Carbon Black

Prospectus Summary

PROSPECTUS SUMMARY
This summary highlights selected information that is presented in greater detail elsewhere in this prospectus. This summary does not contain all of the information you should consider before investing in our common stock. You should read this entire prospectus carefully, including the sections titled "Risk Factors" and "Management's Discussion and Analysis of Financial Condition and Results of Operations" and our consolidated financial statements and related notes included elsewhere in this prospectus, before making an investment decision. Unless the context indicates otherwise, the terms "Carbon Black," "company," "we," "us," "our" and "our company" in this prospectus refer to Carbon Black, Inc. and its consolidated subsidiaries.

CARBON BLACK, INC.

Carbon Black is a leading provider of next-generation endpoint security solutions. Our predictive security cloud platform continuously captures, records and analyzes rich, unfiltered endpoint data. We believe the depth, breadth and real-time nature of our endpoint data, combined with the strength of our analytics platform, provides customers with the most robust and data-intensive solution to address the complete endpoint security lifecycle. Our solutions enable customers to predict, prevent, detect, respond to and remediate cyber attacks before they cause a damaging incident or data breach.

Organizations globally are re-platforming their IT by investing in cloud computing and workforce mobility, which has resulted in enterprise environments that are more open, interconnected, and vulnerable to cyber attacks. In the past, knowledge workers only had access to applications and data inside the corporate network perimeter, which were firewalled off from potential cyber threats. Today, an increasingly mobile workforce and the explosion of enterprise data and applications in the cloud have expanded the attack surface beyond the traditional network perimeter. In response, cyber attackers have adapted their attack methods and tools to directly target the endpoint. In short, the endpoint is the new perimeter.

Endpoints are the primary focus of attacks because they store valuable data that attackers seek to steal; perform critical operations that attackers seek to disrupt; and are the interface where attackers can target humans through email, social engineering and other tactics. Endpoints are the physical and virtual locations where sensitive data resides and include desktops, laptops, servers, virtual machines, cloud workloads (services running on cloud servers), fixed-function devices such as ATMs, point of sale systems, and control and data systems for power plants and other industrial assets.

Based on our experience and investment in next-generation solutions designed to address the full endpoint security lifecycle—predict, prevent, detect, respond to and remediate—we have developed a highly differentiated technology approach with four main pillars:

1.

Unfiltered data collection: Our technology uniquely collects complete, "unfiltered" endpoint data by continuously recording endpoint activity and centrally storing the collected data for advanced analytics. Other vendors take a "filtered" approach by capturing a subset of data at select points in time. Unfiltered data is more comprehensive, provides greater visibility and we believe offers more effective security capabilities.

2.

Proprietary data shaping technology: Our unfiltered data approach, which we believe is fundamental to deliver the most effective endpoint security, required us to overcome several difficult technical challenges, which we refer to as the "edge to cloud data pipeline problem." These challenges centered on how to reliably collect and cost effectively analyze and store massive amounts of data from edge devices (i.e., endpoints) in the cloud. To address those challenges, we have developed proprietary data shaping technology that smooths bursts of endpoint data activity; optimizes bandwidth demands to move massive amounts of endpoint data; compresses data at a high ratio to reduce the cost of storing massive amounts of data; and leverages a graph-like custom model for endpoint data that allows analysis of the data in multiple ways for multiple use cases. We believe our proprietary data shaping technology creates a strong and lasting competitive advantage not just in endpoint security, but also as we seek to disrupt and consolidate adjacent security markets that leverage endpoint data.


3.

Streaming analytics: We analyze endpoint data at massive scale leveraging event stream processing technology, which evaluates and classifies a continuously updated stream of events based on their risk level. We also employ machine learning and other advanced analytic techniques.

4.

Extensible and open architecture: Our open architecture was designed to integrate with leading security technologies and IT products used by our customers. Moreover, endpoint data is the fuel that powers multiple security products across an organization's security stack. Our open architecture, when combined with the value of our data, positions our platform to serve as the hub of security activity in a customer's IT organization and enables deep customer relationships.

We have a strong heritage of innovative technology leadership in multiple endpoint security categories: application control, endpoint detection and response, or EDR, and next-generation antivirus, or NGAV. Our flagship solutions are technology leaders in each of these categories, and we are integrating each with our predictive cloud platform. Unlike legacy security products that install an agent and collect data specific to its domain or use case, our platform provides a single agent that continuously collects unfiltered endpoint data to address the entire endpoint security lifecycle, which today is addressed by multiple point products. We believe that we are well positioned to continue serving the $6.5 billion endpoint security market.

We focus on solutions that enable organizations to address the entire security lifecycle of an endpoint and integrate endpoint security within their cyber security architecture. We are transforming cyber security with our predictive security cloud, which positions us to address adjacent security use cases requiring endpoint data, such as IT asset management, public cloud security software and security and vulnerability management, which, according to IDC, represented markets of $1.9 billion, $5.3 billion and $5.4 billion, respectively, in 2016. This presents us with the opportunity to extend into adjacent security markets, and potentially expand our market opportunity, from $6.5 billion to $19.1 billion. While we have not yet penetrated these adjacent security markets, and there are multiple challenges associated with doing so, we believe that we can leverage the unfiltered endpoint data, proprietary data shaping technology, streaming analytics capabilities and extensible open architecture of our predictive security cloud to address adjacent security use cases and the market opportunities that they present through the development of additional product functionality.

Our customers include many of the world's largest, security-focused enterprises and government agencies that are among the most heavily targeted by cyber adversaries, as well as mid-sized organizations. We serve over 3,700 customers globally across multiple industries, including 33 of the Fortune 100. Our solutions address the needs of a diverse range of customers. Over 70 security technology companies, including industry leaders such as VMware, Inc., or VMware, Splunk Inc., and the International Business Machines Corporation, or IBM, have integrated their products with Carbon Black to access our unfiltered endpoint data.

We primarily sell our products through a channel go-to-market model, which significantly extends our global market reach and ability to rapidly scale our sales efforts. Our inside sales and field sales representatives work alongside an extensive network of value-added resellers, or VARs, distributors, managed security service providers, or MSSPs, and incident response, or IR, firms. Our MSSP and IR firm channel partners both use and recommend our products to their clients. We have established significant relationships with leading channel partners, including the CDW Corporation, one of the world's largest software VARs; Arrow Electronics, Inc., a major global distributor; SecureWorks, Inc., a leading MSSP; and Kroll Inc., or Kroll, a leading IR firm. In addition, we have technology and go-to-market partnerships with both IBM and VMware, enabling us to leverage their sales organizations to reach their large customer bases. In the three months ended December 31, 2017, 94% of our new and add-on business was closed in collaboration with a channel partner.

We have experienced strong revenue growth, with revenue increasing from $70.6 million in 2015 to $116.2 million in 2016 and $162.0 million in 2017, representing a 51% compound annual growth rate over the same period. We have a subscription-based revenue model that provides visibility into future revenue. Recurring revenue represented 77%, 83% and 88% of our total revenue in 2015, 2016 and 2017, respectively. Annual recurring revenue, or ARR, was $76.8 million, $124.2 million and $174.2 million as of December 31, 2015, 2016 and 2017, respectively. We define ARR as the annualized value of all active subscription contracts as of the end of the period. ARR excludes revenue from perpetual licenses and services. The portion of ARR related to our cloud-based subscription contracts was $2.5 million, $15.1 million and $46.0 million as of December 31, 2015, 2016 and 2017, respectively. The percentage of our total recurring revenue generated by sales of our cloud-based solutions was negligible in 2015, 7% in 2016 and 18% in 2017. We incurred net losses of $38.7 million in 2015, $44.6 million in 2016 and $55.8 million in 2017 as we continued to invest for growth to address the large market opportunity for our platform.

Industry Background

Cyber security is critical to organizations as they face an increasingly hostile threat environment with a growing number of cyber adversaries launching stealthy, sophisticated and targeted attacks. The following major trends are driving strong and growing demand for our products:

Endpoints are the new front line in the cyber war, and organizations are shifting their defenses as a result

The attack surface is expanding. Workforce mobility is increasing the number of connected devices that operate outside the traditional network perimeter, which is expanding the potential "attack surface." Moreover, enterprises are increasing their use of public clouds for a broad range of services, such as virtual machines, cloud workloads and cloud-based applications. As a result, enterprises' critical data and operations have increasingly shifted outside of their traditional network defenses, and the importance of protecting their endpoint devices has become paramount.

Endpoints are the primary target of cyber attacks. Endpoints are the primary targets of attacks because these devices store valuable data and intellectual property and are the interface where attackers can target humans through email, social engineering techniques, keylogging and other tactics.

Endpoint data is critical to an effective cyber security program. Effective security critically depends on having complete visibility into what is happening on each endpoint. Multiple categories of security products, from vulnerability assessment to patch management, require endpoint data for their core functionality.

Organizations are shifting their defenses to focus on next-generation endpoint security solutions. Because network-centric security is no longer adequate, organizations must focus on securing the endpoint. The majority of endpoint security technology in use today relies on multiple agents and uses the same ineffective, traditional signature-based antivirus software originally designed more than 20 years ago. As a result, organizations are increasingly shifting their security budgets toward next-generation endpoint security solutions.

With the continued success of cyber attacks, organizations are shifting from a passive prevention-only response to a holistic approach. Historically, organizations have relied on passive prevention-only technologies that sought to block attackers from penetrating the network perimeter and protect corporate endpoints and data. This limited, passive prevention-only approach has proven inadequate and the number of successful cyber attacks has continued to grow. Organizations are shifting to a holistic and active security approach that requires next-generation technologies to predict, prevent, detect, respond to and remediate today's advanced cyber attacks.

The cyber threat is large, sophisticated and growing and requires new and more advanced approaches to combat it Cyber security is a board-level issue and a focal point for governments worldwide. The ongoing occurrence and devastating consequences of high profile cyber attacks have elevated cyber security to a top priority for executives. Additionally, due to the financial, operational and reputational risks of breaches and non-compliance with regulatory requirements, C-level security officers are now commonplace and cyber security strategy is a critical focus area for boards of directors.

The rise of ransomware has made every organization a potential target. In the past, cyber attackers tended to target entities that held commercially valuable data that could be stolen and used for financial gain. However, with the emergence and proliferation of ransomware in recent years, cyber attackers now target organizations regardless of type or size to extort money by holding computers and data hostage.

Today's attacks are stealthy, sophisticated and targeted. Today's organizations face a complex threat landscape with a broad range of well-funded cyber attackers who use techniques designed to circumvent traditional security approaches. Less skilled attackers can purchase these attacks through cybercrime marketplaces on the "Dark Web," leading to a widespread proliferation of successful, advanced attacks. Once an organization has been breached, attackers can move unseen for months or even years, exfiltrating a larger amount of data and intellectual property. The longer these invisible breaches remain undetected, the greater the costs and reputational damage they can cause.

The shortage of security talent creates a need for next-generation solutions. The continuous growth in the number and sophistication of cyber attacks and the expansion of the attack surface are driving the need for more security professionals with deeper expertise. As the number of threats multiplies, legacy solutions either miss threats or produce more alerts than security teams are able to process and investigate. The number of security professionals has not kept pace with total demand. Organizations are increasingly turning to next-generation solutions, advanced analytics and automation tools to empower their security professionals to increase their efficiency and focus on the highest value cyber security tasks, thereby reducing the need for additional security headcount.

Our Market Opportunity

We believe that our cloud platform addresses a significant capability gap in the enterprise endpoint security market and that our solutions will address an increasing subset of additional use cases in public cloud security software, security and vulnerability management and IT asset management. According to International Data Corporation, or IDC, the market for enterprise endpoint security software, our primary market, was $6.5 billion in 2016 and is expected to reach $8.3 billion by 2021. According to IDC, the market for security and vulnerability management was $5.4 billion in 2016 and is expected to reach $9.0 billion in 2021. According to IDC, the market for public cloud security software was $5.3 billion in 2016 and is expected to reach almost $10.0 billion in 2021. According to IDC, the market for IT asset management was $1.9 billion in 2016 and is expected to reach $2.8 billion in 2021.

Our Solutions

Powered by the Cb Predictive Security Cloud, our solutions provide best-in-class security by collecting and analyzing unfiltered data from the endpoint, addressing the entire security lifecycle and enabling our customers to continuously improve their security posture.

Our customers use our products to:

•

Augment or replace legacy antivirus software;


•

Prevent malware and fileless attacks that do not use malware;


•

Protect against ransomware;


•

Hunt down threats;


•

Respond to and remediate security incidents;


•

Lock down critical systems and applications;


•

Protect fixed-function devices;


•

Secure workloads and applications in virtualized and cloud environments;


•

Comply with regulatory mandates; and


•

Enhance other security products through our unfiltered endpoint data.

Benefits of Our Platform and Solutions

Decreased risk of breach by protecting against known and unknown endpoint attacks

We believe our solutions extend beyond legacy antivirus solutions to detect and stop the widest possible array of cyber attacks, including file-based attacks such as malware and ransomware, as well as next-generation attacks, such as memory-based, PowerShell and script-based attacks. Our solutions apply a full spectrum of technologies to analyze attack patterns in the cloud using richer and more complete endpoint data than any other vendor. According to a MRG Effitas Ltd. efficacy assessment commissioned by us, Cb Defense has a 100% prevention rate against known and unknown ransomware samples. We believe the increased security efficacy from the use of our solutions results in a decreased risk of breach for our customers.

Ability to identify root cause of attacks and quickly respond to security incidents

Our next-generation detection and response capabilities enable organizations and incident responders to rapidly identify the root cause of an attack and the scope of compromise on the network. By capturing unfiltered data, the Cb Predictive Security Cloud provides full visibility into potential threats, both proactively as well as retroactively after a threat is blocked or identified, providing complete details of what happened and what was impacted.

Automated remediation and threat containment

Using the unfiltered data that is continuously collected from each endpoint where our solutions are deployed, our users can launch automated remediation and threat containment actions. These automated capabilities enable organizations to respond to attacks as they happen and minimize the impact and cost of an attack.

Continuous enhancement by leveraging intelligence from across the security community

Our solutions allow organizations to continuously improve their security posture, benefiting from ongoing refinement of endpoint hardening and the latest threat intelligence. Through the Cb Predictive Security Cloud, our customers anonymously share data with each other. We believe the ability to share intelligence across our users increases the security expertise of each customer in our community and reduces their need to hire additional security experts.

Seamless integration with other best-of-breed security solutions

Our next-generation endpoint security solutions are designed to integrate seamlessly with other security technologies deployed in an organization's IT environment. Our open architecture enables customers to build their own integrations with other systems across their IT environment. Our emphasis on open architecture and integration with partners at all layers of the security stack enhances an enterprise's security posture, reduces incident response times and increases overall operational efficiency. Ultimately, this ability enables customers to evolve with the dynamic threat landscape and achieve greater utility across their cyber security architecture.

Security efficacy without blocking legitimate activity

Customers require security products that are highly effective in detecting and preventing attacks, while also minimizing the number of "false positive" alerts that interrupt legitimate end-user activity. In order to achieve these dual requirements, we apply an approach that combines endpoint-based prevention models that are optimized for low false positives, with cloud-based detection algorithms that are optimized for low false negatives.

Increased security operations efficiency and less reliance on scarce security talent

Carbon Black solutions enable our customers to significantly improve the efficiency of their security operations and reduce their reliance on additional security professionals through our automated security solutions, streamlined workflow management and access to the collective expertise available in the Cb Predictive Security Cloud.

Greater ability to meet compliance requirements

Our solutions enable organizations to comply with numerous regulatory requirements for data collection, analysis, reporting, archival and retrieval, while also optimizing the overall enterprise cyber security posture.

Ability to deploy endpoint security at any scale and grow and evolve their defenses

Carbon Black products are used by customers of all sizes, from small and medium sized businesses to large global enterprises. We have designed the Cb Predictive Security Cloud to enable customers to easily grow and evolve their defenses. Customers can start by deploying whichever solutions best match their immediate needs and then extend and enhance their deployment over time.

Our Competitive Strengths

We believe a number of competitive advantages enable us to maintain and extend our leadership position, including:

•

Differentiated technology and intellectual property. Our predictive security approach continuously captures unfiltered endpoint activity for real-time and retrospective analysis using our analytics technology that incorporates event stream processing, dynamic and static behavioral analysis, machine learning and reputation analysis and scoring. We believe our unfiltered approach is highly

scalable and uniquely positions us to address the needs of adjacent security markets by delivering additional products that leverage this data.