FireEye

Prospectus Summary

PROSPECTUS SUMMARY This summary highlights information contained elsewhere in this prospectus. This summary is not complete and does not contain all of the information you should consider in making your investment decision. You should read the following summary together with the more detailed information appearing elsewhere in this prospectus, including “Risk Factors,” “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and our consolidated financial statements and related notes before deciding whether to purchase shares of our common stock.

FIREEYE, INC.

Overview

We have invented a purpose-built, virtual machine-based security platform that provides real-time protection to enterprises and governments worldwide against the next generation of cyber attacks. Our technology approach represents a paradigm shift from how IT security has been conducted since the earliest days of the information technology industry. The core of our purpose-built, virtual machine-based security platform is our virtual execution, or MVX, engine, which identifies and protects against known and unknown threats that existing signature-based technologies are unable to detect. The new generation of cyber attacks on organizations, including large and small enterprises and governments worldwide, is characterized by an unprecedented escalation in the complexity and scale of advanced malware created by criminal organizations and nation-states. These highly sophisticated cyber attacks routinely circumvent traditional signature-based defenses by launching dynamic, stealthy and targeted malware that penetrates defenses in multiple stages and through multiple entry points of an IT network. Our proprietary virtual machine-based technology represents a new approach to detecting these cyber attacks in real time with high efficacy while also scaling in response to ever-increasing network performance requirements. We believe it is imperative for organizations to invest in this new approach to security to protect their critical assets, such as intellectual property and customer and financial data, from the global pandemic of cybercrime, cyber espionage and cyber warfare.

Our nine years of research and development in proprietary virtual machine technology, anomaly detection and associated heuristic, or experience-based, algorithms enables us to provide real-time, dynamic threat protection without the use of signatures while delivering high efficacy and network performance. We provide a comprehensive platform that employs a virtualized execution engine and a cloud-based threat intelligence network that uniquely protects organizations from next-generation threats at all stages of the attack lifecycle and across all primary threat vectors, including Web, email and file systems. Our MVX engine detonates, or “runs,” Web objects, suspicious attachments and files within purpose-built virtual machine environments to detect and block the full array of next-generation threats, including attacks that leverage unknown vulnerabilities in widely used software programs, also known as “zero-day” attacks. Newly identified threats are quarantined to prevent exposure to the organization’s actual network environment, and information regarding such threats is sent to our Dynamic Threat Intelligence, or DTI, cloud. Our DTI cloud enables real-time global sharing of threat intelligence uploaded by our customers’ cloud-connected FireEye appliances. In over 95% of our prospective customer evaluations, we have discovered incidents of next-generation threats that were conducting malicious activities and that successfully evaded the prospective customers’ existing security infrastructure, including traditional firewalls, next-generation firewalls, intrusion prevention systems, anti-virus software, email security and Web filtering appliances. By deploying our platform, organizations can stop inbound attacks and outbound theft of valuable intellectual property and data with a negligible false-positive rate, enabling them to avoid potentially catastrophic financial and intellectual property losses, reputational harm and damage to critical infrastructures.

Our platform is delivered through a family of software-based appliances and includes our DTI cloud subscription as well as support and maintenance services. Our principal appliance families address three critical vectors of attack: Web, email and file shares. We also provide a family of management appliances that serve as a central nervous system unifying reporting and configuration, while monitoring and correlating attacks that simultaneously cross multiple vectors of the network, thereby increasing the efficacy of our security platform. Our management appliances enable us to share intelligence regarding threats at a local implementation level and also across the organization. In addition, we enhance the efficacy of our solution by sharing with customers anonymized global threat data through our DTI cloud. Finally, we offer a malware analysis appliance that provides IT security analysts with the ability to test, characterize and conduct forensic examinations on next-generation threats by simulating their execution path with our virtual machine technology.

Our sales model consists of a direct sales team and channel partners that collaborate to identify new sales prospects, sell products and services, and provide post-sale support. We believe this approach allows us to maintain face-to-face connectivity with our customers, including key enterprise accounts, and helps us support our partners, while leveraging their reach and capabilities. As of June 30, 2013, we had over 1,100 end-customers across more than 40 countries, including over 100 of the Fortune 500. Our customers include leading enterprises in a diverse set of industries, including telecommunications, technology, financial services, public utilities, healthcare and oil and gas, as well as leading U.S. and international governmental agencies.

For 2010, 2011 and 2012, our revenue was $11.8 million, $33.7 million and $83.3 million, respectively, representing year-over-year growth of 186% for 2011 and 148% for 2012, and our net losses were $9.5 million, $16.8 million and $35.8 million, respectively. For the six months ended June 30, 2012 and 2013, our revenue was $29.7 million and $61.6 million, respectively, representing year-over-year growth of 165% and 107%, and our net losses were $14.3 million and $67.2 million, respectively. Subscription and services revenue has increased as a percentage of revenue over the last three years, from 21% in 2010 to 37% in 2012 and to 48% during the six months ended June 30, 2013, while our product revenue has decreased as a percentage of revenue, from 79% in 2010 to 63% in 2012 and to 52% during the six months ended June 30, 2013. The increase in subscription and services revenue as a percentage of total revenue is primarily due to the growth of our installed base in conjunction with the increase in product sales and renewals of the related subscription and services from existing customers.

Industry Background

Organizations Are Spending Billions On Legacy Signature-Based Security Technologies

Organizations today are embracing a confluence of technologies to enhance the productivity of their employees, generate new revenue sources and improve their operating efficiency. These technologies include cloud services, mobile computing and online services and social networking sites, such as LinkedIn, Facebook and Twitter. This greater reliance on information technology has significantly increased the attack surface within these organizations that is vulnerable to potential security attacks and has resulted in significant investments in IT security to help protect against a myriad of potential threats. According to IDC, a global market research firm, 2013 worldwide IT security spending will be approximately $17.9 billion, including investments in traditional security technologies such as firewalls, intrusion prevention systems and endpoint security software.

To date, organizations have deployed IT security products to defend against earlier generations of security threats by utilizing legacy signature-based threat protection technology. The signature model works by forensically examining the code base of known malware and, if no match is found, subsequently developing a signature that network security devices can match against future incoming traffic. These signatures are gathered by IT security companies and distributed periodically to organizations that subscribe to the company’s update service. This signature-based approach is the principal foundation of existing IT threat protection technologies.

The Threat Landscape Has Evolved: Organizations Face A New Generation Of Threat Actors

The historical threat landscape was defined by amateur hackers who launched attacks principally for fame or mischief. While these hackers garnered a lot of press, they caused relatively little damage, and signature-based security solutions were effective at detecting and preventing them. Today’s organizations face an advanced malware pandemic of unprecedented severity led by “advanced persistent threat actors,” such as cyber-criminal organizations, nation-states and hacktivists, who are utilizing highly sophisticated next-generation threats to circumvent traditional IT defenses at an alarming rate. Cybercriminals are expending significant resources to exfiltrate sensitive intellectual property and personal data, causing financial and reputational damage; nation-states are pursuing cyber espionage and warfare targeting critical infrastructure, such as power grids and highly sensitive information that can threaten national security; and hacktivists, who are ideologically driven, are defacing Websites, stealing information and launching denial of service attacks.

Next-Generation Threats Exhibit A Unique Set Of Challenges

Next-generation threats, utilized by advanced persistent threat actors, are fundamentally different from earlier generation threats, with a unique set of characteristics that create a new set of detection and prevention challenges. One of the most dangerous characteristics of next-generation threats is their ability to take advantage of a previously unknown vulnerability in widely used software programs, creating what is known as “zero day” threats. By exploiting this vulnerability, significant damage can be done because it can take days before signature-based software vendors discover the vulnerability and patch it, and an even longer period of time for traditional security products to update their signature databases accordingly. Next-generation threats are stealthy by design and are significantly harder to detect. Further compounding the problem, next-generation threats are dynamic, or polymorphic, meaning they are designed to mutate quickly and retain their function while changing their code, making it almost impossible for traditional signature technologies that rely on pattern matching to detect them. These threats are also targeted, which enables them to present specific individuals within organizations’ networks with customized messages or content that maximizes the likelihood of the individual becoming an unwitting accomplice to the attack. Next-generation threats are also persistent and can perform malicious activity over a significantly longer period of time by remaining in the network and spreading undetected across devices for a specific period of time before conducting their activity, thereby resulting in higher damage potential. An additional level of complexity created by these threats is that they can target all primary entry points of a network by launching advanced malware attacks at the organization through Web, email and file vectors. These attacks may also include “blended attacks” that target multiple vectors simultaneously to gain entry to an organization’s IT environment.

Next-generation threats are significantly more complex in the way they carry out their attacks. The threats formulate over multiple steps, and they are difficult to detect via legacy security technologies at each step. The typical next-generation attack lifecycle contains the following five steps:

organization and the malware file can be obfuscated to seem harmless, legacy security systems cannot detect the threat. As an example, the file can be presented as a .jpg (a picture) instead of an .exe (executable) file and therefore avoid detection by legacy security technologies designed to look for executables. In addition, the malware program is encrypted and the key to decrypt the file is only available in the exploit code. Therefore, only if a security product detects the initial exploit code, can it collect the key to decrypt, detect and block the larger malware program.

Existing Security Solutions Are Not Architected To Protect Against Next-Generation Threats

The evolving threat landscape has rendered traditional defenses incapable of protecting organizations against next-generation threats. This includes traditional and next-generation firewalls, which provide the ability to manage policies for network and application traffic but are not fundamentally designed to detect advanced cyber attacks in a granular and scalable fashion. In addition, although products like intrusion prevention systems, or IPS, anti-virus, or AV, whitelisting and Web filtering technologies were designed with the intent of detecting the full spectrum of cyber attacks, their signature-based approaches have left them increasingly unsuccessful in detecting and blocking next-generation threats.

Protecting Today’s IT Infrastructure Requires A Fundamentally Different Approach To Security

A solution to protect against next-generation threats needs to be built from the ground up and have the following key capabilities:

Our Solution

Our technology platform, built on our proprietary MVX engine, is able to identify and protect against known and unknown threats without relying on existing signature-based technologies employed by legacy IT security vendors and best-of-breed point solution vendors. The key benefits of our platform include:

Our Market Opportunity

According to IDC, worldwide IT security spending in 2013 will be approximately $17.9 billion across firewalls, virtual private networking, Web security, unified threat management, intrusion detection and prevention, messaging security and corporate endpoint security. While this spending is focused principally on traditional IT security products, we believe the rise in next-generation threats is creating significant new demand from organizations for products that offer advanced protection against this new threat paradigm. Gartner, Inc., a global market research firm, estimates that by 2020, 75% of enterprises’ information security budgets will be allocated for rapid detection and response approaches, up from less than 10% in 2012.¹ We believe our platform is essential to protect these organizations against next-generation threats. As organizations seek new defenses against next-generation threats, we believe that our virtualization-based approach, which represents a paradigm shift from how IT security has been conducted in the past, will take an increasing share of IT security spending from the traditional enterprise IT security markets. Specifically, we believe this approach can be applied to initially supplement, and ultimately replace, any threat protection technology that utilizes a traditional signature-based approach. These markets consist of Web security ($2.4 billion), messaging security ($2.9 billion), intrusion detection and prevention ($2.1 billion) and corporate endpoint security ($4.2 billion), and aggregate to a total projected spending of $11.6 billion in 2013, in each case according to IDC.

Our Competitive Strengths

We have developed the following key competitive advantages that we believe will allow us to maintain and extend our leadership position:

Our Strategy

Our objective is to be the global leader in virtual machine-based security solutions for the entire IT security market. The key elements of our growth strategy include:

Risks Associated With Our Business

Our business is subject to numerous risks and uncertainties, including those highlighted in the section entitled “Risk Factors” immediately following this prospectus summary. These risks include, among others, the following:

Corporate Information

Our principal executive offices are located at 1440 McCarthy Blvd., Milpitas, California 95035, and our telephone number is (408) 321-6300. Our Website address is www.fireeye.com. Information contained on, or that can be accessed through, our Website is not incorporated by reference into this prospectus, and you should not consider information on our Website to be part of this prospectus. We were incorporated in Delaware in February 2004 under the name NetForts, Inc., and changed our name to FireEye, Inc. in September 2005.

The mark “FireEye” and the FireEye design logo are the property of FireEye, Inc. This prospectus contains additional trade names, trademarks, and service marks of other companies, and such tradenames, trademarks and service marks are the property of their respective owners. We do not intend our use or display of other companies’ trade names, trademarks, or service marks to imply a relationship with, or endorsement or sponsorship of us by, these other companies.

Emerging Growth Company

The Jumpstart Our Business Startups Act, or the JOBS Act, was enacted in April 2012 with the intention of encouraging capital formation in the United States and reducing the regulatory burden on newly public companies that qualify as “emerging growth companies.” We are an emerging growth company within the meaning of the JOBS Act. As an emerging growth company, we may take advantage of certain exemptions from various public reporting requirements, including the requirement that our internal control over financial reporting be audited by our independent registered public accounting firm pursuant to Section 404 of the Sarbanes-Oxley Act of 2002, certain requirements related to the disclosure of executive compensation in this prospectus and in our periodic reports and proxy statements, and the requirement that we hold a nonbinding advisory vote on executive compensation and any golden parachute payments. We may take advantage of these exemptions until we are no longer an emerging growth company.

We will remain an emerging growth company until the earliest to occur of (i) the last day of the fiscal year in which we have more than $1.0 billion in annual revenue; (ii) the date we qualify as a “large accelerated filer,” with at least $700 million of equity securities held by non-affiliates; (iii) the date on which we have issued, in any three-year period, more than $1.0 billion in non-convertible debt securities; and (iv) the last day of the fiscal year ending after the fifth anniversary of the completion of this offering.

For certain risks related to our status as an emerging growth company, see “Risk Factors—Risks Related to this Offering, the Securities Markets and Ownership of Our Common Stock—We are an ‘emerging growth company,’ and we cannot be certain if the reduced disclosure requirements applicable to emerging growth companies will make our common stock less attractive to investors.”