, analyze, prioritize and respond to specific threats, compliance violations and other events of interest.
 
  •  Comprehensive View.  We have designed our architecture to allow it to be extended for collection, consolidation and correlation of information from any network-connected system, enabling customers to potentially address business risk and operational effectiveness beyond the security and compliance use cases to which our products have traditionally been applied.
 
  •  Cost-Effective Consolidation and Storage.  Our log management suite provides easy, scalable, cost-effective storage and enables customers to demonstrate the integrity and availability of log data both in transit and at rest, facilitating automated compliance reporting and reducing the cost of audits.


6


Table of Contents

 
  •  Reporting and Visualization.  We present threat, compliance risk and other event information through a rich and intuitive graphical user interface, through which customers can view risk across their organization in a variety of ways, address internal and external compliance requirements and communicate the value and effectiveness of the organization’s security operations.
 
Customers can enhance these key benefits through deployment of one of our compliance applications, which are used in combination with our leading enterprise threat and risk management products to focus on security or particular compliance needs, ranging from SOX to Federal Information Security Management Act (FISMA) to PCI. For example, our compliance application for North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection, or CIP, supports compliance with NERC CIP standards 002-009. We provide other compliance applications for industry regulations such as PCI DSS, and for governmental regulations such as HIPAA and Sarbanes-Oxley. Our family of leading security and compliance management products includes:
 
ArcSight ESM.  ArcSight ESM, our flagship product, is designed specifically to address the compliance, security and business risk concerns of large, geographically-distributed organizations with complex, heterogeneous IT environments. ArcSight ESM serves as a centralized system for understanding and managing risks across an organization’s entire business and technology infrastructure. The key elements within ArcSight ESM include:
 
  •  ArcSight Manager.  ArcSight Manager, available as software or as an appliance, manages event aggregation and storage, controls the various elements of our platform and provides the engine for high-speed real-time correlation and incident response workflow. ArcSight Manager comes with standard rules that address common compliance and security issues and business risks. It also provides an intuitive system that enables customers to write customized rules that apply an organization’s compliance and security policies into the real-time analytics of the correlation engine, as well as seamless integration with rules generated by our ArcSight Threat Detector product. ArcSight Manager enables real-time collaboration and case management among security analysts, to track risk-prioritized response and remediation. In addition, it provides case resolution metrics to demonstrate compliance and security process and control effectiveness. Our case management system also can integrate with third-party trouble ticketing systems, such as the Remedy Service desk system from BMC Software. Our architecture was designed to allow customers to scale from a single centralized deployment to a distributed, global deployment by deploying additional Managers that work in concert.
 
  •  ArcSight Console, ArcSight Web and ArcSight Viewer.  ArcSight Console is the primary user interface to interact with and control ArcSight ESM. Through its intuitive interface, the Console provides administrators, analysts and operators with graphical data summaries and an intuitive interface to perform tasks ranging from real-time monitoring and analysis to incident investigation and response to system administration and authoring of new content. The Console is highly configurable to reflect individual customer environments and can display threat and risk information in a wide variety of formats including by geography, by division or line of business, by type of threat, and by compliance or policy initiative. With ArcSight Console, customers can run a wide variety of reports to answer internal and external compliance audits and communicate the value and effectiveness of the organization’s security operations. We also provide an authoring system that customers can use to create new reports to meet their specific business needs. ArcSight ESM contains hundreds of standard report templates that immediately address common compliance, security and business risk reporting requirements. To facilitate remote access for IT administrators as well as provide a portal for line-of-business viewing of status summaries and scheduled reports, our ArcSight Web product provides browser-based access to all Console functions and content, except administration and authoring, and our ArcSight Viewer product provides browser-based read-only access to all Console content.
 
ArcSight Logger.  ArcSight Logger, our suite of log management products, enables organizations to collect and store event data in support of security and compliance requirements. It is available in a variety of feature sets and capacities either as software or one or more appliances. ArcSight Logger provides customers with an easily searchable log data repository, together with reporting capabilities, that can be leveraged across networking, security and IT operations teams. As with ArcSight ESM, ArcSight Logger provides administrators, analysts and operators with graphical data summaries and an intuitive interface to perform search, reporting and management tasks. Access controls and intelligent search technology enable customers to interact with historical raw event data


7


Table of Contents

for insight into specific events. ArcSight Logger currently captures raw logs at sustained rates of up to 100,000 events per second per appliance and provides approximately 10:1 compression capability for event data, storing 40 terabytes or more of data on a single appliance. ArcSight Logger software can be deployed on multiple servers, or multiple appliances can be deployed, to linearly scale both storage and performance. Large organizations with multiple administrative domains or managed security service providers can choose to deploy multiple ArcSight Logger installations or appliances in a hierarchical or peer-to-peer manner to extend capacity and performance as needed. Because multiple ArcSight Logger instances operate as an array, a comprehensive view into enterprise-wide log data remains available. ArcSight Logger can flexibly and selectively forward security events to ArcSight ESM for real-time, cross-device correlation, visualization and threat detection. In turn, ArcSight ESM can send correlated alerts back to ArcSight Logger for archiving and subsequent retrieval.
 
ArcSight Express.  ArcSight Express is a set of SIEM and log management appliances designed for smaller organizations with fewer resources for managing a network security and compliance program. ArcSight Express includes many of the same correlation functions as ArcSight ESM, and many of the same log management functions of ArcSight Logger. These are presented in a simplified, pre-configured appliance solution, at different price points aimed at organizations of different size and needs. ArcSight Express includes pre-built rules, reports, and dashboards for monitoring network security, user activity and regulatory compliance.
 
ArcSight Connectors.  Connectors collect event data streams from sources across an organization’s business and technology infrastructure and feed that event data to our ESM, ArcSight Logger, ArcSight Express and ArcSight FraudView products. Our connectors are available as software or appliances, which available in a range of feature sets and throughput capacities. These connectors implement extensive normalization and categorization capabilities to restructure event data into a common taxonomy so events from hundreds of different sources can be compared meaningfully and queried systematically irrespective of which device is reporting the information. The normalized event data stream is then intelligently aggregated and compressed to eliminate irrelevant and duplicate messages and reduce bandwidth and storage consumption. Our SmartConnectors receive and translate event data streams from over 300 different devices and applications from more than 100 vendors and in more than 36 different solution categories. Further, using our FlexConnector toolkit, our customers can create custom connectors tailored to their environment, such as for new products, proprietary applications and mainframe and other legacy systems. Our connectors can be deployed on intermediate collection points, such as third-party management consoles, where available, avoiding the requirement to provision our connectors directly onto end devices.
 
ArcSight EnterpriseView Applications.  Our EnterpriseView family of applications apply our threat and risk detection technologies to address areas beyond traditional security and compliance matters.
 
  •  ArcSight IdentityView.  ArcSight IdentityView is a software application that enables customers to detect increased risk from activities performed by employees, contractors and other users of internal corporate systems. It allows enterprise customers to address insider threat and fraud risks as well as compliance and audit needs. IdentityView includes specialized connectors to leading identity and access management, or IAM, systems and directories and pre-built capabilities for correlating multiple user accounts to a single identity. From that, pre-built or user-defined rules for fraud detection and unauthorized actions analyze this information to determine if the user is performing unauthorized activities. The pre-packaged reports and dashboards include access rights and group membership analysis, user risk analysis by department or job function and comprehensive activity reporting for any user over any time period. IdentityView also utilizes the technology underlying our ArcSight Threat Detector module to automatically create new risk profiles employing IAM information.
 
  •  ArcSight FraudView.  The ArcSight FraudView appliance enables our financial services customers to detect and prevent or mitigate online fraud by evaluating and scoring financial transactions in real-time (rather than simply performing after the fact forensic analysis). It evaluates risk factors related to the type of transaction, the account involved, the destination and the device involved to address account takeover, fraudulent transaction initiation and false account creation. That helps reduce the financial institution’s penalty fees, revenue loss and operating expenses. ArcSight FraudView correlates activity across multiple financial transaction channels to detect sophisticated fraud schemes that span online, ATM, telephone and branch activity, as well as correlating and adjusting risk profiles over time. ArcSight FraudView can


8


Table of Contents

  aggregate information from a variety of risk and fraud scoring products already available to a financial firm, such as a blacklist feed, to create a single, high-level risk score of any transaction, as it occurs. As a result, banks can better leverage their investments in legacy fraud detection technologies. The pre-packaged reports and dashboards include automatic watchlist and case creation, as well as analyst desktop tools that facilitate incident investigation and annotation, case management, notification and response. ArcSight FraudView also utilizes the technology underlying our ArcSight Threat Detector module to automatically update or create new risk profiles and rules and to enable multi-path detection.
 
ArcSight Compliance Applications.  We offer pre-packaged add-on applications that enable our ESM, ArcSight Logger and ArcSight Express products to provide technical-and business-level checks on corporate compliance with regulatory and policy requirements for perimeter security, protection of key business processes, threat management and incident response. These applications comprise relevant rules and reports to accelerate implementation by our customers, and can be customized or extended by the customer. These tailored monitoring, assesments and reporting packages address specific security, regulatory or policy concerns, including IT governance, SOX and the Japanese analogue of Sarbanes-Oxley (J-SOX), FISMA, PCI, NERC CIP standards 002-009, Gramm-Leach-Bliley Act (GLBA), Health Insurance Portability and Accountability Act (HIPAA), Basel II Framework, International Standardization Organization/International Electrotechnical Commission (ISO/IEC 27002:2005) and National Institute of Standards and Technology (NIST 800-53) compliance.
 
ArcSight Threat Detector.  Our ArcSight Threat Detector software is a powerful complement to our correlation engine. It is an advanced pattern identification engine that retrospectively examines large amounts of security events previously collected and processed by ArcSight ESM or ArcSight Express to discover patterns of activity that may be characteristic of threats, such as emerging worms, new worm variants, self-concealing malware, and low profile, slowly developing attacks. ArcSight Threat Detector proactively alerts the security operations analyst about existing or emerging patterns that are not comprehended by any rules in our correlation engine, and provides the customer the option to classify the patterns and also to optionally or automatically generate new rules for our SIEM products that will detect and respond to similar threatening patterns in the future.
 
ArcSight Interactive Discovery  Our ArcSight Interactive Discovery visualization software helps IT security professionals pan, zoom and switch perspectives across complex technical data to perform in-depth analysis of security data as well as featuring visuals and drill-down capabilities that enable non-technical employees to see relevant threat information in a non-technical format.
 
ArcSight TRM (Threat Response Manager).  ArcSight TRM is an appliance that enables customers to quickly and precisely reconfigure network control devices to remediate security, compliance and business risks, consistent with an organization’s policy directives. ArcSight TRM profiles a network’s topology through communication with devices without the need to install a software agent on the device. Through advanced algorithms, it can identify the exact location of any node (wireless, wired or VPN) on the network, analyze, recommend and, at the customer’s option, execute specific, policy-based actions in response to a threat, attack or other out-of-policy situation. ArcSight TRM can block, quarantine or filter undesirable users and systems at the individual port level. ArcSight TRM integrates seamlessly with ArcSight ESM or ArcSight Express to accelerate incident response by facilitating the coordination between the security and networking groups, thus improving the effectiveness of the response and acute remediation function.
 
ArcSight NCM (Network Configuration Manager).  ArcSight NCM is an appliance that automates the audit of network topology, maintaining protected records of all prior configurations for purposes of rollback, audit and compliance reporting. ArcSight NCM presents network topology in a visual format, allowing organizations to identify mis-configurations, redundant links and multiple wide area network (WAN) access routes. ArcSight NCM dynamically compares existing device configuration and highlights discrepancies from desired configuration policies that generally map to regulatory requirements, operational guidelines and business rules.
 
Maintenance and Professional Services
 
We offer a range of services in connection with or after a sale occurs, principally installation and implementation, project planning, advice on business use cases and training services that complement our product offerings. Initial implementation of ArcSight ESM is typically accomplished within two to four weeks, and we


9


Table of Contents

expect an implementation of ArcSight FraudView to take approximately four to twelve weeks, while our ArcSight Logger, ArcSight Express and other appliance products are typically implemented in a matter of days. On an ongoing basis, we offer consulting services and training related to application of our enterprise threat and risk management platform to address additional or customer-specific security and compliance issues and business risks.
 
For large enterprise customers, for which design, staffing and operation of a security operations center, or SOC, is not a part of their core IT expertise, we offer turnkey SOC service engagements through which we and our partners provide these functions and customize them for the customer. SOC engagements are typically longer in duration than other services engagements and support the day-to-day monitoring of customer SOC environments. We intend to partner with larger system integrators to provide a substantial portion of the personnel used to provide SOC services.
 
Following deployment, our technical support organization provides ongoing maintenance for our products. We provide standard and, for customers that require 24-hour coverage seven days a week, premium tiers of maintenance and support, which include telephone- and web-based technical support and updates, if and when available, to our products during the period of coverage. Our three major support centers are located in Hong Kong, London and Cupertino, California. In addition, we sell an enhanced maintenance service that provides security content updates for our SIEM products and extended hardware maintenance for our appliance products. These content updates reflect emerging threats and risks in the form of signature categorization, vulnerability mapping and knowledge base articles on an ongoing basis.
 
Research and Development
 
Building on our history of innovation, we believe that continued and timely development of new products and enhancements to our existing products are necessary to maintain our competitive position. Accordingly, we have invested, and intend to continue to invest, significant time and resources in our research and development activities to extend our technology leadership. At present, our research and development efforts are focused on improving and broadening the capabilities of each of our major product lines and developing additional products. We work closely with our customers, as well as technology partners, to understand their emerging requirements and use cases for our products. As of April 30, 2010, our research and development team had 134 employees. Our research and development expenses were $26.3 million, $22.5 million and $19.8 million during fiscal 2010, 2009 and 2008, respectively.
 
Sales and Marketing
 
We market and sell our products through our direct sales organization and indirectly through resellers and systems integrators. Historically, the majority of our domestic sales are made through our direct sales organization, while international sales have primarily been made through our resellers and other channel partners, while sales to U.S. federal government customers are often through our direct sales organization, resellers and systems integrators. Additionally, a small but growing percentage of sales transactions involving our appliance products are completed without any involvement from ArcSight. We structure our sales organization by function, including direct and channel sales, strategic accounts, technical pre-sales, customer and sales operations, and by region, including Americas, U.S. Federal, Europe, Middle East and Africa, or EMEA, Asia Pacific, or APAC, and Japan. As of April 30, 2010, we had 177 employees in our sales and marketing organizations.
 
The selling process for our products follows a typical enterprise software sales cycle. It generally involves one or more of our direct sales representatives, even when a channel partner is involved. The sales cycle for an initial sale normally takes from three to six months, but can extend to more than a year for some sales of ArcSight ESM, from the time of initial prospect qualification to consummation, and typically includes product demonstrations and proof of concepts. We deploy a combination of field account management supported by technical pre-sales specialists to manage the activities from qualification through close. After initial deployment, our sales personnel focus on ongoing account management and follow-on sales. To assist our customers with reaching their business and technical goals for their implementations of our products, our Global Services Organization meets with customers to determine their success criteria and to help formulate both short- and long-term plans for their


10


Table of Contents

deployments of our products. We also have assigned specific sales personnel to our larger, more diverse and often global customers in order to understand their individual needs and increase customer satisfaction.
 
We derive a portion of our revenues from sales of our products and related services through channel partners, such as resellers and systems integrators. In particular, systems integrators are an important source of sales leads for us in the U.S. public sector, as government agencies often rely on them to meet IT needs, and we use resellers to augment our internal resources in international markets and, to a lesser but increasing extent, domestically. Our agreements with our channel partners are generally non-exclusive. Historically, we used our channel partners to support direct sales of our enterprise threat and risk management platform products. Sometimes we are required by our U.S. government customers to utilize particular resellers. We anticipate that we will derive a significant portion of our ArcSight Express sales through channel partners. We also anticipate that we will derive a substantial portion of our ArcSight Logger product sales to the mid-market through channel partners. We are currently engaged in a program to increase the effectiveness of our channel partners, while continuing to broaden our channel program, but with a decreased emphasis on adding new channel partners. In part to address the mid-market, we created a dedicated channel team in each of our geographic regions responsible for recruiting, managing and supporting our channel partners and for developing channel partners that will operate more independently.
 
We focus our marketing efforts on building brand awareness and on customer lead generation, including advertising, cooperative marketing, public relations activities, web-based seminars and targeted direct mail and e-mail campaigns. We also are building our brand through articles contributed to various trade magazines, public speaking opportunities and international, national and regional trade show participation. We reinforce our brand and loyalty among our customer base with our annual users conference.
 
Competition
 
We offer a range of enterprise threat and risk management products ranging from our SIEM and log management products to our related connector and response products and complementary solution software and packages. Our products address traditional security and compliance concerns, as well as a range of other risks that businesses face. We believe that there are three primary sources of competition or potential competition for our products and related professional services: custom internal efforts; specialized startup companies; and large software companies.
 
A significant source of competition is represented by the custom efforts undertaken by potential customers to analyze and manage the information produced from their existing devices and applications to identify and remediate threats and satisfy compliance requirements. We believe that, over the last several years, a declining portion of potential customers are undertaking such customer efforts, and expect that trend to continue. In addition, some organizations have outsourced these functions to managed security services providers.
 
For customers that choose to purchase a commercial product rather than developing their own solution, a significant number of specialized, privately-held companies, such as LogLogic, netForensics, NitroSecurity, Q1 Labs and SenSage, have developed, or are developing, products that currently, or in the future are likely to, compete with some or all of our products. This includes companies with log management products that are adding SIEM functionality to their offerings and SIEM companies adding some form of log management product to their offerings, as the two fields converge. These specialized, privately-held companies primarily target their offerings at mid-market and smaller companies. In addition, specialized, privately-held companies competing with us may price their products more competitively than ours, or have an entirely different pricing or distribution model, such as making introductory versions with limited functionality available as freeware products. Further, specialized, privately-held companies have sometimes chosen, and in the future may choose, to partner with larger security-focused software vendors or large diversified enterprise software and hardware vendors to market and sell their competitive products. Partnerships such as these enable specialized, privately-held companies the ability to scale, and allows larger companies the ability to offer product suites that directly compete with ours, enabling both a competitive advantage over us that would otherwise be unavailable to them.
 
We also continue to experience competition with several larger security-focused software vendors that offer functionality such as ours, primarily SIEM, as a component of suites of products that include software applications for security and compliance and enterprise management, and in some cases as a point solution. Further, as the


11


Table of Contents

market for our enterprise threat and risk management platform continues to grow, we expect that large diversified enterprise software and hardware vendors may seek to enter this market, either by way of the organic development of a competing product line or through the acquisition of a competitor. Larger software vendors that are current or potential competitors include EMC, IBM, Novell and Symantec. Competitors that offer a large array of security or software products may be able to offer products or functionality similar to ours at a more attractive price than we can by integrating or bundling them with their other product offerings.
 
We have emerged as a leader in our market by competing successfully against both small and large companies. If our target market continues to grow small, highly specialized competitors may continue to emerge, and large software vendors may continue to add to integrate or bundle their array of security or software products with their other product offerings.
 
Mergers, acquisitions or consolidations by and among actual and potential competitors present heightened competitive challenges to our business. The consolidation in our industry increases the likelihood of competition based on integration or bundling, particularly where competitors’ products and offerings are effectively integrated, and we believe that consolidation in our industry may increase the competitive pressures we face on all our products. If we are unable to sufficiently differentiate our products from the integrated or bundled products of our competitors, such as by offering enhanced functionality, performance or value, we may see a decrease in demand for those products, which would adversely affect our business, operating results and financial condition. Further, it is possible that continued industry consolidation may impact customers’ perceptions of the viability of smaller or even medium-sized software firms and consequently customers’ willingness to purchase from such firms. Similarly, if customers seek to concentrate their software purchases in the product portfolios of a few large providers, we may be at a competitive disadvantage notwithstanding the superior performance that we believe our products can deliver. We believe that in order to remain competitive at the large enterprise level, we will need to develop and expand relationships with the large system integrators that provide broad ranging products for these governmental and civilian customers.
 
For our ESM product, we believe that we compete principally at the large enterprise level on the basis of functionality, analytical capability, scalability, interoperability with other components of the network and business infrastructure, and customers’ ability to successfully and rapidly deploy the product. We believe that we compete favorably with our existing competitors with respect to these factors. At the mid-market, where customers do not require the full range of features and functionality available in our ESM product, we compete with our ArcSight Express product. In this segment of the market potential customers may elect to purchase a less feature-rich product, and a number of specialized, privately-held companies are pursuing that portion of the market with lower priced products with fewer features. We have designed our ArcSight Express offering to compete favorably with our existing competitors on the factors that are important in this market.
 
The market for our ArcSight Logger products is also competitive, particularly when sold separately from a SIEM product. We continue to believe that success in this market depends on our ability to continue working more effectively with channel partners. We may be at a disadvantage in dealing with channel partners, who also may have relationships with large competitors that offer a wide variety of products.
 
The primary competitive factors for our appliance products are functionality, price, scalability, interoperability with other components of the network and customers’ ability to successfully and rapidly deploy the product. We believe that we currently compete favorably with respect to these factors.
 
Increased competition could result in fewer customer orders, price reductions, reduced gross margins and loss of market share. Many of our existing and potential competitors, particularly larger companies, enjoy substantial competitive advantages, such as wider geographic presence, access to larger customer bases and the capacity to leverage their sales efforts and marketing expenditures across a broader portfolio of products, and substantially greater financial, technical and other resources. As a result, they may be able to adapt more quickly and effectively to new or emerging technologies and changing opportunities, standards or customer requirements. In addition, large competitors, such as integrated software companies and diversified, global hardware vendors, may regularly sell enterprise-wide and other large software applications, or large amounts of infrastructure hardware, to, and may have more extensive relationships within, large enterprises and government agencies worldwide, which may provide them with an important advantage in competing for business with those potential customers.


12


Table of Contents

Intellectual Property
 
Our intellectual property is an essential element of our business. We use a combination of copyright, patent, trademark, trade secret and other intellectual property laws, confidentiality agreements and license agreements to protect our intellectual property. It is our policy that our employees and independent contractors involved in development are required to sign agreements acknowledging that all inventions, trade secrets, works of authorship, developments and other processes generated by them on our behalf are our property, and assigning to us any ownership that they may claim in those works. Despite our precautions, it may be possible for third parties to obtain and use without consent intellectual property that we own or license. Unauthorized use of our intellectual property by third parties, and the expenses incurred in protecting our intellectual property rights, may adversely affect our business.
 
Patents and Patent Applications.  We have twelve issued patents and a number of patent applications pending in the United States, internationally and in specific foreign countries. We expect to file additional patent applications from time to time. Our issued patents expire between 2024 and 2028. We do not know whether any of our outstanding patent applications will result in the issuance of a patent, and even if additional patents are ultimately issued, the examination process may require us to narrow our claims. Our issued patents may be contested, circumvented, found unenforceable or invalidated, and we may not be able to prevent third parties from infringing them. Therefore, the exact effect of having a patent cannot be predicted with certainty.
 
Oracle License Agreement.  We license database software from Oracle that we integrate with our SIEM products. Our agreement with Oracle, which runs through May 2011, permits us to distribute Oracle database software embedded in our SIEM products for customers who may not have already acquired their own Oracle licenses. Under this agreement, we have agreed to make third-party royalty payments totaling $4.8 million over the term of the license.
 
From time to time, we may encounter disputes over rights and obligations concerning intellectual property. Although we believe that our product offerings do not infringe the intellectual property rights of any third party, we cannot be certain that we will prevail in any intellectual property dispute. If we do not prevail in these disputes, we may lose some or all of our intellectual property protection, be enjoined from further sales of our products that are determined to infringe the rights of others, and/or be forced to pay substantial royalties to a third party, any of which would adversely affect our business, financial condition and results of operations.
 
Employees
 
As of April 30, 2010, we had a total of 512 employees, consisting of 177 employees in sales and marketing, 134 employees in research and development, 86 employees in professional services, 48 employees in support and 67 employees in general and administrative functions. A total of 79 employees are located outside the United States. None of our employees is represented by a union or covered by a collective bargaining agreement. We consider our employee relations to be good and have never experienced a work stoppage.
 
Corporate History and Information
 
We were incorporated in Delaware on May 3, 2000 as Wahoo Technologies, Inc. On March 30, 2001, we changed our name to ArcSight, Inc. Our principal executive offices are located at 5 Results Way, Cupertino, California 95014, and our telephone number is (408) 864-2600. We launched our first product in January 2002, and made our first product sale in June 2002. Our revenues have grown from $0.2 million in fiscal 2002 and $32.8 million in fiscal 2005 to $181.4 million in the fiscal 2010. We initially funded our operations primarily through convertible preferred stock financings that raised a total of $26.8 million. We completed our initial public offering, or IPO, in February 2008.
 
We believe that our product revenue has been somewhat seasonal historically, increasing in each quarter through the fiscal year, but with the first quarter of our fiscal year typically having relatively lower product revenue compared to the fourth fiscal quarter. However, we believe that there are significant seasonal factors that may cause the second and fourth quarters of our fiscal year to have relatively higher product revenue (with the first and third fiscal quarters each potentially having lower revenue than the immediately preceding fiscal quarter), and that our


13


Table of Contents

rapid historical growth and the required timing of new compliance mandates may have overshadowed the nature or magnitude of seasonal or cyclical factors that might have influenced our business to date. See the discussion of seasonality under “Sources of Revenues, Cost of Revenues and Operating Expenses — Product Revenues” in Item 7. “Management’s Discussion and Analysis of Financial Condition and Results of Operations” for a more complete description of the factors contributing to seasonal variation in our business.
 
“ArcSight” and the ArcSight logo are registered trademarks of ArcSight in the United States and in some other countries. Where not registered, these marks and “ArcSight Console,” “ArcSight Express,” “ArcSight Manager,” “ArcSight Web,” “ArcSight EnterpriseView,” “FlexConnector,” “ArcSight FraudView,” “ArcSight IdentityView,” “ArcSight Logger,” “ArcSight NCM,” “SmartConnector,” “ArcSight TRM,” “ArcSight Viewer,” “ArcSight Interactive Discovery,” “ArcSight ESM” and “ArcSight Threat Detector” are trademarks of ArcSight.
 
Available Information
 
Our Internet address is www.arcsight.com. There we make available, free of charge, our annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K and any amendments to those reports, as soon as reasonably practicable after we electronically file such material with, or furnish it to, the SEC. Our SEC reports can be accessed through the Investor Relations section of our website. The information found on our website is not part of this or any other report we file with or furnish to the SEC. The SEC also maintains an Internet website that contains reports, proxy and information statements and other information regarding registrants, such as ArcSight, that file electronically with the SEC. The address of the website is www.sec.gov. In addition, you may read and copy any filing that we make with the SEC at the public reference room maintained by the SEC, located at 100 F Street, N.E., Washington, D.C. 20549. Please call the SEC at 1-800-SEC-0330 for further information about the public reference room.
 
Item 1A.   Risk Factors
 
Risk Related to Our Business and Industry
 
Our future operating results may fluctuate significantly and our current operating results may not be a good indication of our future performance.
 
Our revenues and operating results could vary significantly from period to period as a result of a variety of factors, many of which are outside of our control. As a result, comparing our revenues and operating results on a period-to-period basis may not be meaningful, and you should not rely on our past results as an indication of our future performance. We may not be able to accurately predict our future revenues or results of operations. We base our current and future expense levels on our operating plans and sales forecasts, and our operating costs are relatively fixed in the short-term. As a result, we may not be able to reduce our costs sufficiently to compensate for an unexpected shortfall in revenues, and even a small shortfall in revenues could disproportionately and adversely affect financial results for that quarter. In addition, we recognize revenues from sales to some customers or resellers when cash is received, which may be delayed because of changes or issues with those customers or resellers. If our revenues or operating results fall below the expectations of investors or any securities analysts that cover our stock, the price of our common stock could decline substantially.
 
In addition to other risk factors listed in this section, factors that may affect our operating results include:
 
  •  the timing of our sales during the quarter, particularly since a large portion of our sales occurs in the last few weeks of the quarter and loss or delay of a few large contracts may have a significant adverse impact on our operating results;
 
  •  changes in the mix of revenues attributable to higher-margin revenues from ESM products as opposed to lower-margin revenues from sales of our appliance products;
 
  •  the timing of satisfying revenue recognition criteria, including, for example, establishing (1) vendor-specific objective evidence of fair value, or VSOE, for new products and maintaining VSOE for maintenance and services, particularly where we accrue the associated commission expense in a different period, and (2) sufficient history with respect to our newly introduced appliance licensing model such that revenue


14


Table of Contents

  recognition criteria would be met on shipment of our appliances, rather than delaying revenue recognition until payment for these transactions which we will be required to do until such history is established;
 
  •  changes in the renewal rate of maintenance agreements;
 
  •  our ability to estimate warranty claims accurately;
 
  •  general economic conditions, both domestically and in our foreign markets, and economic conditions specifically affecting industries in which our customers participate, such as the impact of the continuing instability in global and U.S. economic and financial market conditions, including the recent instability in Europe; and
 
  •  the impact of Accounting Standards Codification, or ASC, Topic ASC 740-10, Accounting for Uncertainty in Income Taxes, which requires us to establish reserves for uncertain tax positions and accrue potential tax penalties and interest.
 
Our sales cycle is long and unpredictable, and our sales efforts require considerable time and expense. As a result, our revenues are difficult to predict and may vary substantially from quarter to quarter, which may cause our operating results to fluctuate.
 
Our operating results may fluctuate, in part, because of the intensive nature of our sales efforts, the length and variability of the sales cycle of our ESM products and the short-term difficulty in adjusting our operating expenses. Because decisions to purchase products such as our ESM products involve significant capital commitments by customers, potential customers generally have our products evaluated at multiple levels within an organization, each often having specific and conflicting requirements. Enterprise customers make product purchasing decisions based in part on factors not directly related to the features of the products, including but not limited to the customers’ projections of business growth, uncertainty regarding economic conditions, capital budgets and anticipated cost savings from implementation of the software. As a result of these factors, selling our products often requires an extensive effort throughout a customer’s organization. The continuing instability in global and U.S. economic and financial market conditions has increased the duration of our sales cycle and requires greater intensity of our sales efforts as customers review their spending decisions. In addition, we have less experience with sales of ArcSight Express and some of our other appliance products. As a result, the sales cycle for these products may be lengthy or may vary significantly. Our sales efforts involve educating our customers, who are often relatively unfamiliar with our products and their technical capabilities, as well as the value of our products, including the potential cost savings to the organization that our products may generate. We spend substantial time, effort and money in our sales efforts without any assurance that our efforts will produce any sales.
 
The length of our sales cycle, from initial evaluation to delivery of products, tends to be long and varies substantially from customer to customer. Our sales cycle is typically three to six months but can extend to more than a year for some sales. We typically recognize a large portion of our product revenues in the last few weeks of a quarter. It is difficult to predict exactly when, or even if, we will actually make a sale with a potential customer. As a result, large individual sales have, in some cases, occurred in quarters subsequent to those we anticipated, or have not occurred at all. The loss or delay of one or more large product transactions in a quarter could impact our operating results for that quarter and any future quarters for which revenues from that transaction are delayed. As a result of these factors, it is difficult for us to accurately forecast product revenues in any quarter. Because a substantial portion of our expenses are relatively fixed in the short-term, our operating results will suffer if revenues fall below our expectations in a particular quarter, which could cause the price of our common stock to decline significantly.
 
If we fail to enhance and manage our distribution channels, our revenues could decline and our growth prospects could suffer.
 
We derive a portion of our revenues from sales of our products and related services through channel partners, such as resellers and systems integrators. In particular, systems integrators are an important source of sales leads for us in the U.S. public sector, as government agencies often rely on them to meet information technology, or IT, needs. We also use resellers to augment our internal resources in international markets and domestically. We may be


15


Table of Contents

required by our U.S. government customers to utilize particular resellers that may not meet our criteria for creditworthiness, and revenues from those resellers may not be recognizable until receipt of payment. We have derived, and anticipate that in the future we will continue to derive, a substantial portion of the sales of ArcSight Logger and other appliance products through channel partners, including parties with which we have not yet developed relationships. We expect that channel sales will represent a substantial portion of our revenues for the foreseeable future. In order to scale our channel program to support growth in our business, it is important that we continue to help our partners enhance their ability to independently sell and deploy our products. We may be unable to continue to successfully expand and improve the effectiveness of our channel sales program. If we do not successfully execute our strategy to increase channel sales, particularly to further develop relationships with systems integrators to facilitate sales to large enterprises and agencies of the U.S. government, penetrate the mid-market and sell our appliance products, our growth prospects may be materially and adversely affected.
 
Our agreements with our channel partners are generally non-exclusive and many of our channel partners have more established relationships with our competitors. If our channel partners do not effectively market and sell our products, if they choose to place greater emphasis on products of their own or those offered by our competitors, or if they fail to meet the needs of our customers, our ability to grow our business and sell our products may be adversely affected. Similarly, the loss of a substantial number of our channel partners, who may cease marketing our products and services with limited or no notice and with little or no penalty, and our possible inability to replace them, the failure to recruit additional channel partners, or any reduction or delay in their sales of our products and services or conflicts between channel sales and our direct sales and marketing activities could materially and adversely affect our results of operations. In addition, increases in the proportion of our revenues attributable to sales by channel partners, which are more likely than direct sales to involve collectability concerns at the time of contract execution and product delivery, in particular with channel partners in developing markets, may cause our operating results to fluctuate from period to period.
 
We operate in an evolving market that has not yet reached widespread adoption and have a history of losses, and we may not be profitable in the future.
 
We launched our ESM products in January 2002 and our first ArcSight Logger product in December 2006. Because the market for our products is rapidly evolving and has not yet reached widespread adoption, it is difficult for us to predict our operating results and the ultimate size of the market for our products. Although we recorded net income of $28.4 million and $9.9 million for the fiscal years ended April 30, 2010 and April 30, 2009, respectively, we have a history of losses from operations, incurring losses from operations of $1.4 million, $0.3 million and $16.8 million for the fiscal years ended April 30, 2008, 2007 and 2006, respectively. As of April 30, 2010, our accumulated deficit was $8.4 million. We expect our operating expenses to increase over the next several years as we hire additional sales and marketing personnel, expand and improve the effectiveness of our distribution channel program and develop our technology and new products. In addition, we have incurred, and anticipate that we will continue to incur, significant legal, accounting and other expenses relating to being a public company. If our revenues do not increase to offset these expected increases in operating expenses, we may not continue to be profitable in future periods. Our historical revenue growth has been inconsistent and should not be considered indicative of our future performance. See the section entitled “Management’s Discussion and Analysis of Financial Condition and Results of Operations — Sources of Revenue, Cost of Revenues and Operating Expenses.” Further, in future periods, our revenues could decline and, accordingly, we may not be able to sustain or increase profitability on a consistent basis, which may result in a decline in our common stock price.
 
If we are unable to successfully develop and market new products, make enhancements to our existing products or expand our offerings into new markets, our business may not grow and our operating results may suffer.
 
We introduced our most recent ArcSight ESM product in June 2010 and we are currently developing new versions of this product and our Logger product, as well as developing new products in our ETRM platform and new complementary products. Our growth strategy and future financial performance will depend, in part, on our ability to market and sell these products and to diversify our offerings by successfully developing, timely introducing and gaining customer acceptance of new products.


16


Table of Contents

The software in our products, particularly our ArcSight ESM and ArcSight Express products, is especially complex because it must recognize, effectively interact with and manage a wide variety of devices and applications, and identify and respond to new and increasingly sophisticated security threats and other risks, while not impeding the high network performance demanded by our customers. The typical development cycle for a patch to our ESM software is one to three months, a service pack is usually four to six months and a new version or major sub-version is generally 12 to 18 months, and are released when and if available. Customers and industry analysts expect speedy introduction of software to respond to new threats and risks and to add new functionality, and we may be unable to meet these expectations. Since developing new products or new versions of, or add-ons to, existing products is complex, the timetable for their commercial release is difficult to predict and may vary from our historical experience, which could result in delays in their introduction from anticipated or announced release dates. We may not offer updates as rapidly as new threats affect our customers. If we do not quickly respond to the rapidly changing and rigorous needs of our customers by developing and introducing on a timely basis new and effective products, upgrades and services that can respond adequately to new security threats, our competitive position, business and growth prospects will be harmed.
 
Diversifying our product offerings and expanding into new markets will require significant investment and planning, will bring us more directly into competition with software providers that may be better established or have greater resources than we do, will require additional investment of time and resources in the development and training of our channel and strategic partners and will entail significant risk of failure. Sales of our ArcSight Logger and ArcSight Express products and other products that we may develop and market may reduce revenues of our flagship ESM product and our overall margin by offering a subset of features or capabilities of our flagship ESM product at a reduced price with a lower gross margin. If the average selling price for orders of such alternate products is lower, we may need to sell to a larger number of customers to achieve equivalent revenues, potentially incurring increased sales, marketing and general and administrative expenses in support of those sales. Moreover, increased emphasis on the sale of our appliance products, add-on products or new product lines could distract us from sales of our core ArcSight ESM offering, negatively affecting our overall sales. If we fail or delay in diversifying our existing offerings or expanding into new markets, or we are unsuccessful competing in these new markets, our business, operating results and prospects may suffer.
 
Our business depends, in part, on sales to the public sector, and significant changes in the contracting or fiscal policies of the public sector could have a material adverse effect on our business.
 
We derive a portion of our revenues from contracts with federal, state, local and foreign governments and government agencies, and we believe that the success and growth of our business will continue to depend on our successful procurement of government contracts. For example, we have historically derived, and expect to continue to derive, a significant portion of our revenues from sales to agencies of the U.S. federal government, either directly by us or through systems integrators and other resellers. In the fiscal years ended April 30, 2010, 2009 and 2008, we derived 32%, 22% and 20% of our revenues, respectively, from contracts with agencies of the U.S. federal government. Accordingly:
 
  •  changes in fiscal or contracting policies or decreases in available government funding;
 
  •  changes in government programs or applicable requirements;
 
  •  the adoption of new laws or regulations or changes to existing laws or regulations;
 
  •  changes in political or social attitudes with respect to security issues; and
 
  •  potential delays or changes in the government appropriations process, including actions such as spending freezes implemented to address political or fiscal policy concerns,
 
could cause governments and governmental agencies to delay or refrain from purchasing the products and services that we offer in the future or otherwise have an adverse effect on our business, financial condition and results of operations.


17


Table of Contents

We face intense competition in our market, including with larger, better-known companies, and we may be unable to simultaneously compete effectively for enterprise threat and risk management opportunities at both the large enterprise level and for smaller mid-size customers.
 
The market for enterprise threat and risk management products is intensely competitive, and we expect competition to increase in the future. We believe that there are three primary sources of competition or potential competition for our products and related professional services:
 
  •  custom internal efforts;
 
  •  specialized startup companies; and
 
  •  large software companies.
 
A significant source of competition, is represented by custom efforts undertaken by potential customers to analyze and manage the information produced from their existing devices and applications to identify and remediate threats and satisfy compliance requirements. While we believe that over the last several years a declining portion of potential customers are undertaking such custom efforts, that apparent trend may not continue. In addition, some organizations have outsourced these functions to managed security services providers.
 
For customers that choose to purchase a commercial product rather than developing their own solution, a significant number of specialized, privately-held companies, such as LogLogic, netForensics, NitroSecurity, Q1 Labs and SenSage, have developed, or are developing, products that currently, or in the future are likely to, compete with some or all of our products. This includes companies with log management products that are adding SIEM functionality to their offerings and SIEM companies adding some form of log management product to their offerings, as the two fields converge.
 
We also continue to experience competition from several larger security-focused software vendors, such as EMC, that offer functionality such as ours, primarily SIEM, as a component of suites of products that include software applications for security and compliance and enterprise management, and in some cases as a point solution. Further, as the market for our enterprise threat and risk management platform continues to grow, we expect that large diversified enterprise software and hardware vendors may seek to enter this market, either by way of the organic development of a competing product line or through the acquisition of a competitor. Competitors that offer a large array of security or software products may be able to offer products or functionality similar to ours at a more attractive price than we can by integrating or bundling them with their other product offerings.
 
We anticipate that mergers, acquisitions or consolidations by and among actual and potential competitors will continue to accelerate. For example, in the last five years, IBM has acquired Internet Security Systems, Inc., Micromuse and Consul, Novell acquired e-Security, EMC acquired Network Intelligence and recently announced an agreement to acquire Archer Technologies and TrustWave acquired Intellitactics. Acquisitions such as these present heightened competitive challenges to our business. The consolidation in our industry increases the likelihood of competition based on integration or bundling, particularly where their products and offerings are effectively integrated, and we believe that consolidation in our industry may increase the competitive pressures we face on all our products. If we are unable to sufficiently differentiate our products from the integrated or bundled products of our competitors, such as by offering enhanced functionality, performance or value, we may see a decrease in demand for those products, which would adversely affect our business, operating results and financial condition. Further, it is possible that continued industry consolidation may impact customers’ perceptions of the viability of smaller or even medium-sized software firms and consequently customers’ willingness to purchase from such firms. Similarly, if customers seek to concentrate their software purchases in the product portfolios of a few large providers, we may be at a competitive disadvantage notwithstanding the superior performance that we believe our products can deliver. We believe that in order to remain competitive at the large enterprise level, we will need to develop and expand relationships with the large system integrators that provide broad ranging products and services for these governmental and civilian customers.
 
A number of our existing and potential competitors enjoy substantial competitive advantages, such as:
 
  •  greater name recognition and longer operating histories;


18


Table of Contents

 
  •  larger sales and marketing budgets and resources;
 
  •  the capacity to leverage their sales efforts and marketing expenditures across a broader portfolio of products;
 
  •  broader distribution and established relationships with distribution partners;
 
  •  access to larger customer bases;
 
  •  greater customer support;
 
  •  greater resources to make acquisitions;
 
  •  wider geographic presence;
 
  •  lower labor and development costs; and
 
  •  substantially greater financial, technical and other resources.
 
As a result, they may be able to adapt more quickly and effectively to new or emerging technologies and changing opportunities, standards or customer requirements. In addition, these companies have reduced, and could continue to reduce, the price of their enterprise security and compliance management, log collection and storage products and managed security services, resulting in intensified pricing pressures within our market.
 
We may not compete successfully against our current or potential competitors. Companies competing with us may introduce products that have greater performance or functionality, are easier to implement or use, or incorporate technological advances that we have not yet developed or implemented. In addition, companies competing with us may price their products more competitively than ours, or have an entirely different pricing or distribution model, such as making introductory versions with limited functionality available as freeware products. Further, wide adoption of our Common Event Format, which we are promoting as a standard for event logs generated by security and other products, may facilitate development by our competitors and potential competitors.
 
Increased competition could result in fewer customer orders, price reductions, reduced operating margins and loss of market share. Our larger competitors and potential competitors may be able to provide customers with different or greater capabilities or benefits than we can provide in areas such as technical qualifications or geographic presence, or to provide customers a broader range of services and products and price. In addition, large competitors may have more extensive relationships within large enterprises, the federal government or foreign governments, which relationships may provide them with an advantage in competing for business with those potential customers. We may be required to make substantial additional investments in research, development, marketing and sales in order to respond to competition, and we cannot assure you that we will be able to compete successfully in the future.
 
We may not be able to compete effectively with companies that integrate or bundle products similar to ours with their other product offerings.
 
Many large, integrated software companies offer suites of products that include software applications for security and compliance management. In addition, hardware vendors, including diversified, global concerns, offer products that address the security and compliance needs of the enterprises and government agencies that comprise our target market. Further, several companies currently sell software products that our customers and potential customers have broadly adopted, providing them a substantial advantage when they sell products that perform functions substantially similar to some of our products. Competitors that offer a large array of security or software products may be able to offer products or functionality similar to ours at a more attractive price than we can by integrating or bundling them with their other product offerings. The consolidation in our industry increases the likelihood of competition based on integration or bundling. Customers may also increasingly seek to consolidate their enterprise-level software purchases with a small number of larger companies that can purport to satisfy a broad range of their requirements. If we are unable to sufficiently differentiate our products from the integrated or bundled products of our competitors, such as by offering enhanced functionality, performance or value, we may see a decrease in demand for our products, which would adversely affect our business, operating results and financial condition. Similarly, if customers seek to concentrate their software purchases with a few large providers, we may be at a competitive disadvantage.


19


Table of Contents

If we are unable to maintain and further develop our relationships with our existing customers, our operating results may decline.
 
In recent years, the majority of our product revenues has come from sales to existing customers. Many customers make an initial purchase from us and then decide to use our products with respect to a larger portion of their business and technology infrastructure or buy additional complementary products from us. Part of our strategy is to further penetrate our existing customers by expanding their use of our platform across the enterprise and extending their use of our products to new use cases. We may not be effective in executing this or any other aspect of our growth strategy. Our revenue could decline if our current customers do not continue to purchase additional products and services from us, or make follow-on purchases at lower than historical levels.
 
If we are not able to maintain and enhance our brand, our business and operating results may be harmed.
 
We believe that maintaining and enhancing our brand identity is critical to our relationships with, and to our ability to attract, new customers and partners. The successful promotion of our brand will depend largely upon our marketing and public relations efforts, our ability to continue to offer high-quality products and services, and our ability to successfully differentiate our products and services from those of our competitors, especially to the extent that our competitors integrate or bundle competitive offerings with a broader array of products and services that they may offer. Our brand promotion activities may not be successful or yield increased revenues. In addition, extension of our brand to products and uses different from our traditional products and services may dilute our brand, particularly if we fail to maintain the quality of our products and services in these new areas. Moreover, it may be difficult to maintain and enhance our brand in connection with sales through channel or strategic partners. The promotion of our brand requires us to make substantial expenditures, and we anticipate that the expenditures will increase as our market becomes more competitive and as we expand into new markets and as more sales are through our channel partners. To the extent that these activities yield increased revenues, these revenues may not offset the expenses we incur. If we do not successfully maintain and enhance our brand, our business may not grow, we may have reduced pricing power relative to competitors with stronger brands, and we could lose customers and channel partners, all of which would harm our business, operating results and financial condition.
 
In addition, independent industry analysts often provide reviews of our products and services, as well as those of our competitors, and perception of our products in the marketplace may be significantly influenced by these reviews. We have no control over what these industry analysts report, and because industry analysts may influence current and potential customers, our brand could be harmed if they do not provide a positive review of our products and services or view us as a market leader.
 
We may have difficulty forecasting demand for our appliance products and, because we primarily rely on a single contract manufacturer for manufacture and fulfillment of our appliance products, we may be unable to fulfill orders for these appliance products.
 
Fulfillment of sales of our appliance products involves hardware manufacturing, inventory, import certification and return merchandise authorization processes. If we fail to accurately predict demand and as a result our manufacturers maintain insufficient hardware inventory or excess inventory, we may be unable to timely deliver ordered products or may have substantial inventory expense. Because our channel partners do not purchase our products in advance of customer orders, we may face additional difficulty in accurately forecasting demand for our hardware products. This difficulty in forecasting could increase as the number of sales transactions that do not directly involve our sales force increases, which is one of the goals of our channel program, since we have limited historical experience upon which to base forecasts for these types of sales transactions. Further, as the size of individual orders increases, we may be unable to cause delivery of unforecasted orders, particularly near the end of quarterly periods. In addition, we primarily use one source for the manufacture and fulfillment of our appliance products and if this equipment vendor fails to manufacture our appliance products or fulfill orders in required volumes, in a timely manner, at a sufficient level of quality, or at all, if it is no longer financially viable or for other reasons, we may be unable to fulfill customer orders and our operating results may fluctuate from period to period, particularly if a disruption occurs near the end of a fiscal period. Disruptions in the manufacture and fulfillment of our products could damage our reputation and relationships with our customers and result in revenue declines and a


20


Table of Contents

negative effect on our growth prospects. In addition, if we change our hardware configuration or manufacturer, some countries may require us to reinitiate their import certification process. If we are unable to successfully perform these functions or maintain a relationship with a fulfillment partner that does so for us, our sales, operating results and financial condition may be harmed. In addition, the process of obtaining additional or alternative capacity with a different contract manufacturer would likely result in an increase of cost of goods sold, which could negatively impact our financial performance if we are unable to offset such increases with increases in the prices we charge our customers.
 
We face risks related to customer outsourcing to managed security service providers.
 
Some of our customers have outsourced the management of their IT departments or the network security operations function to large systems integrators or managed security service providers, or MSSPs. If this trend continues, our established customer relationships could be disrupted and our products could be displaced by alternative system and network protection solutions offered by systems integrators or MSSPs. Significant product displacements could impact our revenues and have a negative effect on our business. While to date we have developed a number of successful relationships with MSSPs, they may develop or acquire their own technologies rather than purchasing our products for use in provision of managed security services.
 
Seasonality may cause fluctuations in our operating results.
 
We believe that our product revenue has been seasonal historically, increasing in each quarter through the fiscal year, but with the first quarter of our fiscal year having relatively lower product revenue compared to the prior fourth fiscal quarter. However, we believe that there are significant seasonal factors that may cause the second and fourth quarters of our fiscal year to have relatively higher product revenue (with the first and third fiscal quarters each potentially having lower revenue than the immediately preceding fiscal quarter). We believe that this seasonality results from a number of factors, including:
 
  •  the timing of our annual sales “club” for top performers and annual training for our entire sales force in our first fiscal quarter;
 
  •  the fiscal year end procurement cycle of our government customers;
 
  •  the budgeting, procurement and work cycles of our customers, including customers in the public sector;
 
  •  seasonal reductions in business activity during the summer months in the United States, Europe and certain other regions; and
 
  •  the structure of our direct sales incentive and compensation program, which may reinforce the tendency of our direct sales team to book the largest volume of deals toward the end of our fiscal year.
 
We believe that our rapid historical growth and the required timing of new compliance mandates may have overshadowed the nature or magnitude of seasonal or cyclical factors that might have influenced our business to date. In addition, the timing of one or more large transactions may overshadow seasonal factors in any particular quarterly period. In the future, we may experience growth from additional compliance and cybersecurity mandates that could continue to mask underlying seasonal purchasing decisions by our customers. Seasonal or cyclical variations in our operations may become more pronounced over time and may materially affect our results of operations in the future.
 
For example, as noted above, the timing of our fiscal quarters and the U.S. federal government’s September 30 fiscal year end may impact product sales to governmental agencies in the second quarter of our fiscal year, offsetting the otherwise seasonal downturn in later summer months. Government spending on cybersecurity and new compliance mandates may drive customer demand at different times throughout our fiscal year, the timing of which we may not be able to anticipate and may cause fluctuations in our operating results. In addition, sales to customers with a standard December 31 fiscal year end may have a positive impact on our license revenue in the third quarter of our fiscal year, potentially offsetting the impact of the major holidays during the period. We expect seasonality to continue to impact our business in the future.


21


Table of Contents

Failure to comply with laws or regulations applicable to our business could cause us to lose U.S. government customers or our ability to contract with the U.S. government.
 
We must comply with laws and regulations relating to the formation, administration and performance of U.S. government contracts, which affect how we and our channel partners do business with U.S. government agencies. These laws and regulations may impose added costs on our business, and failure to comply with these or other applicable regulations and requirements, including non-compliance in the past, could lead to claims for damages from our channel partners, and penalties, termination of contracts and suspension or debarment from government contracting for a period of time with U.S. government agencies. Any such damages, penalties, disruption or limitation in our ability to do business with the U.S. government could have a material adverse effect on our business, operating results and financial condition.
 
Our government contracts may limit our ability to move development activities overseas and to source components from some countries, which may impair our ability to optimize our product development costs and compete for non-government contracts.
 
Increasingly, product development and component sourcing are being shifted to lower-cost countries, such as India and China. However, some contracts with U.S. government agencies require that at least 50% of the components of each of our products be of U.S. origin or that each product be substantially transformed in the U.S. or in a country on the U.S. government’s list of designated countries. Consequently, our ability to optimize our product development by conducting it overseas and to lower our costs of goods sold by sourcing from lower cost regions may be hampered. Some of our competitors do not rely on contracts with the U.S. government to the same degree as we do and may develop product or source components offshore, or may have the scale to permit them to separately source versions of their competing products for sale to customers other than U.S. government agencies. If we are unable to develop product or source components as cost-effectively as our competitors, our ability to compete for our non-government customers may be reduced and our customer sales may decline, resulting in decreased revenues.
 
Real or perceived errors, failures or bugs in our products could adversely affect our operating results and growth prospects.
 
Because we offer very complex products, undetected errors, failures or bugs may occur, especially when products are first introduced or when new versions are released. Our products are often installed and used in large-scale computing environments with different operating systems, system management software and equipment and networking configurations, which may cause errors or failures in our products or may expose undetected errors, failures or bugs in our products. Despite testing by us, errors, failures or bugs may not be found in new products or releases until after commencement of commercial shipments. In the past, we have discovered software errors, failures and bugs in some of our product offerings after their introduction.
 
In addition, our products could be perceived to be ineffective for a variety of reasons outside of our control. Hackers could circumvent our customers’ security measures, and customers may misuse our products resulting in a security breach or perceived product failure. We provide a top-level enterprise security and compliance management solution that integrates a wide variety of other elements in a customer’s IT and security infrastructure, and we may receive blame for a security breach that was the result of the failure of one of the other elements.
 
Real or perceived errors, failures or bugs in our products could result in negative publicity, loss of or delay in market acceptance of our products, loss of competitive position or claims by customers for losses sustained by them. In such an event, we may be required, or may choose, for customer relations or other reasons, to expend additional resources in order to help correct the problem. Our product liability insurance may not be adequate. Further, provisions in our license agreements with end users that limit our exposure to liabilities arising from such claims may not be enforceable in some circumstances or may not fully protect us against such claims and related liabilities and costs. Defending a lawsuit, regardless of its merit, could be costly and could limit the amount of time that management has available for day-to-day execution and strategic planning or other matters.
 
Many of our end-user customers use our products in applications that are critical to their businesses and may have a greater sensitivity to defects in our products than to defects in other, less critical, software products. In


22


Table of Contents

addition, if an actual or perceived breach of information integrity or availability occurs in one of our end-user customer’s systems, regardless of whether the breach is attributable to our products, the market perception of the effectiveness of our products could be harmed. Alleviating any of these problems could require significant expenditures of our capital and other resources and could cause interruptions, delays or cessation of our product licensing, which could cause us to lose existing or potential customers and could adversely affect our operating results and growth prospects.
 
In addition, because we are a leading provider of enterprise security products and services, “hackers” and others may try to access our data or compromise our systems. If we are the subject of a successful attack, then our reputation in the industry and with current and potential customers may be compromised and our sales and operating results could be adversely affected.
 
Incorrect or improper use of our complex products, our failure to properly train customers on how to utilize our products or our failure to properly provide consulting and implementation services could result in customer dissatisfaction and negatively affect our results of operations and growth prospects.
 
Our ESM products are complex and are deployed in a wide variety of network environments. The proper use of our products, particularly our ESM products, requires training of the end user. If our products are not used correctly or as intended, inadequate performance may result. For example, among other things, deployment of our ESM products requires categorization of IT assets and assignment of business or criticality values for each, selection or configuration of one of our pre-packaged rule sets, user interfaces and network utilization parameters, and deployment of connectors for the various devices and applications from which event data are to be collected. Our customers or our professional services personnel may incorrectly implement or use our products. Our products may also be intentionally misused or abused by customers or their employees or third parties who obtain access and use of our products. Similarly, our ArcSight Express and Logger products, while less complex than our ESM products, are often distributed through channel partners and sold to customers with smaller or less sophisticated IT departments, potentially resulting in sub-optimal installation. This may result in performance that is less than the level anticipated by the end user. Because our customers rely on our product, service and maintenance offerings to manage a wide range of sensitive security, network and compliance functions, the incorrect or improper use of our products, our failure to properly train customers on how to efficiently and effectively use our products, our failure to properly provide consulting and implementation services and maintenance to our customers or our failure to properly provide services for customer SOCs, may result in negative publicity or legal claims against us. For example, as we continue to expand our provision of SOC services, any failure by us to properly provide these high profile services will likely result in lost opportunities for follow-on sales of our software and appliance products in addition to loss of any opportunity to renew the SOC services arrangement.
 
In addition, if customer personnel are not well trained in the use of our products, customers may defer the deployment of our products, may deploy them in a more limited manner than originally anticipated or may not deploy them at all. If there is substantial turnover of the customer personnel responsible for implementation and use of our products, our product may go unused and our ability to make additional sales may be substantially limited.
 
If we are unable to maintain effective relationships with our technology partners, we may not be able to support the interoperability of our software with a wide variety of security and other products and our business may be harmed.
 
A key feature of ArcSight ESM is that it provides out-of-the-box support for many third-party devices and applications that the customer may use in its business and technology infrastructure. To provide effective interoperability, we work with individual product vendors to develop our SmartConnectors, which allow our ArcSight ESM, ArcSight Logger and ArcSight Express products to interface with third party products. In addition, we are promoting the adoption of our Common Event Format as a standard way to format system log events. Some of these technology partners are current or potential competitors of ours. If we are unable to develop and maintain effective relationships with a wide variety of technology partners, if companies adopt more restrictive policies with respect to, or impose unfavorable terms and conditions on, access to their products, or if our Common Event Format is not widely adopted, we may not be able to continue to provide our customers with a high degree of


23


Table of Contents

interoperability with their existing IT and business infrastructure, which could reduce our sales and adversely affect our business, operating results and financial condition.
 
Our international sales and operations subject us to additional risks that can adversely affect our operating results.
 
In the fiscal years ended April 30, 2010, 2009 and 2008, we derived 29%, 27% and 33% of our revenues, respectively, from customers outside the United States, and we are continuing to expand our international operations as part of our growth strategy. We currently have sales personnel and sales and support operations in Australia, Austria, Brazil, Canada, China, France, Germany, Hong Kong, India, Italy, Japan, Mexico, the Netherlands, Poland, Singapore, Spain and the United Kingdom. Our international operations subject us to a variety of risks, including:
 
  •  increased management, travel, infrastructure and legal compliance costs associated with having multiple international operations;
 
  •  longer payment cycles and difficulties in collecting accounts receivable, especially in emerging markets, and the likelihood that revenues from international resellers and customers may need to be recognized when cash is received, at least until satisfactory payment history has been established;
 
  •  the need to localize our products and licensing programs for international customers;
 
  •  differing regulatory and legal requirements and possible enactment of additional regulations or restrictions on the use, import or export of encryption technologies and our appliance-based products, which could delay or prevent the sale or use of our products in some jurisdictions;
 
  •  weaker protection of intellectual property rights in some countries; and
 
  •  overlapping of different tax regimes.
 
Any of these risks could harm our international operations and reduce our international sales, adversely affecting our business, operating results and financial condition and growth prospects.
 
Our business in countries with a history of corruption and transactions with foreign governments increase the risks associated with our international activities.
 
As we operate and sell internationally, we are subject to the U.S. Foreign Corrupt Practices Act, or the FCPA, and other laws that prohibit improper payments or offers of payments to foreign governments and their officials and political parties by U.S. and other business entities for the purpose of obtaining or retaining business. We have operations, deal with and make sales to governmental or quasi-governmental customers in countries known to experience corruption, particularly certain emerging countries in East Asia, Eastern Europe, the Middle East, Russia and South America. Our activities in these countries create the risk of unauthorized payments or offers of payments by one of our employees, consultants, sales agents or channel partners that could be in violation of various laws, including the FCPA, even though these parties are not always subject to our control. We have implemented safeguards to discourage these practices by our employees, consultants, sales agents and channel partners. However, our existing safeguards and any future improvements may prove to be less than effective, and our employees, consultants, sales agents or channel partners may engage in conduct for which we might be held responsible. Violations of the FCPA may result in severe criminal or civil sanctions, including suspension or debarment from U.S. government contracting, and we may be subject to other liabilities, which could negatively affect our business, operating results and financial condition.
 
Failure to protect our intellectual property rights could adversely affect our business.
 
Our success depends, in part, on our ability to protect proprietary methods and technologies that we develop under patent and other intellectual property laws of the United States, so that we can prevent others from using our inventions and proprietary information. If we fail to protect our intellectual property rights adequately, our competitors might gain access to our technology, and our business might be harmed. In addition, defending our intellectual property rights might entail significant expenses. Any of our patents, copyrights, trademarks or other


24


Table of Contents

intellectual property rights may be challenged by others or invalidated through administrative process or litigation. We have twelve issued patents and a number of patent applications pending in the United States, internationally and in specific foreign countries. Our issued patents may not provide us with any competitive advantages or may be challenged by third parties, and our patent applications may never be granted at all. Additionally, the process of obtaining patent protection is expensive and time-consuming, and we may not be able to prosecute all necessary or desirable patent applications at a reasonable cost or in a timely manner. Even if issued, there can be no assurance that these patents will adequately protect our intellectual property, as the legal standards relating to the validity, enforceability and scope of protection of patent and other intellectual property rights are uncertain.
 
Any patents that are issued may subsequently be invalidated or otherwise limited, enabling other companies to better develop products that compete with ours, which could adversely affect our competitive business position, business prospects and financial condition. In addition, issuance of a patent does not guarantee that we have a right to practice the patented invention. Patent applications in the U.S. are typically not published until 18 months after filing, or in some cases not at all, and publications of discoveries in industry-related literature lag behind actual discoveries. We cannot be certain that we were the first to make the inventions claimed in our issued patents or pending patent applications or otherwise used in our products, that we were the first to file for protection in our patent applications, or that third parties do not have blocking patents that could be used to prevent us from marketing or practicing our patented products or technology. Effective patent, trademark, copyright and trade secret protection may not be available to us in every country in which our products and services are available. The laws of some foreign countries may not be as protective of intellectual property rights as those in the United States, and mechanisms for enforcement of intellectual property rights may be inadequate. Accordingly, despite our efforts, we may be unable to prevent third parties from infringing upon or misappropriating our intellectual property.
 
We might be required to spend significant resources to monitor and protect our intellectual property rights. We may initiate claims or litigation against third parties for infringement of our proprietary rights or to establish the validity of our proprietary rights. Any litigation, whether or not it is resolved in our favor, could result in significant expense to us and divert the efforts of our technical and management personnel, which may adversely affect our business, operating results and financial condition.
 
Confidentiality agreements with employees and others may not adequately prevent disclosure of trade secrets and other proprietary information.
 
In order to protect our proprietary technology, processes and methods, we rely in part on confidentiality agreements with our corporate partners, employees, consultants, advisors and others. These agreements may not effectively prevent disclosure of confidential information and may not provide an adequate remedy in the event of unauthorized disclosure of confidential information. In addition, others may independently discover trade secrets and proprietary information, and in these cases we would not be able to assert any trade secret rights against those parties. Costly and time-consuming litigation could be necessary to enforce and determine the scope of our proprietary rights, and failure to obtain or maintain trade secret protection could adversely affect our competitive business position.
 
We may in the future be subject to intellectual property rights claims, which are extremely costly to defend, could require us to pay significant damages and could limit our ability to use certain technologies.
 
Companies in the software, networking and technology industries, including some of our current and potential competitors, own large numbers of patents, copyrights, trademarks and trade secrets and frequently enter into litigation based on allegations of infringement or other violations of intellectual property rights. In addition, many of these companies have the capability to dedicate substantially greater resources to enforce their intellectual property rights and to defend claims that may be brought against them. The litigation may involve patent holding companies or other adverse patent owners who have no relevant product revenues and against whom our potential patents may provide little or no deterrence. We have received, and may in the future receive, notices that claim we have misappropriated or misused other parties’ intellectual property rights, and, to the extent we gain greater visibility, we face a higher risk of being the subject of intellectual property infringement claims, which is not uncommon with respect to software technologies in general and network security technology in particular. There


25


Table of Contents

may be third-party intellectual property rights, including issued or pending patents, that cover significant aspects of our technologies or business methods. Any intellectual property claims, with or without merit, could be very time-consuming, could be expensive to settle or litigate and could divert our management’s attention and other resources. These claims could also subject us to significant liability for damages, potentially including treble damages if we are found to have willfully infringed patents or copyrights. These claims could also result in our having to stop using technology found to be in violation of a third party’s rights. We might be required to seek a license for the intellectual property, which may not be available on reasonable terms or at all. Even if a license were available, we could be required to pay significant royalties, which would increase our operating expenses. As a result, we may be required to develop alternative non-infringing technology, which could require significant effort and expense. If we cannot license or develop technology for any infringing aspect of our business, we would be forced to limit or stop sales of one or more of our products or product features and may be unable to compete effectively. Any of these results would harm our business, operating results and financial condition.
 
We rely on software licensed from other parties, the loss of which could increase our costs and delay software shipments.
 
We utilize various types of software licensed from unaffiliated third parties in order to provide certain elements of our product offering. For example, we license database software from Oracle that we integrate with our ESM product. Our agreement with Oracle permits us to distribute Oracle software in our products to our customers and partners worldwide through May 2011. See the section entitled “Item 1. Business — Intellectual Property — Oracle License Agreement.” Any errors or defects in this third-party software could result in errors that could harm our business. In addition, licensed software may not continue to be available on commercially reasonable terms, or at all. While we believe that there are currently adequate replacements for third-party software, any loss of the right to use any of this software could result in delays in producing or delivering our software until equivalent technology is identified and integrated, which delays could harm our business. Our business would be disrupted if any of the software we license from others or functional equivalents of this software were either no longer available to us or no longer offered to us on commercially reasonable terms. In either case, we would be required to either redesign our products to function with software available from other parties or to develop these components ourselves, which would result in increased costs and could result in delays in our product shipments and the release of new product offerings. Furthermore, we might be forced to limit the features available in our current or future products. If we fail to maintain or renegotiate any of these software licenses, we could face significant delays and diversion of resources in attempting to license and integrate a functional equivalent of the software.
 
If we are unable to attract and retain personnel, our business would be harmed.
 
We depend on the continued contributions of our senior management and other key personnel, in particular Tom Reilly and Hugh Njemanze, the loss of whom could harm our business. All of our executive officers and key employees are at-will employees, which means they may terminate their employment relationship with us at any time. We do not maintain a key-person life insurance policy on any of our officers or other employees.
 
Our future success also depends on our ability to identify, attract and retain highly skilled technical, managerial, finance and other personnel, particularly in our sales and marketing, research and development and professional service departments. We face intense competition for qualified individuals from numerous security, software and other technology companies. In addition, competition for qualified personnel is particularly intense in the San Francisco Bay Area, where our headquarters are located. Often, significant amounts of time and resources are required to train technical, sales and other personnel. Qualified individuals are in high demand. We may incur significant costs to attract and retain them, and we may lose new employees to our competitors or other technology companies before we realize the benefit of our investment in recruiting and training them. We may be unable to attract and retain suitably qualified individuals who are capable of meeting our growing technical, operational and managerial requirements, on a timely basis or at all, and we may be required to pay increased compensation in order to do so. If we are unable to attract and retain the qualified personnel we need to succeed, our business would suffer.
 
Volatility or lack of performance in our stock price may also affect our ability to attract and retain our key employees. Many of our senior management personnel and other key employees have become, or will soon become,


26


Table of Contents

vested in a substantial amount of stock or stock options. Employees may be more likely to leave us if the shares they own or the shares underlying their vested options have significantly appreciated in value relative to the original purchase prices of the shares or the exercise prices of the options, or if the exercise prices of the options that they hold are significantly above the market price of our common stock. If we are unable to retain our employees, our business, operating results and financial condition would be harmed.
 
If we fail to manage future growth effectively, our business would be harmed.
 
We operate in an emerging market and have experienced, and may continue to experience, significant expansion of our operations. In particular, we grew from 335 employees as of April 30, 2008 to 400 employees as of April 30, 2009, and then to 512 employees as of April 30, 2010. This growth has placed, and will continue to place, a strain on our employees, management systems and other resources. Managing our growth will require significant expenditures and allocation of valuable management resources. If we fail to achieve the necessary level of efficiency in our organization as it grows, our business, operating results and financial condition would be harmed.
 
Some of our products contain “open source” software, and any failure to comply with the terms of one or more of these open source licenses could negatively affect our business.
 
Certain of our products are distributed with software licensed under “open source” licenses. Some of these licenses contain requirements that we make available source code for modifications or derivative works we create based upon the open source software, and that we license these modifications or derivative works under the terms of a particular open source license or other license granting third parties certain rights of further use. If we combine our proprietary software with open source software in a certain manner, we could, under certain provisions of the open source licenses, be required to release the source code of our proprietary software. In addition to risks related to license requirements, usage of open source software can lead to greater risks than use of third-party commercial software, as open source licensors generally do not provide warranties or controls on origin of the software. We have established processes to help alleviate these risks, including a review process for screening requests from our development organization for the use of open source software, but we cannot be sure that all open source software is submitted for approval prior to use in our products. In addition, open source license terms may be ambiguous and many of the risks associated with usage of open source software cannot be eliminated, and could, if not properly addressed, negatively affect our business. If we were found to have inappropriately used open source software, we may be required to re-engineer our products, to release proprietary source code, to discontinue the sale of our products in the event re-engineering could not be accomplished on a timely basis or to take other remedial action that may divert resources away from our development efforts, any of which could adversely affect our business, operating results and financial condition.
 
Indemnity provisions in various agreements potentially expose us to substantial liability for intellectual property infringement and other losses.
 
Our agreements with customers and channel partners include indemnification provisions under which we agree to indemnify them for losses suffered or incurred as a result of claims of intellectual property infringement and, in some cases, for damages caused by us to property or persons. The term of these indemnity provisions is generally perpetual after execution of the corresponding product sale agreement. Large indemnity payments could harm our business, operating results and financial condition.
 
Changes or reforms in the law or regulatory landscape could diminish the demand for our solutions, and could have a negative impact on our business.
 
One factor that drives demand for our products and services is the legal and regulatory framework in which our customers operate. Laws and regulations are subject to drastic changes, and these could either help or hurt the demand for our products. Thus, some changes in the law and regulatory landscape, such as legislative reforms that limit corporate compliance obligations, could significantly harm our business.


27


Table of Contents

Future acquisitions could disrupt our business and harm our financial condition and results of operations.
 
We have expanded by acquisition in the past, and we may pursue additional acquisitions in the future, any of which could be material to our business, operating results and financial condition. Our ability as an organization to successfully acquire and integrate technologies or businesses on a larger scale is unproven. Acquisitions involve many risks, including the following:
 
  •  an acquisition may negatively impact our results of operations because it may require us to incur charges and substantial debt or liabilities, may cause adverse tax consequences, substantial depreciation or deferred compensation charges, may result in acquired in-process research and development expenses or in the future may require the amortization, write-down or impairment of amounts related to deferred compensation, goodwill and other intangible assets, or may not generate sufficient financial return to offset acquisition costs;
 
  •  we may encounter difficulties or unforeseen expenditures in integrating the business, technologies, products, personnel or operations of any company that we acquire, particularly if key personnel of the acquired company decide not to work for us;
 
  •  an acquisition may disrupt our ongoing business, divert resources, increase our expenses and distract our management;
 
  •  an acquisition may result in a delay or reduction of customer purchases for both us and the company acquired due to customer uncertainty about continuity and effectiveness of service from either company;
 
  •  we may encounter difficulties in, or may be unable to, successfully sell any acquired products; and
 
  •  an acquisition may involve the entry into geographic or business markets in which we have little or no prior experience.
 
If we fail to maintain an effective system of internal controls, our ability to produce accurate financial statements or comply with applicable regulations could be impaired.
 
As a public company, we are subject to the reporting requirements of the Exchange Act, the Sarbanes-Oxley Act of 2002, or the Sarbanes-Oxley Act, and the rules and regulations of The NASDAQ Stock Market. We expect that the requirements of these rules and regulations will continue to increase our legal, accounting and financial compliance costs, make some activities more difficult, time-consuming and costly and place undue strain on our personnel, systems and resources.
 
The Sarbanes-Oxley Act requires, among other things, that we maintain effective disclosure controls and procedures and internal control over financial reporting. We are continuing to develop and refine our disclosure controls and other procedures that are designed to ensure that information required to be disclosed by us in the reports that we file with the SEC is recorded, processed, summarized and reported within the time periods specified in SEC’s rules and forms. As part of this effort, we have licensed, and our currently in the process of implementing, a new company-wide integrated enterprise resource planning, or ERP, system to handle our various business, operating and financial processes. The implementation of the ERP system is an extremely complex and time-consuming project. Any failure to properly implement, or the delay in the implementation of, the new ERP system could have an adverse impact on our operating results.
 
Our current controls and any new controls that we develop may become inadequate because of changes in conditions, and the degree of compliance with the policies or procedures may deteriorate. Further, weaknesses in our internal controls may be discovered in the future. Any failure to develop or maintain effective controls, or any difficulties encountered in their implementation or improvement, could harm our operating results or cause us to fail to meet our reporting obligations and may result in a restatement of our prior period financial statements. Any failure to implement and maintain effective internal controls also could adversely affect the results of periodic management evaluations and annual auditor attestation reports regarding the effectiveness of our internal control over financial reporting that we are required to include in our periodic reports filed with the SEC under Section 404 of the Sarbanes-Oxley Act. Ineffective disclosure controls and procedures and internal control over financial


28


Table of Contents

reporting could also cause investors to lose confidence in our reported financial and other information, which would likely have a negative effect on the trading price of our common stock.
 
In order to maintain and improve the effectiveness of our disclosure controls and procedures and internal control over financial reporting, we have expended, and anticipate that we will continue to expend, significant resources and provide significant management oversight, which involve substantial accounting-related costs. Any failure to maintain the adequacy of our internal controls, or consequent inability to produce accurate financial statements on a timely basis, could increase our operating costs and could materially impair our ability to operate our business. In the event that we are not able to continue to demonstrate compliance with Section 404 of the Sarbanes-Oxley Act in a timely manner, that our internal controls are perceived as inadequate or that we are unable to produce timely or accurate financial statements, investors may lose confidence in our operating results and our stock price could decline. In addition, if we are unable to continue to meet these requirements, we may not be able to remain listed on The NASDAQ Global Market.
 
We have not yet implemented a complete disaster recovery plan or business continuity plan for our accounting and related information technology systems. Any disaster could therefore materially impair our ability to maintain timely accounting and reporting.
 
We may not be able to utilize a significant portion of our net operating loss carry-forwards, which could adversely affect our operating results.
 
Due to prior period losses, we have generated significant federal and state net operating loss carry-forwards, which expire beginning in fiscal 2020 and fiscal 2015, respectively. U.S. federal and state income tax laws limit the amount of these carry-forwards we can utilize upon a greater than 50% cumulative shift of stock ownership over a three-year period, including shifts due to the issuance of additional shares of our common stock, or securities convertible into our common stock. We have previously experienced a greater than 50% shift in our stock ownership, which has limited our ability to use a portion of our net operating loss carry-forwards, and we may experience subsequent shifts in our stock ownership. Accordingly, there is a risk that our ability to use our existing carry-forwards in the future could be further limited and that existing carry-forwards would be unavailable to offset future income tax liabilities, adversely affecting our operating results.
 
Governmental export or import controls could subject us to liability or limit our ability to compete in foreign markets.
 
Our products incorporate encryption technology and may be exported outside the U.S. only if we obtain an export license or qualify for an export license exception. Compliance with applicable regulatory requirements regarding the export of our products, including new releases of our products, may create delays in the introduction of our products in international markets, prevent our customers with international operations from deploying our products throughout their global systems or, in some cases, prevent the export of our products to some countries altogether. In addition, various countries regulate the import of our appliance-based products and have enacted laws that could limit our ability to distribute products or could limit our customers’ ability to implement our products in those countries. Any new export or import restrictions, new legislation or shifting approaches in the enforcement or scope of existing regulations, or in the countries, persons or technologies targeted by such regulations, could result in decreased use of our products by existing customers with international operations, declining adoption of our products by new customers with international operations and decreased revenues. If we fail to comply with export and import regulations, we may be denied export privileges, be subjected to fines or other penalties and our products may be denied entry into other countries.
 
We may become a party to litigation that may negatively affect our business results of operations or financial condition.
 
From time to time, we may become involved in various legal proceedings relating to matters incidental to the ordinary course of our business, including employment litigation. Such matters can be expensive and disruptive to normal business operations. In addition, the outcome of litigation is highly uncertain and an unfavorable outcome in such litigation could have a negative effect on our business, results of operations or financial condition.


29


Table of Contents

Risks Related to Ownership of Our Common Stock
 
Our stock price may be volatile or may decline regardless of our operating performance.
 
The trading prices of the securities of technology companies have been highly volatile. The market price of our common stock may fluctuate significantly in response to numerous factors, many of which are beyond our control, including:
 
  •  actual or anticipated fluctuations in our operating results;
 
  •  the financial projections we may provide to the public, any changes in these projections or our failure to meet these projections;
 
  •  failure of securities analysts to maintain coverage of us, changes in financial estimates by any securities analysts who follow our company, or our failure to meet these estimates or the expectations of investors;
 
  •  ratings or other changes by any securities analysts who follow our company or our industry;
 
  •  announcements by us or our competitors of significant technical innovations, acquisitions, strategic partnerships, joint ventures or capital commitments;
 
  •  changes in operating performance and stock market valuations of other technology companies generally, or those in our industry in particular;
 
  •  price and volume fluctuations in the overall stock market, including as a result of trends in the economy as a whole, such as the continuing volatility in the financial markets;
 
  •  lawsuits threatened or filed against us; and
 
  •  other events or factors, including those resulting from war, incidents of terrorism or responses to these events.
 
In addition, the stock markets, and in particular The NASDAQ Global Market on which our common stock is listed, have experienced extreme price and volume fluctuations that have affected and continue to affect the market prices of equity securities of many companies, particularly technology companies. Broad market fluctuations such as these may have and could continue to adversely affect the market price of our common stock. Even prior to the continuing volatility in the financial markets, stock prices of many technology companies had fluctuated in a manner unrelated or disproportionate to the operating performance of those companies. In the past, stockholders have instituted securities class action litigation following periods of market volatility. If we were to become involved in securities litigation, it could subject us to substantial costs, divert resources and the attention of management from our business and adversely affect our business, operating results and financial condition.
 
If securities or industry analysts cease publishing research or publish inaccurate or unfavorable research about our business, our stock price and trading volume could decline.
 
The trading market for our common stock depends in part on the research and reports that securities or industry analysts publish about us or our business. Securities analysts and industry analysts that currently cover us may cease to do so, negatively impacting the trading price for our stock. If one or more of the analysts who cover us or our industry downgrade our stock or the stock of other companies in our industry, or publish inaccurate or unfavorable research about our business or industry, our stock price would likely decline. If one or more of these analysts fail to publish reports on us regularly, demand for our stock could decrease, which might cause our stock price and trading volume to decline.
 
Delaware law, provisions in our restated certificate of incorporation and amended and restated bylaws and the concentration of our ownership could make a merger, tender offer or proxy contest difficult, thereby depressing the trading price of our common stock.
 
We are a Delaware corporation and the anti-takeover provisions of the Delaware General Corporation Law may discourage, delay or prevent a change in control by prohibiting us from engaging in a business combination with an interested stockholder for a period of three years after the person becomes an interested stockholder, even if


30


Table of Contents

a change of control would be beneficial to our existing stockholders. In addition, our restated certificate of incorporation and amended and restated bylaws contain provisions that may make the acquisition of our company more difficult without the approval of our board of directors, including the following:
 
  •  our board of directors is classified into three classes of directors with staggered three-year terms;
 
  •  currently only our president and chief executive officer, our lead independent director or a majority of our board of directors is authorized to call a special meeting of stockholders;
 
  •  our stockholders are only able to take action at a meeting of stockholders and not by written consent;
 
  •  vacancies on our board of directors are able to be filled only by our board of directors and not by stockholders;
 
  •  directors may be removed from office only for cause;
 
  •  our restated certificate of incorporation authorizes undesignated preferred stock, the terms of which may be established, and shares of which may be issued, without stockholder approval; and
 
  •  advance notice procedures will apply for stockholders to nominate candidates for election as directors or to bring matters before an annual meeting of stockholders.
 
In addition, as of July 1, 2010 our directors and executive officers, together with their affiliates, beneficially own in the aggregate 20.1% of our outstanding common stock (including options exercisable by those holders within 60 days of that date). Further, holders that together with their affiliates, hold 5% or more of our outstanding common stock, but who are not affiliated with our directors and executive officers, beneficially own in the aggregate an additional 20.1% of our outstanding common stock as of July 1, 2010. As a result, our directors and officers and their affiliates, collectively, or our largest stockholders, acting together, may be able to impede a merger, consolidation or sale of all or substantially all of our assets.
 
Item 1B.   Unresolved Staff Comments
 
Not applicable.
 
Item 2.   Properties
 
Our corporate headquarters and research and development facilities occupy approximately 116,000 square feet in Cupertino, California under a lease that expires on May 31, 2017. In addition to our principal office space in Cupertino, we lease facilities for use as sales and local support offices in various cities in the United States and internationally. We believe our facilities are adequate for our needs for at least the next 12 months. We also anticipate that suitable additional or alternative space will be reasonably available to accommodate foreseeable expansion of our operations.
 
Item 3.   Legal Proceedings
 
We are subject to various claims, complaints and legal actions that arise in the normal course of business from time to time. We do not believe we are party to any currently pending legal proceedings the outcome of which will have a material adverse effect on our operations or financial position. There can be no assurance that existing or future legal proceedings arising in the ordinary course of business or otherwise will not have a material adverse effect on our business, consolidated financial position, results of operations or cash flows.
 
Item 4.   (Removed and Reserved)
 
PART II
 
Item 5.   Market for Registrant’s Common Equity, Related Stockholder Matters and Issuer Purchases of Equity Securities


31


Table of Contents

Market Information for Common Stock
 
Our common stock has been listed on The NASDAQ Global Market under the symbol “ARST” since our IPO in February 2008. The following table sets forth, for the periods indicated, the high and low intra-day prices for our common stock as reported on The NASDAQ Global Market.
 
                 
Fiscal 2009
  High   Low
 
First Quarter
  $ 11.74     $ 7.19  
Second Quarter
    13.00       5.25  
Third Quarter
    10.00       4.17  
Fourth Quarter
    16.10       7.70  
 
                 
Fiscal 2010
  High   Low
 
First Quarter
  $ 20.80     $ 13.52  
Second Quarter
    25.99       16.90  
Third Quarter
    29.24       22.15  
Fourth Quarter
    29.33       22.58  
 
                 
Fiscal 2011
  High   Low
 
First Quarter (through July 6, 2010)
  $ 25.77     $ 17.51  
 
Stockholders
 
As of July 1, 2010, we had approximately 41 record holders of our common stock.
 
Stock Price Performance Graph
 
The following graph shows a comparison from February 14, 2008 (the date our common stock commenced trading on The NASDAQ Global Market) through April 30, 2009 of the cumulative total return for an investment of $100 (and the reinvestment of dividends) in our common stock, the NASDAQ Composite Index and the NASDAQ Computer and Data Processing Index. Such returns are based on historical results and are not intended to suggest future performance.
 
COMPARISON OF 26 MONTH CUMULATIVE TOTAL RETURN*
Among ArcSight, Inc., the NASDAQ Composite Index
and the NASDAQ Computer & Data Processing Index
 
(PERFORMANCE GRAPH)
 
 
$100 invested on 2/14/08 in stock or 1/31/08 in index, including reinvestment of dividents. Fiscal year ending April 30.


32


Table of Contents

 
The above information under the heading “Stock Price Performance Graph” shall not be deemed to be “filed” for purposes of Section 18 of the Securities Exchange Act of 1934, as amended, or otherwise subject to the liabilities of that section or Sections 11 and 12(a)(2) of the Securities Act of 1933, as amended, and shall not be incorporated by reference into any registration statement or other document filed by us with the Securities and Exchange Commission, whether made before or after the date of this Annual Report on Form 10-K, regardless of any general incorporation language in such filing, except as shall be expressly set forth by specific reference in such filing.
 
Dividend Policy
 
We have never declared or paid cash dividends on our capital stock. We currently intend to retain any future earnings and do not expect to declare or pay any dividends in the foreseeable future. Any further determination to pay dividends on our capital stock will be at the discretion of our board of directors and will depend on our financial condition, results of operations, capital requirements and other factors that our board of directors considers relevant.
 
Equity Compensation Plan Information
 
The following table summarizes information about our equity compensation plans as of April 30, 2010. All outstanding awards relate to our common stock.
 
                         
    (a) Number of
      (c) Number of Securities
    Securities to be
      Remaining Available for
    Issued Upon
      Future Issuance Under
    Exercise of
  (b) Weighted-Average
  Equity Compensation
    Outstanding
  Exercise Price of
  Plans (Excluding
    Options, Warrants
  Outstanding Options,
  Securities Reflected in
Plan Category
  and Rights(1)   Warrants and Rights   Column (a))
 
Equity compensation plans approved by security holders
    6,734,350     $ 10.41       4,222,243  
Equity compensation plans not approved by security holders
                 
Total
    6,734,350     $ 10.41       4,222,243  
 
 
(1) Prior to our IPO, we issued securities under our 2002 Stock Plan, as amended, and our 2000 Stock Incentive Plan. Following our IPO, we issued securities under our 2007 Equity Incentive Plan (“2007 Plan”) and our 2007 Employee Stock Purchase Plan (“ESPP”).
 
Under the 2007 Plan we may issue stock awards, including but not limited to restricted stock awards, restricted stock units, stock bonus awards, stock appreciation rights and performance share awards. The 2007 Plan contains a provision that the number of shares available for grant and issuance will be increased on January 1 of each year from 2009 through 2012 by an amount equal to 4% of our shares outstanding on the immediately preceding December 31, unless our board of directors, in its discretion, determines to make a smaller increase. It is the policy of our board of directors that non-employee directors are granted options to purchase 25,000 shares of common stock under the 2007 Plan upon initial election or appointment to the board. Similarly, on the date of the first board meeting following each annual stockholder meeting each non-employee director will automatically be granted options to purchase 10,375 shares of common stock under the 2007 Plan pursuant to that policy. The board may also make discretionary grants to purchase common stock to any non-employee director.
 
Under the 2007 ESPP we may grant options for the purchase of our common stock. The 2007 ESPP contains a provision that the number of shares available for grant and issuance will be increased on January 1 of each of 2009 through 2016, by an amount equal to 1% of our shares outstanding on the immediately preceding December 31, unless our board of directors, in its discretion determines to make a smaller increase.
 
Recent Sales of Unregistered Securities
 
For the fiscal quarter ended April 30, 2010, we did not sell any unregistered securities.


33


Table of Contents

Use of Proceeds from Public Offering of Common Stock
 
The Form S-1 Registration Statement (Registration No. 333-145974) relating to our IPO was declared effective by the SEC on February 14, 2008, and the offering commenced that day. Morgan Stanley & Co. Incorporated acted as the sole book-running manager for the offering, and Lehman Brothers Inc., Wachovia Capital Markets, LLC and RBC Capital Markets Corporation acted as co-managers of the offering.
 
The net proceeds to us of our IPO after deducting underwriters’ discounts and offering expenses were $45.9 million. Through April 30, 2010, we did not use any of the net proceeds. We expect to use the net proceeds for general corporate purposes, including working capital and potential capital expenditures and acquisitions. Although we may also use a portion of the net proceeds for the acquisition of, or investment in, companies, technologies, products or assets that complement our business, we have no present understandings, commitments or agreements to enter into any acquisitions or make any investments.
 
Our management will retain broad discretion in the allocation and use of the net proceeds of our IPO, and investors will be relying on the judgment of our management regarding the application of the net proceeds. Pending specific utilization of the net proceeds as described above, we have invested the net proceeds of the offering in short-term, interest-bearing obligations. The goal with respect to the investment of the net proceeds will be capital preservation and liquidity so that such funds are readily available to fund our operations.
 
Purchases of Equity Securities by the Issuer and Affiliated Purchasers
 
For the fiscal year ended April 30, 2010, we did not repurchase any equity securities.


34


Table of Contents

Item 6.   Selected Financial Data
 
The following selected consolidated financial data should be read in conjunction with “Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations” and our consolidated financial statements and related notes included elsewhere in this Annual Report on Form 10-K. The selected financial data in this section is not intended to replace the financial statements and is qualified in its entirety by the consolidated financial statements and related notes thereto included elsewhere in this Annual Report on Form 10-K. Our historical results of operations are not necessarily indicative of results to be expected for any future period.
 
                                         
    Fiscal Year Ended April 30,  
Consolidated Statements of Operations Data:
  2010     2009     2008     2007     2006  
    (In thousands, except per share data)  
 
Revenues:
                                       
Products
  $ 106,568     $ 80,616     $ 63,765     $ 43,989     $ 22,859  
Maintenance
    54,736       38,521       27,607       18,762       11,473  
Services
    20,080       17,031       10,173       7,082       5,103  
                                         
Total revenues
    181,384       136,168       101,545       69,833       39,435  
Cost of revenues:
                                       
Products
    12,969       8,595       4,767       2,569       1,769  
Maintenance(1)
    9,503       6,861       5,691       3,498       2,085  
Services(1)
    13,340       9,875       5,800       3,521       2,942  
                                         
Total cost of revenues
    35,812       25,331       16,258       9,588       6,796  
                                         
Gross profit
    145,572       110,837       85,287       60,245       32,639  
Operating expenses(1):
                                       
Research and development
    26,266       22,537       19,762       14,535       12,154  
Sales and marketing
    73,658       56,279       53,453       36,587       24,309  
General and administrative
    26,269       20,278       13,422       9,453       12,978  
                                         
Total operating expenses
    126,193       99,094       86,637       60,575       49,441  
                                         
Income (loss) from operations
    19,379       11,743       (1,350 )     (330 )     (16,802 )
Other income (expense), net
    (399 )     734       472       462       219  
                                         
Income (loss) before provision for income taxes
    18,980       12,477       (878 )     132       (16,583 )
Provision (benefit) for income taxes
    (9,407 )     2,564       1,131       389       163  
                                         
Net income (loss)
  $ 28,387     $ 9,913     $ (2,009 )   $ (257 )   $ (16,746 )
                                         
Net income (loss) per common share, basic
  $ 0.85     $ 0.32     $ (0.08 )   $ (0.03 )   $ (2.24 )
                                         
Net income (loss) per common share, diluted
  $ 0.78     $ 0.30     $ (0.08 )   $ (0.03 )   $ (2.24 )
                                         
Shares used in computing basic net income (loss) per common share
    33,434       31,233       25,936       10,042       7,469  
                                         
Shares used in computing diluted net income (loss) per common share
    36,197       33,550       25,936       10,042       7,469  
                                         
 
 
(1) Stock-based compensation expense is included above as follows:
 
                                         
Cost of maintenance revenues
  $ 445     $ 216     $ 106     $ 3     $ 5  
Cost of services revenues
    225       142       115       14       5  
Research and development
    2,177       1,342       1,356       501       1,950  
Sales and marketing
    3,418       2,451       2,685       661       210  
General and administrative
    3,941       1,994       664       350       5,948  
                                         
Total stock-based compensation expense
  $ 10,206     $ 6,145     $ 4,926     $ 1,529     $ 8,118  
                                         
 
Revenues in fiscal 2007 and prior years were impacted by revenues related to multiple element sales transactions consummated for which the revenues were deferred because we did not have vendor-specific objective


35


Table of Contents

evidence of fair value, or VSOE, for some product elements that were not delivered in the fiscal year of the transaction. Following identification in mid-fiscal 2007 of transactions with such undelivered elements, with respect to some of these transactions, we and our customers amended the contractual terms to remove the undelivered product elements and in other instances we have since delivered such product elements. The net impact of these transactions reduced revenues in fiscal 2006 by $6.3 million and increased revenues in fiscal 2010, 2009, 2008 and 2007 by $0.9 million, $0.9 million, $2.9 million and $1.8 million, respectively. See “Item 7: Management’s Discussion and Analysis of Financial Condition and Results of Operations — Sources of Revenues, Cost of Revenues and Operating Expenses” for additional details, including the net amounts involved. While similar multiple element transactions with undelivered elements for which we lack VSOE may be identified prospectively in future periods, we expect that in future periods the comparison of revenues period-to-period will not be impacted to the same extent by similar transactions.
 
                                         
    As of April 30,
    2010   2009   2008   2007   2006
    (In thousands)
 
Consolidated Balance Sheet Data:
                                       
Cash, cash equivalents, and marketable securities
  $ 149,371     $ 90,467     $ 71,946     $ 16,917     $ 16,443  
Working capital (deficit)
    123,773       74,549       46,711       (3,811 )     5,377  
Total assets
    226,203       141,161       118,579       48,990       32,926  
Current and long-term debt
                             
Convertible preferred stock
                      26,758       26,758  
Common stock and additional paid-in capital
    144,273       113,781       101,574       23,479       19,383  
Total stockholders’ equity
    135,576       76,673       54,769       5,130       1,433  
 
Item 7.   MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS OF OPERATIONS
 
The following discussion and analysis of our financial condition and results of operations should be read in conjunction with the audited consolidated financial statements and notes thereto and management’s discussion and analysis of financial condition and results of operations for the fiscal year ended April 30, 2010 included herein. This Annual Report on Form 10-K contains “forward-looking statements” within the meaning of Section 27A of the Securities Act of 1933, as amended, and Section 21E of the Securities Exchange Act of 1934, as amended. These statements are often identified by the use of words such as “may,” “will,” “expect,” “believe,” “anticipate,” “intend,” “could,” “estimate,” or “continue,” and similar expressions or variations. Such forward-looking statements are subject to risks, uncertainties and other factors that could cause actual results and the timing of certain events to differ materially from future results expressed or implied by such forward-looking statements. Factors that could cause or contribute to such differences include, but are not limited to, those identified herein, and those discussed in the section titled “Risk Factors,” set forth in Part I, Item 1A of this Form 10-K and in our other SEC filings. We disclaim any obligation to update any forward-looking statements to reflect events or circumstances after the date of such statements.
 
Overview
 
We are a leading provider of enterprise threat and risk management solutions that protect businesses and government agencies. Our enterprise threat and risk management platform collects, consolidates and correlates network and user activity data across the enterprise so that businesses can rapidly detect, diagnose and manage both internal and external threats and risks across the organization for activities associated with critical assets and processes. With our enterprise threat and risk management platform and products, organizations can use the ArcSight platform to reduce risk, identify vulnerabilities, comply with regulations and protect their high-value digital assets from cyber-theft, cyber-fraud, cyber-warfare and cyber-espionage.
 
Our SIEM products, ArcSight ESM and ArcSight Express, deliver a centralized, real-time view of all activity or events across geographically dispersed and heterogeneous business and technology infrastructures. Our log


36


Table of Contents

management products collect and store activity and event data for regulatory compliance, reporting and forensic analysis. Working together, these products collect, consolidate and correlate massive amounts of activity data, in the form of log events, from thousands of security point solutions, network and computing devices, databases and applications, enabling intelligent identification, prioritization and response to compliance and corporate policy violations, and external and insider threats. Our specialized software and application packages deliver pre-packaged analytics and reports tailored to specific compliance and security initiatives, such as Sarbanes-Oxley (SOX), PCI, user monitoring and fraud detection.
 
We were founded in May 2000 and first sold our initial ESM product in June 2002. We initially funded our operations primarily through convertible preferred stock financings that raised a total of $26.8 million. Our revenues have grown from $32.8 million in fiscal 2005 to $181.4 million in fiscal 2010.
 
In February 2008, we completed our IPO in which we sold 6,000,000 shares of common stock, at an issue price of $9.00 per share. We raised a total of $54.0 million in gross proceeds from our IPO, or $45.9 million in net proceeds after deducting underwriting discounts of $3.8 million and offering expenses of $4.3 million.
 
We achieved positive cash flows from operations in fiscal 2004 through 2010. We generated $45.7 million and $16.8 million in cash from our operating activities during fiscal 2010 and 2009, respectively, and we generally expect to continue to generate positive cash flows from operating activities on an annual basis. As of April 30, 2010, we had cash, cash equivalents and marketable securities of $149.4 million, net accounts receivable of $33.6 million, and an aggregate of $27.2 million in accounts payable and accrued liabilities.
 
Important Factors Affecting Our Operating Results and Financial Condition
 
We believe that the market for our products is still in the early stages of development, but may be entering a stage of more widespread adoption. We have identified factors that we expect to play an important role in our future growth and profitability. These factors are:
 
Development and Introduction of New Products.  We believe it is important that we continue to develop or acquire new products and services that will help us capitalize on opportunities in the enterprise threat and risk management market. An example of a new product introduced in fiscal 2010 is ArcSight FraudView, an appliance product that detects online fraud by evaluating and scoring financial transactions. We continue the enhancement of our SIEM and log management products and solutions, such as enhanced location-based intelligence for our ESM products in May 2009, an updated version of our ArcSight Express product in March 2010 and version 4.5 of our ArcSight Logger product in June 2010. In addition, we continue to develop and release updates to complementary solution packages for our SIEM and log management products.
 
Sales of Products to New Customers and Continued Sales to Our Installed Base.  The market for enterprise threat and risk management solutions is growing, with initial purchases often driven by corporate compliance initiatives, and federal government cyber-security spending priorities. A key component of our growth will depend on our ability to sell our products to new customers. An initial sale typically involves the sale of our SIEM or log management products, in combination with each other or with our complementary solution packages to address a specific compliance or security use case, such as SOX, PCI, user monitoring or fraud detection. Many customers make an initial purchase from us and then decide whether to use our products with respect to a larger portion of their business and technology infrastructure or buy additional complementary products from us. Thus, another key component of our growth will be our ability to ensure initial customer success and successfully maintain and further develop the relationships with our existing customers to cover additional use cases. While historically our initial sale to a customer has involved our ESM products, we anticipate that a growing proportion of future new customers will be a result of initial sales of our ArcSight Logger products, our ArcSight Express product and our other products sold in an appliance form factor. We may not be able to generate the level of subsequent sales that we have historically experienced with our ESM customers.
 
Further Development of Our Channel Network and Our Relationships with System Integrators.  Historically, we have sold our products primarily through our direct sales force, with sales to government or international customers through systems integrators and resellers. In recent years, we expanded our sales channel to assist us in penetrating the mid-market, particularly as we expanded our appliance-based offerings. We believe that our current


37


Table of Contents

and any new appliance-based products that we develop will be sold more effectively through resellers and, if we are successful in introducing these new products, we will become more dependent on the development of an effective channel network. In addition to continuing to develop additional “channel-ready” products and versions of our products designed for use by smaller enterprises, further training, certification and development of our existing channel partners to improve their effectiveness will be a key factor in the success of this strategy. Further, we believe that strong relationships with major system integrators will facilitate sales to large enterprises and governmental customers, particularly for use cases beyond traditional security and compliance.
 
Sources of Revenues, Cost of Revenues and Operating Expenses
 
Our sales transactions typically include the following elements: license fees paid for the use of our software and appliance products in perpetuity or, in limited circumstances, for a specified term; an arrangement for first-year support and maintenance, which includes unspecified software updates and upgrades; and professional services for installation, implementation and training. The majority of our revenues are derived from sales of our enterprise threat and risk management products, primarily ArcSight ESM and Logger, and we expect this to continue for the foreseeable future. We sell our products and services through our direct sales force, channel partners and system integrator partners, although the emphasis varies from region to region. For example, we primarily sell through resellers and other channel partners internationally, while our sales to U.S. federal government customers are typically through our direct sales force, resellers and system integrators.
 
Our strategy is to make our products available in the form factor desired by the customer. Consequently, our SIEM, log management and related products are available as software, as appliances or as packages of software and appliances. However, our appliance products generally have lower gross margins than our software products.
 
We recognize revenues pursuant to generally accepted accounting principles or GAAP, in accordance with Accounting Standards Codification, or ASC, Topic 985-605, Software Revenue Recognition, as amended, or ASC 985-605. ASC 985-605 provides that, if revenues are to be recognized upon product delivery, among other things vendor-specific objective evidence of fair value, or VSOE, for each undelivered element of multiple element customer contracts is required. In addition, if we determine that collectibility is not reasonably assured, we defer the revenues until collectibility becomes reasonably assured, generally upon receipt of cash.
 
Deferred revenue and accounts receivable are reported net of adjustments for sales transactions invoiced during the period that are recognized as revenue in a future period once cash is received and all other revenue recognition criteria have been met, which are sometimes referred to as net-down adjustments. Accordingly, we believe that in order to understand the change in both deferred revenue and accounts receivable from one period to another, the impact of these net-down adjustments should be considered.
 
Historically sales to U.S. commercial and governmental entities have represented a majority of our revenues, while international sales, including sales to agencies of foreign governments, have represented a smaller portion of our revenues. While the vertical make-up of our revenues will vary from period to period, over the long term we expect revenues from sales to U.S. commercial and governmental entities to each continue to grow in absolute dollars, and we expect that sales to customers outside of the United States will continue to grow in absolute dollars over the long term.
 
Product Revenues
 
Product revenues consist of license fees for our software products and sales of our appliance products. License fees are based on a number of factors, including the type and number of devices that a customer intends to monitor using our software as well as the number of users and locations. In addition to our core solution, some of our customers purchase additional licenses for optional extension modules that provide enhanced discovery and analytics capabilities. Sales of our appliance products consist of sales of the appliance hardware and associated perpetual licenses to the embedded software. We introduced our first appliance products in June 2006 and our first ArcSight Logger product, our most widely adopted appliance product to date, in December 2006. Appliance fees are based on the number of appliances purchased and, in some cases, on the number of network devices with which our customer intends to use the appliances. We generally recognize product revenues at the time of product delivery, provided all other revenue recognition criteria have been met.


38


Table of Contents

Historically, we have engaged in long sales cycles with our customers, typically three to six months and more than a year for some sales, and many customers make their purchase decisions in the last month of a fiscal quarter, following procurement trends in the industry. Further, average deal size can vary considerably depending on our customers’ configuration requirements, implementation plan and budget availability. As a result, it is difficult to predict timing or size of product sales on a quarterly basis. In addition, we may fail to forecast sufficient production of our appliance products, or we may be unable to physically deliver appliances within the quarter, depending on the proximity of the order to the end of the quarter. These situations may lead to delay of revenues until we can deliver products. The loss or delay of one or more large sales transactions in a quarter could impact our operating results for that quarter and any future quarters into which revenues from that transaction are delayed.
 
In addition, we believe that our product revenue has been somewhat seasonal historically, increasing in each quarter through the fiscal year, but with the first quarter of our fiscal year typically having relatively lower product revenue compared to the prior fourth fiscal quarter. However, we believe that there are significant seasonal factors that may cause the second and fourth quarters of our fiscal year to have relatively higher product revenue (with the first and third fiscal quarters each potentially having lower revenue than the immediately preceding fiscal quarter). We believe that this seasonality results from a number of factors, including:
 
  •  the timing of our annual sales “club” for top performers and annual training for our entire sales force in our first fiscal quarter;
 
  •  the fiscal year end procurement cycle of our government customers;
 
  •  the budgeting, procurement and work cycles of our customers, including customers in the public sector;
 
  •  seasonal reductions in business activity during the summer months in the United States, Europe and certain other regions; and
 
  •  the structure of our direct sales incentive and compensation program, which may reinforce the tendency of our direct sales team to book the largest volume of deals toward the end of our fiscal year.
 
We believe that our rapid historical growth and the required timing of new compliance mandates may have overshadowed the nature or magnitude of seasonal or cyclical factors that might have influenced our business to date. In addition, the timing of one or more large transactions may overshadow seasonal factors in any particular quarterly period. In the future, we may experience growth from additional compliance and cybersecurity mandates that could continue to mask underlying seasonal purchasing decisions by our customers. Seasonal or cyclical variations in our operations may become more pronounced over time and may materially affect our results of operations in the future.
 
For example, as noted above, the timing of our fiscal quarters and the U.S. federal government’s September 30 fiscal year end may impact product sales to governmental agencies in the second quarter of our fiscal year, offsetting the otherwise seasonal downturn in later summer months. Government spending on cybersecurity and new compliance mandates may drive customer demand at different times throughout our fiscal year, the timing of which we may not be able to anticipate and may cause fluctuations in our operating results. In addition, sales to customers with a standard December 31 fiscal year end may have a positive impact on our license revenue in the third quarter of our fiscal year, potentially offsetting the impact of the major holidays during the period. We expect seasonality to continue to impact our business in the future.
 
As of April 30, 2010, 2009 and 2008, deferred product revenues were $10.8 million, $9.8 million and $13.6 million, respectively. Included in deferred product revenues as of April 30, 2010, 2009 and 2008 were $0.5 million, $1.3 million and $2.2 million, respectively, related to multiple element arrangements where one or more product elements for which we did not have VSOE remained undelivered. The remainder of deferred product revenues as of April 30, 2010, 2009 and 2008 were $10.3 million, $8.5 million and $11.4 million, respectively, and primarily related to product revenues to be recognized ratably over the term of the maintenance arrangements, prepayments in advance of delivery and other delivery deferrals. Deferred revenue and accounts receivable are reported net of adjustments for sales transactions invoiced during the period that are recognized as revenue in a future period once cash is received and all other revenue recognition criteria have been met. These net-down adjustments decrease both accounts receivable and deferred revenue. Accordingly, we believe that in order to


39


Table of Contents

understand the change in both deferred revenue and accounts receivable from one period to another the impact of these net-down adjustments should be considered. As of April 30, 2010, 2009 and 2008, deferred product revenues of $10.8 million, $9.8 million and $13.6 million, respectively, were reduced by net-down adjustments of $10.1 million, $5.4 million and $3.3 million, respectively. Our operating results in any particular quarterly period in fiscal 2010 may be similarly impacted by the recognition of previously deferred revenue, where the associated costs were recorded in prior periods. See “Critical Accounting Policies, Significant Judgments and Estimates — Revenue Recognition” and Note 2 to our Consolidated Financial Statements (“Significant Accounting Policies — Revenue Recognition”) elsewhere in this report.
 
Maintenance Revenues
 
Maintenance includes rights to unspecified software product updates and upgrades, maintenance releases and patches released during the term of the support period, and internet and telephone access to maintenance personnel. Maintenance revenues are generated both from maintenance that we agree to provide in connection with initial sales of software and hardware products and from maintenance renewals. We generally sell maintenance on an annual basis. We offer two levels of maintenance-standard and premium. The premium level is for customers that require 24-hour coverage seven days a week. In most cases, we provide maintenance for sales made through channel partners. In addition, we sell an enhanced maintenance offering that provides frequent security content updates for our software. Maintenance fees are treated as deferred revenue at the time the maintenance agreement is initiated and recognized ratably over the term of the maintenance agreement. As our customer base expands, we expect maintenance revenues to continue to grow, as maintenance is sold to new customers and existing customers renew.
 
As of April 30, 2010, deferred maintenance revenues were $46.7 million, of which $39.1 million represented current deferred maintenance revenues. As of April 30, 2009, deferred maintenance revenues were $32.4 million, of which $26.7 million represented current deferred maintenance revenues. As of April 30, 2008, deferred maintenance revenues were $24.3 million, of which $20.0 million represented current deferred maintenance revenues. Deferred maintenance revenues relate to advanced payments for support contracts that are recognized ratably. As of April 30, 2010, 2009 and 2008, the deferred maintenance revenues of $46.7 million, $32.4 million and $24.3 million, respectively, were reduced by net-down adjustments of $3.9 million, $2.6 million and $1.5 million, respectively. Net-down adjustments decrease both accounts receivable and deferred revenue and typically relate to billed but unpaid customer transactions for maintenance renewal support terms where services have not yet been provided, or where revenue from the customer is only recognized when cash has been paid and all other revenue recognition criteria have been met. See “Critical Accounting Policies, Significant Judgments and Estimates — Revenue Recognition” and Note 2 to our Consolidated Financial Statements (“Significant Accounting Policies — Revenue Recognition”) elsewhere in this report.
 
Services Revenues
 
Services revenues are generated from sales of services to our customers, including installation and implementation of our software, consulting and training. Professional services are not essential to the functionality of the associated software products. During fiscal 2009 and 2010, we continued to enter into an increasing number of service engagements to staff and manage the security operations center, or SOCs, of certain large customers. SOC engagements are typically longer in duration than other services engagements and support the day-to-day monitoring of customer SOC environments. We generally sell our services on a time-and-materials basis and recognize revenues as the services are performed. Services revenues have generally increased over time as we have sold and delivered installation and training services to our new customers and continued to sell training and consulting services to our existing customers, including our new SOC services.
 
As of April 30, 2010, 2009 and 2008, deferred service revenues were $3.4 million, $2.9 million and $3.4 million, respectively, in each case all of which represented current deferred services revenues. Deferred services revenues relate to customer payments in advance of services being performed. As of April 30, 2010, 2009 and 2008, the deferred service revenues of $3.4 million, $2.9 million and $3.4 million, respectively were reduced by net-down adjustments of $1.0 million, $1.0 million and $0.7 million, respectively. Net-down adjustments decrease both accounts receivable and deferred revenue and typically relate to billed but unpaid customer transactions for service engagements where services have not yet been provided, or where revenue from the customer is only


40


Table of Contents

recognized when cash has been paid and all other revenue recognition criteria have been met. See “Critical Accounting Policies, Significant Judgments and Estimates — Revenue Recognition” and Note 2 to our Consolidated Financial Statements (“Significant Accounting Policies — Revenue Recognition”) elsewhere in this report.
 
Cost of Revenues
 
Cost of revenues for our software products consists of third-party royalties and license fees for licensed technology incorporated into our software product offerings. Cost of revenues for appliance products consists of the hardware costs of the appliances and third-party royalties for licensed technology. The cost of product revenues is primarily impacted by the mix of software and appliance products as well as the relative ratio of third-party royalty bearing products included in software sales transactions. Sales of our appliance products are generally at a lower gross margin than sales of our software products.
 
Cost of maintenance revenues consists primarily of salaries and benefits related to maintenance personnel, royalties and other out-of-pocket expenses, and facilities and other related overhead.
 
Cost of services revenues consists primarily of the salaries and benefits of personnel, travel and other out-of-pocket expenses, facilities and other related overhead that are allocated based on the portion of the efforts of such personnel that are related to performance of professional services, and cost of services provided by subcontractors for professional services. Services gross margin may fluctuate as a result of periodic changes in our use of third party service providers, resulting in lower or higher gross margins for these services.
 
Gross margins may fluctuate from period to period as a result of the mix of software, appliances and services as components of revenue. However, in general over the longer term, we expect gross margins to fluctuate around current levels.
 
Operating and Non-Operating Expenses
 
Research and Development Expenses.  Research and development expenses consist primarily of salaries and benefits of personnel engaged in the development of new products, the enhancement of existing products, quality assurance activities and, to a lesser extent, facilities costs and other related overhead. We expense all of our research and development costs as they are incurred. We expect research and development expenses to increase in absolute dollars for the foreseeable future as we continue to invest in the development of our products.
 
Sales and Marketing Expenses.  Sales and marketing expenses consist primarily of salaries, commissions and benefits related to sales and marketing personnel and consultants; travel and other out-of-pocket expenses; expenses for marketing programs, such as for trade shows and our annual users conference, marketing materials and corporate communications; and facilities costs and other related overhead. Commissions on sales of products and maintenance are typically accrued and expensed when the respective revenue elements are ordered. Commissions on sales of services are typically accrued and expensed when the services were ordered. We pay commissions for channel sales not only to our channel sales force but also to our direct sales force in an effort to minimize channel conflicts as we develop our channel network. We intend to hire additional sales personnel, initiate additional marketing programs and further develop and build additional relationships with resellers and systems integrators on a global basis. Accordingly, we expect that our sales and marketing expenses will continue to increase for the foreseeable future in absolute dollars.
 
General and Administrative Expenses.  General and administrative expenses consist primarily of salaries and benefits related to general and administrative personnel and consultants; accounting and legal fees; insurance costs and facilities costs and other related overhead. We expect that, in the future, general and administrative expenses will increase in absolute dollars as we add personnel and incur additional costs related to the growth of our business and additional legal, accounting and other expenses in connection with our reporting and compliance obligations as a public company.
 
Other Income (Expense), Net.  Other income (expense), net consists of interest earned on our cash investments and foreign currency-related gains and losses. Our interest income will vary each reporting period depending on our average cash balances during the period and the current level of interest rates. Our foreign currency-related gains and losses will also vary depending upon movements in underlying exchange rates.


41


Table of Contents

Accounting for Income Taxes.  Our provision for income taxes is calculated in compliance with ASC Topic 740, Accounting for Income Taxes, or ASC 740, and other related guidance, and generally consists of tax expense related to current period earnings. We estimate income taxes in each of the jurisdictions in which we operate. Deferred income taxes are recorded for the expected tax consequences of temporary differences between the tax bases of assets and liabilities for financial reporting purposes and amounts recognized for income tax purposes. Deferred tax assets are recognized for deductible temporary differences, along with net operating loss and tax credit carry-forwards, if it is more likely than not that the tax benefits will be realized. Deferred tax assets and liabilities are measured using enacted tax rates in effect for the year in which those temporary differences are expected to be recovered or settled. These deferred tax assets and liabilities are included within the consolidated balance sheets.
 
To the extent a deferred tax asset cannot be recognized a valuation allowance is established to reduce our deferred tax assets to the amount that is more likely than not to be realized. A valuation allowance is maintained until sufficient evidence exists to support the reversal of all or some portion of these allowances. Should the actual amounts differ from our estimates, the amount of our valuation allowance could be materially impacted. As of April 30, 2010, and in accordance with ASC 740, we evaluated our need for a valuation allowance based on historical evidence, trends in profitability and expectations of future taxable income, and determined that a valuation allowance against deferred tax assets was no longer necessary. As such, we released $18.6 million of the valuation allowance as an offset against all of our U.S. and state deferred tax assets resulting in a net benefit in our provision for income taxes.
 
Critical Accounting Policies, Significant Judgments and Estimates
 
Our consolidated financial statements have been prepared in accordance with accounting principles generally accepted in the United States, which requires us to make estimates and judgments that affect the reported amounts of assets and liabilities and the disclosure of contingent assets and liabilities at the date of the financial statements as well as the reported amounts of revenues and expenses during the reporting period. We base our estimates and judgments on our historical experience, knowledge of current conditions and our beliefs regarding likely occurrences in the future, given available information. Estimates are used for, but are not limited to, revenue recognition, determination of fair value of stock and stock-based awards, valuation of goodwill and intangible assets acquired in business combinations, impairment of goodwill and other intangible assets, amortization of intangible assets, accounting for income taxes, accounting for uncertainties in income taxes, contingencies and litigation, allowances for doubtful accounts, and accrued liabilities. Actual results may differ from those estimates, and any differences may be material to our financial statements. Further, if we apply different factors, or change the method by which we apply the various factors that are used, in making our critical estimates and judgments, our reported operating results and financial condition could be materially affected.
 
Revenue Recognition
 
We recognize revenues in accordance with ASC 985-605. Accordingly, we exercise judgment and use estimates in connection with the determination of the amount of product, maintenance and services revenues to be recognized in each accounting period.
 
We derive revenues primarily from three sources: (i) sales of our software and hardware products, (ii) fees for maintenance to provide unspecified upgrades and customer technical support, and (iii) fees for services, including professional services for product installation, implementation, staffing and management services for SOCs and training. Our appliance products contain software that is more than incidental to the functionality of the product. In accordance with the guidance, we recognize revenues when the following conditions have been met:
 
  •  persuasive evidence of an arrangement exists;
 
  •  the fee is fixed or determinable;
 
  •  product delivery has occurred or services have been rendered; and
 
  •  collection is considered probable.


42


Table of Contents

 
We typically use a binding purchase order in conjunction with either a signed contract or reference on the purchase order to the terms and conditions of our shrinkwrap or end-user license agreement as evidence of an arrangement. We assess whether the fee is fixed or determinable based on the payment terms associated with the transaction and whether the sales price is subject to refund or forfeiture, concession or other adjustment. We do not generally grant rights of return or price protection to our distribution partners or end users, other than limited rights of return during the warranty period in some cases. We use shipping documents, contractual terms and conditions and customer acceptance, when applicable, to verify product delivery to the customer. For perpetual software license fees in arrangements that do not include customization, or services that are not considered essential to the functionality of the licenses, delivery is deemed to occur when the product is delivered to the customer. Services and consulting arrangements that are not essential to the functionality of the licensed product are recognized as revenues as these services are provided. Delivery of maintenance is considered to occur on a straight-line basis ratably over the life of the contract. We consider probability of collection based on a number of factors, such as creditworthiness of the customer as determined by credit checks and analysis, past transaction history, the geographic location and financial viability. We do not require, nor do we request, collateral from customers. If we determine that collectibility is not reasonably assured, we defer the revenues until collectibility becomes reasonably assured, generally upon receipt of cash. A net-down adjustment may be recorded in cases where sales transactions have been invoiced but are recognized on cash receipt, for invoiced but unpaid sales transactions related to post-contract customer support obligations for which the term has not commenced, or for invoiced but unpaid service engagements where services have not yet been provided. Net-down adjustments decrease both accounts receivable and deferred revenue. Any such transactions included in accounts receivable and deferred revenue at period end are reflected on the balance sheet on a net basis.
 
Our sales of software products to date have typically been multiple element arrangements, which have included software licenses and corresponding maintenance, and have also generally included some amount of professional services. Our sales of appliance products to date have been multiple element arrangements as well, which included hardware, software licenses and corresponding maintenance, and have also generally included some amount of professional services. We allocate the total arrangement fee among these multiple elements based upon their respective fair values as determined by VSOE or, if applicable, by the residual method under the guidance. VSOE for maintenance and support services is based on separate sales and/or renewals to other customers or upon renewal rates quoted in contracts when the quoted renewal rates are deemed substantive in both rate and term. VSOE for professional services is established based on prices charged to customers when those services are sold separately. If we cannot objectively determine the fair value of any undelivered element in a multiple element arrangement, we defer revenues for each element until all elements have been delivered, or until VSOE can objectively be determined for any remaining undelivered element. If VSOE for maintenance does not exist, and this represents the only undelivered element, then revenues for the entire arrangement are recognized ratably over the performance period. When VSOE of a delivered element has not been determined, but the fair value for all undelivered elements has, we use the residual method to record revenues for the delivered element. Under the residual method, the fair value of the undelivered elements is deferred and the remaining portion of the arrangement fee is allocated to the delivered element and recognized immediately as revenues. Revenues from time-based (term) license sales that include ongoing delivery obligations throughout the term of the arrangement are recognized ratably over the term.
 
Our agreements generally do not include acceptance provisions. However, if acceptance provisions exist, we deem delivery to have occurred upon customer acceptance.
 
For sales to direct end-users and channel partners, we recognize product revenue once either we or our channel partner has a contractual agreement in place and upon transfer of title and risk of loss, which is generally upon shipment, provided all other criteria for revenue recognition have been met. Where sales are made through resellers, revenue is generally recorded upon shipment to the end-users, when all other criteria for revenue recognition have been met. In a limited number of instances, when delivery is to be made to a reseller upon the request of either the end-user or the reseller, and when all other criteria for revenue recognition have been met, it is our practice to recognize revenue on shipment to a reseller but only where an end-user has been identified prior to shipment. For end-users, resellers and systems integrators, we generally have no significant obligations for future performance such as rights of return or pricing credits.


43


Table of Contents

We assess whether fees are collectible and fixed or determinable at the time of the sale, and recognize revenues if all other revenue recognition criteria have been met. Our standard payment terms are net 30 days and are considered normal up to net three months, while payment terms beyond three months are considered to be extended terms. Payments that are due within three months are generally deemed to be fixed or determinable based on our successful collection history on these agreements.
 
Stock-Based Compensation
 
Effective May 1, 2006, we adopted ASC Topic 718, Compensation-Stock Compensation, or ASC 718, which requires companies to expense the fair value of employee stock options and other forms of stock-based compensation. The guidance requires nonpublic companies that used the minimum value method, for either recognition or pro forma disclosures to apply the guidance using the prospective-transition method. As such, we continued to apply the minimum value method in future periods to unvested equity awards outstanding at the date of adoption of ASC 718 that were measured using the minimum value method. In addition, we continued to amortize those awards granted prior to May 1, 2006 utilizing an accelerated amortization schedule. As of April 30, 2009, amortization under the minimum value method was complete. In accordance with the guidance, we will recognize the compensation cost of employee stock-based awards granted subsequent to April 30, 2006 in the statement of operations using the straight-line method over the vesting period of the award.
 
To determine the fair value of stock options granted after May 1, 2006, we have elected to use the Black-Scholes-Merton option pricing model, which requires, among other inputs, an estimate of the fair value of the underlying common stock on the date of grant and assumptions as to volatility of our stock over the expected term of the related options, the expected term of the options, the risk-free interest rate and the option forfeiture rate. As there had been no public market for our common stock prior to our IPO in February 2008, we have determined the volatility for options granted for fiscal 2008 and fiscal 2007 based on an analysis of reported data for a peer group of companies that issued options with substantially similar terms. The expected volatility of options granted has been determined using weighted-average measures of the implied volatility and the historical volatility for this peer group of companies for a period equal to the expected life of the option. The weighted-average expected volatility for options granted during fiscal 2010, 2009 and 2008, was 57%, 52% and 55%, respectively. The expected life of options has been determined considering the expected life of options granted by a group of peer companies and the average vesting and contractual terms of options granted to our employees. The weighted-average expected life of options granted for fiscal 2010, 2009 and 2008 was 5.64, 5.74 and 5.25 years, respectively. For fiscal 2010, 2009 and 2008, the weighted-average risk-free interest rate used was 2.41%, 3.13% and 4.22%, respectively. The risk-free interest rate is based on a zero coupon United States treasury instrument whose term is consistent with the expected life of the stock options. We have not paid and do not anticipate paying cash dividends on our shares of common stock; therefore, the expected dividend yield is assumed to be zero. In addition, ASC 718 requires companies to utilize an estimated forfeiture rate when calculating the expense for the period, whereas the former SFAS 123 guidance permitted companies to record forfeitures based on actual forfeitures, which was our historical policy prior to the adoption of ASC 718. We apply an estimated annual forfeiture rate of 5%, based on our historical forfeiture experience during the previous six years, in determining the expense recorded in our consolidated statement of operations. The forfeiture rate is graded and results in a weighted average effective forfeiture rate of 12.9%, 8.6%, and 5.5% for fiscal 2010, 2009, and 2008, respectively.
 
We recorded expense of $9.0 million, $5.1 million and $4.2 million for fiscal 2010, 2009 and 2008, respectively, in connection with stock-based awards accounted for under ASC 718. As of April 30, 2010, unrecognized stock-based compensation expense of non-vested stock options was $21.1 million. As of April 30, 2010, the unrecognized stock-based compensation expense is expected to be recognized using the straight-line method over the required service period of the options. The actual amount of stock-based compensation expense we record in any fiscal period will depend on a number of factors, including the number of stock options issued and the volatility of our stock price over time. In future periods, stock-based compensation expense may increase as we issue additional equity-based awards to continue to attract and retain key employees. Additionally, the guidance requires that we recognize compensation expense only for the portion of stock options that are expected to vest. If the actual number of forfeitures differs from that estimated by management, we will be required to record adjustments to stock-based compensation expense in future periods.


44


Table of Contents

Our 2007 Employee Stock Purchase Plan, or ESPP, became effective on the effectiveness of our IPO on February 14, 2008. The ESPP provides for consecutive six-month offering periods, except for the first offering period, which commenced on February 14, 2008 and ended on September 15, 2008. The ESPP is compensatory and results in compensation cost accounted for under ASC 718. We use the Black-Scholes-Merton option pricing model to estimate the fair value of rights to acquire stock granted under the ESPP. For the fiscal year ended April 30, 2010, 2009 and 2008, we recorded stock-based compensation expense associated with the ESPP of $1.2 million, $1.0 million and $0.2 million, respectively. As of April 30, 2010, unrecognized stock-based compensation expense associated with rights to acquire shares of common stock under the ESPP was $0.5 million.
 
Business Combinations
 
We account for business combinations in accordance with ASC Topic 805, Business Combinations, or ASC 805, which requires the purchase method of accounting for business combinations. In accordance with the guidance, we determine the recognition of intangible assets based on the following criteria: (i) the intangible asset arises from contractual or other rights; or (ii) the intangible asset is separable or divisible from the acquired entity and capable of being sold, transferred, licensed, returned or exchanged. In accordance with the guidance, we allocate the purchase price of our business combinations to the tangible assets, intangible assets and liabilities acquired based on their estimated fair values. We record the excess of the purchase price over the total of those fair values as goodwill.
 
Our valuations require significant estimates, especially with respect to intangible assets. Critical estimates in valuing certain intangible assets include, but are not limited to, future expected cash flows from customer contracts, customer lists and distribution agreements and discount rates. We estimate fair value based upon assumptions we believe to be reasonable, but which are inherently uncertain and unpredictable, and, as a result, actual results may differ from our estimates.
 
Goodwill and Intangible Assets
 
In accordance with ASC Topic 350, Goodwill and Other Intangible Assets, or ASC 350, we do not amortize goodwill or other intangible assets with indefinite lives but rather test them for impairment. The guidance requires us to perform an impairment review of our goodwill balance at least annually, which we intend to perform on November 1 of each fiscal year, and also whenever events or changes in circumstances indicate that the carrying amount of these assets may not be recoverable. The allocation of the acquisition cost to intangible assets and goodwill requires the extensive use of estimates and assumptions, including estimates of future cash flows expected to be generated by the acquired assets and amortization of intangible assets, other than goodwill. Further, when impairment indicators are identified with respect to previously recorded intangible assets, the values of the assets are determined using discounted future cash flow techniques. Significant management judgment is required in the forecasting of future operating results that are used in the preparation of the projected discounted cash flows, and should different conditions prevail, material write-downs of net intangible assets could occur. We review periodically the estimated remaining useful lives of our acquired intangible assets. A reduction in our estimate of remaining useful lives, if any, could result in increased amortization expense in future periods. Future goodwill impairment tests could result in a charge to earnings.
 
Allowance for Doubtful Accounts
 
We maintain an allowance for doubtful accounts based on a periodic review of customer accounts, payment patterns and specific collection issues. Where account-specific collection issues are identified, we record a specific allowance based on the amount that we believe will not be collected. For accounts where specific collection issues are not identified, we record a reserve based on the age of the receivables. As of April 30, 2010, we had two customers that accounted for 15% and 10%, respectively, of our net accounts receivable, which receivables were majorily paid subsequent to the end of fiscal 2010. As of April 30, 2009, we had two customers that accounted for 17% and 11%, respectively, of our net accounts receivable, which receivables were fully paid subsequent to the end of fiscal 2009.


45


Table of Contents

Accounting for Income Taxes
 
Management judgment is required in determining our provision for income taxes, our deferred tax assets and liabilities and any valuation allowance recorded against our net deferred tax assets.
 
Our provision for income taxes is calculated in accordance with ASC 740, and other related guidance, and generally consists of tax expense related to current period earnings. As part of the process of preparing our consolidated financial statements, we continuously monitor the circumstances impacting the expected realization of our deferred tax assets for each jurisdiction. We consider all available evidence, both positive and negative, including historical levels of income in each jurisdiction, expectations and risks associated with estimates of future taxable income and ongoing prudent and feasible tax planning strategies in assessing the need for the valuation allowance. We determine our income tax expense together with calculating the deferred income tax expense or benefit related to temporary differences resulting from the differing treatment of items for tax and accounting purposes, such as deferred revenue or deductibility of certain intangible assets. These temporary differences result in deferred tax assets and liabilities. We must then assess the likelihood that the deferred tax assets may be recovered through carry back to prior year’s income or through the generation of future taxable income after consideration of tax planning strategies. Changes in these estimates may result in significant increases or decreases to our tax provision in a period in which such estimates are changed which in turn would affect net income.
 
As of April 30, 2010, and in accordance with ASC 740, we evaluated our need for a valuation allowance based on historical evidence, trends in profitability and expectations of future taxable income, and determined that a valuation allowance against deferred tax assets was no longer necessary. As such, we released $18.6 million of the valuation allowance as an offset against all of our U.S. and state deferred tax assets resulting in a net benefit in our provision for income taxes.
 
We adopted ASC 740-10-50, Accounting for Uncertainty in Income Taxes, an interpretation of the guidance under ASC 740, on May 1, 2007. ASC 740-10-50 prescribes a recognition threshold and measurement attributes for the financial statement recognition and measurement of uncertain tax positions taken or expected to be taken in a company’s income tax return. The pronouncement also provides guidance on derecognition, classification, interest and penalties, accounting in interim periods, disclosure and transition with respect to income tax uncertainty. Management judgment is required to determine if the weight of available evidence indicates that a tax position is more likely than not to be sustained, as well as the largest amount of benefit from each sustained position that is more likely than not to be realized.
 
As a result of the implementation of ASC 740-10-50 in fiscal 2008, we recognized a liability for uncertain tax positions and a cumulative effect adjustment to the beginning balance of accumulated deficit on the balance sheet of $0.1 million. As of April 30, 2009 and 2010, the liability for uncertain tax positions was $0.3 million and $0.4 million, respectively. In addition, as of April 30, 2009, we recorded a $2.7 million reduction to deferred tax assets for unrecognized tax benefits, all of which was currently offset by a full valuation allowance that had no affect on the beginning balance of accumulated deficit or the net balance sheet. As of April 30, 2010, the unrecognized tax benefit of $2.7 million increased to $3.4 million.
 
Our total unrecognized tax benefit as of April 30, 2010, 2009 and 2008 was $3.4 million, $2.7 million and $2.1 million, respectively. For the year ended April 30, 2010 if the remaining balance of $3.4 million of unrecognized tax benefits were realized in a future period, it would result in a tax benefit and a reduction of the effective tax rate. For the years ended April 30, 2009 and 2008 without regard to the valuation allowance, if the balance of $2.7 million and $2.1 million, respectively, of unrecognized tax benefits would have been realized in a future period, it would have resulted in a tax benefit and a reduction of the effective tax rate. We do not expect any material changes to the amount of the unrecognized tax benefit associated with our uncertain tax positions within the next twelve months.
 
Our policy is to recognize interest and penalties accrued on any unrecognized tax benefits as a component of income tax expense. As of April 30, 2010, 2009, and 2008 we had approximately $44,000, $37,000 and $23,000, respectively, of accrued interest or penalties associated with unrecognized tax benefits.
 
We file income tax returns in the U.S. federal jurisdiction, California and various state and foreign tax jurisdictions in which we have a subsidiary or branch operation. During the fourth quarter of fiscal 2010, the


46


Table of Contents

U.S. Internal Revenue Service, or IRS, notified us of its intent to audit fiscal years 2007 to 2009. The IRS will also make a determination regarding R&D tax credit carryforwards from calendar 2000 through April 30, 2009. Tax years 2001 to 2009 remain open to examination by state tax authorities, and the tax years 2005 to 2009 remain open to examination by the foreign tax authorities.
 
Results of Operations
 
The following table presents our results of operations as a percentage of total revenues for the periods indicated:
 
                         
    Fiscal Year Ended April 30,
    2010   2009   2008
 
Revenues:
                       
Products
    58.7 %     59.2 %     62.8 %
Maintenance
    30.2       28.3       27.2  
Services
    11.1       12.5       10.0  
                         
Total revenues
    100.0       100.0       100.0  
Cost of revenues:
                       
Products
    7.1       6.3       4.7  
Maintenance
    5.2       5.0       5.6  
Services
    7.4       7.3       5.7  
                         
Total cost of revenues
    19.7       18.6       16.0  
                         
Gross margin
    80.3       81.4       84.0  
Operating expenses:
                       
Research and development
    14.5       16.6       19.5  
Sales and marketing
    40.6       41.3       52.6  
General and administrative
    14.5       14.9       13.2  
                         
Total operating expenses
    69.6       72.8       85.3  
                         
Income (loss) from operations
    10.7 %     8.6 %     (1.3 )%
                         
 
Comparison of Fiscal 2010 and Fiscal 2009
 
Revenues
 
Revenues for 2010 and 2009 were as follows (in thousands, except percentages):
 
                                 
    Fiscal Year Ended
             
    April 30,     Change in
    Change in
 
    2010     2009     Dollars     Percent  
 
Products
  $ 106,568     $ 80,616     $ 25,952       32.2 %
Percentage of total revenues
    58.7 %     59.2 %                
Maintenance
    54,736       38,521       16,215       42.1 %
Percentage of total revenues
    30.2 %     28.3 %                
Services
    20,080       17,031       3,049       17.9 %
                                 
Percentage of total revenues
    11.1 %     12.5 %                
                                 
Total revenues
  $ 181,384     $ 136,168     $ 45,216       33.2 %
                                 
 
Product Revenues.  Product revenues in fiscal 2010 included revenues of $47.8 million from 324 new customers and revenues of $58.8 million from existing customers. New customer revenues from 324 customers for fiscal 2010 increased by $16.0 million compared to revenues from 217 new customers fiscal 2009. The significant


47


Table of Contents

increase in the number of new customer for fiscal 2010 compared to fiscal 2009 is primarily the result of an increase in the number of mid-market customers purchasing our products. The average transaction size of new customer purchases remained relatively consistent from fiscal 2009 to fiscal 2010. This was a result of an increase in the average transaction size of new enterprise and government customers, offsetting the smaller transaction size from a greater number of mid-market customers. Existing customer revenues for fiscal 2010 increased by $9.9 million compared to existing customer revenues for fiscal 2009. The increase was primarily attributable to an increase in the number and average transaction size of sales to our existing customers, driven by additional purchases of our ESM product together with our ArcSight Logger products as well as the expansion of the deployment of our products more broadly across their IT infrastructure. We anticipate that the mix of product revenues from new and existing customers could fluctuate from period to period as a result of the transaction size, product mix, impact of the recovering economic environment and related geography of each revenue transaction.
 
Maintenance Revenues.  Maintenance revenues increased $16.2 million for fiscal 2010 compared to fiscal 2009, as a result of providing support services to a larger installed base as well as the incremental maintenance revenues from increased product sales.
 
Services Revenues.  Services revenues increased by $3.0 million for fiscal 2010 compared to fiscal 2009, primarily due to continued growth in our SOC staffing and management engagements.
 
Geographic Regions.  We sell our product in three geographic regions: Americas; EMEA; and APAC. Net sales, which include product, maintenance and service revenues, for each region are summarized in the following table (in thousands, except percentages):
 
                                 
    Fiscal Year Ended
             
    April 30,     Change in
    Change in
 
    2010     2009     Dollars     Percent  
 
Americas
  $ 139,938     $ 109,812     $ 30,126       27.4 %
Percentage of total revenues
    77.2 %     80.6 %                
EMEA
    33,750       19,409       14,341       73.9 %
Percentage of total revenues
    18.6 %     14.3 %                
APAC
    7,696       6,947       749       10.8 %
                                 
Percentage of total revenues
    4.2 %     5.1 %                
                                 
Total revenues
  $ 181,384     $ 136,168     $ 45,216       33.2 %
                                 
 
Total revenues for fiscal 2010 as compared to fiscal 2009 increased due to the strength of the Americas and EMEA regions. The EMEA region during fiscal 2010 increased in both absolute dollars and as a percentage of revenues, as IT infrastructure and security mandate spending returned to historic levels from the unusually low levels of 2009 caused by the recent economic instability in this region. We experienced an increase in revenues in the Americas region in absolute dollars, but the percentage of total revenues year over year remained roughly constant, primarily due to the growth in the EMEA region. The Asia Pacific region’s revenue increased by 11% in fiscal 2010 as compared to fiscal 2009.
 
Cost of Revenues and Gross Margin
 
The following table is a summary of cost of product, maintenance, and services revenues in absolute amounts (in thousands, except percentages):
 
                                 
    Fiscal Year Ended
             
    April 30,     Change in
    Change in
 
    2010     2009     Dollars     Percent  
 
Products
  $ 12,969     $ 8,595     $ 4,374       50.9 %
Maintenance
    9,503       6,861       2,642       38.5 %
Services
    13,340       9,875       3,465       35.1 %
                                 
Total cost of revenues
  $ 35,812     $ 25,331     $ 10,481       41.4 %
                                 


48


Table of Contents

The following table is a summary of gross profit for products, maintenance and services and their respective gross margins (in thousands, except percentages):
 
                 
    Fiscal Year Ended
 
    April 30,  
    2010     2009  
 
Gross margin
               
Products
  $ 93,599     $ 72,021  
Percentage of product revenues
    87.8 %     89.3 %
Maintenance
  $ 45,233     $ 31,660  
Percentage of maintenance revenues
    82.6 %     82.2 %
Services
  $ 6,740     $ 7,156  
Percentage of services revenues
    33.6 %     42.0 %
                 
Total gross margin
  $ 145,572     $ 110,837  
Percentage of total revenues
    80.3 %     81.4 %
                 
 
Cost of Product Revenues and Gross Margin.  Cost of product revenues increased by $4.4 million in fiscal 2010, primarily due to increased appliance product cost of goods of $3.3 million, the majority of which relates to increased ArcSight Logger product sales, as well as an increase of $0.9 million in related royalty obligations attributed to ESM and appliance products that include licensed technology. Product gross margin as a percentage of product revenues decreased by 1.5% as a percentage of product revenues for fiscal 2010 compared to fiscal 2009, due to appliance revenues contributing a higher percentage of product revenue than the prior year. While we expect appliance revenues to generally represent less than half of product revenues going forward, the mix of software and appliance product revenues will likely fluctuate from period to period, potentially negatively impacting product gross margins during the period.
 
Cost of Maintenance Revenues and Gross Margin.  Cost of maintenance revenues increased by $2.6 million in fiscal 2010, due primarily to increased compensation-related expenses of $1.4 million related to increased head count and cost per employee in our technical support organization. In addition, third-party royalty support and maintenance expenses increased by $0.8 million. Maintenance gross margin remained roughly constant for fiscal 2010 compared to fiscal 2009 increasing by 0.4% as a percentage of maintenance revenues.
 
Cost of Services Revenues and Gross Margin.  Cost of service revenues increased by $3.5 million in fiscal 2010, primarily due to a $1.5 million increase in compensation related-expenses related to increased head count and cost per employee. Additionally, use of third party contractors and external consultants increased by $1.2 million, $0.8 million of which relates to SOC engagements. Services gross margin as a percentage of services revenues decreased by 8.4% to 33.6% for fiscal 2010 from 42.0% for fiscal 2009, due primarily to an increase in headcount and related cost per employee, the increased use of higher cost external consultants to staff such engagements, and the investment and introduction of ArcSight University. We continue to hire internally to staff our growing services business increasing headcount 43% from fiscal 2009 to fiscal 2010. We expect margins to stabilize in the future as our SOC business is further developed and is able to sustain its own growth, and we utilize personnel from system integrator partners. Additionally, training and materials increased by $0.3 million and travel related expenses increased by $0.4 million.


49


Table of Contents

Operating Expenses
 
The following table is a summary of research and development, sales and marketing, and general and administrative expenses in absolute amounts and as a percentage of total revenues (in thousands, except percentages):
 
                                 
    Fiscal Year Ended
             
    April 30,     Change in
    Change in
 
    2010     2009     Dollars     Percent  
 
Research and development
  $ 26,266     $ 22,537     $ 3,729       16.5 %
Percentage of total revenues
    14.5 %     16.6 %                
Sales and marketing
    73,658       56,279       17,379       30.9 %
Percentage of total revenues
    40.6 %     41.3 %                
General and administrative
    26,269       20,278       5,991       29.5 %
                                 
Percentage of total revenues
    14.5 %     14.9 %                
                                 
Total operating expenses
  $ 126,193     $ 99,094     $ 27,099       27.3 %
                                 
Percentage of total revenues
    69.6 %     72.8 %                
                                 
 
Research and Development Expenses.  The increase in research and development expenses in fiscal 2010 of $3.7 million compared to fiscal 2009 was primarily attributable to an increase of $3.3 million in compensation-related expenses associated with an increase in research and development personnel from 109 to 134 at the respective period ends. We plan to continue hiring to extend our product platform. As a result, we expect research and development expenses to continue to increase in absolute dollars.
 
Sales and Marketing Expenses.  The increase in sales and marketing expenses in fiscal 2010 of $17.4 million compared to fiscal 2009 was primarily attributable to an increase of $13.0 million in compensation-related expense of which $6.4 million related to commission and bonus plan expenses partially associated with a change in commission plan structures but primarily due to strong annual sales during the fiscal period and $6.6 million was due to an increase in sales and marketing personnel across our sales organization from 141 to 177 at the respective period ends. We plan to continue hiring in line with our growth opportunities. In addition, the increase in sales and marketing expenses also includes an increase of $1.1 million in external consultants and temporary help partially attributable to supporting operations abroad and market research, an increase in travel and entertainment expenses of $1.0 million, an increase in marketing program expenses of $0.9 million most notably related to corporate identity, trade show and event services. We expect sales and marketing expenses to continue to increase in absolute dollars. Sales and marketing expense as a percentage of total revenue decreased slightly by 0.7% to 40.6% for fiscal 2010 compared to 41.3% for fiscal 2009, due primarily to lower sales commissions as a result of changes in compensation plan structure, and as a result of a greater percentage of sales to existing customers, which are at a lower cost than sales to new customers.
 
General and Administrative Expenses.  The increase in general and administrative expenses of $6.0 million in fiscal 2010 compared to fiscal 2009 was primarily attributable to an increase of $2.5 million associated with compensation expense and an increase of $1.9 million in stock-based compensation expense, partially due to an increase in general and administrative personnel from 54 to 67 at the respective period ends. External consultants and temporary help increased $0.7 million and third-party software support and maintenance expense increased $0.6 million attributable to enterprise resource planning, or ERP, system hosting expenses related to the implementation project. This increase was offset by a decrease of $0.4 million in legal, audit and tax advisory service fees. We expect general and administrative expenses to increase in absolute dollars due to growth of our corporate infrastructure.


50


Table of Contents

Non-Operating Expenses
 
The following table is a summary of interest income and other expenses, net, in absolute amounts and as a percentage of total revenues (in thousands, except percentages):
 
                                 
    Fiscal Year Ended
             
    April 30,     Change in
    Change in
 
    2010     2009     Dollars     Percent  
 
Interest income
  $ 124     $ 991     $ (867 )     (87.5 )%
Percentage of total revenues
    0.1 %     0.7 %                
Other expense, net
    (523 )     (257 )     (266 )     (103.5 )%
Percentage of total revenues
    (0.3 )%     (0.2 )%                
Provision (benefit) for income taxes
    (9,407 )     2,564       (11,971 )     (466.9 )%
                                 
Percentage of total revenues
    (5.2 )%     1.9 %                
                                 
Total non-operating expenses
  $ 9,008     $ (1,830 )   $ 10,838       592.2 %
                                 
Percentage of total revenues
    5.0 %     (1.3 )%                
                                 
 
Interest Income.  The decrease in interest income of $0.9 million for fiscal 2010 compared to fiscal 2009 was primarily to lower interest rates during fiscal 2010.
 
Other Expense, Net.  Other expense, net, for fiscal 2010 compared to fiscal 2009 increased as a result of increases in interest expense associated with entering into new capitalized software license arrangements, as well as increases in foreign currency losses.
 
Provision (Benefit) for Income Taxes.  For fiscal 2010, we recorded a benefit from income taxes of $9.4 million. The effective tax rate for fiscal 2010 is (49.6%), and is based on our taxable income for the year. The difference between the provision for income taxes that would be derived by applying the statutory rate to our income before tax and the income tax provision actually recorded is primarily due to the release of all of our valuation allowance, the impact of non-deductible ASC 718 stock-based compensation expenses, offset by the use of net operating loss carry-forwards and tax credits previously offset by a valuation allowance. For fiscal 2009 we recorded a provision for income taxes of $2.6 million. The effective tax rate for fiscal 2009 is 20.6%. The difference between the provision for income taxes that would be derived by applying the statutory rate to our income before tax and the income tax provision actually recorded is primarily due to the impact of nondeductible ASC 718 stock-based compensation expenses, offset by the use of net operating loss carry-forwards and tax credits.
 
Comparison of Fiscal 2009 and Fiscal 2008
 
Revenues
 
Revenues for 2009 and 2008 were as follows (in thousands, except percentages):
 
                                 
    Fiscal Year Ended
             
    April 30,     Change in
    Change in
 
    2009     2008     Dollars     Percent  
 
Products
  $ 80,616     $ 63,765     $ 16,851       26.4 %
Percentage of total revenues
    59.2 %     62.8 %                
Maintenance
    38,521       27,607       10,914       39.5 %
Percentage of total revenues
    28.3 %     27.2 %                
Services
    17,031       10,173       6,858       67.4 %
                                 
Percentage of total revenues
    12.5 %     10.0 %                
                                 
Total revenues
  $ 136,168     $ 101,545     $ 34,623       34.1 %
                                 
 
Product Revenues.  Product revenues in fiscal 2009 included revenues of $31.7 million from 217 new customers and revenues of $48.9 million from existing customers. New customer revenues in fiscal 2009 increased


51


Table of Contents

by $0.8 million compared to new customer revenues in fiscal 2008. Despite the increase of 53 new customers in fiscal 2009 compared to fiscal 2008, the marginal increase of product revenue from new customers was a result of a decline in average sales price of new customer sales transactions. This was primarily attributable to an increase in the number of new mid-market customers purchasing our ArcSight Logger product on a stand-alone basis during fiscal 2009 compared to fiscal 2008, as well pricing pressure resulting from the poor economic environment. Existing customer revenues in fiscal 2009 increased by $16.1 million compared to existing customer revenues in fiscal 2008. The increase was primarily attributable to follow-on sales of our ESM and appliance products from a larger installed base. In addition, there was a net recognition of $0.9 million of product revenues in fiscal 2009 related to sales transactions executed in prior years that included undelivered product elements for which we did not have VSOE, while in fiscal 2008 there was a net recognition of product revenues of $2.7 million from such transactions. As of April 30, 2009, deferred product revenues included $1.3 million related to similar transactions. See the related discussion in “— Sources of Revenues, Cost of Revenues and Operating Expenses.”
 
Maintenance Revenues.  Maintenance revenues increased by $10.9 million in fiscal 2009 as a result of providing support services to a larger installed base as well as the incremental maintenance revenues from increased product sales. As a result of the timing of revenue recognition for sales transactions that included an undelivered product element for which we did not have VSOE, there was no recognition of such maintenance revenues in fiscal 2009, and a net recognition of $0.2 million of maintenance revenues in fiscal 2008. See the related discussion in “— Sources of Revenues, Cost of Revenues and Operating Expenses.”
 
Services Revenues.  Services revenues increased by $6.9 million in fiscal 2009 primarily due to service engagements to staff and manage the SOCs of certain large customers.
 
Geographic Regions.  We sell our product in three geographic regions: Americas; EMEA; and APAC. Net sales, which include product, maintenance and service revenues, for each region are summarized in the following table (in thousands, except percentages):
 
                                 
    Fiscal Year Ended
             
    April 30,     Change in
    Change in
 
    2009     2008     Dollars     Percent  
 
Americas
  $ 109,812     $ 77,621     $ 32,191       41.5 %
Percentage of total revenues
    80.6 %     76.4 %                
EMEA
    19,409       18,447       962       5.2 %
Percentage of total revenues
    14.3 %     18.2 %                
Asia Pacific
    6,947       5,477       1,470       26.8 %
                                 
Percentage of total revenues
    5.1 %     5.4 %                
                                 
Total revenues
  $ 136,168     $ 101,545     $ 34,623       34.1 %
                                 
 
Total revenues for fiscal 2009 as compared to fiscal 2008 increased primarily due to the strength of the Americas region. The Americas region during fiscal 2009 increased in both absolute dollars and as a percentage of revenues. We experienced an increase in revenues of the EMEA and APAC regions in absolute dollars, but a decrease in percentage of total revenues year over year. This percentage decrease was caused by a more significant impact on IT spending in this region due to the weak economic environment.


52


Table of Contents

Cost of Revenues and Gross Margin
 
The following table is a summary of cost of product, maintenance, and services revenues in absolute amounts and as a percentage of total revenues (in thousands, except percentages):
 
                                 
    Fiscal Year Ended
             
    April 30,     Change in
    Change in
 
    2009     2008     Dollars     Percent  
 
Products
  $ 8,595     $ 4,767     $ 3,828       80.3 %
Maintenance
    6,861       5,691       1,170       20.6 %
Services
    9,875       5,800       4,075       70.3 %
                                 
Total cost of revenues
  $ 25,331     $ 16,258     $ 9,073       55.8 %
                                 
 
The following table is a summary of gross profit for products, maintenance and services and their respective gross margins (in thousands, except percentages):
 
                 
    Fiscal Year Ended
 
    April 30,  
    2009     2008  
 
Gross margin
               
Products
  $ 72,021     $ 58,998  
Percentage of product revenues
    89.3 %     92.5 %
Maintenance
  $ 31,660     $ 21,916  
Percentage of maintenance revenues
    82.2 %     79.4 %
Services
  $ 7,156     $ 4,373  
Percentage of services revenues
    42.0 %     43.0 %
                 
Total gross margin
  $ 110,837     $ 85,287  
Percentage of total revenues
    81.4 %     84.0 %
                 
 
Cost of Product Revenues and Gross Margin.  Cost of product revenues increased by $3.8 million in fiscal 2009, primarily due to increased ArcSight Logger appliance cost of goods related to increased ArcSight Logger appliance sales, as well as an increase related to royalty obligations. Product gross margin decreased by 3.2% as a percentage of product revenues to 89.3% in fiscal 2009, compared to 92.5% in fiscal 2008 due in part to increased sales of lower margin ArcSight Logger and Connector appliance products and due in part to an increase in royalty fees related to increased sales of products that include licensed technology.
 
Cost of Maintenance Revenues and Gross Margin.  Cost of maintenance revenues increased by $1.2 million in fiscal 2009, due primarily to increased compensation related expenses of $1.0 million related to increased head count in our technical support organization and increases in third-party royalty support and maintenance expenses of $0.4 million, offset by a decrease in recruiting expenses of $0.1 million. Maintenance gross margin increased by 2.8% as a percentage of maintenance revenues to 82.2% in fiscal 2009 compared to 79.4% in fiscal 2008 due primarily to our installed base growing more quickly than corresponding growth in our support organization and associated costs.
 
Cost of Services Revenues and Gross Margin.  Cost of service revenues increased by $4.1 million in fiscal 2009 primarily due to a $1.9 million increase in compensation related-expenses related to increased head count and cost per employee, a $1.9 million increase related to the use of third party contractors and external consultants and a $0.3 million increase related to training and materials expense. Services gross margin decreased by 1.0% as a percentage of services revenues to 42.0% for fiscal 2009 compared to 43.0% in fiscal 2008, due primarily to an increase in headcount and related cost per employee, partially offset by increased employee productivity in relation to revenue growth.


53


Table of Contents

Operating Expenses
 
The following table is a summary of research and development, sales and marketing, and general and administrative expenses in absolute amounts and as a percentage of total revenues (in thousands, except percentages):
 
                                 
    Fiscal Year Ended
             
    April 30,     Change in
    Change in
 
    2009     2008     Dollars     Percent  
 
Research and development
  $ 22,537     $ 19,762     $ 2,775       14.0 %
Percentage of total revenues
    16.6 %     19.5 %                
Sales and marketing
    56,279       53,453       2,826       5.3 %
Percentage of total revenues
    41.3 %     52.6 %                
General and administrative
    20,278       13,422       6,856       51.1 %
                                 
Percentage of total revenues
    14.9 %     13.2 %                
                                 
Total operating expenses
  $ 99,094     $ 86,637     $ 12,457       14.4 %
                                 
Percentage of total revenues
    72.8 %     85.3 %                
                                 
 
Research and Development Expenses.  The increase in research and development expenses in fiscal 2009 of $2.8 million compared to fiscal 2008 was primarily attributable to an increase of $2.6 million in compensation-related expenses associated with an increase in research and development personnel from 101 to 109 at the respective period ends. In addition, there was an increase in facilities-related expense of $0.2 million as a result of the expansion of our headquarters in Cupertino, California to accommodate the increase in our personnel.
 
Sales and Marketing Expenses.  The increase in sales and marketing expenses in fiscal 2009 of $2.8 million compared to fiscal 2008 was primarily attributable to an increase of $2.0 million in compensation-related expense associated with an increase in sales and marketing personnel from 123 to 141 at the respective period ends. The increase also included an increase of $0.5 million in marketing program expense, an increase of $0.4 million in travel and entertainment expenses, and an increase in facilities expense of $0.2 million, offset by a decrease of $0.2 million in outside consulting fees. Sales and marketing expense as a percentage of total revenue decreased by 11.3% to 41.3% for fiscal 2009 as compared to 52.6% in fiscal 2008, due primarily to lower sales commissions as a result of changes in compensation plan structure, and as a result of a greater percentage of sales to existing customers, which are at a lower cost than sales to new customers.
 
General and Administrative Expenses.  The increase in general and administrative expenses of $6.9 million in fiscal 2009 compared to fiscal 2008 was primarily attributable to an increase of $3.3 million associated with compensation-related expense partially due to an increase in general and administrative personnel from 41 to 54 at the respective period ends. The increase also included an increase in professional service expenses for legal and accounting of $2.1 million, an increase of $0.3 million in liability insurance premium expense associated with increasing our coverage level in connection with our becoming a public company, an increase of $0.4 million in other service and miscellaneous expenses, an increase of $0.2 million in depreciation expense, an increase of $0.1 million in bad debt expense, and an increase of $0.2 million related to an investor relations program.


54


Table of Contents

Non-Operating Expenses
 
The following table is a summary of interest income and other expenses, net, in absolute amounts and as a percentage of total revenues (in thousands, except percentages):
 
                                 
    Fiscal Year Ended
             
    April 30,     Change in
    Change in
 
    2009     2008     Dollars     Percent  
 
Interest income
  $ 991     $ 857     $ 134       15.6 %
Percentage of total revenues
    0.7 %     0.8 %                
Other expense, net
    (257 )     (385 )     128       (33.2 )%
Percentage of total revenues
    (0.2 )%     (0.4 )%                
Provision for income taxes
    2,564       1,131       1,433       126.7 %
                                 
Percentage of total revenues
    1.9 %     1.1 %                
                                 
Total non-operating expenses
  $ (1,830 )   $ (659 )   $ (1,695 )     (257.2 )%
                                 
Percentage of total revenues
    (1.3 )%     (0.6 )%                
                                 
 
Interest Income.  The increase in interest income of $0.1 million for fiscal 2009 compared to fiscal 2008 was primarily attributable to increased cash and cash equivalents related to net proceeds received from our IPO. The increase was offset by lower interest rates during fiscal 2009.
 
Other Income (Expense), Net.  The increase in other income (expense) of $0.1 million, net for fiscal 2009 compared to fiscal 2008 was primarily a result of a reduction in interest expense related to capitalized software licenses.
 
Provision for Income Taxes.  For fiscal 2009, we recorded a provision for income taxes of $2.6 million. The effective tax rate for fiscal 2009 is 20.6%. The difference between the provision for income taxes that would be derived by applying the statutory rate to our income before tax and the income tax provision actually recorded is primarily due to the impact of nondeductible ASC 718 stock-based compensation expenses, offset by the use of net operating loss carry-forwards and tax credits previously offset by a valuation allowance. For fiscal 2008, we recorded a provision for income taxes of $1.1 million, primarily related to foreign corporate income taxes, federal and state alternative minimum taxes currently due, and a charge of $0.1 million to establish a deferred tax liability related to the temporary timing differences between the tax deductible amortization of goodwill related to the acquisition of Enira Technologies, LLC in June 2006 under applicable tax rules and ASC 350 under which goodwill must be analyzed annually for impairment rather than amortized for financial reporting purposes (See Note 11 — “Income Taxes” for more detailed discussion). The effective tax rate for fiscal 2008 was (128.8%). The effective tax rate for fiscal 2008 differs from the U.S. federal statutory rate primarily due to our inability during this period to record a tax benefit for all or a portion of the domestic tax loss as a result of the valuation allowance on our deferred tax assets, and to a lesser extent other non-deductible items such as non-deductible ASC 718 stock-based compensation expense.
 
Liquidity and Capital Resources
 
From our inception in May 2000 through October 2002, we funded our operations primarily through convertible preferred stock financings that raised a total of $26.8 million. We achieved positive cash flows from operations in fiscal 2004 through 2009, and generated $45.7 million of cash from our operating activities during fiscal 2010 compared to $16.8 million of cash from our operating activities during fiscal 2009. We generally expect to continue generating positive operating cash flows on an annual basis. There may be individual quarters in which we use cash as a result of the timing of receipts or payments such as receipt of a large receivable from a customer whose revenue is recognized on a cash basis or payment of annual bonuses in the first quarter of a fiscal year. As we have continued to generate cash, we invested $25.0 million into marketable security investments during fiscal 2010, of which $12.0 million remains invested as of April 30, 2010. These marketable securities consist of certificates of deposit and US Treasury notes invested with financial institutions that we believe to be financially sound, in order to minimize our credit risk. Additionally in February 2008, we completed our IPO in which we sold 6,000,000 shares


55


Table of Contents

of common stock at an issue price of $9.00 per share. We raised a total of $54.0 million in gross proceeds from our IPO, or $45.9 million in net proceeds after deducting underwriting discounts and offering expenses.
 
At April 30, 2010, we had cash and cash equivalents totaling $137.4 million and accounts receivable of $33.6 million, compared to $90.5 million of cash and cash equivalents and $34.2 million of accounts receivable at April 30, 2009.
 
Historically our principal uses of cash have consisted of payroll and other operating expenses and purchases of property and equipment to support our growth. In fiscal 2007, we used $7.2 million in cash to purchase the assets of Enira Technologies, LLC and pay acquisition costs.
 
The following table shows our cash flows from operating activities, investing activities and financing activities for the stated periods:
 
                         
    Fiscal Year Ended April 30,
    2010   2009   2008
 
Net cash provided by operating activities
  $ 45,685     $ 16,841     $ 13,532  
Net cash used in investing activities
    (16,689 )     (2,007 )     (4,012 )
Net cash provided by financing activities
  $ 17,876     $ 3,948     $ 45,567  
 
Operating Activities
 
We have reported net income for fiscal 2010 and 2009 and although we reported a net loss in fiscal 2008, our operating activities have provided positive cash flows for each fiscal year presented, primarily due to the significant non-cash charges associated with stock-based compensation and depreciation and amortization reflected in operating expenses and cash received from collections from customers. In addition, the realized tax benefit related to the excess of the deductible amount over the recognized stock-based compensation cost is classified as a cash inflow from financing activities and a cash outflow from operating activities. Our cash flows from operating activities in any period will continue to be significantly influenced by our results of operations, these non-cash charges and changes in deferred revenues, as well as changes in other components of our working capital.
 
While we may report negative cash flows from operating activities from time to time in particular quarterly periods, we generally expect to continue to generate positive cash flows from operating activities on an annual basis. Future cash from operations will depend on many factors, including:
 
  •  the growth in our sales transactions and associated cash collections or growth in receivables;
 
  •  the level of our sales and marketing activities, including expansion into new territories;
 
  •  the timing and extent of spending to support product development efforts; and
 
  •  the timing of the growth in general and administrative expenses as we further develop our administrative infrastructure to support the business as a public company.
 
We generated $45.7 million of cash from operating activities during fiscal 2010, primarily as a result of generated net income of $28.4 million for this period, which included non-cash charges of $10.2 million for stock-based compensation expense, $3.3 million of depreciation and amortization, offset by non-cash outflow of $8.3 million from excess tax benefits from stock-based compensation expense and $19.5 million from deferred tax assets related to our valuation release. In addition, cash generated from operations included $15.9 million increase in deferred revenues, a $9.6 million increase in other accrued liabilities, an increase in accounts payable of $3.6 million, and an increase in accrued compensation and benefits of $2.4 million due to timing of commissions earned on increased sales and bonus payments earned related to headcount increases. These amounts were offset by a $0.6 million increase in prepaid expenses.
 
We generated $16.8 million of cash from operating activities during fiscal 2009, primarily as a result of generated net income of $9.9 million for this period, which included non-cash charges of $6.1 million for stock-based compensation expense, $3.3 million of depreciation and amortization and a $1.3 million non-cash outflow from excess tax benefits from stock-based compensation expense, a $3.8 million increase in deferred revenues, a $2.2 million decrease in prepaid expenses, a $2.2 million increase in other accrued liabilities. These amounts were


56


Table of Contents

offset in part by a $7.7 million increase in accounts receivable associated with the growth in revenue and timing of sales, a decrease in accounts payable of $1.7 million and a $0.2 million decrease in our accrued compensation and benefits due to changes in our compensation plan structures.
 
We generated $13.5 million of cash from operating activities during fiscal 2008, primarily as a result of a $11.7 million increase in deferred revenues, a $5.2 million increase in our accrued compensation and benefits because sales commissions and performance bonus accrued under our fiscal 2008 bonus plan were not paid until the first quarter of fiscal 2009, a $0.6 million decrease in prepaid expenses, offset in part by a $11.1 million increase in accounts receivable associated with the growth in revenue and timing of sales. In addition, we had a net loss of $2.0 million for this period, which included non-cash charges of $4.9 million for stock-based compensation expense and $2.5 million of depreciation and amortization.
 
Investing Activities
 
During fiscal 2010, we used $16.7 million in cash for investing activities, comprised primarily of acquisitions of $25.0 million in short-term held to maturity investments of which $13.0 million have matured during the fiscal period, and $5.5 million in capital expenditures primarily associated with software acquired in support of our ERP software implementation, in addition to acquisitions of computer equipment, furniture and fixtures and software in support of the expansion of our infrastructure and work force. In addition, $0.8 million of previously restricted cash reserved under operating lease terms and conditions became unrestricted after satisfying certain requirements of the operating lease. During fiscal 2009, we used $2.0 million in cash for investing activities, all of which was related to capital expenditures associated with computer equipment, furniture and fixtures and software in support of the expansion of our infrastructure and work force. During fiscal 2008, we used $4.0 million in cash for investing activities, of which $2.0 million was related to capital expenditures associated with computer equipment, furniture and fixtures and software, and $1.4 million related to leasehold improvements, all in support of the expansion of our infrastructure and work force.
 
Financing Activities
 
During fiscal 2010, we generated $17.9 million of cash from financing activities, comprised of $12.0 million from net proceeds from the exercise of stock options and $8.3 million from realized tax benefit related to the excess of the deductible amount over the recognized stock-based compensation cost, offset by $2.4 million in payments for prepaid software licenses used as a component in our product sales. During fiscal 2009, we generated $3.9 million of cash from financing activities, comprised primarily of $4.8 million from net proceeds from the exercise of stock options and $1.3 million inflow from tax benefits associated with disqualifying dispositions of awards associated with stock-based compensation, offset by $2.1 million in payments for prepaid software licenses used as a component in our product sales. During fiscal 2008, we generated $45.6 million of cash from financing activities, comprised primarily of $50.2 million in proceeds from our IPO (after underwriting discounts and commissions) and $0.9 million of net proceeds from the exercise of stock options, offset by payments of $3.7 million in IPO preparation costs, $1.9 million in payments for capital lease obligations and capitalized software licenses used as a component in our product sales.
 
Other Factors Affecting Liquidity and Capital Resources
 
We believe that our cash and cash equivalents and any cash flow from operations will be sufficient to meet our anticipated cash needs, including for working capital purposes, capital expenditures and various contractual obligations, for at least the next 12 months. We may, however, require additional cash resources due to changed business conditions or other future developments, including any investments or acquisitions we may decide to pursue. If these sources are insufficient to satisfy our cash requirements, we may seek to sell debt securities or additional equity securities or to obtain a credit facility. The sale of additional equity securities could result in additional dilution to our stockholders. The incurrence of indebtedness would result in debt service obligations and could result in operating and financial covenants that would restrict our operations. In addition, there can be no assurance that any additional financing will be available on acceptable terms, if at all. We anticipate that, from time to time, we may evaluate acquisitions of complementary businesses, technologies or assets. However, there are no current understandings, commitments or agreements with respect to any acquisitions.


57


Table of Contents

Off-Balance Sheet Arrangements
 
As of April 30, 2010, we had no off-balance sheet arrangements as defined in Item 303(a)(4) of the SEC’s Regulation S-K.
 
Contractual Obligations and Commitments
 
We lease facilities for our corporate headquarters, subsidiaries and regional sales offices. We lease our principal facility in Cupertino, California under a non-cancelable operating lease agreement. In November 2009, we modified and extended our operating lease agreement, which now expire in May 2017. Over the term of the amendment we have agreed to make payments totaling $22.1 million.
 
We also have leases for our regional sales offices that are for 13 months or less.
 
The following table is a summary of our contractual obligations as of April 30, 2010:
 
                                                 
    Payments Due by Period  
    Total     FY 2011     FY 2012     FY 2013     FY 2014     Thereafter  
    (In thousands)  
 
Operating lease obligations
  $ 22,833     $ 3,354     $ 3,024     $ 3,045     $ 3,137     $ 10,273  
Accrued contractual obligations
  $ 2,986       2,595       271       120              
                                                 
Total
  $ 25,819     $ 5,949     $ 3,295     $ 3,165     $ 3,137     $ 10,273  
                                                 
 
On May 20, 2009, we entered into a software license agreement with Oracle USA, Inc that authorizes us to integrate Oracle database software with our ArcSight ESM products and distribute ArcSight ESM products with the embedded database software. Under the agreement, which has a two year term that commenced on May 31, 2009 when our prior agreement with Oracle expired, we have agreed to make royalty payments totaling $4.8 million over the license term. During fiscal 2010, we made payments of approximately $2.4 million under the current agreement. Under the prior agreement with Oracle, we made payments totaling $1.9 million during fiscal 2009.
 
Recent Accounting Pronouncements
 
In May 2009, the FASB issued revised guidance under ASC Topic 855-10, Subsequent Events, which establishes principles and requirements for subsequent events. Subsequent events are events or transactions that occur after the balance sheet date but before financial statements are issued or are available to be issued. There are two types of subsequent events: (i) the first type consists of events or transactions that provide additional evidence about conditions that existed at the date of the balance sheet and (ii) the second type consists of events that provide evidence about conditions that did not exist at the date of the balance sheet but arose after that date. An entity shall recognize in its financial statements the effects of all subsequent events that provide additional evidence about conditions that existed at the date of the balance sheet, including the estimates inherent in the process of preparing financial statements. This guidance is effective for interim or annual financial periods ending after June 15, 2009. We adopted this guidance effective May 1, 2009.
 
In February 2010, the FASB issued ASU No. 2010-09, Amending Subsequent Events (Topic 855) Certain Recognition and Disclosure Requirements. This guidance addresses the interaction between Topic 855 and related SEC reporting requirements. The amendment removes the requirement for SEC filers to disclose a date through which subsequent events have been evaluated. The amendment is effective upon issuance and has been adopted for our fiscal quarter ended January 31, 2010, the adoption of which did not impact our condensed consolidated results of operations, financial condition or cash flows.
 
In June 2009, the FASB issued ASC Topic 105-10 The FASB Accounting Standards Codification and the Hierarchy of Generally Accepted Accounting Principles, which approved the FASB Accounting Standards Codification as the single source of authoritative United States accounting and reporting standards for all non-governmental entities, except for guidance issued by the SEC. The codification, which changes the referencing of financial standards, is effective for interim or annual financial periods ending after September 15, 2009. We adopted the guidance effective August 1, 2009. All references made to generally accepted accounting principles in the United States, or U.S. GAAP, will use the new Codification numbering system prescribed by the FASB. As the


58


Table of Contents

Codification is not intended to change or alter existing U.S. GAAP, it did not have any impact on our condensed consolidated results of operations, financial condition or cash flows.
 
In October 2009, the FASB issued Accounting Standards Update, or ASU No. 2009-13, Revenue Recognition (Topic 605) Multiple-Deliverable Element Arrangements — a consensus of the FASB Emerging Issues Task Force. This guidance impacts the determination of when the individual deliverables included in a multiple-element arrangement may be treated as separate units of accounting. Additionally, this guidance modifies the manner in which the transaction consideration is allocated across the separately identified deliverables by no longer permitting the residual method of allocating arrangement consideration. This revised guidance is effective for annual financial periods beginning after June 15, 2010, and early adoption is permitted. We are currently evaluating the potential impact, if any, the adoption of this new guidance will have on our consolidated results of operations, financial condition or cash flows.
 
In October 2009, the FASB issued ASU No. 2009-14, Software (Topic 985) Certain Arrangements That Contain Software Elements — a consensus of the FASB Emerging Issues Task Force. This guidance amends the scope of pre-existing software revenue guidance by removing from the guidance non-software components of tangible products and certain software components of tangible products. This revised guidance is effective for annual financial periods beginning after June 15, 2010, and early adoption is permitted. We are currently evaluating the potential impact, if any, the adoption of this new guidance will have on our consolidated results of operations, financial condition or cash flows.
 
Item 7A.   Quantitative and Qualitative Disclosures about Market Risk
 
Market Risk.  Market risk represents the risk of loss that may impact our financial position due to adverse changes in financial market prices and rates. Our market risk exposure is primarily a result of fluctuations in foreign exchange rates, interest rates and credit risk. We do not hold or issue financial instruments for trading purposes.
 
Foreign Currency Exchange Risk.  To date, substantially all of our international sales have been denominated in U.S. dollars, and therefore the majority of our net revenues are not subject to foreign currency risk. Our operating expenses and cash flows are subject to fluctuations due to changes in foreign currency exchange rates, but historically have had relatively little impact on our operating results and cash flows. We utilize foreign currency forward and option contracts to manage our currency exposures as part of our ongoing business operations. We do not expect to enter into foreign currency exchange contracts for trading or speculative purposes.
 
Interest Rate Risk.  Our investment policy is intended to preserve principal, provide liquidity and maximize income by limiting default risk, market risk and reinvestment risk. To minimize these risks, we primarily invest in money market funds, certificates of deposit and US Treasury securities. We had cash, cash equivalents and marketable securities of totaling $149.4 million as of April 30, 2010, including the $45.9 million net proceeds from our IPO, which are primarily held for working capital and general corporate purposes. The fair value of our investment portfolio would not be significantly impacted by either a 100 basis point increase or decrease in market interest rates due mainly to the short-term nature of the majority of our investment portfolio. As a result, we do not believe that we have any material exposure to changes in the fair value of our investment portfolio as a result of changes in interest rates. Declines in interest rates, however, will reduce future interest income. We do not enter into investments for trading or speculative purposes.
 
Credit Risk.  Financial instruments that potentially subject us to concentrations of credit risk consist principally of cash equivalents, marketable securities, foreign currency forward contracts and accounts receivable. We are exposed to credit risk in the event of default by the financial institutions holding our cash, cash equivalents, marketable securities, and foreign currency forward contracts to the extent recorded on its balance sheet. Risks associated with cash equivalents, marketable securities, and foreign currency forward contracts are mitigated by banking with high-credit quality institutions. Cash deposits and investments may be in excess of insured limits. We believe that the financial institutions that hold our investments are financially sound and, accordingly, minimal credit risk exists with respect to these investments. To date, we have not experienced any losses on our cash, cash equivalents and marketable securities and minimal losses on its foreign currency forward contracts. We perform periodic evaluations of the relative credit standing of the financial institutions.


59


Table of Contents

We sell our products, maintenance and services directly to customers or through resellers in APAC, EMEA, and the Americas, with the majority of our sales in the United States. We monitor our exposure within accounts receivable and record an allowance against doubtful accounts as necessary. We perform ongoing credit evaluations of our customers and extend credit in the normal course of business and generally do not require collateral. Historically, we have not experienced significant credit losses on our accounts receivable. We believe that any risk of loss for trade receivables is mitigated by our ongoing credit evaluations of customers.
 
No customer or reseller accounted for more than 10% of total revenues for fiscal 2010, 2009 or 2008. As of April 30, 2010, we had two resellers with accounts receivable balances greater than 10% of our net accounts receivable, with balances of 15% and 10% of net accounts receivable. As of April 30, 2009, we had two customers with accounts receivable balances greater than 10% of our net accounts receivable, with balances of 17% and 11% of net accounts receivable. Reseller accounts receivable balances greater than 10% are comprised of multiple customers and often multiple transactions with those customers. In fiscal 2010, 2009 and 2008, we derived 32%, 22% and 20% of our revenues, respectively, from contracts with agencies of the U.S. federal government.


60


Table of Contents

Item 8.   Financial Statements and Supplementary Data
 
Quarterly Results of Operations
 
The following table sets forth unaudited quarterly consolidated statements of operations data for each of the years in the two-year period ended April 30, 2010, (in thousands, except per share data). We derived this information from our unaudited consolidated financial statements, which we prepared on the same basis as our audited consolidated financial statements contained in this Annual Report on Form 10-K. In our opinion, these unaudited statements include all adjustments, consisting only of normal recurring adjustments that we consider necessary for a fair statement of that information when read in conjunction with the consolidated financial statements and related notes included elsewhere in this Annual Report on Form 10-K. The operating results for any quarter should not be considered indicative of results for any future period.
 
                                                                 
    Three Months Ended  
    July 31,
    Oct. 31,
    Jan. 31,
    April 30,
    July 31,
    Oct. 31,
    Jan. 31,
    April 30,
 
    2008     2008     2009     2009     2009     2009     2010     2010  
    (Unaudited, in thousands)  
 
Revenues:
                                                               
Products
  $ 15,802     $ 19,169     $ 21,775     $ 23,870     $ 18,265     $ 28,018     $ 26,555     $ 33,730  
Maintenance
    8,568       9,530       10,004       10,419       11,919       12,617       14,702       15,498  
Services
    3,293       4,136       4,613       4,989       4,371       4,868       4,853       5,988  
                                                                 
Total revenues
    27,663       32,835       36,392       39,278       34,555       45,503       46,110       55,216  
                                                                 
Cost of revenues:
                                                               
Products
    1,655       1,844       2,637       2,459       1,944       3,150       3,824       4,051  
Maintenance(1)
    1,631       1,663       1,637       1,930       1,925       2,434       2,497       2,647  
Services(1)
    2,043       2,387       2,587       2,858       2,630       3,204       3,283       4,223  
                                                                 
Total cost of revenues
    5,329       5,894       6,861       7,247       6,499       8,788       9,604       10,921  
                                                                 
Gross profit
    22,334       26,941       29,531       32,031       28,056       36,715       36,506       44,295  
                                                                 
Operating expenses(1):
                                                               
Research and development
    5,315       5,423       5,201       6,598       5,598       6,576       6,429       7,663  
Sales and marketing
    14,868       14,355       12,298       14,758       14,785       18,582       18,563       21,728  
General and administrative
    4,349       4,863       4,943       6,123       6,018       6,336       6,767       7,148  
                                                                 
Total operating expenses
    24,532       24,641       22,442       27,479       26,401       31,494       31,759       36,539  
                                                                 
Income (loss) from operations
    (2,198 )     2,300       7,089       4,552       1,655       5,221       4,747       7,756  
                                                                 
Interest and other income (expense), net
    305       340       157       (68 )     (89 )     (179 )     (81 )     (50 )
                                                                 
Income (loss) before provision for income taxes
    (1,893 )     2,640       7,246       4,484       1,566       5,042       4,666       7,706  
Provision (benefit) for income taxes
    (563 )     795       2,183       149       551       2,544       2,438       (14,940 )
                                                                 
Net income (loss)
  $ (1,330 )   $ 1,845     $ 5,063     $ 4,335     $ 1,015     $ 2,498     $ 2,228     $ 22,646  
                                                                 
 
 
(1) Stock-based compensation expense as included in above:
 
                                                                 
Cost of maintenance revenues
  $ 46     $ 54     $ 56     $ 60     $ 80     $ 102     $ 123     $ 140  
Cost of services revenues
    33       39       34       36       33       43       64       85  
Research and development
    339       334       322       347       429       518       595       635  
Sales and marketing
    751       752       466       482       612       851       987       968  
General and administrative
    234       346       786       628       776       971       1,071       1,123  
                                                                 
Total stock-based compensation expenses
  $ 1,403     $ 1,525     $ 1,664     $ 1,553     $ 1,930     $ 2,485     $ 2,840     $ 2,951  
                                                                 


61


Table of Contents

The following table sets forth our historical results, for the periods indicated, as a percentage of our revenues.
 
                                                                 
    Three Months Ended
    July 31,
  Oct. 31,
  Jan. 31,
  April 30,
  July 31,
  Oct. 31,
  Jan. 31,
  April 30,
    2008   2008   2009   2009   2009   2009   2010   2010
    (Unaudited)
 
Revenues:
                                                               
Products
    57.1 %     58.4 %     59.8 %     60.8 %     52.9 %     61.6 %     57.6 %     61.1 %
Maintenance
    31.0       29.0       27.5       26.5       34.5       27.7       31.9       28.1  
Services
    11.9       12.6       12.7       12.7       12.6       10.7       10.5       10.8  
                                                                 
Total revenues
    100.0       100.0       100.0       100.0       100.0       100.0       100.0       100.0  
                                                                 
Cost of revenues:
                                                               
Products
    6.0       5.6       7.3       6.3       5.6       6.9       8.3       7.3  
Maintenance
    5.9       5.1       4.5       4.9       5.6       5.4       5.4       4.8  
Services
    7.4       7.3       7.1       7.3       7.6       7.0       7.1       7.7  
                                                                 
Total cost of revenues
    19.3       18.0       18.9       18.5       18.8       19.3       20.8       19.8  
                                                                 
Gross margin
    80.7       82.0       81.1       81.5       81.2       80.7       79.2       80.2  
Operating expenses:
                                                               
Research and development
    19.2       16.5       14.3       16.8       16.2       14.5       13.9       13.9  
Sales and marketing
    53.7       43.7       33.8       37.6       42.8       40.8       40.3       39.4  
General and administrative
    15.7       14.8       13.5       15.6       17.4       13.9       14.7       12.9  
                                                                 
Total operating expenses
    88.6       75.0       61.6       70.0       76.4       69.2       68.9       66.2  
                                                                 
Income (loss) from operations
    (7.9 )%     7.0 %     19.5 %     11.5 %     4.8 %     11.5 %     10.3 %     14.0 %
                                                                 
 
 
Due to rounding to the nearest tenth of a percent, totals may not equal the sum of the line items in the table above.
 
Our operating results may fluctuate due to a variety of factors, many of which are outside our control. As a result, comparing our operating results on a period-to-period basis may not be meaningful. You should not rely on our past results as an indication of our future performance.
 
Revenues have increased over the quarters presented, other than for the first quarter of fiscal 2010, due primarily to the seasonality of our business with our first quarter having relatively lower product revenue compared to our respective prior fourth quarter. In addition, the timing of our annual sales “club” for top performers and annual training for our entire sales force occurs annually during our first fiscal quarter, may inhibit the selling potential during this period.
 
Our second and fourth quarters of our fiscal year tend to have relatively higher product revenue due to a number of factors, but primarily due to the fiscal year end procurement cycles of our U.S federal government customers, the budgeting, procurement and work cycles of our customers, including customers in the public sector, and the structure of our direct sales incentive and compensation programs, which may reinforce the tendency of our direct sales team to book the largest volume of deals towards the end of our fiscal year. Likewise our quarterly revenue improvements are offset by seasonal reductions in business activity during the summer months in the United States and Europe.
 
In general, our quarterly revenue continues to increase due to the increased number of products sold to new and existing customers and expansion into the international and mid-size markets. Our revenues continue to be positively impacted by timing of new compliance and cybersecurity mandates both domestic and international. Most notably during fiscal 2010, our quarterly revenue improvements have been positively impacted by continued strong sales in our federal vertical and strong mid-market wins. In addition, continued improvements in the EMEA region and significant revenue wins in our enterprise business drive continue to drive our growth.
 
Our operating expenses in general steadily increase over the quarterly periods presented. We continue to invest in resources to expand our platform and product offerings and expect research and development expenses to continue to increase in absolute dollars. On a quarterly basis, we have focused on continuing to grow and expand our business model, improve and create new market opportunities and expand our customer base. Our sales and marketing expenses on a quarterly basis reflect this focus and we expect that these expenses will continue to increase in absolute dollars to reflect our continued growth. Headcount increased 28% during 2010 raising headcount to 512 employees, and will continue to increase as we expand our headcount across the organization as a result of continued growth.


62


 

INDEX TO CONSOLIDATED FINANCIAL STATEMENTS
 
         
    Page
 
    64  
    65  
    66  
    67  
    68  
    69  


63


Table of Contents

 
Report of Independent Registered Public Accounting Firm
 
The Board of Directors and Stockholders
ArcSight, Inc.
 
We have audited the accompanying consolidated balance sheets of ArcSight, Inc. as of April 30, 2010 and 2009, and the related consolidated statements of operations, stockholders’ equity, and cash flows for each of the three years in the period ended April 30, 2010. These financial statements are the responsibility of the Company’s management. Our responsibility is to express an opinion on these financial statements based on our audits.
 
We conducted our audits in accordance with the standards of the Public Company Accounting Oversight Board (United States). Those standards require that we plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement. An audit includes examining, on a test basis, evidence supporting the amounts and disclosures in the financial statements. An audit also includes assessing the accounting principles used and significant estimates made by management, as well as evaluating the overall financial statement presentation. We believe that our audits provide a reasonable basis for our opinion.
 
In our opinion, the financial statements referred to above present fairly, in all material respects, the consolidated financial position of ArcSight, Inc. at April 30, 2010 and 2009, and the consolidated results of its operations and its cash flows for each of the three years in the period ended April 30, 2010, in conformity with U.S. generally accepted accounting principles.
 
We also have audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States), ArcSight, Inc.’s internal control over financial reporting as of April 30, 2010, based on criteria established in Internal Control-Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission and our report dated July 9, 2010 expressed an unqualified opinion thereon.
 
 
-s- Ernst & Young LLp
 
San Jose, California
July 9, 2010


64


Table of Contents

 
ARCSIGHT, INC.

Consolidated Balance Sheets
 
                 
    As of April 30,  
    2010     2009  
    (In thousands, except share amounts and par value)  
 
ASSETS
Current assets:
               
Cash and cash equivalents
  $ 137,358     $ 90,467  
Marketable securities
    12,013        
Accounts receivable, net of allowance for doubtful accounts of $256 and $262, as of April 30, 2010 and 2009, respectively
    33,609       34,184  
Deferred tax asset, current
    8,807        
Capitalized software, current
    2,303       144  
Prepaid expenses and other current assets
    6,557       3,717  
                 
Total current assets
    200,647       128,512  
Property and equipment, net
    8,174       4,416  
Deferred tax asset, non-current
    10,649        
Goodwill
    5,746       5,746  
Acquired intangible assets, net
    430       1,319  
Other long-term assets
    557       1,168  
                 
Total assets
  $ 226,203     $ 141,161  
                 
 
LIABILITIES AND STOCKHOLDERS’ EQUITY
Current liabilities:
               
Accounts payable
  $ 5,039     $ 1,432  
Accrued compensation and benefits
    13,633       11,671  
Obligations for software licenses, current
    2,832       363  
Other accrued liabilities
    5,696       4,337  
Deferred revenues, current
    49,674       36,160  
                 
Total current liabilities
    76,874       53,963  
Deferred revenues, non-current
    11,237       8,888  
Other long-term liabilities
    2,516       1,637  
                 
Total liabilities
    90,627       64,488  
Commitments and contingencies (Note 5)
               
Stockholders’ equity:
               
Convertible preferred stock, $0.00001 par value per share, 10,000,000 shares authorized as of April 30, 2010 and 2009, respectively; no shares issued and outstanding as of April 30, 2010 and 2009, respectively
           
Common stock, $0.00001 par value per share; 150,000,000 shares authorized as of April 30, 2010 and April 30, 2009, respectively; 34,322,543 and 32,248,116 issued and outstanding as of April 30, 2010 and 2009, respectively
           
Additional paid-in capital
    144,273       113,781  
Accumulated other comprehensive loss
    (290 )     (314 )
Accumulated deficit
    (8,407 )     (36,794 )
                 
Total stockholders’ equity
    135,576       76,673  
                 
Total liabilities and stockholders’ equity
  $ 226,203     $ 141,161  
                 
 
The accompanying notes are an integral part of these consolidated financial statements.


65


Table of Contents

 
ARCSIGHT, INC.

Consolidated Statements of Operations
 
                         
    Fiscal Year Ended April 30,  
    2010     2009     2008  
    (In thousands, except share amounts)  
 
Revenues:
                       
Products
  $ 106,568     $ 80,616     $ 63,765  
Maintenance
    54,736       38,521       27,607  
Services
    20,080       17,031       10,173  
                         
Total revenues
    181,384       136,168       101,545  
                         
Cost of revenues:
                       
Products
    12,969       8,595       4,767  
Maintenance(1)
    9,503       6,861       5,691  
Services(1)
    13,340       9,875       5,800  
                         
Total cost of revenues
    35,812       25,331       16,258  
                         
Gross profit
    145,572       110,837       85,287  
Operating expenses(1):
                       
Research and development
    26,266       22,537       19,762  
Sales and marketing
    73,658       56,279       53,453  
General and administrative
    26,269       20,278       13,422  
                         
Total operating expenses
    126,193       99,094       86,637  
                         
Income (loss) from operations
    19,379       11,743       (1,350 )
Interest income
    124       991       857  
Other income (expense), net
    (523 )     (257 )     (385 )
                         
Income (loss) before provision for income taxes
    18,980       12,477       (878 )
Provision (benefit) for income taxes
    (9,407 )     2,564       1,131  
                         
Net income (loss)
  $ 28,387     $ 9,913     $ (2,009 )
                         
Net income (loss) per common share, basic
  $ 0.85     $ 0.32     $ (0.08 )
                         
Net income (loss) per common share, diluted
  $ 0.78     $ 0.30     $ (0.08 )
                         
Shares used in computing basic net income (loss) per common share
    33,434       31,233       25,936  
                         
Shares used in computing diluted net income (loss) per common share
    36,197       33,550       25,936  
                         
 
 
(1) Stock-based compensation expense included in above (see Note 8):
 
                         
Cost of maintenance revenues
  $ 445     $ 216     $ 106  
Cost of services revenues
    225       142       115  
Research and development
    2,177       1,342       1,356  
Sales and marketing
    3,418       2,451       2,685  
General and administrative
    3,941       1,994       664  
 
The accompanying notes are an integral part of these consolidated financial statements.


66


Table of Contents

 
ARCSIGHT, INC.
 
Consolidated Statements of Stockholders’ Equity
For the Fiscal Years Ended April 2008, 2009 and 2010
 
                                                                         
                                  Deferred
    Accumulated
             
    Convertible
                Additional
    Stock-
    Other
          Total
 
    Preferred Stock     Common Stock     Paid-in
    Based
    Comprehensive
    Accumulated
    Stockholders’
 
    Shares     Amount     Shares     Amount     Capital     Compensation     Income (Loss)     Deficit     Equity  
    (In thousands, except share amounts)  
 
Balance as of April 30, 2007
    13,032,497       26,758       10,620,041             23,479       (554 )     13       (44,566 )     5,130  
Cumulative effect adjustment due to the adoption of ASC 740-10
                                              (132 )     (132 )
Issuance of common stock upon exercise of stock options
                402,260             923                         923  
Reclassification of options exercised but not vested, net
                            60                         60  
Repurchase of common stock subject to vesting
                (6,845 )           (3 )                       (3 )
Amortization of deferred stock-based compensation, net of terminations
                            (6 )     97                   91  
Amortization of restricted stock-based compensation
                                  404                   404  
Stock-based compensation under ASC 718
                            4,431                         4,431  
Exercise of Series B preferred stock warrants
    12,909                                                  
Exercise of common stock warrants
                6,293                                      
Conversion of preferred stock into common stock
    (13,045,406 )     (26,758 )     14,000,441             26,758                          
Proceeds from initial public offering, net of issuance costs of $4,288
                6,000,000             45,932                         45,932  
Comprehensive loss:
                                                                       
Foreign currency translation adjustment
                                        (58 )           (58 )
Net loss
                                              (2,009 )     (2,009 )
                                                                         
Comprehensive loss
                                                                    (2,067 )
                                                                         
Balance as of April 30, 2008
                31,022,190             101,574       (53 )     (45 )     (46,707 )     54,769  
Issuance of common stock under stock option and stock purchase plans
                1,225,926             4,800                         4,800  
Reclassification of options exercised but not vested, net
                            24                         24  
Amortization of deferred stock-based compensation, net of terminations
                                  19                   19  
Amortization of restricted stock-based compensation
                                  34                   34  
Stock-based compensation under ASC 718
                            6,092                         6,092  
Tax benefit from stock-based awards
                            1,291                         1,291  
Comprehensive income:
                                                                       
Foreign currency translation adjustment
                                        (269 )           (269 )
Net income
                                              9,913       9,913  
                                                                         
Comprehensive income
                                                                    9,644  
                                                                         
Balance as of April 30, 2009
        $       32,248,116     $     $ 113,781     $     $ (314 )   $ (36,794 )   $ 76,673  
                                                                         
Issuance of common stock under stock option and stock purchase plans
                2,074,427             12,017                         12,017  
Stock-based compensation under ASC 718
                            10,206                         10,206  
Tax benefit from stock-based awards
                            8,269                         8,269  
Comprehensive income:
                                                                       
Foreign currency translation adjustment
                                        24             24  
Net income
                                              28,387       28,387  
                                                                         
Comprehensive income
                                                                    28,411  
                                                                         
Balance as of April 30, 2010
        $       34,322,543     $     $ 144,273     $     $ (290 )   $ (8,407 )   $ 135,576  
                                                                         
 
The accompanying notes are an integral part of these consolidated financial statements.


67


Table of Contents

 
ARCSIGHT, INC.
 
Consolidated Statements of Cash Flows
 
                         
    Fiscal Year Ended April 30,  
    2010     2009     2008  
    (In thousands)  
 
Cash flows from operating activities:
                       
Net income (loss)
  $ 28,387     $ 9,913     $ (2,009 )
Adjustments to reconcile net income (loss) to net cash provided by operating activities:
                       
Depreciation and amortization
    2,452       2,471       1,945  
Amortization of acquired intangibles
    889       842       573  
Loss (gain) on disposal of property and equipment
    26       17       (6 )
Stock-based compensation
    10,206       6,145       4,926  
Deferred tax assets
    (19,456 )            
Excess tax benefit from stock-based compensation
    (8,269 )     (1,291 )      
Provision for allowance for doubtful accounts
    134       142       33  
Changes in operating assets and liabilities:
                       
Accounts receivable
    441       (7,668 )     (11,137 )
Prepaid expenses and other assets
    (624 )     2,205       1,008  
Accounts payable
    3,607       (1,683 )     269  
Accrued compensation and benefits
    2,386       (193 )     5,186  
Other accrued liabilities
    9,643       2,159       1,066  
Deferred revenues
    15,863       3,782       11,678  
                         
Net cash provided by operating activities
    45,685       16,841       13,532  
Cash flows from investing activities:
                       
Restricted cash
    842              
Maturities of marketable securities
    12,985              
Purchases of marketable securities
    (24,998 )            
Purchases of property and equipment
    (5,518 )     (2,007 )     (4,031 )
Proceeds from sales of property and equipment
                19  
                         
Net cash used in investing activities
    (16,689 )     (2,007 )     (4,012 )
Cash flows from financing activities:
                       
Initial public offering preparation costs
                (3,669 )
Proceeds from initial public offering
                50,220  
Excess tax benefit from stock-based compensation
    8,269       1,291        
Proceeds from exercise of stock options, net of repurchases
    12,017       4,800       920  
Payment of capital lease and software license obligations
    (2,410 )     (2,143 )     (1,904 )
                         
Net cash provided by financing activities
    17,876       3,948       45,567  
Effect of exchange rate changes on cash
    19       (261 )     (58 )
                         
Net increase in cash and cash equivalents
    46,891       18,521       55,029  
Cash and cash equivalents at beginning of period
    90,467       71,946       16,917  
                         
Cash and cash equivalents at end of period
  $ 137,358     $ 90,467     $ 71,946  
                         
Supplemental disclosure of cash flow information:
                       
Income taxes paid
  $ 2,873     $ 1,669     $ 331  
Interest expense paid
    103       110       227  
Supplemental disclosure of non-cash investing and financing activities:
                       
Common stock issued upon conversion of preferred stock
                26,758  
Property and equipment acquired under capital lease
    713       101        
Capitalized software obligations
    4,606              
 
The accompanying notes are an integral part of these consolidated financial statements.


68


Table of Contents

 
ARCSIGHT, INC.
 
Notes to Consolidated Financial Statements
 
1.   Description of Business
 
ArcSight, Inc. (“ArcSight” or the “Company”) is a leading provider of enterprise threat and risk management solutions that protect businesses and government agencies. The Company’s enterprise threat and risk management platform collects, consolidates and correlates network and user activity data across the enterprise so that businesses can rapidly detect, diagnose and manage both internal and external threats and risks across the organization for activities associated with critical assets and processes. With the Company’s enterprise threat and risk management platform and products, organizations can use the ArcSight platform to reduce risk, identify vulnerabilities, comply with regulations and protect their high-value digital assets from cyber-theft, cyber-fraud, cyber-warfare and cyber-espionage. The Company’s SIEM products deliver a centralized, real-time view of all activity or events across geographically dispersed and heterogeneous business and technology infrastructures. Its log management products collect and store activity and event data for regulatory compliance, reporting and forensic analysis. Working together, these products collect, consolidate and correlate massive amounts of activity data, in the form of log events, from thousands of security point solutions, network and computing devices, databases and applications, enabling intelligent identification, prioritization and response to compliance and corporate policy violations, and external and insider threats. The Company’s specialized software and application packages deliver pre-packaged analytics and reports tailored to specific compliance and security initiatives, such as Sarbanes-Oxley (SOX), PCI, user monitoring and fraud detection. The Company is headquartered in Cupertino, California, and was incorporated on May 3, 2000 under the laws of the state of Delaware.
 
Initial Public Offering
 
In February 2008, the Company completed an initial public offering (“IPO”), in which it sold 6,000,000 shares of common stock, at an issue price of $9.00 per share. The Company raised a total of $54.0 million in gross proceeds from the IPO, or $45.9 million in net proceeds after deducting underwriters’ discounts of $3.8 million and other offering expenses of $4.3 million. Upon the completion of the IPO, all shares of convertible preferred stock outstanding automatically converted into 14,000,441 shares of common stock.
 
2.   Significant Accounting Policies
 
Basis of Presentation and Consolidation
 
The accompanying audited consolidated financial statements include the accounts of the Company and its wholly-owned subsidiaries. All significant inter-company transactions have been eliminated on consolidation.
 
On November 20, 2007, the Board of Directors and the Company’s stockholders approved a 1-for-4 reverse stock split of the Company’s outstanding shares of common stock and convertible preferred stock (the “Reverse Split”). All authorized, reserved, issued and outstanding common stock, convertible preferred stock and per share amounts contained in these notes and the accompanying consolidated financial statements have been retroactively adjusted to reflect the Reverse Split.
 
Use of Estimates
 
The preparation of financial statements in conformity with U.S. generally accepted accounting principles (“GAAP”) requires management to make estimates and assumptions that affect the reported amounts of assets and liabilities and disclosure of contingent assets and liabilities at the date of the financial statements as well as the reported amounts of revenues and expenses during the reporting period. The Company bases its estimates and judgments on its historical experience, knowledge of current conditions, and its beliefs on what could occur in the future, given available information. Estimates, assumptions and judgments, are used for, but are not limited to, revenue recognition, determination of fair value of stock and stock-based awards, valuation of goodwill and intangible assets acquired in business combinations, impairment of goodwill and other intangible assets, amortization of intangible assets, contingencies and litigation, accounting for income taxes, including the valuation


69


Table of Contents

 
reserve on deferred tax assets and uncertain tax positions, allowances for doubtful accounts, valuations of cash equivalents and marketable securities, and accrued liabilities such as bonus accruals. Actual results may differ from those estimates, and such differences may be material to the financial statements.
 
Cash and Cash Equivalents
 
The Company maintains its cash and cash equivalents in accounts consisting of high-credit quality financial instruments. The Company considers all highly liquid investments purchased with a maturity of three months or less at the date of purchase to be cash equivalents. The Company’s cash equivalents consist of money market accounts on deposit with two banks and are stated at cost, which approximates fair value.
 
Marketable Securities
 
Marketable securities were $12.0 million as of April 30, 2010. There were no marketable securities as of April 30, 2009. The Company determines the appropriate classification of the securities at the time of purchase and re-evaluates the designation as of each balance sheet date. As of April 30, 2010, all marketable securities are considered available-for-sale. Marketable securities consist principally of taxable, short-term marketable certificates of deposit and U.S. Treasury notes, with original maturities between three and nine months. Marketable securities are stated at estimated fair value with unrealized gains and losses reported in accumulated other comprehensive loss. Unrealized gain recorded net of tax benefit amounted to $3,000 for fiscal 2010. A decline in the market value of any available-for sale security below cost that is deemed to be other-than-temporary results in an impairment which reduces the carrying amount to fair value. The impairment is charged to earnings and a new cost basis for the security is established. To determine whether an impairment is other-than-temporary, the Company considers whether it has the ability and intent to hold the investment until a market price recovery and considers whether evidence indicating the costs of the investment is recoverable outweighs evidence to the contrary. Evidence considered in this assessment includes the reason for the impairment, the severity and duration of the impairment, changes in value subsequent to period-end, and the general market conditions. There were no other-than-temporary impairments for the period ended April 30, 2010. The specific identification method is used to determine the costs of securities disposed of, with realized gains and losses reflected in other expense, net. Investments are anticipated to be used for current operations.
 
Fair Value of Financial Instruments
 
The carrying amounts of cash equivalents, marketable securities, trade accounts receivable, accounts payable, and other accrued liabilities approximate their respective fair values due to the relatively short-term maturities. The carrying amounts of marketable securities and derivative financial instruments approximate their respective fair values due to adjusting these investments to their respective market values each reporting period.
 
Foreign Currency Translation/Transactions
 
The functional currency of the Company’s foreign subsidiaries is the local currency. Adjustments resulting from translating foreign functional currency financial statements into U.S. dollars are recorded as a separate component of accumulated other comprehensive income (loss). Income and expense accounts are translated into U.S. dollars at average rates of exchange prevailing during the periods presented. All assets and liabilities denominated in a foreign currency are translated into U.S. dollars at the exchange rates in effect on the balance sheet dates.
 
Net foreign currency transaction losses of approximately $0.4 million, $0.1 million and $0.1 million, for fiscal 2010, 2009 and 2008, respectively, were primarily the result of the settlement of inter-company transactions and are included in other expense.
 
Derivative Financial Instruments
 
The majority of the Company’s sales are denominated in United States dollars; however, there are some sales transactions denominated in foreign currencies. In addition, the Company’s foreign subsidiaries pay their expenses in local currency. Therefore, movements in exchange rates could cause net sales and expenses to fluctuate, affecting


70


Table of Contents

 
the Company’s profitability and cash flows. The Company’s general practice is to use foreign currency forward contracts to reduce its exposure to foreign currency exchange rate fluctuations. Unrealized gains and losses associated with these foreign currency contracts are reflected in the Company’s balance sheet and recorded in prepaid expenses and other current assets or accrued expenses and other current liabilities. Changes in fair value and premiums paid for foreign currency contracts are recorded directly in other income and expense in the consolidated statements of income. Cash flows from such derivatives are classified as operating activities. The objective of these contracts is to reduce the impact of foreign currency exchange rate movements on the Company’s net income. During fiscal 2010, 2009 and 2008, the Company considered the net results of the use of foreign currency forward contracts to be an effective mechanism to minimize the fluctuations and movements in exchange rates that affect the Company’s profitability and cash flows. All of the Company’s foreign currency forward contracts mature within 12 months from the balance sheet date. The Company does not use derivatives for speculative or trading purposes, nor does the Company designate its derivative instruments as hedging instruments, as defined by the Financial Accounting Standard Board (“FASB”) under Accounting Standards Codification (“ASC”) Topic 815, “Accounting for Derivative Instruments in Hedging Activities” (“ASC 815”).
 
As of April 30, 2010, and 2009, the notional amount of outstanding foreign currency derivatives classified as other accrued liabilities not designated as hedging instruments under the guidance was $0.3 million and $1.4 million, respectively. As of April 30, 2010, approximately 60%, 24%, and 15% of the notional amount of the Company’s outstanding foreign currency derivatives were attributable to the Canadian dollar, Euro and British Pound Sterling currencies, respectively, and all will expire within 60 days. As of April 30, 2009, approximately 97% and 3% of the notional amount of the Company’s outstanding foreign currency derivatives were attributable to the Canadian dollar and British Pound Sterling currencies, respectively. As of April 30, 2010 and 2009, the fair value gain or (loss) adjustment to mark these instruments to market was ($2,000) and $28,000, respectively, and are included in accrued expenses and other accrued liabilities in the accompanying condensed consolidated balance sheets. For fiscal 2010, 2009 and 2008, the Company recorded losses of $1,000, $0.1 million and $36,000, respectively, in other income (expense), net, associated with foreign currency derivative contracts.
 
Concentration of Credit Risk and Business Risk
 
Financial instruments that potentially subject the Company to concentrations of credit risk consist principally of cash equivalents, marketable securities, foreign currency forward contracts and accounts receivable. The Company is exposed to credit risk in the event of default by the financial institutions holding its cash, cash equivalents, marketable securities, and foreign currency forward contracts to the extent recorded on its balance sheet. Risks associated with cash equivalents, marketable securities, and foreign currency forward contracts are mitigated by banking with high-credit quality institutions. Cash deposits and investments may be in excess of insured limits. Management believes that the financial institutions that hold the Company’s investments are financially sound and, accordingly, minimal credit risk exists with respect to these investments. To date, the Company has not experienced any losses on its cash, cash equivalents and marketable securities and minimal losses attributable to mark-to-market adjustment on its foreign currency forward contracts. The Company performs periodic evaluations of the relative credit standing of the financial institutions.
 
The Company sells its products, maintenance and services directly to customers or through resellers in Asia Pacific, Europe, the Middle East and Africa (collectively, “EMEA”) and the Americas, with the majority of its sales in the United States. The Company monitors its exposure within accounts receivable and records an allowance against doubtful accounts as necessary. The Company performs ongoing credit evaluations of its customers and extends credit in the normal course of business and generally does not require collateral. Historically, the Company has not experienced significant credit losses on its accounts receivable. Management believes that any risk of loss for trade receivables is mitigated by the Company’s ongoing credit evaluations of its customers.
 
No customer or reseller accounted for more than 10% of total revenues for fiscal 2010, 2009 or 2008. As of April 30, 2010, the Company had two resellers with accounts receivable balances greater than 10% of the Company’s net accounts receivable, with balances of 15% and 10% of net accounts receivable. As of April 30, 2009, the Company had two customers with accounts receivable balances greater than 10% of the Company’s net accounts receivable, with balances of 17% and 11% of net accounts receivable. Reseller accounts receivable balances greater than 10% are comprised of multiple customers and often multiple transactions with those customers. In fiscal 2010,


71


Table of Contents

 
2009 and 2008, the Company derived 32%, 22% and 20% of our revenues, respectively, from contracts with agencies of the U.S. federal government.
 
The majority of the Company’s revenues are derived from sales of the Company’s security and compliance management products, primarily ArcSight ESM and Logger, and the Company expects this to continue for the foreseeable future. The Company primarily uses one source for manufacturing and fulfillment for its Logger and other appliance products. Demand for the Company’s products is affected by a number of factors, some of which are beyond the Company’s control, including the timing of development and release of new products by the Company and its competitors, technological change, lower-than-expected growth or a contraction in the worldwide market for enterprise security and compliance management solutions and other risks.
 
Revenue Recognition
 
The Company derives its revenues from three sources: (1) sales of software licenses and related appliances (“products”); (2) fees for maintenance to provide unspecified upgrades and customer technical support (“maintenance”); and (3) fees for services, which includes services performed in connection with time-and-materials based consulting agreements (“services”).
 
For all sales, revenues are recognized in accordance with GAAP, subject to the guidance for “Software Revenue Recognition” under ASC Topic 985-605 (“ASC 985-605”), as amended.
 
The Company enters into software license agreements through direct sales to customers and through resellers. The license agreements include post-contract customer support and may include professional services deliverables. Post-contract customer support includes rights to receive unspecified software product updates and upgrades, maintenance releases and patches released during the term of the support period, and Internet and telephone access to technical support personnel and content. Professional services include installation and implementation of the Company’s software, staffing and management services for customer security operation centers (“SOCs”) and customer training. Professional services are not essential to the functionality of the associated licensed software.
 
For all sales, revenues attributable to an element in a customer arrangement are recognized when persuasive evidence of an arrangement exists and delivery has occurred, provided the fee is fixed or determinable and collectibility is reasonably assured.
 
The Company typically uses a binding purchase order in conjunction with either a signed contract or reference on the purchase order to the terms and conditions of the Company’s shrinkwrap or end-user license agreement as evidence of an arrangement. In circumstances where the customer does not issue purchase orders separate from a signed contract, the Company uses the signed contract as evidence of the arrangement. Sales through its significant resellers are evidenced by a master agreement governing the relationship.
 
Resellers and systems integrators purchase products for specific end-users and do not hold inventory. Resellers and systems integrators perform functions that include delivery to the end customer, installation or integration and post-sales service and support. The agreements with these resellers and systems integrators have terms that are generally consistent with the standard terms and conditions for the sale of the Company’s products and services to end-users and do not provide for product rotation or pricing allowances. For sales to direct end-users, resellers and systems integrators, the Company recognizes product revenue upon transfer of title and risk of loss, which is generally upon shipment, provided all other criteria for revenue recognition have been met. Where sales are made through resellers, revenue is generally recorded only upon shipment to the end-users, when all other criteria for revenue recognition have been met. In a limited number of instances, where delivery is to be made to a reseller upon the request of either the end-user or the reseller, and all other criteria for revenue recognition have been met, it is the Company’s practice to recognize revenue on shipment to a reseller but only where an end-user has been identified prior to shipment. For end-users, resellers and system integrators, the Company generally has no significant obligations for future performance such as rights of return or pricing credits.
 
At the time of each transaction, the Company assesses whether the fees associated with the transaction are fixed or determinable. If a significant portion of a fee is due after the Company’s normal payment terms, currently up to three months (payment terms beyond three months are considered to be extended terms), or if as a result of customer acceptance provisions, the price is subject to refund or forfeiture, concession or other adjustment, then the


72


Table of Contents

 
Company considers the fee to not be fixed or determinable. In the limited instances in which these cases occur, revenues are deferred and recognized when payments become due and payable, or the right to refund or forfeiture, concession or adjustment, if any, lapses upon customer acceptance.
 
The Company assesses whether collection is reasonably assured based on a number of factors including the creditworthiness of the customer as determined by credit checks and analysis, past transaction history, geographic location and financial viability. The Company generally does not require collateral from customers. If the determination is made at the time of the transaction that collection of the fee is not reasonably assured, then all of the related revenues are deferred until the time that collection becomes reasonably assured, which in some cases requires the collection of cash prior to recognition of the related revenues.
 
The Company uses shipping documents, contractual terms and conditions and customer acceptance, when applicable, to verify delivery to the customer. For software license fees in arrangements that do not include customization, or services that are not considered essential to the functionality of the licenses, delivery is deemed to occur when the product is delivered to the customer. Services and consulting arrangements that are not essential to the functionality of the licensed product are recognized as revenues as these services are provided. Delivery of maintenance agreements is considered to occur on a straight-line basis ratably over the life of the contract, typically 12 months.
 
Vendor-specific objective evidence of fair value (“VSOE”) for maintenance and support services is based on separate sales and/or renewals to other customers or upon renewal rates quoted in contracts when the quoted renewal rates are deemed substantive in both rate and term. VSOE for professional services is established based on prices charged to customers when such services are sold separately. For deliverables and multiple element arrangements subject to the guidance, when VSOE exists for all of the undelivered elements of the arrangement, but does not exist for the delivered elements in the arrangement, the Company recognizes revenues under the residual method. Under the residual method, at the outset of the arrangement with a customer, revenues are deferred for the fair value of the undelivered elements and revenues are recognized for the remainder of the arrangement fee attributable to the delivered elements (typically products) when all of the applicable criteria in the guidance have been met. In the event that VSOE for maintenance services does not exist, and this represents the only undelivered element, revenues for the entire arrangement are recognized ratably over the performance period. Revenues from maintenance and support agreements are recognized on a straight-line basis ratably over the life of the contract. Revenues from time-based (term) license sales that include ongoing delivery obligations throughout the term of the arrangement are recognized ratably over the term because the Company does not have VSOE for the undelivered elements.
 
Many of the Company’s product contracts include implementation and training services. When products are sold together with consulting services, license fees are recognized upon delivery, provided that (i) the criteria of software revenue recognition have been met, (ii) payment of the license fees is not dependent upon the performance of the services, and (iii) the services do not provide significant customization of the products and are not essential to the functionality of the software that was delivered. The Company does not typically provide significant customization of its software products. These services are typically recognized on a time-and-materials basis.
 
The cost of providing the Company’s products, maintenance and services consists primarily of direct material costs for products and the fully burdened cost of the Company’s service organization for maintenance and services. Shipping and handling charges incurred and billed to customers for product shipments are recorded in product revenue and related cost of product revenues in the accompanying consolidated statements of income. If it becomes probable that the amount allocated to an undelivered element will result in a loss on that element of the arrangement, the loss is recognized.
 
Deferred revenues consist primarily of deferred product revenues, deferred maintenance fees and deferred services fees. Deferred revenues are recorded net of pre-billed services, post-contract customer support billings for which the term has not commenced and invoices for cash basis customers. Deferred product revenues generally relate to product sales being recognized ratably over the term of the licensing arrangement, and, to a lesser extent, partial shipments when the Company does not have VSOE for the undelivered elements and products that have been delivered but await customer acceptance. Deferred maintenance fees and consulting services generally relate to


73


Table of Contents

 
payments for maintenance and consulting services in advance of the time of delivery of services. These deferred amounts are expected to be recognized as revenues based on the policy outlined above.
 
Allowance for Doubtful Accounts
 
The Company maintains an allowance for doubtful accounts for potential future estimated losses resulting from the inability or unwillingness of certain customers to make all of their required payments. The allowance for doubtful accounts is based on the Company’s assessment of the collectibility of customer accounts. The Company regularly reviews the allowance by considering factors such as historical experience, credit quality, the age of the accounts receivable balances, and current economic conditions that may affect a customer’s ability to pay. This assessment requires significant judgment. When facts and circumstances indicate the collection of specific amounts or from specific customers is at risk, the Company assesses the impact on amounts recorded for bad debts and, if necessary, records a charge in the period the determination is made. If the financial condition of its customers or any of the other factors the Company uses to analyze creditworthiness were to worsen, additional allowances may be required, resulting in future operating losses that are not included in the allowance for doubtful accounts as of April 30, 2010.
 
The following describes activity in the allowance for doubtful accounts for fiscal 2010, 2009 and 2008 (in thousands):
 
                                 
        Addition
       
    Balance at
  Charged to
      Balance at
    Beginning
  Costs and
      End
Period