Prospectus Summary
This summary highlights selected information contained elsewhere in this prospectus and does not contain all of the information you should consider in making your investment decision. You should read the following summary together with all of the more detailed information regarding us and our common stock being sold in the offering, including our financial statements and the related notes, appearing elsewhere in this prospectus. Unless we state otherwise, “Sourcefire,” the “Company,” “we,” “us,” and “our” refer to Sourcefire, Inc., a Delaware corporation, and its subsidiaries, taken as a whole.
SOURCEFIRE, INC.
Overview
We are a leading provider of intelligence driven, open source network security solutions that enable our customers to protect their computer networks in an effective, efficient and highly automated manner. We sell our security solutions to a diverse customer base that includes more than 25 of the Fortune 100 companies and over half of the 30 largest U.S. government agencies. We also manage one of the security industry’s leading open source initiatives, Snort.
Our family of network security products forms a comprehensive Discover, Determine and Defend, or 3D, approach to network security. Using this approach, our technology can automatically:
Our Sourcefire 3D approach is comprised of three key components:
RNA. At the heart of the Sourcefire 3D security solution is Real-time Network Awareness, or RNA, our network intelligence product that provides persistent visibility into the composition, behavior, topology (the relationship of network components) and risk profile of the network. This information provides a platform for the Defense Center’s automated decision-making and network policy compliance enforcement. The ability to continuously discover characteristics and vulnerabilities of network assets, or endpoint intelligence, enables our Intrusion Prevention products to more precisely identify and block threatening traffic and to more efficiently classify threatening and/or suspicious behavior than products lacking network intelligence.
Intrusion Sensors. The Intrusion Sensors utilize open source Snort® and our proprietary technology to monitor network traffic. These sensors compare observed traffic to a set of “Rules”, or a set of anomolous network traffic characteristics, which can be indicative of malicious activity. Once the Intrusion Sensors match a Rule to the observed traffic, they block malicious traffic and/or send an alert to the Defense Center for further analysis, prioritization and possible action.
Defense Center. The Defense Center aggregates, correlates and prioritizes network security events from RNA Sensors and Intrusion Sensors to synthesize multipoint event correlation and policy compliance analysis. The Defense Center’s policy and response subsystems are designed to leverage existing IT infrastructure such as firewalls, routers, trouble ticketing and patch management systems for virtually any task, including alerting, blocking and initiating corrective measures.
The traffic inspection engine used in our intrusion prevention products is the open source technology called Snort. Martin Roesch, our founder and Chief Technology Officer, created Snort in 1998. Our employees, including Mr. Roesch, have authored all major components of Snort, and we maintain control over the Snort project, including the principal Snort community forum, Snort.org. Snort, which has become a de facto industry standard, has been downloaded over 3 million times. We believe that a majority of the Fortune 100 companies and all of the 30 largest U.S. government agencies use Snort technology to monitor network traffic and that Snort is the most widely deployed intrusion prevention technology worldwide. The ubiquitous nature of the Snort user community represents a significant opportunity to sell our proprietary products to customers that require a complete enterprise solution.
End box 1 END LOGICAL PAGE PAGEBREAK BEGIN LOGICAL PAGE Begin box 1For the year ended December 31, 2005, we generated approximately 83% of our revenue from customers in North America and 17% from international customers. We increased our revenue from $16.7 million in 2004 to $32.9 million in 2005, representing a growth rate of 97%. For the nine months ended September 30, 2006, our revenue was $28.9 million, compared to $21.2 million for the nine months ended September 30, 2005, representing a growth rate of 36%.
Our Industry
According to International Data Corporation, or IDC, the network security industry is estimated to be a $18.4 billion market in 2006 and is projected to grow to $26.9 billion in 2009, representing a compound annual growth rate of over 13%. Our addressable markets include intrusion prevention, vulnerability management and unified threat management, which are collectively projected to total $2.9 billion in 2006 and are expected to grow at a compound annual growth rate in excess of 21% to $5.2 billion in 2009, according to IDC. We expect that this growth should continue as organizations seek solutions to various growing and evolving security challenges, including:
Greater Sophistication, Severity and Frequency of Network Attacks. The growing use of the Internet as a business tool has required organizations to increase the number of access points to their networks, which has made vast amounts of critical information more vulnerable to attack. Theft of sensitive information for financial gain motivates network attackers, who derive profit through identity theft, credit card fraud, money laundering, extortion, intellectual property theft and other illegal means. These profit-motivated attackers, in contrast to the hobbyist hackers of the past, are employing much more sophisticated tools and techniques to generate profits for themselves and their well-organized and well-financed sponsors.
Increasing Risks from Unknown Vulnerabilities. Unknown vulnerabilities in computer software that are discovered by network attackers before they are discovered by security and software vendors represent a tremendous risk. These uncorrected flaws can leave networks largely defenseless and open to exploitation. According to Computer Emergency Response Team Coordination Center, or CERT-CC, the trends in the rate of vulnerability disclosure are particularly alarming, with approximately 3,780 disclosed in 2004 and more than 5,990 disclosed in 2005, representing a growth rate of approximately 58%.
Potential Degradation of Network Performance. Many security products degrade network performance and are, therefore, disfavored by network administrators who generally prioritize network performance over incremental gains in network security. For example, the use of active scanners that probe networks for vulnerabilities often meets heavy resistance from administrators concerned about excessive network “noise,” clogged firewall logs and disruption of network assets that are critical to business operations.
Diverse Demands on Security Administrators. The proliferation of targeted security solutions such as firewalls, intrusion prevention systems, URL filters, spam filters and anti-spyware solutions, while critical to enhancing network security, create significant administrative burdens on personnel who must manage numerous disparate technologies that are seldom integrated and often difficult to use. Most network security products require manual, labor intensive incident response and investigation by security administrators, especially when “false positive” results are generated.
Heightened Government Regulation. Rapidly growing government regulation is forcing compliance with increased requirements for network security, which has escalated demand for security solutions that meet both compliance requirements and reduce the burdens of compliance, reporting and enforcement. Examples of these laws include The Health Insurance Portability and Accountability Act of 1996, or HIPAA, The Financial Services Modernization Act of 1999, commonly known as the Gramm-Leach-Bliley Act, The Sarbanes-Oxley Act of 2002 and The Federal Information Security Management Act.
End box 1 END LOGICAL PAGE PAGEBREAK BEGIN LOGICAL PAGE Begin box 1Our Competitive Strengths
We believe that our leading market position results from several key competitive strengths, including:
Real-Time Approach to Network Security. Our solution is designed to support a continuum of network security functions that span pre-attack hardening of assets, high fidelity attack identification and disruption and real-time compromise detection and incident response. In addition, our ability to confidently classify and prioritize threats in network traffic and determine the composition, behavior and relationships of network endpoints allows us to reliably automate what are otherwise manual, time-intensive processes.
Comprehensive Network Intelligence. Our innovative network security solution incorporates RNA, which provides persistent visibility into the composition, behavior, topology and risk profile of the network and serves as a platform for automated decision-making and network security policy enforcement. RNA performs passive, or non-disruptive, network discovery. This enables real-time compositional cataloging of network assets, including their configuration, thereby significantly increasing the network intelligence available to IT and security administrators. By integrating this contextual understanding of the network’s components and situational awareness of network events, our solution is effective across a broad range of security domains, especially in the area of threat identification and impact assessment.
The Snort Community. The Snort user community, with over 100,000 registered users and over 3 million downloads to date, has enabled us to establish a market footprint unlike any other in the industry. We believe the Snort open source community provides us with significant benefits, including a broad threat awareness network, significant research and development leverage, and a large pool of security experts that are skilled in the use of our technology. We believe that Snort’s broad acceptance makes us one of the most trusted sources of intrusion prevention and related security solutions.
Leading-Edge Performance. Our solutions have the ability to process multiple gigabits of traffic with latency as low as 100 microseconds. Our intrusion prevention technology incorporates advanced traffic processing functionality, including packet acquisition, protocol normalization and target-based traffic inspection, which yields increased inspection precision and efficiency and enables more granular inspection of network traffic. The Defense Center supports event loads as high as 1,300 events per second, which we believe meets or exceeds the requirements of the most demanding enterprise customers.
Significant Security Expertise. We have a highly knowledgeable management team with extensive network security industry experience gained from past service in leading enterprises and government organizations including Symantec, McAfee, the Department of Defense and the National Security Agency. Our founder and CTO, Martin Roesch, invented Snort and our core RNA technology and is widely regarded as a network security visionary. Our senior management team averages 16 years of experience in the networking and security industries. In addition, our Vulnerability Research Team, or VRT, is comprised of highly experienced security experts who research new vulnerabilities and create innovative methods for preventing attempts to exploit them.
Broad Industry Recognition. We have received numerous industry awards and certifications, including recognition by Gartner, Inc. as a “leader” in the network intrusion prevention systems market. RNA is one of only five network security products to receive the NSS Gold award, which is awarded by The NSS Group only to those products that are distinguished in terms of advanced or unique features, and which offer outstanding value. In addition, our technology has achieved Common Criteria Evaluation Assurance Level 2, or EAL2, which is an international evaluation standard for information technology security products sanctioned by, among others, the International Standards Organization, the National Security Agency and the National Institute for Standards and Technology.
Our Growth Strategy
We intend to become the preeminent provider of network security solutions on a global basis. The key elements of our growth strategy include:
Continue to Develop Innovative Network Security Technology. We will continue to invest significantly in internal development and product enhancements and to hire additional network security experts to broaden our proprietary knowledge base. We believe our platform is capable of expanding into new markets such as unified threat management, security management and compliance and network management.
End box 1 END LOGICAL PAGE PAGEBREAK BEGIN LOGICAL PAGE Begin box 1Grow our Customer Base. With over 3 million downloads of Snort and over 100,000 registered users, we believe Snort is the most ubiquitous network intrusion detection and prevention technology. We seek to monetize the Snort installed base by targeting enterprises that implement Snort but have not yet purchased any of the components of our Sourcefire 3D security solution. We will continue to target large enterprises and government agencies that require advanced security technology and high levels of network availability and performance in sectors including finance, technology, healthcare, manufacturing and defense.
Further Penetrate our Existing Customer Base. As of September 30, 2006, over 1,200 customers have purchased our Intrusion Sensors and Defense Center products. We intend to sell additional Intrusion Sensors to existing customers and expand our footprint in the networks of our customers to include branch offices, remote locations and data centers. In addition, we believe we have a significant opportunity to up-sell our higher margin RNA product to existing customers because of the significant incremental benefit that increased network intelligence can bring to their security systems.
Expand our OEM Alliances and Distribution Relationships. As part of our ongoing effort to expand our OEM alliances, we recently entered into a relationship with Nokia whereby Nokia Enterprise Solutions will market to its enterprise customers network security solutions that utilize our proprietary software and technology. In addition, we seek to expand our strategic reseller agreements and increasingly use this channel to generate additional inbound customer prospects. We also intend to utilize our relationships with managed security service providers such as Verizon, VeriSign and Symantec, to derive incremental revenue. In 2005, we generated approximately 16% of our revenue from governmental organizations and, in the future, we believe we will generate an increasing amount of revenue from government suppliers such as Lockheed Martin, Northrop Grumman and Immix Technology.
Strengthen Our International Presence. We believe the network security needs of many enterprises located outside of the United States are not being adequately served and represent a significant potential market opportunity. In 2005, we generated only approximately 17% of our revenue from international customers. We are expanding our sales in international markets by adding distribution relationships and expanding our direct sales force, with plans in the next year to double the number of personnel in Europe and to hire a country manager for Japan.
Selectively Pursue Acquisitions of Complementary Businesses and Technologies. To accelerate our expected growth, enhance the capabilities of our existing products and broaden our product and service offerings, we intend to selectively pursue acquisitions of businesses, technologies and products that could complement our existing operations.
Certain Risk Factors
Investing in our common stock involves substantial risk. You should carefully consider all the information in this prospectus prior to investing in our common stock. These risks and uncertainties include, but are not limited to, the following:
End box 1 END LOGICAL PAGE PAGEBREAK BEGIN LOGICAL PAGE Begin box 1 callerid=999 iwidth=455 length=96Our Corporate Information
We were incorporated as a Delaware corporation in December 2001. Our principal executive office is located at 9770 Patuxent Woods Drive, Columbia, Maryland 21046. Our telephone number at that location is (410) 290-1616. Our website address is www.sourcefire.com. We also operate www.snort.org. These are textual references only. We do not incorporate the information on, or accessible through, any of our websites into this prospectus, and you should not consider any information on, or that can be accessed through, our websites as part of this prospectus.
End box 1 END LOGICAL PAGE PAGEBREAK BEGIN LOGICAL PAGE Begin box 1