UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

WASHINGTON, DC 20549

FORM 10-Q

(Mark One)

☒ QUARTERLY REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the quarterly period ended September 30, 2018

OR

☐ TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the transition period from______to_____.

Commission File Number: 001-38478

CARBON BLACK, INC.

(Exact Name of Registrant as Specified in its Charter)

Delaware	55-0810166
(State or other jurisdiction of	(I.R.S. Employer
incorporation or organization)	Identification No.)
1100 Winter Street
Waltham, MA	02451
(Address of principal executive offices)	(Zip Code)

(617) 393-7400

(Registrant’s telephone number, including area code)

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes☒     No☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§ 232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes☒    No☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

Large accelerated filer	☐	Accelerated filer	☐
Non-accelerated filer	☒	Small reporting company	☐
Emerging growth company	☒

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act.  ☒

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). Yes☐     No☒

There were 67,917,331 shares of the registrant’s common stock with a par value of $0.001 per share, outstanding as of October 22, 2018.

CARBON BLACK,INC.

FORM 10-Q

For the Quarter Ended September 30, 2018

TABLE OF CONTENTS

PARTI  — FINANCIAL INFORMATION
Item 1.	Financial Statements
	Unaudited Condensed Consolidated Balance Sheets	2
	Unaudited Condensed Consolidated Statements of Operations	3
	Unaudited Condensed Consolidated Statements of Comprehensive Loss	4
	Unaudited Condensed Consolidated Statement of Redeemable Convertible and Convertible Preferred Stock and Stockholders’ Equity	5
	Unaudited Condensed Consolidated Statements of Cash Flows	6
	Notes to Unaudited Condensed Consolidated Financial Statements	7
Item 2.	Management’s Discussion and Analysis of Financial Condition and Results of Operations	23
Item 3.	Quantitative and Qualitative Disclosures About Market Risk	36
Item 4.	Controls and Procedures	37
PARTII — OTHER INFORMATION
Item 1.	Legal Proceedings	37
Item 1A.	Risk Factors	37
Item 2.	Unregistered Sales of Equity Securities and Use of Proceeds	66
Item 6.	Exhibits	67
	Signatures	68

1

PART I – FINANCIAL INFORMATION

ITEM 1. FINANCIAL STATEMENTS

CARBON BLACK,INC.

UNAUDITED CONDENSED CONSOLIDATED BALANCE SHEETS

	September 30,		December 31,
(In thousands, except share and per share amounts)	2018		2017
Assets
Current assets:
Cash and cash equivalents	$	69,099	$	36,073
Short-term investments		94,666		—
Accounts receivable, net of allowances of $209 and $124 as of September 30, 2018 and December 31, 2017, respectively		51,582		60,850
Prepaid expenses and other current assets		8,967		6,040
Deferred commissions		11,801		9,551
Total current assets		236,115		112,514
Deferred commissions, net of current portion		23,171		20,404
Property and equipment, net		14,792		12,459
Intangible assets, net		2,919		4,092
Goodwill		119,656		119,656
Other-long term assets		531		2,436
Total assets	$	397,184	$	271,561
Liabilities, Redeemable Convertible and Convertible Preferred Stock and Stockholders' Equity (Deficit)
Current liabilities:
Accounts payable	$	3,502	$	2,481
Accrued expenses		19,596		18,846
Deferred revenue		138,515		130,165
Deferred rent		1,176		944
Total current liabilities		162,789		152,436
Deferred revenue, net of current portion		38,316		38,535
Warrant liability		—		2,766
Deferred rent, net of current portion		2,774		3,114
Deferred tax liability		37		33
Other long-term liabilities		42		42
Total liabilities		203,958		196,926
Commitments and contingencies (Note 11)
Redeemable convertible preferred stock (Series B, C, D, E, E-1 and F), $0.001 par value, 94,101,207 authorized, 88,741,194 shares issued and outstanding with aggregate liquidation preference of $272,506 as of December 31, 2017. No shares authorized, issued or outstanding as of September 30, 2018.		—		333,204
Series A convertible preferred stock, $0.001 par value, 8,800,000 shares authorized, 3,851,806 shares issued and outstanding as of December 31, 2017. No shares authorized, issued or outstanding as of September 30, 2018.		—		1,510
Stockholders' equity (deficit):
Common stock, $0.001 par value, 500,000,000 shares and 156,650,000 shares authorized as of September 30, 2018 and December 31, 2017, respectively; 67,951,050 shares and 11,193,366 shares issued and 67,895,646 and 11,139,690 shares outstanding as of September 30, 2018 and December 31, 2017, respectively		68		11
Treasury stock, at cost, 55,404 and 53,676 shares as of September 30, 2018 and December 31, 2017, respectively		(6)		(6)
Additional-paid in capital		712,156		13,429
Accumulated other comprehensive loss		(30)		—
Accumulated deficit		(518,962)		(273,513)
Total stockholders' equity (deficit)		193,226		(260,079)
Total liabilities, redeemable convertible and convertible preferred stock and stockholders' equity (deficit)	$	397,184	$	271,561

See notes to unaudited condensed consolidated financial statements.

2

CARBON BLACK,INC.

UNAUDITED CONDENSED CONSOLIDATED STATEMENTS OF OPERATIONS

	Three Months Ended September 30,				Nine Months Ended September 30,
(In thousands, except share and per share amounts)	2018		2017		2018		2017
Revenue:
Subscription, license and support	$	50,824	$	38,381	$	144,106	$	107,135
Services		2,591		3,128		8,735		9,010
Total revenue		53,415		41,509		152,841		116,145
Cost of revenue:
Subscription, license and support		9,015		6,842		24,278		17,417
Services		2,890		2,943		8,946		8,360
Total cost of revenue		11,905		9,785		33,224		25,777
Gross profit		41,510		31,724		119,617		90,368
Operating expenses:
Sales and marketing		35,818		25,988		101,657		75,078
Research and development		16,189		13,675		47,195		37,794
General and administrative		7,563		5,717		25,838		16,060
Total operating expenses		59,570		45,380		174,690		128,932
Loss from operations		(18,060)		(13,656)		(55,073)		(38,564)
Interest income, net		737		22		1,192		5
Change in fair value of warrant liability		—		(45)		(8,838)		79
Other income (expense), net		(173)		102		(547)		215
Loss before income taxes		(17,496)		(13,577)		(63,266)		(38,265)
Provision for income taxes		136		22		241		108
Net loss		(17,632)		(13,599)		(63,507)		(38,373)
Accretion of preferred stock to redemption value		—		(7,427)		(199,492)		(15,751)
Net loss attributable to common stockholders	$	(17,632)	$	(21,026)	$	(262,999)	$	(54,124)
Net loss per share attributable to common stockholders—basic and diluted	$	(0.26)	$	(1.99)	$	(6.34)	$	(5.27)
Weighted-average common shares outstanding—basic and diluted		67,837,240		10,587,153		41,494,203		10,263,962

See notes to unaudited condensed consolidated financial statements.

3

CARBON BLACK,INC.

UNAUDITED CONDENSED CONSOLIDATED STATEMENTS OF COMPREHENSIVE LOSS

	ThreeMonths Ended September 30,				Nine Months Ended September 30,
In thousands	2018		2017		2018		2017
Net loss	$	(17,632)	$	(13,599)	$	(63,507)	$	(38,373)
Other comprehensive loss:
Unrealized loss on available-for-sale securities		(30)		-		(30)		-
Total other comprehensive loss		(30)		-		(30)		-
Comprehensive loss	$	(17,662)	$	(13,599)	$	(63,537)	$	(38,373)

See notes to unaudited condensed consolidated financial statements.

4

CARBON BLACK, INC.

UNAUDITED CONDENSED CONSOLIDATED STATEMENT OF REDEEMABLE CONVERTIBLE AND CONVERTIBLE PREFERRED STOCK AND
STOCKHOLDERS’ EQUITY

		Redeemable																											Accumulated
		Convertible				Convertible																	Additional					Other						Total
		Preferred Stock				Preferred Stock					Common Stock						Treasury Stock						Paid‑in						Comprehensive		Accumulated			Stockholders'
(In thousands, except share amounts)		Shares	Amount			Shares		Amount			Shares		Amount			Shares			Amount			Capital				Income (Loss)					Deficit			Equity
Balances at December 31, 2017	88,741,194			$	333,204		3,851,806		$	1,510		11,139,690		$	11			53,676		$	(6)			$	13,429		$					$	(273,513)		$	(260,079)
Exercise of Series A stock options	—				—		360,385			211		—			—			—			—				—					—			—			—
Accretion of redeemable convertible preferred stock to redemption value	—				199,492		—			—		—			—			—			—				(17,550)					—			(181,942)			(199,492)
Conversion of redeemable convertible preferred stock upon initial public offering	(88,741,194)				(532,696)		—			—		44,370,560			44			—			—				532,652					—			—			532,696
Conversion of convertible preferred stock upon initial public offering	—				—		(4,212,191)			(1,721)		1,709,063			2			—			—				1,719					—			—			1,721
Issuance of common stock upon initial public offering, net of underwriting discounts and commissions and offering costs incurred of $4,858	—				—		—			—		9,200,000			9			—			—				157,697					—			—			157,706
Issuance of common stock upon exercise of common stock warrants	—				—		—			—		712,063			1			—			—				11,603					—			—			11,604
Repurchase of common stock	—				—		—			—		(1,728)			—			1,728			—				—					—			—			—
Exercise of common stock options	—				—		—			—		765,998			1			—			—				3,136					—			—			3,137
Stock-based compensation expense	—				—		—			—		—			—			—			—				9,470					—			—			9,470
Unrealized loss on available-for-sale securities	—				—		—			—		—			—			—			—				—					(30)			—			(30)
Net loss	—				—		—			—		—			—			—			—				—					—			(63,507)			(63,507)
Balances at September 30, 2018	—			$	—		—		$	—		67,895,646		$	68			55,404		$	(6)			$	712,156		$			(30)		$	(518,962)		$	193,226

See notes to unaudited condensed consolidated financial statements.

5

CARBON BLACK,INC.

UNAUDITED CONDENSED CONSOLIDATED STATEMENTS OF CASH FLOWS

	Nine Months Ended September 30,
(In thousands)	2018		2017
Cash flows from operating activities:
Net loss	$	(63,507)	$	(38,373)
Adjustments to reconcile net loss to net cash used in operating activities:
Depreciation and amortization expense		5,881		5,204
Stock-based compensation expense		9,470		6,649
Provisions for doubtful accounts		140		(159)
Non-cash interest expense		34		15
Change in fair value of warrant liability		8,838		(79)
Deferred income taxes		4		—
Other non-cash income		(115)		—
Changes in operating assets and liabilities:
Accounts receivable		9,127		(2,517)
Prepaid expenses and other assets		(2,657)		(1,916)
Deferred commissions		(5,017)		(4,122)
Accounts payable		1,236		1,136
Accrued expenses		751		(1,686)
Deferred revenue		8,131		23,711
Deferred rent		(109)		(200)
Other long-term liabilities		(263)		(59)
Net cash used in operating activities		(28,056)		(12,396)
Cash flows from investing activities:
Purchases of short-term investments		(94,581)		—
Purchases of property and equipment		(5,354)		(4,228)
Capitalization of internal-use software costs		(1,901)		(714)
Net cash used in investing activities		(101,836)		(4,942)
Cash flows from financing activities:
Proceeds from exercise of stock options		3,348		2,349
Repayments of line of credit		—		(5,500)
Proceeds from initial public offering, net of offering costs of $2,947		159,617		—
Payments of deferred financing costs		(47)		(84)
Net cash provided by (used in) financing activities		162,918		(3,235)
Net increase (decrease) in cash and cash equivalents		33,026		(20,573)
Cash and cash equivalents at beginning of period		36,073		51,503
Cash and cash equivalents at end of period	$	69,099	$	30,930
Supplemental disclosure of non-cash investing and financing activities:
Conversion of redeemable convertible preferred stock upon initial public offering	$	532,696	$	—
Conversion of convertible preferred stock upon initial public offering		1,720		—
Issuance of common stock upon exercise of common stock warrants		11,604		—
Deferred IPO costs paid in prior periods		1,911		—
Accretion of preferred stock to redemption value		199,492		15,751
Additions to property and equipment included in accounts payable at period end		75		139
Series B preferred stock issued upon exercise of Series B Warrant		—		225
Series F preferred stock and common stock issued upon termination of customer warrant in connection with acquisition of Confer Technologies, Inc.		—		1,347

See notes to unaudited condensed consolidated financial statements.

6

CARBON BLACK,INC.

NOTESTO UNAUDITED CONDENSED CONSOLIDATED FINANCIAL STATEMENTS

(Amounts in thousands, except share and per share amounts)

1. OVERVIEW AND BASIS OF PRESENTATION

Overview

Carbon Black, Inc. (the “Company”) is a leading provider of next-generation endpoint security solutions. The Company’s solutions enable customers to predict, prevent, detect, respond to and remediate cyber attacks before they cause a damaging incident or data breach. The Company was incorporated under the laws of the State of Delaware in December 2002 as Bit 9, Inc. and in April 2005 changed its name to Bit9, Inc. In January 2016, the Company amended its certificate of incorporation to change its name to Carbon Black, Inc.

On April 20, 2018, the Company effected a 1-for-2 reverse stock split of its issued and outstanding shares of common stock and a proportional adjustment to the existing conversion ratios of Company’s Series B, Series C, Series D, Series E, Series E-1 and Series F preferred stock. Accordingly, all share and per share amounts for all periods presented in the accompanying unaudited consolidated financial statements and notes thereto have been adjusted retroactively, where applicable, to reflect this reverse stock split and adjustment of the preferred stock conversion ratios.

On May 8, 2018, the Company closed its initial public offering (“IPO”), in which it issued and sold 9,200,000 shares of common stock inclusive of the underwriters’ option to purchase additional shares that was exercised in full. The price to the public was $19 per share. The Company received aggregate proceeds of $162.6 million from the IPO, net of underwriters’ discounts and commissions, and before deducting offering costs of approximately $4.9 million. Upon closing of the IPO, all shares of the Company’s outstanding redeemable convertible and convertible preferred stock automatically converted into 46,079,623 shares of common stock. Additionally, an outstanding warrant which became exercisable upon the closing of the IPO was exercised to purchase 485,985 shares of common stock.

Basis of Presentation

The accompanying unaudited condensed consolidated financial statements have been prepared in conformity with U.S. generally accepted accounting standards (“GAAP”) for interim financial information and include the accounts of the Company and its wholly owned subsidiaries. All intercompany balances and transactions have been eliminated in consolidation.

The Company’s condensed consolidated financial statements are unaudited, but include all adjustments of a normal recurring nature necessary for a fair presentation of the quarterly results. The Company has made estimates and judgments affecting the amounts reported in the condensed consolidated financial statements and the accompanying notes. The actual results that the Company experiences may differ materially from the Company’s estimates.

The Company’s condensed consolidated financial statements should be read in conjunction with the consolidated financial statements and related notes included in the Company’s final prospectus for its IPO dated as of May4, 2018 and filed with the SEC pursuant to Rule 424(b)(4) under the Securities Act of 1933, as amended.

Effective January 1, 2018, the Company adopted the requirements of Accounting Standards Update (“ASU”) No. 2014-09, Revenue from Contracts with Customers (Topic 606) (“ASC 606”) on a full retrospective basis as discussed in detail in Note 2. All amounts and disclosures set forth in this Quarterly Report on Form 10-Q have been updated to comply with ASC 606.

The Jumpstart Our Business Startups Act of 2012, or the JOBS Act, permits an “emerging growth company” such as the Company to take advantage of an extended transition period to comply with new or revised accounting standards applicable to public companies until those standards would otherwise apply to private companies. The Company has irrevocably elected to “opt out” of this provision and, as a result, the Company will comply with new or revised accounting standards when they are required to be adopted by public companies that are not emerging growth companies.

7

2. NEW ACCOUNTING PRONOUNCEMENTS

Recently issued accounting pronouncements:

Internal-Use Software

In August 2018, the Financial Accounting Standards Board (“FASB”) issued ASU No. 2018-15, Intangibles—Goodwill and Other—Internal-Use Software (Subtopic 350-40) (“ASU 2018-15”). ASU 2018-15 was issued in order to address a customer's accounting for implementation costs incurred in a cloud computing arrangement (“CCA”) that is considered a service contract. Under this guidance, implementation costs for a CCA should be evaluated for capitalization using the same approach as implementation costs associated with internal-use software. The capitalized implementation costs should be expensed over the term of the hosting arrangement, which includes any reasonably certain renewal periods. The pronouncement is effective for fiscal years beginning after December 15, 2019, with early adoption permitted. The Company is currently evaluating the impact of this pronouncement on its consolidated financial statements.

Stock Compensation

In June 2018, the FASB issued ASU No. 2018-07, Compensation – Stock Compensation (Topic 718) (“ASU 2018-07”). ASU 2018-07 was issued in order to expand the guidance for stock-based compensation, to include share-based payment transactions for acquiring goods and services from nonemployees. The pronouncement is effective for fiscal years, and for interim periods within those fiscal years, beginning after December 15, 2018, with early adoption permitted. The Company does not expect the adoption of the new accounting standard to have a material impact on its consolidated financial statements.

Comprehensive Income

In February 2018, the FASB issued ASU 2018-02, Income Statement - Reporting Comprehensive Income (“ASU 2018-02”), which provides for the reclassification of the effect of remeasuring deferred tax balances related to items within accumulated other comprehensive income to retained earnings resulting from the Tax Cuts and Jobs Act, or Tax Act. The guidance is effective for annual reporting periods beginning after December 15, 2018, including interim periods within that reporting period. Early adoption is permitted. The Company does not expect the adoption of the new accounting standard to have a material impact on its consolidated financial statements.

Leases

In February 2016, the FASB issued ASU No. 2016-02, Leases (Topic 842) (“ASU 2016-02”). ASU 2016-02 was issued to increase transparency and comparability among organizations by recognizing lease assets and lease liabilities on the balance sheet and disclosing key information about leasing arrangements. The new standard will be effective for the Company on January 1, 2019. Companies are required to use a modified retrospective approach, with the option of applying the requirements of the standard either (1) retrospectively to each prior comparative reporting period presented, or (2) retrospectively at the beginning of the period of adoption. The Company plans to adopt this standard in the first quarter of 2019 by applying the requirements to the beginning of the period of adoption through a cumulative-effect adjustment. The Company is in the process of identifying the population of potential lease arrangements and evaluating these arrangements in the context of the new guidance. While the Company continues to evaluate the effect of adoption on its consolidated financial statements, the Company expects the adoption will result in the recognition of right-of-use assets and lease liabilities that were not previously recognized, which will increase total assets and liabilities on the Company’s consolidated balance sheet.

Recently adopted accounting pronouncement:

Revenue

In May 2014, the FASB issued ASC 606, which supersedes existing revenue recognition guidance under GAAP. The Company adopted ASC 606 effective January 1, 2018 using the full retrospective method, which required the Company to restate each prior reporting period presented for the impact of adoption of the standard.

8

The Company’s recognition of total revenue related to subscription (i.e., term-based) licenses, cloud-based subscriptions, access to the threat intelligence capabilities of the Cb Predictive Security Cloud, maintenance services and customer support, and stand-alone professional services remain substantially unchanged under the new standard. However, as further discussed herein, the timing of recognition related to certain aspects of subscription (i.e. term-based) licenses, perpetual licenses and associated professional services is different under the new standard.

For subscription license sales of Cb Protection and Cb Response, under the new standard, the Company considers the software license and the access to the threat intelligence capabilities of the Cb Predictive Security Cloud, which provides continuous updates of real-time threat intelligence, to be a single performance obligation. As a result, the arrangement consideration allocated to the software license is deferred on the Company’s balance sheet and recognized ratably over the term of the subscription as the performance obligation is satisfied. However, under the new standard, the Company is no longer required to delay the commencement of revenue recognition of subscription licenses until the commencement of any professional services and training sold with the subscription license  due to the lack of vendor-specific objective evidence ("VSOE") of its longest delivered service elements, maintenance and support. While under the new standard, maintenance services and customer support related to subscription licenses are a stand-alone performance obligation, the related revenue continues to be recognized ratably over the term of the maintenance and support arrangement as the performance obligation is satisfied.

For its infrequent sales of perpetual licenses of Cb Protection and Cb Response, prior to the adoption of ASC 606, the Company recognized revenue ratably over the longest service period of any deliverable in the arrangement, which was generally the maintenance and support term, due to the lack of VSOE of fair value for its maintenance and support offerings. Under the new standard, the Company is no longer required to delay revenue recognition of perpetual licenses until the commencement of any bundled professional services and training sold with the perpetual license. Further, the Company recognizes the revenue related to the sale of perpetual software licenses ratably over the customer’s estimated economic life, which the Company has estimated to be five years, rather than over the initially committed period of maintenance and support.

In addition, under the new standard, for subscription and perpetual licenses that are sold with professional services in a combined arrangement, the professional services represent a separate performance obligation and the Company recognizes revenue associated with the professional services as such services are performed. Revenue associated with professional services sold in a combined arrangement with subscription and perpetual licenses was previously recognized ratably over the longest service period of any deliverable in the arrangement, which was generally the maintenance and support term, due to the lack of VSOE of fair value for the Company’s maintenance and support offerings.

Another significant provision of the new standard requires the capitalization and amortization of costs associated with obtaining a contract, such as sales commissions. Under the new standard, all incremental costs to acquire a contract are capitalized and amortized using a systematic basis over the pattern of transfer of the goods and services to which the asset relates. Under the previous standard, the Company capitalized commission costs that were incremental and directly related to the acquisition of a customer arrangement. The commission costs were capitalized when earned and were amortized as expense over the period that the revenue was recognized for the related non-cancelable customer arrangement in proportion to the recognition of revenue, without regard to anticipated customer renewals. Under the new standard, the Company continues to capitalize all incremental commission costs to obtain a customer arrangement, but now amortizes the capitalized costs on a straight-line basis over the estimated customer relationship period, which includes anticipated customer renewals, because the Company anticipates that a majority of customers will renew their license and cloud-based subscriptions and the commissions paid by the Company for such renewals are not commensurate with the commissions paid for new sales. Accordingly, this has resulted in the Company’s capitalized commission costs being amortized to expense over a longer period under the new standard than under the prior guidance. The Company has estimated the customer relationship period to be five years.

For additional information on the Company’s accounting policies as a result of the adoption of ASC 606 see Note 13 “Revenue”.

9

The Company adjusted its consolidated financial statements due to the adoption of ASC 606. Select unaudited consolidated financial statements, which reflect the adoption of ASC 606 are as follows:

	As of December 31, 2017
			Adjustments for
	As Previously		ASC 606
	Reported		Adoption		As Adjusted
Consolidated Balance Sheet
Assets:
Deferred commissions, current portion	$	15,195	$	(5,644)	$	9,551
Deferred commissions, net of current portion		3,811		16,593		20,404
Liabilities, redeemable convertible and convertible preferred stock and stockholders' equity (deficit):
Deferred revenue, current portion		132,278		(2,113)		130,165
Deferred revenue, net of current portion		31,902		6,633		38,535
Accumulated deficit		(279,942)		6,429		(273,513)

	Three Months Ended September 30, 2017						Nine Months Ended September 30, 2017
	As Prepared under ASC 605		Adjustments for ASC 606 Adoption		As Adjusted		As Prepared under ASC 605		Adjustments for ASC 606 Adoption		As Adjusted
Consolidated Statement of Operations
Subscription, license and support	$	38,216	$	165	$	38,381	$	107,783	$	(648)	$	107,135
Services		3,163		(35)		3,128		9,417		(407)		9,010
Total revenue		41,379		130		41,509		117,200		(1,055)		116,145
Gross profit		31,594		130		31,724		91,423		(1,055)		90,368
Sales and marketing		26,905		(917)		25,988		77,929		(2,851)		75,078
Total operating expenses		46,297		(917)		45,380		131,783		(2,851)		128,932
Loss from operations		(14,703)		1,047		(13,656)		(40,360)		1,796		(38,564)
Loss before income taxes		(14,624)		1,047		(13,577)		(40,061)		1,796		(38,265)
Net loss and comprehensive loss		(14,646)		1,047		(13,599)		(40,169)		1,796		(38,373)
Net loss attributable to common stockholders		(22,073)		1,047		(21,026)		(55,920)		1,796		(54,124)
Net loss per share attributable to common stockholders—basic and diluted	$	(2.08)	$	0.09	$	(1.99)	$	(5.45)	$	0.17	$	(5.27)

	Nine Months Ended September30,2017
			Adjustmentsfor
	As Prepared		ASC606
	under ASC 605		Adoption		AsAdjusted
Consolidated Statement of Cash Flows
Cash flows from operating activities:
Net loss	$	(40,169)	$	1,796	$	(38,373)
Changes in operating assets and liabilities, excluding the impact of acquisition of businesses:
Deferred commissions		(1,272)		(2,850)		(4,122)
Deferred revenue	$	22,657	$	1,054	$	23,711

3. CASH EQUIVALENTS AND SHORT-TERM INVESTMENTS

The Company considers all highly liquid investments with a maturity of three months or less when purchased to be cash equivalents. The Company’s cash equivalents consist of highly liquid investments in money market funds.

The Company considers all high quality investments purchased with original maturities at the date of purchase greater than three months to be short-term investments. Investments are available to be used for current operations and are, therefore, classified as current assets even though maturities may extend beyond one year. Short-term investments are classified as available for sale and are,

10

therefore, recorded at fair value on the consolidated balance sheet, with any unrealized gains and losses reported in accumulated other comprehensive income (loss), which is reflected as a separate component of stockholders’ equity in the Company’s consolidated balance sheets, until realized. The Company uses the specific identification method to compute gains and losses on the investments. The amortized cost of securities is adjusted for amortization of premiums and accretion of discounts to maturity. Such amortization and accretion is included as a component of interest income, net in the consolidated statement of operations. Cash equivalents and short-term investments consist of the following:

	September  30, 2018
	Amortized Cost		Unrealized Gains		Unrealized Losses		Fair Value
Cash equivalents:
Money market funds	$	56,647	$	—	$	—	$	56,647
Total cash equivalents		56,647		—		—		56,647
Short-term investments:
Commercial paper	$	46,710	$	—	$	—	$	46,710
U.S. treasury securities		21,382		—		(13)		21,369
Corporate bonds		13,778		—		(6)		13,772
Asset-backed securities		12,826		—		(11)		12,815
Total short-term investments	$	94,696	$	—	$	(30)	$	94,666

4. FAIR VALUE OF FINANCIAL INSTRUMENTS

The Company categorizes assets and liabilities recorded or disclosed at fair value on our condensed consolidated balance sheets based upon the level of judgment associated with inputs used to measure their fair value. The categories are as follows:

• Level 1—Inputs are unadjusted quoted prices in active markets for identical assets or liabilities.

• Level 2—Inputs are quoted prices for similar assets and liabilities in active markets or inputs that are observable for the assets or liabilities, either directly or indirectly.

• Level 3—Inputs are unobservable inputs based on our own assumptions used to measure assets and liabilities at fair value. The inputs require significant management judgment or estimation.

The following tables present information about the Company's financial assets and liabilities measured at fair value on a recurring basis and indicate the level of the fair value hierarchy utilized to determine such fair values:

	September 30,2018
	Level 1		Level 2		Level 3		Total
Cash equivalents:
Money market funds	$	56,647	$	—	$	—	$	56,647
Total cash equivalents	$	56,647	$	—	$	—	$	56,647
Short-term investments:
Commercial paper	$	—	$	46,710	$	—	$	46,710
U.S. treasury securities		21,369		—		—		21,369
Corporate bonds		—		13,772		—		13,772
Asset-backed securities		—		12,815		—		12,815
Total short-term investments	$	21,369	$	73,297	$	—	$	94,666

11

	December 31, 2017
	Level 1		Level 2		Level 3		Total
Assets:
Money market funds	$	21,597	$	—	$	—	$	21,597
Total cash equivalents	$	21,597	$	—	$	—	$	21,597
Liabilities:
Series D preferred stock warrant liability	$	—	$	—	$	992	$	992
Common stock warrant liability		—		—		1,774		1,774
	$	—	$	—	$	2,766	$	2,766

As of September 30, 2018 and December 31, 2017, the Company's cash equivalents, which were invested in money market funds, were valued based on Level1 inputs.

Changes in the fair values of the Company's preferred stock warrant liabilities and common stock warrant liability for the nine months ended September 30, 2018 were as follows:

	SeriesD
	PreferredStock		CommonStock
	WarrantLiability		WarrantLiability
Fair value at December31,2017		992		1,774
Change in fair value		1,378		7,460
Exercise of common stock warrant		—		(9,234)
Conversion to common stock warrant		(2,370)		—
Fair value at September30,2018	$	—	$	—

Upon the closing of the IPO, the warrants for the purchase of Series D preferred stock became warrants to purchase common stock. The Company valued the Series D preferred stock liability as of the IPO closing date using the Black-Scholes option pricing-model and recorded a change in the fair value of the preferred stock warrants through that date. The Series D preferred stock warrant liability was then reclassified to additional paid-in capital. Additionally, the warrants for the purchase of common stock were exercised to purchase 485,985 shares of common stock upon the closing of the IPO. The Company valued the common stock warrant liability as of the IPO date using the $19 per share offering price and recorded a change in the fair value of the common stock warrants through that date. The common stock warrant liability was then reclassified to common stock and additional paid-in capital.

5. PROPERTY AND EQUIPMENT, NET

	September 30,		December 31,
	2018		2017
Computer equipment	$	14,928	$	12,349
Computer software		3,693		3,048
Leasehold improvements		6,870		6,327
Furniture and fixtures		3,751		2,870
Office equipment		20		99
Internal-use software		3,880		1,979
		33,142		26,672
Less: Accumulated depreciation and amortization		(18,350)		(14,213)
	$	14,792	$	12,459

For the three months ended September 30, 2018 and 2017, depreciation and amortization expense related to property and equipment, including internal-use software, was $1,615 and $1,417, respectively. During the three months ended September 30, 2018 and 2017, the Company disposed of fully depreciated assets with an original cost of $571 and $0, respectively.

For the nine months ended September 30, 2018 and 2017, depreciation and amortization expense related to property and equipment, including internal-use software, was $4,708 and $4,031, respectively. During the nine months ended September 30, 2018 and 2017, the Company disposed of fully depreciated assets with an original cost of $571 and $0, respectively.

12

During the three month ended September 30, 2018 and 2017, the Company capitalized $910 and $237 of costs related to the development of internal-use software and recorded amortization expense of capitalized internal-use software of $115 and $117, respectively.

During the nine months ended September 30, 2018 and 2017, the Company capitalized $1,901 and $714 of costs related to the development of internal-use software and recorded amortization expense of capitalized internal-use software of $405 and $302, respectively.

6. GOODWILL AND INTANGIBLE ASSETS

Goodwill was $119,656 as of September 30, 2018 and December 31, 2017.

Identifiable intangible assets consisted of the following:

	September30,2018						December31,2017
	Gross		Accumulated		Carrying		Gross		Accumulated		Carrying
	Amount		Amortization		Value		Amount		Amortization		Value
License agreement	$	150	$	(124)	$	26	$	150	$	(113)	$	37
Developed technology		7,301		(4,440)		2,861		7,301		(3,344)		3,957
Trade name		440		(408)		32		440		(342)		98
Customer relationships		2,950		(2,950)		—		2,950		(2,950)		—
	$	10,841	$	(7,922)	$	2,919	$	10,841	$	(6,749)	$	4,092

For both three months ended September 30, 2018 and 2017, amortization expense related to intangible assets was $391.

For both nine months ended September 30, 2018 and 2017, amortization expense related to intangible assets was $1,173.

Estimated future amortization expense of the identifiable intangible assets as of September 30, 2018 is as follows:

Year Ending December 31,
2018 (remaining three months)	$	390
2019		1,130
2020		1,015
2021		384
	$	2,919

7. DEBT

As of September 30, 2018 and December 31, 2017, the Company had $0 of outstanding borrowings under its line of credit with a financial institution (the “Line of Credit”).

8. PREFERRED STOCK

Upon the closing of the IPO, all outstanding shares of redeemable convertible and convertible preferred stock automatically converted into shares of common stock and all outstanding warrants to purchase shares of redeemable convertible preferred stock became warrants to purchase shares of common stock.

Also, on the date of the IPO, the Company filed a restated certificate of incorporation, which authorized the issuance of preferred stock with rights and preferences designated from time to time by the board of directors. As of September 30, 2018, there were 25,000,000 shares of preferred stock authorized with a par value of $0.001 per share, and no shares of preferred stock issued or outstanding.

Prior to the closing of the IPO, certain employees exercised options to purchase 360,385 of Series A preferred stock in exchange for cash proceeds of $211 and the Company adjusted the carrying value of each series of redeemable convertible preferred stock by $199,492. This adjustment resulted in an increase to the net loss attributable to common stockholders for the period.

13

As of December 31, 2017, the liquidation preference of the redeemable convertible preferred stock was $272,506.

Immediately prior to the automatic conversion into common stock upon the closing of the IPO, preferred stock consisted of the following:

	Preferred	Preferred						Common Stock
	Shares	Shares Issued	Carrying		Liquidation			Issuable Upon
	Authorized	and Outstanding	Value		Preference			Conversion
Series A preferred stock	8,800,000	4,212,191	$	1,721	$		(1)	1,709,063
Series B preferred stock	24,673,917	24,665,856		10,442		22,534		12,332,924
Series C preferred stock	13,283,366	10,105,400		9,540		11,447		5,052,697
Series D preferred stock	11,876,688	11,541,688		109,646		34,500		5,770,841
Series E preferred stock	12,219,202	12,219,202		116,082		48,999		6,109,588
Series E-1 preferred stock	6,415,146	4,739,463		45,025		3,991		2,369,729
Series F preferred stock	25,632,888	25,469,585		241,961		151,035		12,734,781
	94,101,207	88,741,194	$	532,696	$	272,506		44,370,560

(1) The liquidation preference of the Series A preferred stock was calculated based on a percentage of the proceeds received by the Company in the event of a Deemed Liquidation Event. The holders of the Series A preferred stock did not have redemption rights other than in the event of a Deemed Liquidation Event.

9. PREFERRED STOCK WARRANTS AND COMMON STOCK WARRANTS

Immediately prior to the IPO, warrants outstanding consisted of the following:

Issuance Date	Underlying Security	Exercise Price	Number of Shares Issuable Upon Exercise	Warrant Contractual Term	Classification
July1, 2012	Common stock	$ 0.002	485,985(1)	(1)	Liability
August22, 2013	SeriesD preferred stock	$ 2.9891	167,500	10years	Liability
June27, 2014	SeriesD preferred stock	$ 2.9891	167,500	9.2years	Liability
July31, 2014	Common stock	$ 3.02	106,250	10years	Equity

(1)The number of shares of common stock issuable upon the exercise of the Company’s liability‑classified warrant to purchase common stock is calculated based on the number of shares of common stock equal to 12.5% of the sum of (a)the number of shares of common stock into which the outstanding shares of SeriesA preferred stock, including shares issuable upon the exercise of outstanding options to purchase shares of SeriesA preferred stock, convert upon an IPO and (b)the number of shares of common stock underlying the warrant. Such warrant is only exercisable upon the closing of an IPO of shares of the Company’s common stock. The warrant will expire, if not exercised, on the day immediately following the closing of an IPO of shares of the Company’s common stock.

Upon closing of the IPO, the common stock warrant with an issuance date of July 1, 2012, became exercisable and was net exercised at an exercise price of $0.002 per share to purchase 485,985 shares of common stock.

Upon the closing of the IPO, the warrants to purchase the Series D preferred stock became warrants to purchase common stock. Subsequent to the IPO and during the three months ended June 30, 2018, these common stock warrants were net exercised at an exercise price of $2.9891 per share to purchase 130,965 shares of common stock.

Subsequent to the IPO and during the three months ended June 30, 2018, the common stock warrant with an issuance date of July 31, 2014, was net exercised at an exercise price of $3.02 per share to purchase 95,113 shares of common stock.

As of September 30, 2018, there were no preferred stock warrants or common stock warrants outstanding.

14

10. EQUITY AWARD PLANS

Options to Purchase SeriesA Preferred Stock

Upon the closing of the IPO, all outstanding shares of Series A preferred stock options converted into common stock options at the Series A preferred stock conversion rate. The following table summarizes the Company’s Series A preferred stock option activity since December 31, 2017:

				Weighted-
		Weighted-		Average Remaining	Aggregate
	Number of	Average		Contractual Term	Intrinsic
	Shares	Exercise Price		(in years)	Value
Outstanding at December 31, 2017	4,689,576	$	0.98	5.18	$	10,539
Granted	195,312		3.60
Exercised	(360,385)		0.59
Forfeited	(351,562)		0.52
Converted to common stock options upon IPO	(4,172,941)		1.18
Outstanding at September 30, 2018	—

The assumptions that the Company used to determine the fair value of the SeriesA preferred stock options granted to employees and directors were as follows:

	Nine Months Ended September30,
	2018		2017
Risk-free interest rate	2.74	%	2.17	%
Expected term (in years)	6.25		6.25
Expected volatility	43.85	%	47.42	%
Expected dividend yield	—	%	—	%

Options to Purchase Common Stock

The following table summarizes the Company’s common stock option activity since December 31, 2017 under all common stock option plans:

				Weighted-
		Weighted-		AverageRemaining	Aggregate
	Numberof	Average		ContractualTerm	Intrinsic
	Shares	ExercisePrice		(in years)	Value
Outstanding at December31,2017	14,183,221	$	4.89	7.16	$	17,626
Granted	3,267,775		13.54
Exercised	(765,998)		4.10
Forfeited	(707,256)		6.42
Series A options converted to common stock options upon IPO	1,693,197		2.90
Series E-1 options converted to common stock options upon IPO	837,835		0.86
Outstanding at September30,2018	18,508,774	$	6.02	6.82	$	282,233
Vested and expected to vest at September30,2018	17,895,791	$	5.87	6.75	$	275,452
Options exercisable at September30,2018	11,323,339	$	3.96	5.63	$	194,951

Upon the closing of the IPO, options to purchase 837,835 shares of the Company’s Series E-1 Preferred Stock options converted to options to purchase 837,835 shares of common stock.

15

The assumptions that the Company used to determine the fair value of the common stock options granted to employees and directors were as follows:

	Nine Months Ended September30,
	2018		2017
Risk-free interest rate	2.74-2.98	%	1.96-2.17	%
Expected term (in years)	6.25		6.25
Expected volatility	43.29-43.85	%	45.85-47.42	%
Expected dividend yield	—	%	—	%

Restricted Stock Unit (“RSU”) Activity

The following table summarizes the Company’s RSU activity since December 31, 2017 under all common stock option plans:

		Weighted‑		Weighted‑
		Average		AverageRemaining	Aggregate
	Numberof	Grant Date Fair		ContractualTerm	Intrinsic
	Shares	Value Per Share		(in years)	Value
Outstanding at December31,2017	—	$	—	—	$	—
Granted	502,221		10.99
Vested	—
Forfeited	—
Outstanding at September30,2018	502,221			1.47	$	10,637
RSUs vested and expected to vest at September30,2018	452,399			1.38	$	9,582
RSUs vested and exercisable at September30,2018	—					—

Stock-Based Compensation

Stock-based compensation expense was classified in the unaudited consolidated statements of operations and comprehensive loss as follows:

	Three Months Ended September 30,				Nine Months Ended September 30,
	2018		2017		2018		2017
Cost of subscription, license and support revenue	$	156	$	113	$	429	$	272
Cost of services revenue		82		56		212		167
Sales and marketing expense		1,541		805		3,705		2,422
Research and development expense		748		656		2,206		1,926
General and administrative expense		1,067		652		2,918		1,862
	$	3,594	$	2,282	$	9,470	$	6,649

As of September 30, 2018, total unrecognized compensation cost related to the unvested common stock-based awards was $32,344, which is expected to be recognized over weighted-average periods of 2.54 years.

As of September 30, 2018, total unrecognized compensation cost related to these performance-based RSUs was $4,427 to be amortized over a weighted-average period of approximately 2.96 years.

2018 Stock Option and Incentive Plan

On April 17, 2018, the Company’s board of directors adopted, and on April 19, 2018, the Company’s stockholders approved, the 2018 Stock Option and Incentive Plan (the “2018 Plan”), which became effective on May 2, 2018, the date immediately preceding the effectiveness of the registration statement for the Company’s IPO. The 2018 Plan provides for the grant of incentive stock options, nonqualified stock options, stock appreciation rights, restricted stock units, restricted stock awards, unrestricted stock awards and dividend equivalent rights. The number of shares initially reserved for issuance under the 2018 Plan is 6,075,051, plus the shares of

16

common stock remaining available for issuance under the Company’s 2012 Stock Option and Grant Plan (the “2012 Plan”), which will be automatically increased on January 1, 2019 and each January 1 thereafter by 5% of the number of shares of the Company’s common stock outstanding on the immediately preceding December 31 or a lesser number of shares determined by the Company’s board of directors or the compensation committee of the board of directors. The shares of common stock underlying any awards that are forfeited, canceled, held back upon exercise or settlement of an award to satisfy the exercise price or tax withholding, reacquired  by the Company prior to vesting, satisfied without any issuance of stock, expire or are otherwise terminated by the Company under the 2018 Plan, the 2012 Plan and the Company’s Amended and Restated Equity Incentive Plan will be added back to the shares of common stock available for issuance under the 2018 Plan.

2018 Employee Stock Purchase Plan

On April 17, 2018, the Company’s board of directors adopted, and on April 19, 2018, the Company’s stockholders approved, the 2018 Employee Stock Purchase Plan (the “ESPP”), which became effective on May 2, 2018, the date immediately preceding the effectiveness of the registration statement for the Company’s IPO. A total of 1,735,729 shares of common stock were reserved for issuance under this plan. In addition, the number of shares of common stock that may be issued under the ESPP will be cumulatively increased on January 1, 2019 and each January 1 thereafter through January 1, 2028, by the lesser of (i) 1% of the number of shares of the Company’s common stock outstanding on the immediately preceding December 31, (ii) 1,735,729 shares of common stock or (iii) such lesser number of shares as determined by the compensation committee of the board of directors.

11. COMMITMENTS AND CONTINGENCIES

Operating Leases

The Company leases office facilities under various non‑cancelable operating leases that expire at various dates through June2027. Rent expense for non‑cancelable operating leases with free rental periods or scheduled rent increases is recognized using the straight‑line method over the term of the lease. Improvement reimbursements from landlords are amortized on a straight‑line basis into rent expense over the terms of the leases. The difference between required lease payments and straight‑lined rent expense is recorded as deferred rent. Rent expense related to the Company's leased office space was $3,353 and $2,615 for thenine months ended September 30, 2018 and 2017, respectively.

The following table summarizes the future minimum lease payments due under operating leases as of September 30, 2018:

Year Ending December31,
2018 (remaining three months)	$	1,275
2019		5,263
2020		5,107
2021		4,945
2022		2,164
Thereafter		1,843
	$	20,597

Hosting Services Agreement

In September2017, the Company entered a non‑cancelable contractual agreement related to the hosting of its data processing, storage and other computing services. The agreement, as amended, expires in November2020. The following table summarizes the future minimum payments committed under the hosting agreement as of September 30, 2018:

Year Ending December31,
2018 (remaining three months)	$	5,611
2019		15,333
2020		10,667
	$	31,611

17

Indemnifications

Under the indemnification provisions of the Company's standard sales‑related contracts, the Company agreed to defend end‑customers against third‑party claims asserting infringement of certain intellectual property rights, which may include patents, copyrights, trademarks, or trade secrets, and to pay judgments entered on such claims. The Company's exposure under these indemnification provisions is generally limited to the total amount paid by the end‑customer under the agreement. However, certain agreements include indemnification provisions that could potentially expose the Company to losses in excess of the amount received under the agreement. In addition, the Company indemnifies its officers, directors and certain key employees while they are serving in good faith in their capacities. Through September 30, 2018, there have been no claims under any indemnification provisions.

Litigation

On March21, 2018, Finjan,Inc. (“Finjan”) filed a complaint in the U.S. District Court for the Northern District of California alleging that the Company's products and services infringe at least four U.S. patents purportedly owned by Finjan, seeking, among other things, a judgment holding that the Company has infringed four asserted patents, a preliminary and permanent injunction preventing alleged continued infringement of one of the asserted patents, past damages not less than a reasonable royalty, enhanced damages for alleged willful infringement, costs and reasonable attorneys' fees, and pre‑ and post‑judgment interest. While the Company does not believe the complaint has merit, on April6, 2018, the Company entered into a settlement agreement with Finjan, resolving all claims made pursuant to the complaint. In connection with the settlement agreement, the Company accrued a liability of $3,900 as of March 31, 2018, which is reflected in general and administrative expenses on the Company’s unaudited consolidated statements of operations and comprehensive loss and accrued expenses on the Company’s unaudited consolidated balance sheet, reflecting the aggregate amount of payments to be made to Finjan pursuant to the settlement, all of which will be paid in 2018. In April 2018, the complaint was dismissed and the Company made the first payment of $1,300. The second payment of $1,300 was made in September 2018.

From time to time the Company may become involved in legal proceedings or be subject to claims arising in the ordinary course of business. Although the results of litigation and claims cannot be predicted with certainty, the Company currently believes that the final outcome of these ordinary course matters will not have a material adverse effect on its business, operating results, financial condition or cash flows. Regardless of the outcome, litigation can have an adverse impact because of defense and settlement costs, diversion of management resources and other factors.

12. INCOME TAXES

During the nine months ended September 30, 2018 and 2017, the Company recorded an income tax provision of $241 and $108, respectively, primarily due to foreign income taxes.

In connection with the Tax Cuts and Jobs Act (the “Act”) enacted in December 2017, the Company made provisional estimates of the effects of the Act on its existing deferred tax balances and the one-time transition tax for the year end December 31, 2017. The Act did not have significant impact on the Company’s consolidated financial statements for the year ended December 31, 2017 as a result of the valuation allowance maintained against the Company’s U.S. deferred tax assets. However, the Company’s provisional estimate associated with the reduction in the U.S. federal corporate tax rate from 35% to 21% impacted the change in valuation allowance and tax rate change components of the Company’s effective tax rate reconciliation as well as its ending deferred tax assets, deferred tax liabilities and valuation allowance. The Company has an accumulated deficit from its foreign operations and does not have a transition tax associated with deferred foreign earnings related to the Act. The income tax provision for the nine months ended September 30, 2018 did not reflect any adjustment to the provisional amounts previously recorded. The ultimate impact of the Act may differ from these provisional amounts due to, among other things, additional analysis, changes in interpretations and assumptions the Company has made and additional regulatory guidance that may be issued. The Company’s accounting treatment is expected to be complete in the fourth quarter of 2018.

13. REVENUE

The Company generates revenue through relationships with channel partners and through its direct sales force primarily from three sources: (i) the sale of subscription (i.e., term-based) and perpetual licenses for the Company’s Cb Protection and Cb Response software products along with access to and the right to utilize the threat intelligence capabilities of the Cb Predictive Security Cloud, as well as maintenance services and customer support (collectively, “support”), (ii) cloud-based software-as-a-service (“SaaS”) subscriptions for

18

access to the Company’s Cb Response and Cb Defense software products, and (iii) professional services and training (collectively, “services”).

In accordance with ASC 606, revenue is recognized when a customer obtains control of promised products or services. The amount of revenue recognized reflects the consideration that the Company expects to be entitled to receive in exchange for these products or services. The Company applies the following five steps to recognize revenue:

1)Identification of the contract, or contracts, with a customer

The Company considers the terms and conditions of its contracts and its customary business practices to identify contracts under ASC 606. The Company considers that it has a contract with a customer when the contract is approved, the Company can identify each party’s rights regarding the products or services to be transferred, the Company can identify the payment terms for the products or services to be transferred, the Company has determined that the customer has the ability and intent to pay, and the contract has commercial substance. The Company applies judgment in determining the customer’s ability and intention to pay, which is based on a variety of factors, including the customer’s historical payment experience or, in the case of a new customer, credit and financial information pertaining to the customer.

2)Identification of the performance obligation(s) in the contract

Performance obligations promised in a contract are identified based on the products or services that will be transferred to the customer that are capable of being distinct, whereby the customer can benefit from the product or services either on their own or together with other resources that are readily available from third parties or from the Company, and are distinct in the context of the contract, whereby the transfer of the products or services is separately identifiable from other promises in the contract. To the extent a contract includes multiple promised products or services, the Company applies judgment to determine whether promised products or services are capable of being distinct, and are distinct in the context of the contract. If these criteria are not met, the promised products or services are accounted for as a combined performance obligation.

3)Determination of the transaction price

The transaction price is determined based on the consideration that the Company will be entitled to in exchange for transferring products or services to the customer. Variable consideration is included in the transaction price, if, in the Company’s judgment, it is probable that no significant future reversal of cumulative revenue under the contract will occur.

In instances where the timing of revenue recognition differs from the timing of invoicing, the Company has determined that its contracts generally do not include a significant financing component. The primary purpose of the Company’s invoicing terms is to provide customers with simplified and predictable ways of purchasing its products and services, not to receive financing from its customers or to provide customers with financing. An example is invoicing at the beginning of a subscription term with revenue recognized ratably over the contract period.

4)Allocation of the transaction price to performance obligations in the contract

If the contract contains a single performance obligation, the entire transaction price is allocated to the single performance obligation. Contracts that contain multiple performance obligations require an allocation of the transaction price to each performance obligation based on relative standalone selling price (“SSP”) basis. The Company determines SSP based on the price at which the performance obligation is sold separately. If the SSP is not observable through past transactions, the Company estimates the SSP taking into account available information such as market conditions and internally approved pricing guidelines related to the performance obligation.

5)Recognition of revenue when, or as, a performance obligation is satisfied

Revenue is recognized at the time the related performance obligation is satisfied by transferring the promised product or service to a customer. The Company recognizes revenue when it transfers control of the products or services to the customer for an amount that reflects the consideration that the Company expects to receive in exchange for those products or services. 

19

Subscription, License and Support Revenue

Substantially all of the Company’s software arrangements contain multiple performance obligations that include a combination of software licenses, cloud-based subscriptions, support, professional services and training.

The Company’s Cb Protection and Cb Response products are offered through subscription or perpetual software licenses, with a substantial majority of its customers selecting a subscription license. Subscription licenses include access to and the right to utilize the threat intelligence capabilities of the Cb Predictive Security Cloud as well as ongoing support, which provides customers with telephone and web-based support, bug fixes and repairs and software updates on a when-and-if-available basis. The Cb Predictive Security Cloud automatically distributes real-time threat intelligence, such as detection algorithms, reputation scores and attack classifications, to the Company’s customers. Substantially all customers who purchase licenses on a perpetual basis also purchase an agreement for support and an agreement for access to and the right to utilize the threat intelligence capabilities of the Cb Predictive Security Cloud. For subscription or perpetual license sales of Cb Protection and Cb Response, the Company considers the software license and access to the threat intelligence capabilities of the Cb Predictive Security Cloud to be a single performance obligation.

Subscription (i.e. term-based) revenue is recognized on a ratable basis over the contract term beginning on the date the software is delivered to the customer. Revenue for cloud-based subscriptions is recognized on a ratable basis over the term of the subscription beginning on the date the customer is given access to the platform. Maintenance services and customer support revenue related to subscription licenses is recognized ratably over the term of the maintenance and support arrangement as this performance obligation is satisfied. Revenue from the infrequent sales of perpetual software licenses is recognized ratably over the customer’s estimated economic life, which the Company has estimated to be five years, beginning on the date the software is delivered to the customer. Maintenance services and customer support revenue related to perpetual licenses is recognized ratably over the term of the maintenance and support arrangement as this performance obligation is satisfied.

Services Revenue

The Company provides professional services to customers, primarily in the form of deployment, and training services. Services are typically sold together with licenses of the Company’s software products and, to a lesser extent, on a stand-alone basis. Services are priced separately and are considered distinct from the Company’s software license. The professional services can be performed by a third party and have a history of consistent pricing by the Company. Professional services are sold as time-and-materials contracts based on the number of hours worked and at contractually agreed-upon hourly rates, and also on a fixed-fee basis. Revenue from professional services and training sold on a stand-alone basis or in a combined arrangement is recognized as those services are rendered as control of the services passes to the customer over time.

The Company’s employees may incur out-of-pocket expenses when providing services to customers that are reimbursable from the customer under the terms of the service contract. The Company bills any out-of-pocket expenses incurred in the performance of these services to the customer. The expenses are classified on a gross basis as revenue and costs of revenue in the unaudited consolidated statements of operations and comprehensive loss. The Company’s determination of a gross presentation is based on an assessment of the relevant facts and circumstances, including the fact that the Company’s customers, rather than the Company, benefit from the expenditures and the Company bears the credit risk of the reimbursement until it receives reimbursement from the customer.

Variable Consideration

Revenue is recorded at the net sales price, which is the transaction price. The Company does not offer refunds, rebates or credits to customers in the normal course of business. The impact of variable consideration has not been material.

Contract Costs

The Company capitalizes commission costs that are incremental and directly related to the acquisition of customer agreements. Commissions are earned by the Company’s sales force and paid in full upon the receipt of customer orders for new arrangements or renewals. Commission costs are capitalized when earned and are amortized as expense over an estimated customer relationship period of 5 years. The Company determined the estimated customer relationship period by taking into consideration the contractual term and expected renewals of customer contracts, its technology and other factors, including the fact that commissions paid on renewals are not commensurate with commissions paid on new sales.

20

Commissions paid relating to contract renewals are deferred and amortized over the related renewal period. Costs to obtain a contract for service arrangements are expensed as incurred in accordance with the practical expedient as the contractual period for services is one year or less.

As of September 30, 2018 and December 31, 2017, the Company recorded $34,972 and $29,955, respectively, of deferred commission costs in the consolidated balance sheet. As of September 30, 2017 and December 31, 2016, the Company recorded $25,815 and $21,693 of deferred commission costs in the consolidated balance sheet. Commission costs capitalized as deferred commissions during the nine months ended September 30, 2018 and 2017 totaled $14,253 and $11,230, respectively. Amortization of deferred commissions during the nine months ended September 30, 2018 and 2017 totaled $9,236 and $7,108, respectively, and is included in sales and marketing expense in the unaudited consolidated statements of operations and comprehensive loss. The Company periodically reviews these deferred costs to determine whether events or changes in circumstances have occurred that could impact the period of benefit of these deferred sales commissions.

The Company does not incur any material costs to fulfill customer contracts.

Deferred Revenue

Contract liabilities consist of deferred revenue and include payments received in advance of performance under the contract. Such amounts are recognized as revenue over the contractual period. During the nine months ended September 30, 2018, the Company recognized revenue of $110,482 which was included in the deferred revenue balance as of December 31, 2017.

The Company receives payments from customers based upon contractual billing schedules; accounts receivable are recorded when the right to consideration becomes unconditional. The Company generally bills its customers in advance, and payment terms on invoiced amounts are typically 30 to 90 days. Contract costs include amounts related to our contractual right to consideration for completed and partially completed performance obligations that may not have been invoiced; such amounts have been insignificant to date.

Major products and services

	Three Months Ended September 30,				Nine Months Ended September 30,
	2018		2017		2018		2017
Subscription and support revenue	$	33,113	$	29,567	$	97,855	$	85,567
Cloud-based subscription revenue		16,142		7,147		41,502		16,669
Perpetual license revenue		1,569		1,667		4,749		4,899
Services revenue		2,591		3,128		8,735		9,010
Total revenue	$	53,415	$	41,509	$	152,841	$	116,145

Geographic revenue

	Three Months Ended September 30,				Nine Months Ended September 30,
	2018		2017		2018		2017
United States	$	44,206	$	35,439	$	126,926	$	100,605
All other		9,209		6,070		25,915		15,540
Total revenue	$	53,415	$	41,509	$	152,841	$	116,145

Transaction price allocated to remaining performance obligations

Transaction price allocated to remaining performance obligations represents contracted revenue that has not yet been recognized, which includes deferred revenue and backlog. The Company defines backlog as contractually committed orders for subscriptions and support services for which the associated revenue has not been recognized and the customer has not been invoiced. As of September 30, 2018, the aggregate amount of the transaction price allocated to remaining performance obligations was $176,831 in deferred revenue and $38,660 in backlog.

21

The Company expects to recognize these remaining performance obligations as follows (in percentages):

							More than
	Total		Less than 1 year		1-2 Years		2 years
Deferred revenue	100	%	78	%	15	%	7	%
Backlog	100	%	42	%	40	%	18	%

Concentration Risk

As of September 30, 2018, two channel partners accounted for 26.2% and 12.3% of outstanding accounts receivable, respectively. As of December 31, 2017, two channel partners accounted for 20.2% and 16.2% of outstanding accounts receivable, respectively. For the three and nine months ended September 30, 2018, two channel partners represented 19.9% and 20.1% and 21.2% and 18.5%, respectively, of total revenue. During the three and nine months ended September 30, 2017, one channel partner represented 26.0% and 26.6% of total revenue, respectively.

14. NET LOSS PER SHARE

Net Loss per Share

Basic and diluted net loss per share attributable to common stockholders was calculated as follows:

	Three Months Ended September 30,				Nine Months Ended September 30,
	2018		2017		2018		2017
Numerator:
Net loss	$	(17,632)	$	(13,599)	$	(63,507)	$	(38,373)
Accretion of preferred stock to redemption value		—		(7,427)		(199,492)		(15,751)
Net loss attributable to common stockholders	$	(17,632)	$	(21,026)	$	(262,999)	$	(54,124)
Denominator:
Weighted-average number of common shares outstanding—basic and diluted		67,837,240		10,587,153		41,494,203		10,263,962
Net loss per share attributable to common stockholders—basic and diluted	$	(0.26)	$	(1.99)	$	(6.34)	$	(5.27)

The Company’s potentially dilutive securities, which include stock options, redeemable convertible and convertible preferred stock, and warrants to purchase common stock and preferred stock, have been excluded from the computation of diluted net loss per share as the effect would be to reduce the net loss per share. Therefore, the weighted‑average number of common shares outstanding used to calculate both basic and diluted net loss per share attributable to common stockholders is the same. The Company excluded the following potential common shares, presented based on amounts outstanding at each period end, from the computation of diluted net loss per share attributable to common stockholders for the periods indicated because including them would have had an anti‑dilutive effect:

	As of September30,
	2018	2017
Options to purchase common stock	18,508,774	14,541,159
Unvested restricted stock units	502,221	—
Options to purchase SeriesE-1 preferred stock (as converted to common stock)	—	837,835
Warrants to purchase common stock	—	106,250
Warrants to purchase redeemable convertible preferred stock (as converted to common stock)	—	167,500
Redeemable convertible preferred stock (as converted to common stock)	—	44,370,560
	19,010,995	60,023,304

The table above excludes shares of common stock issuable upon the conversion of Series A preferred stock and upon the exercise of options to purchase shares of Series A preferred stock as such shares are only convertible into common stock upon the closing of an IPO.

22

The table also excludes shares of common stock issuable upon the exercise of the Company’s liability-classified common stock warrant as the warrant is only exercisable upon the closing of an IPO.

ITEM 2. MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS OF OPERATIONS

FORWARD-LOOKING STATEMENTS

The following discussion and analysis of our financial condition and results of operations should be read in conjunction with our unaudited consolidated financial statements and related notes appearing elsewhere in this Quarterly Report on Form 10-Q and our consolidated financial statements and related notes included in our final prospectus for our IPO dated as of May 4, 2018 and filed with the Securities and Exchange Commission, or SEC pursuant to Rule 424(b)(4) under the Securities Act of 1933, as amended. In addition to historical consolidated financial information, the following discussion and analysis and information set forth elsewhere in this Quarterly Report on Form 10-Q contains “forward-looking statements” within the meaning of the Private Securities Litigation Reform Act of 1995 that involve substantial risks and uncertainties. All statements, other than statements of historical facts, included in this Quarterly Report on Form 10-Q regarding our strategy, future operations, future financial position, future revenue, projected costs, prospects, plans, objectives of management and expected market growth are forward-looking statements. The words “anticipate,” “believe,” “could,” “estimate,” “expect,” “intend,” “may,” “might,” “plan,” “predict,” “project,” “will,” “would,” or the negative of these words or other similar terms or expressions are intended to identify forward-looking statements although not all forward-looking statements contain these identifying words.

These forward-looking statements are not statements of historical facts and represent only our current expectations regarding such matters. These statements inherently involve a wide range of known and unknown uncertainties. Our actual actions and results could differ materially from what is expressed or implied by these statements. Specific factors that could cause such a difference include, but are not limited to, those set forth under Item 1A. “Risk Factors” and other important factors disclosed previously in our other filings with the SEC. Given these factors, as well as other variables that may affect our operating results, you should not rely on forward-looking statements, assume that past financial performance will be a reliable indicator of future performance, or use historical trends to anticipate results or trends in future periods. The forward-looking statements made in this Quarterly Report on Form 10-Q relate only to events as of the date on which they are made and we expressly disclaim any obligation or intention to provide updates to the forward-looking statements and the estimates and assumptions associated with them, except as required by law.

BUSINESS OVERVIEW

Carbon Black is a leading provider of next-generation endpoint security solutions. Our Cb Predictive Security Cloud platform continuously captures, records and analyzes rich, unfiltered endpoint data. We believe the depth, breadth and real-time nature of our endpoint data, combined with the strength of our analytics platform, provides customers with the most robust and data-intensive solution to address the complete endpoint security lifecycle. Our solutions enable customers to predict, prevent, detect, respond to and remediate cyber attacks before they cause a damaging incident or data breach.

We have a strong heritage of innovative technology leadership in multiple endpoint security categories: application control, through our Cb Protection solution; endpoint detection and response, or EDR, through our Cb Response solution; and next-generation antivirus, or NGAV, through our Cb Defense solution.

We began selling our initial product in 2005, which was the precursor to Cb Protection. Our initial product focused on delivering endpoint protection for desktops and servers through application control. In February2014, we acquired Carbon Black, whose solution was the precursor to Cb Response. In2015, we acquired Objective LogisticsInc., or Objective Logistics, and VisiTrend,Inc., or VisiTrend, primarily to acquire the technical expertise of their employees and certain intellectual property assets. The acquisition of Carbon Black strengthened our position as a leader in advanced threat detection and incident response management solutions, and was an important event for us as it enabled us to provide our customers with solutions designed to address the full endpoint security lifecycle. We believe that our ability to address the full lifecycle of an attack is a critical differentiator versus other endpoint security technologies that address only a portion of the attack lifecycle.

In more recent periods, we have focused on satisfying the increasing demand for cloud-based software from our customers and prospects and intend to continue to expand our cloud-based product offerings. In August2015, we released a cloud-based version of Cb Response to our customers under a software-as-a-service, or SaaS, model. In June2016, we acquired Confer Technologies,Inc., or

23

Confer, whose solution is currently sold to customers as Cb Defense. The acquisition of Confer was an important event for us as it added key capabilities in the areas of cloud-based, multi-tenant, big-data processing and streaming detection and prevention. With this acquisition, we also entered the next-generation antivirus market. The technology that we acquired is foundational to our strategy, and our Cb Predictive Security Cloud platform, which we announced in October 2017.

We are consolidating our products and services on the Cb Predictive Security Cloud platform. This enables us to develop and deliver multiple product offerings that leverage the unfiltered endpoint data that we collect, in order to address different use cases, all through a single endpoint agent, single console, and single platform. We have released four product offerings on the Cb Predictive Security Cloud platform: Cb Defense (a next-generation antivirus and endpoint detection response solution); Cb ThreatSight (a managed alert triage service); Cb Defense for VMware (a solution for virtualized datacenter security); and Cb LiveOps (a real-time endpoint query and remediation solution). We believe the availability of multiple offerings through a single, multi-tenant, cloud-based platform creates cross-sell and upsell opportunities to drive significant business growth.

We primarily sell our products through a channel partner go-to-market model, which significantly extends our global market reach and ability to rapidly scale our sales efforts. Our inside sales and field sales representatives work alongside an extensive network of value-added resellers, or VARs, distributors, managed security service providers, or MSSPs, and incident response, or IR, firms. Our MSSP and IR firm channel partners both use and recommend our products to their clients. We have established significant relationships with leading channel partners, including Optiv Security,Inc., a leading VAR and MSSP; CDW Corporation, one of the world’s largest software VARs; Arrow Electronics,Inc., a major global distributor; SecureWorks,Inc., a leading MSSP; and Kroll, a leading IR firm. In addition, we have technology and go-to-market partnerships with both IBM and VMware, enabling us to leverage their sales organizations to reach their large customer bases. In the nine months ended September 30, 2018, 79% of our new and add-on business was closed in collaboration with a channel partner. We expect to continue to focus on generating sales to new and existing customers through our channel partners as a part of our growth strategy. When we transact with a channel partner, our contractual arrangement is with the channel partner and not with the end-use customer. However, whether we receive the order from a channel partner or directly from an end-use customer, our revenue recognition policy and resulting pattern of revenue recognition for the order are the same.

Our sales team works closely with our end-use customer prospects at every stage of the sales cycle regardless of whether the prospect is sourced directly or indirectly—from initial information meetings through the implementation of our products with our end-use customers. We believe this coordinated approach to sales allows us to leverage the benefits of channel partners as well as maintain face-to-face connectivity and build long-term, trusted relationships with our customers.

Our customers include many of the world’s largest, security-focused enterprises and government agencies that are among the most heavily targeted by cyber adversaries, as well as mid-sized organizations. As of September 30, 2018, we serve over 4,600 customers globally across multiple industries, including approximately one-thirdof the Fortune 100.

In May2018, we closed our initial public offering, or IPO, of 9,200,000 shares of common stock inclusive of the underwriters’ option to purchase additional shares that was exercised in full. The price per share to the public was $19.00 per share. We received aggregate proceeds of $162.6 million from the IPO, net of underwriters’ discounts and commissions, and before deducting offering costs of $4.9 million.

Effective January1, 2018, we adopted the requirements of Accounting Standards Update (“ASU”) No.2014-09, Revenue from Contracts with Customers (Topic 606) (“ASC 606”) on a full retrospective basis as discussed in detail in Note 2 to our unaudited consolidated financial statements. All amounts and disclosures set forth in this Quarterly Report on Form10-Q have been updated to comply with ASC 606.

Highlights from the three months ended September 30, 2018 compared with the same period in 2017 included:

· Annual recurring revenue, or ARR, was $206.7million and $157.4million, respectively, representing a 31% annual growth rate. We define ARR as the annualized value of all active subscription contracts as of the end of the period. ARR excludes revenue from perpetual licenses and services.

· Revenue increased to $53.4million from $41.5million, a 29% annual growth rate.

24

· Recurring revenue increased to $49.3 million from $36.7 million, a 34% annual growth rate. Recurring revenue represented 92% and 88% of our total revenue, respectively.

· The revenue from cloud based solutions went to $16.1 million from $7.1 million, a 126% annual growth rate. The percentage of our total recurring revenue generated by sales of our cloud-based solutions was 33% and 19%, respectively.

· Our customer count, which includes both direct sale customers and customers with one or more subscriptions to our platform through channel partners, grew to 4,625 from 3,335, representing a year-over-year increase of 39%.

· Number of customers who purchased our cloud-based solutions increased to 2,450 from 1,170.

KEY FACTORS AFFECTING OUR PERFORMANCE

Our historical financial performance has been, and we expect our financial performance in the future to be, primarily driven by the following factors:

Market Adoption.  We believe our future success will depend in large part on the growth in the market for next-generation endpoint security. Because network-centric security is no longer adequate, organizations must focus on securing the endpoint. However, while organizations have made significant investments in upgrading to advanced network security solutions, the majority of endpoint security technology in use today relies on multiple agents and uses the same ineffective, traditional signature-based antivirus software originally designed more than 20years ago. As a result, organizations are increasingly shifting their security budgets toward next-generation endpoint security solutions. We believe that we are well positioned as a market leader to capitalize on this investment cycle and that our ability to address the full lifecycle of a cyber attack will help to drive our market adoption. Additionally, the number of security professionals has not kept pace with total demand. As the number of threats multiplies, legacy solutions either miss threats or produce more alerts than security teams are able to process and investigate. Organizations are increasingly turning to next-generation solutions, advanced analytics and automation tools to empower their security professionals to increase their efficiency and focus on the highest value cyber security tasks, thereby reducing the need for additional security headcount. Organizations are also addressing the talent gap by relying more on security-focused VARs and trusted partners to augment their internal teams of security experts.

Add New Customers.  Our ability to add new customers is a key indicator of our increasing market adoption and future revenue potential. We are focused on continuing to grow our customer base. We have continuously enhanced our endpoint security platform and product offerings, and we have expanded both our domestic and international sales force to drive new customer acquisition. However, our ability to continue to grow our customer base is dependent on a number of factors, including our ability to compete within the increasingly competitive markets in which we participate.

Retain our Existing Customers.  A substantial majority of our customers purchase our solutions under a subscription agreement with a term of one or three years. An important component of our revenue growth strategy is to have our existing customers renew their

25

agreements with us. Our ability to retain these customers upon the renewal of their subscription agreement will depend on a number of factors, including customers’ satisfaction or dissatisfaction with our solutions, our ability to enhance our platform and product offerings, competing technologies and trends in corporate spending.

Increase Sales to Existing Customers.  Our current customer base provides us with a significant opportunity to drive incremental sales. Our extensible platform allows us to develop new solutions rapidly and at lower cost over time. As we develop and deploy additional security offerings on the Cb Predictive Security Cloud platform, we see significant additional opportunity to cross-sell as customers benefit by addressing multiple security requirements through a single platform. Our ability to increase sales to existing customers will depend on a number of factors, including customers’ satisfaction or dissatisfaction with our solutions, our ability to develop new products, pricing, economic conditions or overall reductions in our customers’ spending levels.

Invest in Growth.  We will continue to focus on long-term revenue growth. We believe that our market opportunity is large and we will continue to invest significantly in sales and marketing to grow our customer base, both domestically and internationally. We also expect to continue to invest in research and development to enhance our technology platform and product functionality. In addition to our ongoing investment in research and development, we may also pursue acquisitions of businesses, technologies and assets that complement and expand the functionality of our products and services, expand the functionality of our solutions, add to our technology or security expertise, or bolster our leadership position by gaining access to new customers or markets.

KEY METRICS

We regularly monitor a number of financial and operating metrics, including the following key metrics, in order to measure our current performance and estimate our future performance, as follows:

	Three Months Ended September 30,						Nine Months Ended September 30,
(In thousands, except percentages)	2018			2017			2018			2017
Billings	$	60,975		$	55,324		$	160,972		$	139,858
Year-over-year growth		10	%		50	%		15	%		49	%
Short-term billings	$	62,003		$	49,511		$	161,191		$	127,754
Year-over-year growth		25	%		38	%		26	%		39	%
Total revenue	$	53,415		$	41,509		$	152,841		$	116,145
Year-over-year growth		29	%		38	%		32	%		45	%
Recurring revenue	$	49,255		$	36,714		$	139,357		$	102,236
Year-over-year growth		34	%		44	%		36	%		53	%
Recurring revenue as a percentage of total revenue		92	%		88	%		91	%		88	%

Billings.  We define billings, a non-GAAP financial measure, as total revenue plus the change in deferred revenue during the period, excluding acquired deferred revenue. Our deferred revenue consists of amounts that have been invoiced to customers but that have not yet been recognized as revenue. Our deferred revenue balance primarily consists of the portion of products and support revenue that will be recognized ratably over the term of the subscription as the performance obligation is satisfied.

Most of our revenue is derived from subscriptions to our products with a duration of one or three years. For our subscription arrangements, we typically bill our customers the fee on an annual basis for the upcoming year. For 2017, we changed our policy to require customers with multi-year contract commitments to agree to multi-year upfront billing for the total contract fee. Beginning in 2018, we have reverted to our former policy and will offer customers who make a multi-year contract commitment the option to be billed the total contract fee upfront or to be billed on an annual basis. We expect that many customers who make a multi-year contract commitment will select to be billed on an annual basis, which could result in a lower growth rate for our billings in 2018 compared to 2017.

Some of our revenue is derived from perpetual licenses of our products sold with a maintenance and support agreement. For our perpetual licenses, we bill our customers the entire license fee upon delivery of the software, and for support, we typically bill our customers the support fee on an annual basis for the upcoming year.

26

For services sold on a fixed-price basis, we bill customers in advance. For services sold on a time-and-materials basis, we bill customers as such services are performed.

We use billings as one factor to evaluate our business because billings is an indicator of current period sales activity and provides visibility into corresponding future revenue growth due to our subscription-based revenue model. Accordingly, we believe that billings provides useful information to investors and others in understanding and evaluating our operating results in the same manner as our management. However, it is important to note that billings, in any period, may be impacted by the timing of customer renewals, including early renewals, and customers’ preferences for multi-year upfront or annual billing terms, which could favorably or unfavorably impact year-over-year comparisons. While we believe that billings is useful in evaluating our business, billings is a non-GAAP financial measure that has limitations as an analytical tool, and billings should not be considered as an alternative to, or substitute for, total revenue recognized in accordance with GAAP. In addition, other companies, including companies in our industry, may calculate billings differently or not at all, which reduces the usefulness of billings as a tool for comparison. We recommend that you review the reconciliation of billings to total revenue, the most directly comparable GAAP financial measure, provided below, and that you not rely on billings or any single financial measure to evaluate our business.

	Three Months Ended September 30,				Nine Months Ended September 30,
(In thousands)	2018		2017		2018		2017
Total revenue	$	53,415	$	41,509	$	152,841	$	116,145
Deferred revenue, end of period		176,831		140,396		176,831		140,396
Deferred revenue, beginning of period		(169,271)		(126,581)		(168,700)		(116,683)
Billings	$	60,975	$	55,324	$	160,972	$	139,858

Short-term billings.  We define short-term billings, a non-GAAP financial measure, as total revenue plus the change in current deferred revenue during the period, excluding acquired deferred revenue. We believe that short-term billings provides useful information to investors and others in evaluating our operating performance because it excludes the impact of upfront multi-year billings, which can vary from period to period depending on the timing of large, multi-year customer contracts and customer preferences for annual billing versus multi-year upfront billing. However, it is important to note that short-term billings, in any period, may be impacted by the timing of customer renewals, including early renewals, which could favorably or unfavorably impact year-over-year comparisons. While we believe that short-term billings is useful in evaluating our business, short-term billings is a non-GAAP financial measure that has limitations as an analytical tool, and short-term billings should not be considered as an alternative to, or substitute for, total revenue recognized in accordance with GAAP. In addition, other companies, including companies in our industry, may calculate short-term billings differently or not at all, which reduces the usefulness of short-term billings as a tool for comparison. We recommend that you review the reconciliation of short-term billings to total revenue, the most directly comparable GAAP financial measure, provided below, and that you not rely on short-term billings or any single financial measure to evaluate our business.

	Three Months Ended September 30,				Nine Months Ended September 30,
(In thousands)	2018		2017		2018		2017
Total revenue	$	53,415	$	41,509	$	152,841	$	116,145
Deferred revenue, current, end of period		138,515		108,864		138,515		108,864
Deferred revenue, current, beginning of period		(129,927)		(100,862)		(130,165)		(97,255)
Short-term billings	$	62,003	$	49,511	$	161,191	$	127,754

Recurring revenue.  We define recurring revenue, a non-GAAP financial measure, as subscription, license and support revenue (which includes revenue relating to support for perpetual licenses) less perpetual license revenue for the period. We use recurring revenue as one factor to evaluate our business because we believe that recurring revenue provides visibility into the revenue expected to be recognized in the current and future periods. Accordingly, we believe that recurring revenue provides useful information to investors and others in understanding and evaluating our operating results in the same manner as our management. While we believe that recurring revenue is useful in evaluating our business, recurring revenue is a non-GAAP financial measure that has limitations as an analytical tool, and recurring revenue should not be considered as an alternative to, or substitute for, subscription, license and support revenue recognized in accordance with GAAP. In addition, other companies, including companies in our industry, may calculate recurring revenue differently or not at all, which reduces the usefulness of recurring revenue as a tool for comparison. We recommend that you

27

review the reconciliation of recurring revenue to subscription, license and support revenue, the most directly comparable GAAP financial measure, provided below, and that you not rely on recurring revenue or any single financial measure to evaluate our business.

	Three Months Ended September 30,						Nine Months Ended September 30,
(In thousands, except percentages)	2018			2017			2018			2017
Subscription, license and support revenue	$	50,824		$	38,381		$	144,106		$	107,135
Perpetual license revenue		(1,569)			(1,667)			(4,749)			(4,899)
Recurring revenue	$	49,255		$	36,714		$	139,357		$	102,236
Recurring revenue as a percentage of total revenue		92	%		88	%		91	%		88	%

Free cash flow and free cash flow margin.  We define free cash flow, a non-GAAP financial measure, as net cash used in operating activities less purchases of property and equipment and capitalized internal-use software. We define free cash flow margin as free cash flow divided by total revenue. We monitor free cash flow as one measure of our overall business performance, which enables us to analyze our future performance without the effects of non-cash items and allow us to better understand the cash needs of our business. While we believe that free cash flow is useful in evaluating our business, free cash flow is a non-GAAP financial measure that has limitations as an analytical tool, and free cash flow should not be considered as an alternative to, or substitute for, net cash used in operating activities in accordance with GAAP. The utility of free cash flow as a measure of our liquidity is further limited as it does not represent the total increase or decrease in our cash balance for any given period. In addition, other companies, including companies in our industry, may calculate free cash flow differently or not at all, which reduces the usefulness of free cash flow as a tool for comparison. A summary of our cash flows from operating, investing and financing activities is provided below. We recommend that you review the reconciliation of free cash flow to net cash used in operating activities, the most directly comparable GAAP financial measure, and the reconciliation of free cash flow margin to net cash used in operating activities (as a percentage of revenue), the most directly comparable GAAP financial measure, provided below, and that you not rely on free cash flow, free cash flow margin or any single financial measure to evaluate our business.

	Nine Months Ended September30,
(In thousands)	2018		2017
Net cash used in operating activities	$	(28,056)	$	(12,396)
Net cash used in investing activities		(101,836)		(4,942)
Net cash provided by (used in) financing activities		162,918		(3,235)
Net increase (decrease) in cash and cash equivalents	$	33,026	$	(20,573)

	Nine Months Ended September30,
(In thousands)	2018		2017
Net cash used in operating activities	$	(28,056)	$	(12,396)
Purchases of property and equipment		(5,354)		(4,228)
Capitalization of internal-use software costs		(1,901)		(714)
Free cash flow	$	(35,311)	$	(17,338)

	Nine Months Ended September 30,
	2018		2017
Net cash used in operating activities (as a percentage of revenue)	(18.4)	%	(10.7)	%
Purchases of property and equipment (as a percentage of revenue)	(3.5)	%	(3.6)	%
Capitalization of internal-use software costs (as a percentage of revenue)	(1.2)	%	(0.6)	%
Free cash flow margin	(23.1)	%	(14.9)	%

As discussed above, beginning in 2018, we have reverted to our former policy of offering customers who make multi-year contract commitments the option to be billed the total contract fee upfront or to be billed on an annual basis.  We expect that many customers who make a multi-year contract commitment will select to be billed on an annual basis, which could result in less benefit to free cash flow in 2018 compared to 2017.

Non-GAAP operating loss.  We define non-GAAP operating loss as loss from operations excluding stock-based compensation and amortization of acquired intangible assets. For the nine months ended September 30, 2018, we have also excluded from non-GAAP operating loss the $3.9 million expense related to the payments we agreed to make in 2018 pursuant to the Finjan legal settlement. We consider non-GAAP operating loss to be a useful metric for investors and other users of our financial information in evaluating our

28

operating performance because it excludes the impact of stock-based compensation and amortization of acquired intangible assets, each of which is a non-cash charge that can vary from period to period for reasons that are unrelated to our core operating performance, and expense recorded by us pursuant to the legal settlement because it is a non-recurring item. While we believe that non-GAAP operating loss is useful in evaluating our business, non-GAAP operating loss is a non-GAAP financial measure that has limitations as an analytical tool, and non-GAAP operating loss should not be considered as an alternative to, or substitute for, loss from operations in accordance with GAAP. In addition, other companies, including companies in our industry, may calculate non-GAAP operating loss differently or not at all, which reduces the usefulness of non-GAAP operating loss as a tool for comparison. We recommend that you review the reconciliation of non-GAAP operating loss to loss from operations, the most directly comparable GAAP financial measure, provided below, and that you not rely on non-GAAP operating loss or any single financial measure to evaluate our business.

	Three Months Ended September 30,				Nine Months Ended September 30,
(In thousands)	2018		2017		2018		2017
Loss from operations	$	(18,060)	$	(13,656)	$	(55,073)	$	(38,564)
Stock-based compensation		3,594		2,282		9,470		6,649
Amortization of acquired intangible assets		391		391		1,173		1,173
Legal settlement		—		—		3,900		—
Non-GAAP operating loss	$	(14,075)	$	(10,983)	$	(40,530)	$	(30,742)

RESULTS OF OPERATIONS

	Three Months Ended September 30,				Nine Months Ended September 30,
(In thousands)	2018		2017		2018		2017
Revenue:
Subscription, license and support	$	50,824	$	38,381	$	144,106	$	107,135
Services		2,591		3,128		8,735		9,010
Total revenue		53,415		41,509		152,841		116,145
Cost of revenue:
Subscription, license and support(1)		9,015		6,842		24,278		17,417
Services(1)		2,890		2,943		8,946		8,360
Total cost of revenue		11,905		9,785		33,224		25,777
Gross profit		41,510		31,724		119,617		90,368
Operating expenses:
Sales and marketing(1)		35,818		25,988		101,657		75,078
Research and development(1)		16,189		13,675		47,195		37,794
General and administrative(1)		7,563		5,717		25,838		16,060
Total operating expenses		59,570		45,380		174,690		128,932
Loss from operations		(18,060)		(13,656)		(55,073)		(38,564)
Interest income, net		737		22		1,192		5
Other income (expense), net		(173)		57		(9,385)		294
Loss before income taxes		(17,496)		(13,577)		(63,266)		(38,265)
Provision for income taxes		136		22		241		108
Net loss	$	(17,632)	$	(13,599)	$	(63,507)	$	(38,373)

⁽¹⁾ The following table summarizes the classification of stock-based compensation expense in our consolidated statements of operations:

	Three Months Ended September 30,				Nine Months Ended September30,
(In thousands)	2018		2017		2018		2017
Cost of subscription, license and support revenue	$	156	$	113	$	429	$	272
Cost of services revenue		82		56		212		167
Sales and marketing expense		1,541		805		3,705		2,422
Research and development expense		748		656		2,206		1,926
General and administrative expense		1,067		652		2,918		1,862
Total stock-based compensation expense	$	3,594	$	2,282	$	9,470	$	6,649

29

	Three Months Ended				Nine Months Ended
	September 30,				September 30,
	2018		2017		2018		2017
Percentage of Revenue:
Revenue:
Subscription, license and support	95	%	92	%	94	%	92	%
Services	5		8		6		8
Total revenue	100		100		100		100
Cost of revenue:
Subscription, license and support	17		16		16		15
Services	5		7		6		7
Total cost of revenue	22		24		22		22
Gross profit	78		76		78		78
Operating expenses:
Sales and marketing	67		63		67		65
Research and development	30		33		31		33
General and administrative	14		14		17		14
Total operating expenses	112		109		114		111
Loss from operations	(34)		(33)		(36)		(33)
Interest income, net	1		—		1		—
Other expense, net	—		—		(6)		—
Loss before income taxes	(32)		(33)		(41)		(33)
Provision for income taxes	—		—		—		—
Net loss	(32)	%	(33)	%	(41)	%	(33)	%

Revenue

	Three Months Ended September 30,								Nine Months Ended September 30,
(In thousands, except percentages)	2018		2017		$ Change		% Change		2018		2017		$ Change		% Change
Subscription, license and support	$	50,824	$	38,381	$	12,443	32	%	$	144,106	$	107,135	$	36,971	35	%
Services		2,591		3,128		(537)	(17)	%		8,735		9,010		(275)	(3)	%
Total revenue	$	53,415	$	41,509	$	11,906	29	%	$	152,841	$	116,145	$	36,696	32	%

The increase in subscription, license and support revenue in the three and nine months ended September 30, 2018 was due to an increase in total customers and an increase in sales to existing customers. The growth in total revenue was driven by sales of our Cb Response, CbProtection and Cb Defense products, our increased sales representative capacity to meet the market demand and the expansion of our strategic relationships with channel partners. We added 317 and 886 net new customers, respectively, in the three months ended and nine months ended September 30, 2018. Revenue generated by sales of our cloud-based solutions increased from $7.1million in the three months ended September 30, 2017 to $16.1million for the same period in 2018 and from $16.7 million in the nine months ended September 30, 2017 to $41.5 million for the same period in 2018.

The decrease in services revenue in the three and nine months ended September 30, 2018 is due to an increase in  customers selecting our cloud-based offerings, which require fewer deployment services as they are typically easier to deploy than our on-premise solutions.

30

Cost of Revenue

Cost of subscription, license and support revenue consists primarily of hosting costs associated with our cloud-based offerings, personnel-related costs for our support and hosting personnel, including salaries, benefits, bonuses, payroll taxes, stock-based compensation and allocated overhead costs. Cost of services revenue consists of personnel-related costs for our professional services team, including salaries, benefits, bonuses, payroll taxes, stock-based compensation, travel expenses and allocated overhead costs.

	Three Months Ended September 30,										Nine Months Ended September 30,
(In thousands, except percentages)	2018			2017			$ Change		% Change		2018			2017			$ Change		% Change
Subscription, license and support		9,015			6,842			2,173	32	%	$	24,278		$	17,417		$	6,861	39	%
Services		2,890			2,943			(53)	(2)	%		8,946			8,360			586	7	%
Total cost of revenue		11,905			9,785			2,120	22	%	$	33,224		$	25,777		$	7,447	29	%
Gross margin percentage:
Subscription, license and support		82	%		82	%						83	%		84	%
Services		(12)	%		6	%						(2)	%		7	%
Total gross margin percentage		78	%		76	%						78	%		78	%

The increase in total cost of revenue was primarily due to an increase in the cost of subscription, license and support revenue.

The increase in cost of subscription, license and support revenue during the three months ended September 30, 2018 was driven by a $0.8million increase in employee-related costs resulting from an increase in headcount, a $0.6 million increase in hosting costs primarily related to cloud-based subscriptions for our Cb Response and Cb Defense products, a $0.4 million increase in expense related to a software license agreement, a $0.2 million increase in software related costs and a $0.2 million increase in allocated overhead costs.

The increase in cost of subscription, license and support revenue during the nine months ended September 30, 2018 was driven by a $2.4 million increase in hosting costs primarily related to cloud-based subscriptions for our Cb Response and Cb Defense products, a $2.1 million increase in employee-related costs resulting from an increase in our headcount, a $1.2 million increase in expense related to a software license agreement, a $0.7 million increase in allocated overhead costs, and a $0.3 million increase in software-related costs.

The $0.6million increase in cost of services revenue during the nine months ended September 30, 2018 was primarily due to an increase in employee-related costs.

Total gross margin increased during the three months ended September 30, 2018 compared to the same period in 2017 primarily due to lower services revenue which has lower gross margins than our subscription, license and support revenue. Total gross margin remained flat during the nine months ended September 30, 2018 compared to the same period in 2017.

The gross margin on our subscription, license and support revenue remained flat during the three months ended September 30, 2018 compared to the same period in 2017. We experienced a slight decrease in gross margin on our subscription, license and support revenue in the nine months ended September 30, 2018 compared to the same period in 2017. This slight decrease was primarily due to an increase in the number of customers purchasing our cloud-based subscription products during the nine months ended September 30, 2018 and the associated personnel and hosting costs. We also experienced a decline in gross margin on our services revenue. We offer services to support successful software deployments and to ensure our customers realize the full value of our products. We expect gross margin on our service revenue in future periods to continue to be at or near break-even.

31

Operating Expenses

Sales and Marketing 

Sales and marketing expense consists of personnel-related costs for our sales and marketing teams, including salaries, benefits, amortization of deferred commissions, bonuses, payroll taxes, stock-based compensation and other related costs. Additional expenses include costs of marketing activities and promotional events, travel, and allocated overhead costs.

	Three Months Ended September 30,										Nine Months Ended September 30,
(In thousands, except percentages)	2018			2017			$ Change		% Change		2018			2017			$ Change		% Change
Sales and marketing	$	35,818		$	25,988		$	9,830	38	%	$	101,657		$	75,078		$	26,579	35	%
Percentage of revenue		67	%		63	%						67	%		65	%

The increase in sales and marketing expenses in the three months ended September 30, 2018 was primarily due to a $7.4million increase in employee-related costs due to an increase in headcount, a $0.7 million increase in allocated overhead costs, a $0.6 million increase in marketing costs driven by the timing of programs, a $0.4 million increase in commissions expense, a $0.4 million increase in software-related expenses and a $0.3 million net increase in other operating costs.

The increase in sales and marketing expenses in the nine months ended September 30, 2018 was primarily due to a $20.0 million increase in employee-related expenses, a $2.1 million increase in commission expense, a $1.9 million increase in allocated overhead costs, a $1.0 million increase in software-related expenses, a $0.8 million increase in marketing related expenses and a $0.7 million increase in other operating costs.

Research and Development

Research and development expense consists of personnel-related costs for our research and development team, including salaries, benefits, bonuses, payroll taxes, stock-based compensation and other related costs. Additional expenses include subcontracting for third-party engineering resources as well as allocated overhead costs.

	Three Months Ended September 30,										Nine Months Ended September 30,
(In thousands, except percentages)	2018			2017			$ Change		% Change		2018			2017			$ Change		% Change
Research and development	$	16,189		$	13,675		$	2,514	18	%	$	47,195		$	37,794		$	9,401	25	%
Percentage of revenue		30	%		33	%						31	%		33	%

The increase in research and development  expenses in the three months ended September 30, 2018 was primarily due to a $2.8million increase in employee-related costs resulting from an increase in the headcount of research and development personnel and a $0.3million increase in allocated overhead costs partially offset by a $0.6 million increase in capitalized software development costs.

The increase in research and development expenses in the nine months ended September 30, 2018 was primarily due to a $8.8 million increase in employee-related costs resulting from an increase in headcount, a $0.9 million increase in allocated overhead expenses, a $0.6 million increase in other operating costs and a $0.3 million increase in subscription services related to threat research partially offset by a $1.2 million increase in capitalized software development costs.

General and Administrative

General and administrative expense consists of personnel-related costs for our executive, administrative, legal, human resources, security, finance and accounting personnel, including salaries, benefits, bonuses, payroll taxes, stock-based compensation and other related costs.

	Three Months Ended September 30,										Nine Months Ended September 30,
(In thousands, except percentages)	2018			2017			$ Change		% Change		2018			2017			$ Change		% Change
General and administrative	$	7,563		$	5,717		$	1,846	32	%	$	25,838		$	16,060		$	9,778	61	%
Percentage of revenue		14	%		14	%						17	%		14	%

32

The increase in general and administrative expenses in the three months ended September 30, 2018 was primarily due to increases of $1.4 million in employee-related costs resulting from an increase in headcount and $0.4 million in other operating costs.

The increase in general and administrative expenses in the nine months ended September 30, 2018 was primarily due to increases of $3.9 million of expense related to the settlement agreement with Finjan, $3.5 million in employee-related costs resulting from an increase in headcount of general and administrative personnel as we continued to invest in our senior leadership, finance, legal, security and human resources teams to support our growing business, $0.8 million in outside contractors, $0.4 million in commercial insurance costs, $0.3 million in bad debt expense due to a benefit in the prior period, $0.3 million in software expenses and $0.5 million in other operating costs.

Interest Income, Net

Interest income, net consists of interest income related to our invested balances of cash, cash equivalents and short-term investments, as well as interest expense related to our outstanding debt obligations and the amortization of deferred financing costs and debt discount associated with such arrangements.

	Three Months Ended September 30,										Nine Months Ended September 30,
(In thousands, except percentages)	2018			2017			$ Change		% Change		2018			2017			$ Change		% Change
Interest income, net	$	737		$	22		$	715	3,250	%	$	1,192		$	5		$	1,187	23,740	%
Percentage of revenue		1	%		-	%						1	%		-	%

The increase in interest income, net in the three months ended September 30, 2018 was primarily due to an increase in interest income earned on higher cash and short-term investment balances resulting from the proceeds of our initial public offering.

The increase in interest income, net in the nine months ended September 30, 2018 was primarily due to an increase in interest income earned on higher cash balances and short-term investment resulting from the proceeds of our initial public offering and lower interest expense due to the repayment of all principal amounts outstanding under the line of credit in April2017.

Other Income (Expense), Net

Other income (expense), net historically consisted primarily of gains and losses related to the revaluation of certain of our outstanding warrant liabilities and foreign currency transactions gains and losses. As of June 30, 2018, we no longer have any outstanding warrant liabilities. Therefore, for the three months ended September 30, 2018, other income (expense), net primarily reflects our foreign currency transactions gains and losses.

	Three Months Ended September 30,										Nine Months Ended September 30,
(In thousands, except percentages)	2018			2017			$ Change		% Change		2018			2017			$ Change		% Change
Other income (expense), net	$	(173)		$	57		$	(230)	(404)	%	$	(9,385)		$	294		$	(9,679)	(3,292)	%
Percentage of revenue		-	%		-	%						(6)	%		-	%

The change in other income (expense), net in the three months ended September 30, 2018 is primarily due to higher foreign exchange related loss.

The change in other income (expense), net in the nine months ended September 30, 2018 is primarily due to an increase in the expense associated with the change in the fair value of our warrant liabilities and due to higher foreign exchange related loss.

33

Provision for Income Taxes

Provision for income taxes consists primarily of foreign income taxes. We maintain a full valuation allowance for our net deferred tax assets. The provision for income taxes was $0.1million and $0.2 million, respectively, in the three and nine months ended September 30, 2018 primarily due to foreign income taxes.

Backlog

We define backlog as contractually committed orders for our subscriptions and support services for which the associated revenue has not been recognized and the customer has not been invoiced. Amounts that have been invoiced but not yet recognized as revenue are reported as deferred revenue on our consolidated balance sheets and are not included in our calculation of backlog. As of September 30, 2018 and 2017, we had backlog of approximately $38.7million and $48.7million, respectively. The decrease in backlog was due largely to a change in our policy in 2017 that required customers with multi-year contract commitments to agree to multi-year upfront billing for the total contract fee. Multi-year upfront billings are not included in our backlog as they have been invoiced and are included in deferred revenue. Of the amount of backlog as of September 30, 2018, we expect that approximately $27.8million will be invoiced to customers within the following twelve months and will be initially recorded as deferred revenue.

LIQUIDITY AND CAPITAL RESOURCES

	Nine Months Ended September30,
(In thousands)	2018		2017
Net cash used in operating activities	$	(28,056)	$	(12,396)
Net cash used in investing activities		(101,836)		(4,942)
Net cash provided by (used in) financing activities		162,918		(3,235)
Net increase (decrease) in cash and cash equivalents	$	33,026	$	(20,573)
Cash and cash equivalents at end of period	$	69,099	$	30,930

The increase in cash and cash equivalents during the nine months ended September 30, 2018 was primarily due to the increase in cash provided by financing activities driven by our IPO. The price per share to the public was $19.00 per share. We received aggregate proceeds of $162.6 million from the IPO, net of underwriters’ discounts and commissions, and before deducting offering costs of approximately $4.9 million.

As of September 30, 2018, we had cash and cash equivalents of $69.0 million and short-term investments of $94.6 million, substantially all of which was on deposit or invested in the U.S.

As of September 30, 2018, we are party to a senior loan and security agreement with Silicon Valley Bank, or the line of credit, which, as amended, provides for $40 million in maximum borrowings. Borrowings under the line of credit accrue interest at Silicon Valley Bank’s prime rate and may be repaid and reborrowed until March21, 2020, when the line of credit expires and all outstanding amounts must be repaid. As of September 30, 2018, we had $0 of outstanding borrowings under the line of credit.

Since our inception, we have generated significant losses and expect to continue to generate losses for the foreseeable future. We believe that our existing cash and cash equivalents and short-term investments will be sufficient to meet our working capital expenditure requirements for at least the next 12months. Our future capital requirements will depend on many factors, including our growth rate, our activities related to the acquisition of complementary businesses, technologies and assets, the timing and extent of spending to support research and development efforts, the expansion of sales and marketing activities, particularly internationally, and the introduction of new and enhanced products as we continue to innovate. In the event that additional financing is required from outside sources, we may be unable to raise the funds on acceptable terms, if at all. If we are unable to raise additional capital when desired, our business, operating results and financial condition could be adversely affected.

Operating Activities

During the nine months ended September 30, 2018, operating activities used $28.1 million of cash, primarily resulting from our net loss of $63.5million, partially offset by net cash provided by changes in our operating assets and liabilities of $11.2million and non-cash charges of $24.2million. Net cash provided by changes in our operating assets and liabilities consisted of a $9.1 million decrease in

34

accounts receivable, a $1.2 million increase in accounts payable, a $8.1 million increase in deferred revenue and a $0.8 million increase in accrued expenses partially offset by a $2.7 million increase in prepaid expenses and other assets and a $5.0 million increase in deferred commissions. The decrease in accounts receivable was due to the timing of billings and cash collections. The increase in accounts payable was due to the growth of our business and the timing of payments. The increase in deferred revenue was due to amounts we billed during the nine months ended September 30, 2018. The increase in prepaid expenses and other assets resulted from our increased spending due to the growth of our business and the timing of software subscription renewals. The increase in deferred commissions was due to the increase in the number of customers and the amounts we billed for our products and services during the nine months ended September 30, 2018.

During the nine months ended September 30, 2017, operating activities used $12.4million of cash, primarily resulting from our net loss of $38.4million, partially offset by net cash provided by changes in our operating assets and liabilities of $14.3million and non-cash charges of $11.6million. Net cash provided by changes in our operating assets and liabilities consisted primarily of a $23.7million increase in deferred revenue and a $1.1 million increase in accounts payable, partially offset by a $2.5 million increase in accounts receivable, a $1.7 million decrease in accrued expenses, a $4.1 million increase in deferred commissions and a $1.9 million increase in prepaid expenses and other assets. The increase in deferred revenue was due to amounts we billed during the nine months ended September 30, 2017. The increase in accounts payable was due to the growth of our business and the timing of payments. The increase in accounts receivable was due to the timing of billings and cash collections.The decrease in accrued expenses was primarily due to the payment of the 2016 bonus amount during the first quarter of 2017. The increase in deferred commissions was due to the increase in the number of customers and the amounts we billed for our products and services during the nine months ended September 30, 2017. The increase in prepaid expenses and other assets resulted from our increased spending due to the growth of the business and the timing of software subscription renewals.

Investing Activities

During the nine months ended September 30, 2018, investing activities used $101.8million of cash, consisting of purchases of short-term investments of $94.6 million, purchases of property and equipment of $5.4million and capitalization of internal-use software costs of $1.9million. The purchases of property and equipment in 2018 were primarily computer equipment and were related to the growth of our headcount and the general expansion of our business.

During the nine months ended September 30, 2017, investing activities used $4.9million of cash, consisting of purchases of property and equipment of $4.2million and capitalization of internal-use software costs of $0.7million. The purchases of property and equipment in 2017 were primarily related to the growth of our headcount and the general expansion of the business.

Financing Activities

During the nine months ended September 30, 2018, financing activities provided $162.9million of cash, primarily resulting from proceeds of $159.6 million from the IPO, net of underwriters’ discounts and commissions and after deducting offering costs of $2.9 million paid during the nine months ended September 30, 2018, and $3.3 million from the exercise of stock options.

During the nine months ended September 30, 2017, financing activities used $3.2million of cash, primarily driven by repayment of line of credit of $5.5 million partially offset by proceeds of $2.3million from the exercise of stock options.

CONTRACTUAL OBLIGATIONS AND COMMITMENTS

During the three months ended September 30, 2018, there have been no material changes outside the ordinary course of business to our contractual obligations and commitments from those disclosed in our final prospectus for our IPO dated as of May4, 2018 and filed with the SEC pursuant to Rule424(b)(4)under the Securities Act of 1933, as amended. See Note 11 to our unaudited consolidated financial statements included in PartI,Item 1 of this Quarterly Report on Form10-Q.

CRITICAL ACCOUNTING POLICIES

Our unaudited consolidated financial statements are prepared in accordance with GAAP. The preparation of our unaudited consolidated financial statements requires us to make estimates, assumptions and judgments that affect the reported amounts of assets, liabilities, revenue, costs and expenses. We base our estimates and assumptions on historical experience and other factors that we believe to be

35

reasonable under the circumstances. We evaluate our estimates and assumptions on an ongoing basis. Our actual results may differ materially from these estimates.

Except for accounting policies related to our adoption of ASC 606, there have been no material changes to our critical accounting policies and estimates as compared to the critical accounting policies and estimates described in our final prospectus for our IPO dated as of May4, 2018 and filed with the SEC pursuant to Rule424(b)(4)under the Securities Act of 1933, as amended. See Note 2 and Note 13 to our unaudited consolidated financial statements included in PartI,Item 1 of this Quarterly Report on Form10-Q.

RECENT ACCOUNTING PRONOUNCEMENTS

See Note 2 to our unaudited consolidated financial statements included in PartI,Item 1 of this Quarterly Report on Form10-Q for a discussion of recent accounting pronouncements.

OFF-BALANCE SHEET ARRANGEMENTS

We do not have any relationships with unconsolidated entities or financial partnerships, including entities sometimes referred to as structured finance or special purpose entities that were established for the purpose of facilitating off-balance sheet arrangements or other contractually narrow or limited purposes. We do not engage in off-balance sheet financing arrangements. In addition, we do not engage in trading activities involving non-exchange traded contracts. We therefore believe that we are not materially exposed to any financing, liquidity, market or credit risk that could arise if we had engaged in these relationships.

ITEM 3. QUALITATIVE AND QUANTITATIVE DISCLOSURES ABOUT MARKET RISK

Market risk represents the risk of loss that may impact our financial position due to adverse changes in financial market prices and rates. Our market risk exposure is primarily the result of concentration risk, fluctuations in interest rates and foreign exchange rates as well as, to a lesser extent, inflation.

Concentration Risk

See Note 13 to our unaudited consolidated financial statements included in Part I, Item 1 of this Quarterly Report on Form 10-Q for information on concentration risk.

Interest Rate Risk

We are exposed to interest rate risk in the ordinary course of our business. Our portfolio of cash equivalents and short-term investments is maintained in a variety of securities, including U.S. government agency obligations, high-quality corporate debt securities, commercial paper and money market funds. Our short-term investments are classified as available-for-sale securities and carried at fair market value with cumulative unrealized gains or losses recorded as a component of accumulated other comprehensive loss within stockholders' equity. A sharp rise in interest rates could have an adverse impact on the fair market value of certain securities in our portfolio. We do not currently hedge our interest rate exposure and do not enter into financial instruments for trading or speculative purposes.

Foreign Currency Exchange Risk

To date, a substantial majority of our revenue from customer arrangements has been denominated in U.S. dollars. The majority of our employees and our major operations are currently located in the U.S. We have limited operations outside the U.S. The functional currency of each of our foreign subsidiaries is the U.S. dollar. We occasionally engage in contracts with customers and pay contractors or other vendors in a currency other than the U.S. dollar.

To date, we have had minimal exposure to fluctuations in foreign currency exchange rates as the time period from the date that transactions are initiated and the date of payment or receipt of payment is generally of short duration. Accordingly, we believe we do not have a material exposure to foreign currency risk.

36

Inflation Risk

We do not believe that inflation had a material effect on our business, financial condition or results of operations in the last three years. If our costs were to become subject to significant inflationary pressures, we may not be able to fully offset such higher costs through price increases. Our inability or failure to do so could harm our business, financial condition or results of operations.

ITEM4. CONTROLS AND PROCEDURES

Evaluation of Disclosure Controls and Procedures

Our management, with the participation of our Chief Executive Officer and Chief Financial Officer, has evaluated the effectiveness of our disclosure controls and procedures (as defined in Rules13a-15(e)and 15d-15(e)under the Securities Exchange Act of 1934, as amended, or the Exchange Act), as of the end of the period covered by this Quarterly Report on Form10-Q. In designing and evaluating our disclosure controls and procedures, management recognizes that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving the desired control objectives. In addition, the design of disclosure controls and procedures and internal control over financial reporting must reflect the fact that there are resource constraints and that management is required to apply its judgment in evaluating the benefits of possible controls and procedures relative to their costs. Based on management’s evaluation as of the end of the period covered by this Quarterly Report on Form10-Q, our principal executive officer and principal financial officer have concluded that as of such date, our disclosure controls and procedures were effective to provide reasonable assurance that information required to be disclosed by us in the reports that we file or submit under the Exchange Act is recorded, processed, summarized, and reported within the time periods specified in the SEC’s rulesand forms and to provide reasonable assurance that such information is accumulated and communicated to our management, including our principal executive officer and principal financial officer, as appropriate, to allow timely decisions regarding required disclosures.

Changes in Internal Control over Financial Reporting

There were no changes in our internal control over financial reporting (as defined in Rules13a-15(f)and 15d-15(f)under the Exchange Act) during the period covered by this Quarterly Report on Form10-Q that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

PARTII — OTHER INFORMATION

ITEM 1. LEGAL PROCEEDINGS

The information contained in Note 11 to the Consolidated Financial Statements included in Part I, Item 1 of this Quarterly Report on Form 10-Q is incorporated by reference herein.

ITEM 1A. RISK FACTORS

A description of the risks and uncertainties associated with our business and industry is set forth below. You should carefully consider the risks and uncertainties described below, together with all of the other information in this Quarterly Report on Form 10-Q, including the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and our unaudited condensed consolidated financial statements and related notes included elsewhere in this Quarterly Report on Form 10-Q. The risks and uncertainties described below are not the only ones we face. Additional risks and uncertainties that we are unaware of may also become important factors that adversely affect our business. If any of the following risks actually occur, our business, financial condition, results of operations and future prospects could be adversely affected. In that event, the market price of our stock could decline, perhaps significantly.

Risks Related to Our Business and Industry

We are a rapidly growing company, which makes it difficult to evaluate our future prospects.

We are a rapidly growing company. Our ability to forecast our future operating results is subject to a number of uncertainties, including our ability to plan for and model future growth. We have encountered and will continue to encounter risks and uncertainties frequently

37

experienced by growing companies in rapidly evolving industries. If our assumptions regarding these uncertainties, which we use to plan our business, are incorrect or change in reaction to changes in our markets, or if we do not address these risks successfully, our operating and financial results could differ materially from our expectations, our business could suffer and the trading price of our stock may decline.

We have not been profitable historically and may not achieve or maintain profitability in the future.

We have incurred net losses in each year since inception, including net losses of $17.6 million in the three months ended September 30, 2018 and $13.6 million for the same period in 2017. As of September 30, 2018, we had an accumulated deficit of $519.0 million. While we have experienced significant revenue growth in recent periods, we are not certain whether or when we will obtain a high enough volume of sales of our products to sustain or increase our growth or achieve or maintain profitability in the future. We also expect our costs to increase in future periods, which could negatively affect our future operating results if our revenue does not increase. In particular, we expect to continue to expend substantial financial and other resources on:

· research and development related to our products, including investments in our research and development team;

· sales and marketing, including a significant expansion of our sales organization, both domestically and internationally;

· continued international expansion of our business;

· expansion of our professional services organization; and

· general administration expenses, including legal and accounting expenses related to being a public company.

These investments may not result in increased revenue or growth in our business. We expect to continue to devote research and development resources to our on-premise solutions; if our customers and potential customers shift their information technology, or IT, infrastructures to the cloud faster than we anticipate, we may not realize our expected return from the costs we incur. If we are unable to increase our revenue at a rate sufficient to offset the expected increase in our costs, our business, financial position and results of operations will be harmed, and we may not be able to achieve or maintain profitability over the long term. Additionally, we may encounter unforeseen operating expenses, difficulties, complications, delays and other unknown factors that may result in losses in future periods. If our revenue growth does not meet our expectations in future periods, our financial performance may be harmed, and we may not achieve or maintain profitability in the future.

If we are unable to sustain our revenue growth rate, we may not achieve or maintain profitability in the future.

Our revenue grew from $116.1 million in the nine months ended September 30, 2017 to $152.8 million for the same period in 2018, representing a 32% annual growth rate. Although we have experienced rapid growth historically and currently have high customer retention rates, we may not continue to grow as rapidly in the future and our customer retention rates may decline. Any success that we may experience in the future will depend in large part on our ability to, among other things:

· maintain and expand our customer base;

· increase revenues from existing customers through increased or broader use of our products within their organizations;

· maintain and expand strategic partnerships with our channel partners;

· improve the performance and capabilities of our products through research and development;

· continue to develop our cloud-based solutions;

· maintain the rate at which customers purchase our support services;

· continue to successfully expand our business domestically and internationally;

38

· successfully identify and consummate acquisitions of complementary businesses, technology and assets; and

· successfully compete with other companies.

If we are unable to maintain consistent revenue or revenue growth, our stock price could be volatile, and it may be difficult to achieve and maintain profitability. You should not rely on our revenue for any prior quarterly or annual periods as any indication of our future revenue or revenue growth.

Our quarterly financial results, including our billings and deferred revenue, may fluctuate for a variety of reasons, including our failure to close significant sales before the end of a particular quarter.

A meaningful portion of our revenue is generated by significant sales to new customers and sales of additional products to existing customers. Purchases of our solutions often occur during the last month of each quarter, particularly in the last quarter of the year. In addition, our sales cycle can last several months from proof of concept to contract negotiation, to delivery of our solution to our customers, and this sales cycle can be even longer, less predictable and more resource-intensive for larger sales. Customers may also require additional internal approvals or seek to test our products for a longer trial period before deciding to purchase our solutions. As a result, the timing of individual sales can be difficult to predict. In some cases, sales have occurred in a quarter subsequent to those we anticipated, or have not occurred at all, which can significantly impact our quarterly financial results and make it more difficult to meet market expectations.

In addition to the sales cycle-related fluctuations noted above, our financial results, including our billings and deferred revenue, will continue to vary as a result of a number of factors, many of which are outside of our control and may be difficult to predict, including:

· our ability to attract and retain new customers;

· our ability to sell additional products to existing customers;

· our ability to expand into adjacent and complementary markets;

· changes in customer or channel partner requirements or market needs;

· changes in the growth rate of the next-generation endpoint security market;

· the timing and success of new product introductions by us or our competitors, or any other change in the competitive landscape of the next-generation endpoint security market, including consolidation among our customers or competitors;

· a disruption in, or termination of, any of our relationships with channel partners;

· our ability to successfully expand our business globally;

· reductions in customer retention rates;

· changes in our pricing policies or those of our competitors;

· general economic conditions in our markets;

· future accounting pronouncements or changes in our accounting policies or practices;

· the amount and timing of our operating costs, including cost of goods sold;

· a change in our mix of products and services, including shifts to cloud-based products offered through a software-as-a-service model; and

· increases or decreases in our revenue and expenses caused by fluctuations in foreign currency exchange rates.

39

Any of the above factors, individually or in the aggregate, may result in significant fluctuations in our financial and other operating results from period to period. These fluctuations could result in our failure to meet our operating plan or the expectations of investors or analysts for any period. If we fail to meet such expectations for these or other reasons, the trading price of our common stock could fall substantially, and we could face costly lawsuits, including securities class action suits.

We recognize substantially all of our revenue ratably over the term of our agreements with customers and, as a result, downturns or upturns in sales may not be immediately reflected in our operating results.

We recognize substantially all of our revenue ratably over the terms of our agreements with customers, which generally occurs over a one- or three-year period. As a result, a substantial portion of the revenue that we report in each period will be derived from the recognition of deferred revenue relating to agreements entered into during previous periods. Consequently, a decline in new sales or renewals in any one period may not be immediately reflected in our revenue results for that period. This decline, however, will negatively affect our revenue in future periods. Accordingly, the effect of significant downturns in sales and market acceptance of our products, and potential changes in our rate of renewals may not be fully reflected in our results of operations until future periods. Our model also makes it difficult for us to rapidly increase our revenue through additional sales in any period, as revenue from new customers generally will be recognized over the term of the applicable agreement.

We also intend to increase our investment in research and development, sales and marketing and general and administrative functions and other areas to grow our business. These costs are generally expensed as incurred (with the exception of sales commissions), as compared to our revenue, substantially all of which is recognized ratably in future periods.

We are likely to recognize the costs associated with these increased investments earlier than some of the anticipated benefits and the return on these investments may be lower, or may develop more slowly, than we expect, which could adversely affect our operating results.

We face intense competition in our market, especially from larger, well-established companies, and we may lack sufficient financial or other resources to maintain or improve our competitive position.

Our market is large, highly competitive, fragmented and subject to rapidly evolving technology, shifting customer needs and frequent introductions of new solutions. We expect competition to increase in the future from both established competitors and new market entrants. Our current competitors include legacy antivirus solution providers, such as McAfee and Symantec Corporation, established network security providers, such as Palo Alto Networks, Inc., FireEye, Inc. and Cisco Systems, Inc., and privately held companies, such as Crowdstrike and Cylance. New startup companies, as well as established public and private companies, have entered or are currently attempting to enter the next-generation endpoint security market, some of which are or may become significant competitors in the future. Many of our existing competitors have, and some of our potential competitors could have, substantial competitive advantages such as:

· greater name recognition and longer operating histories;

· larger sales and marketing budgets and resources;

· broader distribution and established relationships with distribution partners and customers;

· greater customer support resources;

· greater resources to make acquisitions;

· lower labor and development costs;

· larger and more mature intellectual property portfolios; and

· substantially greater financial, technical and other resources.

40

In addition, some of our larger competitors have substantially broader and more diverse product offerings and leverage their relationships based on their installed products or incorporate functionality into existing products to gain business in a manner that discourages users from purchasing our products, including by selling their products at zero or negative margins, product bundling or closed technology platforms. Potential customers may also prefer to purchase from their existing suppliers rather than a new supplier regardless of product performance or features. These larger competitors often have broader product lines and market focus and may therefore not be as susceptible to downturns in a particular market. Some of our smaller competitors that specialize in providing point solutions focused on narrow security problems are able to deliver these specialized security solutions to the market on a faster cadence than a typical enterprise class solution. Conditions in our market could change rapidly and significantly as a result of technological advancements, partnering by our competitors or continuing market consolidation. New start-up companies that innovate and large competitors that are making significant investments in research and development may invent similar or superior products and technologies that compete with our products and technology. Our current and potential competitors may also establish cooperative relationships among themselves or with third parties that may further enhance their resources.

Some of our competitors have made acquisitions of businesses that may allow them to offer more directly competitive and comprehensive solutions than they had previously offered. As a result of such acquisitions, our current or potential competitors might be able to adapt more quickly to new technologies and customer needs, devote greater resources to the promotion or sale of their products and services, initiate or withstand substantial price competition, take advantage of acquisition or other opportunities more readily, or develop and expand their product and service offerings more quickly than we do. For various reasons, organizations may be more willing to incrementally add our competitors’ products to their existing security infrastructure instead of incorporating our products. These competitive pressures in our market or our failure to compete effectively may result in price reductions, fewer orders, reduced revenue and gross margins, and loss of market share. Any failure to meet and address these factors could seriously harm our business and operating results.

The next-generation endpoint security market is new and evolving, and may not grow as expected.

We believe our future success will depend in large part on the growth, if any, in the market for next-generation endpoint security products. This market is new and evolving, and as such, it is difficult to predict important market trends, including its potential growth, if any. To date, enterprise and corporate cyber security budgets have allocated a majority of dollars to prevention-centric threat protection solutions, such as network, endpoint and web security products designed to stop threats from penetrating corporate networks. Organizations that use these security products may be satisfied with such existing security products and, as a result, these organizations may not adopt our solutions in addition to, or in lieu of, security products they currently use.

Further, sophisticated cyber attackers are skilled at adapting to new technologies and developing new methods of gaining access to organizations’ sensitive business data, and changes in the nature of advanced cyber threats could result in a shift in IT budgets away from products such as ours. In addition, while recent high visibility attacks on prominent enterprises and governments have increased market awareness of the problem of cyber attacks, if cyber attacks were to decline, or enterprises or governments perceived that the general level of cyber attacks has declined, our ability to attract new customers and expand our sales to existing customers could be materially and adversely affected. If products such as ours are not viewed by organizations as necessary, or if customers do not recognize the benefit of our products as a critical element of an effective cyber security strategy, our revenue may not grow as quickly as expected, or may decline, and the trading price of our stock could suffer.

In addition, it is difficult to predict customer adoption and retention rates, customer demand for our products, the size and growth rate of the market for next-generation endpoint security, the entry of competitive products or the success of existing competitive products. Any expansion in our market depends on a number of factors, including the cost, performance and perceived value associated with our products and those of our competitors. If these products do not achieve widespread adoption or there is a reduction in demand for products in our market caused by a lack of customer acceptance, technological challenges, competing technologies, products, decreases in corporate spending, weakening economic conditions or otherwise, it could result in reduced customer orders, early terminations, reduced customer retention rates or decreased revenue, any of which would adversely affect our business operations and financial results. You should consider our business and prospects in light of the risks and difficulties we encounter in this new and evolving market.

41

Forecasts of our market and market growth may prove to be inaccurate, and even if the markets in which we compete achieve the forecasted growth, there can be no assurance that our business will grow at similar rates, or at all.

Growth forecasts that we disclose relating to our market opportunities, including our primary endpoint security market and adjacent security markets, and the expected growth thereof are subject to significant uncertainty and are based on assumptions and estimates which may prove to be inaccurate. Even if these markets meet our size estimate and experience the forecasted growth, we may not grow our business at a similar rate, or at all. Our growth is subject to many factors, including our success in implementing our business strategy and ability to penetrate adjacent security markets, which is subject to many risks and uncertainties. Accordingly, the forecasts of market growth that we disclose should not be taken as indicative of our future growth.

If our products fail or are perceived to fail to detect cyber attacks, or if our products contain undetected errors or defects, our brand and reputation could be harmed, which could have an adverse effect on our business and results of operations.

If our products fail or are perceived to fail to detect cyber attacks, including advanced attacks that have never been seen before, in our customers’ endpoints and cyber security infrastructure, or if our products fail to identify and respond to new and increasingly complex methods of cyber attacks, our business and reputation may suffer. There is no guarantee that our products will detect all cyber attacks, especially in light of the rapidly changing security landscape to which we must respond. For example, in August 2017, a blog post alleged a product defect in our Cb Response product. We issued a press release stating that the allegation was incorrect, but in the course of evaluating the alleged defect, we uncovered and fixed another defect in our product. We cannot guarantee that our products will not contain undetected errors or defects in the future. Additionally, our products may falsely detect cyber attacks or threats that do not actually exist. For example, our products rely on third-party reports of identified security threats and information provided by an active community of security professionals. If the information from these third parties is inaccurate, the potential for false indications of security cyber attacks increases. These false positives, while typical in the industry, may impair the perceived reliability of our products, and may therefore adversely impact market acceptance of our products, and could result in negative publicity, loss of customers and sales and increased costs to remedy any problem.

Our products, which are complex, may also contain undetected errors or defects when first introduced or as new versions are released. We have experienced these errors or defects in the past in connection with new products and product upgrades. We expect that these errors or defects will be found from time to time in the future in new or enhanced products after commercial release. Defects may cause our products to be vulnerable to attacks, cause them to fail to detect cyber attacks, or temporarily interrupt customers’ networking traffic. Any errors, defects, disruptions in service or other performance problems with our products may damage our customers’ business and could hurt our reputation. If our products fail to detect cyber attacks for any reason, we may incur significant costs, the attention of our key personnel could be diverted, our customers may delay or withhold payment to us or elect not to renew or other significant customer relations problems may arise.

We may also be subject to liability claims for damages related to errors or defects in our products. A material liability claim or other occurrence that harms our reputation or decreases market acceptance of our products may harm our business and operating results. Although we have limitation of liability provisions in our terms and conditions of sale, they may not fully or effectively protect us from claims as a result of federal, state, or local laws or ordinances, or unfavorable judicial decisions in the U.S. or other countries. The sale and support of our also entails the risk of product liability claims. We maintain insurance to protect against certain claims associated with the use of our products, but our insurance coverage may not adequately cover any claim asserted against us. In addition, even claims that ultimately are unsuccessful could result in our expenditure of funds in litigation, divert management’s time and other resources, and harm our business and reputation.

We rely on channel partners, such as managed security service providers, incident response firms and security-focused value added resellers, to generate a significant portion of our revenue. If we fail to maintain successful relationships with our channel partners, or if our channel partners fail to perform, our ability to market, sell and distribute our products will be limited, and our business, financial position and results of operations will be harmed.

In addition to our direct sales force, we rely on our channel partners to sell our products. A majority of our revenue is generated by our channel partners, including managed service security providers, incident response firms and value added resellers. In addition, in the nine months ended September 30, 2018, 79% of our new and add-on business was closed in collaboration with our channel partners. We expect to continue to focus on generating sales to new and existing customers through our channel partners as a part of our growth strategy.

42

We provide our sales channel partners with specific training and programs to assist them in selling our products, but there can be no assurance that these steps will be effective. In addition, our channel partners may be unsuccessful in marketing, selling and supporting our products. If we are unable to develop and maintain effective sales incentive programs for our third-party channel partners, we may not be able to incentivize these partners to sell our products to customers and, in particular, to large enterprises. Our agreements with our channel partners are generally non-exclusive and these partners may also market, sell and support products that are competitive with ours and may devote more resources to the marketing, sales and support of such competitive products. These partners may have incentives to promote our competitors’ products to the detriment of our own or may cease selling our products altogether. Our channel partners may cease or deemphasize the marketing of our products with limited or no notice and with little or no penalty. Our agreements with our channel partners may generally be terminated for any reason by either party with advance notice prior to each annual renewal date. We cannot be certain that we will retain these channel partners or that we will be able to secure additional or replacement channel partners. The loss of one or more of our significant channel partners or a decline in the number or size of orders from them could harm our operating results. In addition, any new sales channel partner requires extensive training and may take several months or more to achieve productivity. Our channel partner sales structure could subject us to lawsuits, potential liability and reputational harm if, for example, any of our channel partners misrepresent the functionality of our products, subscriptions or services to customers or violate laws or our corporate policies.

If we fail to effectively manage our existing sales channels, or if our channel partners are unsuccessful in fulfilling the orders for our products, or if we are unable to enter into arrangements with, and retain a sufficient number of, high quality channel partners in each of the regions in which we sell products and keep them motivated to sell our products, our ability to sell our products and operating results will be harmed. The termination of our relationship with any significant channel partner may also adversely impact our sales and operating results.

If we are unable to acquire new customers, our future revenues and operating results will be harmed.

Our success depends on our ability to acquire new customers, including large enterprise customers. If we are unable to attract a sufficient number of new customers, we may be unable to generate revenue growth at desired rates. Many enterprise customers operate in increasingly complex IT environments and require additional features and functionality, as well as higher levels of support than smaller customers. If our solutions are perceived as insufficient to meet the needs of large enterprises, we may be limited in our ability to acquire large enterprise customers. The next-generation endpoint security market is competitive and many of our competitors have substantial financial, personnel and other resources that they utilize to develop solutions and attract customers. As a result, it may be difficult for us to add new customers to our customer base. Competition in the marketplace may also lead us to win fewer new customers or result in us providing discounts and other commercial incentives. Additional factors that impact our ability to acquire new customers include the perceived need for next-generation endpoint security, the size of our prospective customers’ IT budgets, the utility and efficacy of our existing and new products, whether proven or perceived, and general economic conditions. These factors may have a meaningful negative impact on future revenues and operating results.

If we are unable to sell additional products to our customers and maintain and grow our customer retention rates, our future revenue and operating results will be harmed.

Our future success depends, in part, on our ability to expand the deployment of our products with existing customers by selling them additional products. This may require increasingly sophisticated and costly sales efforts and may not result in additional sales. In addition, the rate at which our customers purchase additional products depends on a number of factors, including the perceived need for additional next-generation endpoint security as well as general economic conditions. If our efforts to sell additional products to our customers are not successful, our business may suffer.

Further, to maintain or improve our operating results, it is important that our customers renew their agreements with us when the existing term expires. Our customers have no obligation to renew their agreements upon expiration of the applicable contract term, and we cannot provide assurance that customers will renew subscriptions or support agreements. The rate of customer retention may decline or fluctuate as a result of a number of factors, including our customers’ satisfaction or dissatisfaction with our products, the effectiveness of our customer support services, our pricing, the prices of competing products, subscriptions or services, mergers and acquisitions affecting our customer base, or reductions in our customers’ budgets and spending levels. If our end-use customers do not renew their agreements, or renew on less favorable terms, our revenue may decline, our business may suffer, and we may not realize improved operating results from our customer base.

43

If we do not successfully anticipate market needs and enhance our existing products or develop new products that meet those needs on a timely basis, we may not be able to compete effectively and our ability to generate revenues will suffer.

Our customers operate in markets characterized by rapidly changing technologies and business plans, which require them to adapt to increasingly complex IT infrastructures that incorporate a variety of hardware, software applications, operating systems and networking protocols. As our customers’ technologies and business plans grow more complex, we expect them to face new and increasingly sophisticated methods of attack. We face significant challenges in ensuring that our products effectively identify and respond to these advanced and evolving attacks without disrupting the performance of our customers’ IT infrastructures. As a result, we must continually modify and improve our products in response to changes in our customers’ IT infrastructures.

We cannot guarantee that we will be able to anticipate future market needs and opportunities or be able to develop product enhancements or new products to meet such needs or opportunities in a timely manner, if at all. Even if we are able to anticipate, develop and commercially introduce enhancements and new products, there can be no assurance that enhancements or new products will achieve widespread market acceptance.

New products, as well as enhancements to our existing products, could fail to attain sufficient market acceptance for many reasons, including:

· delays in releasing new products, or product enhancements;

· failure to accurately predict market demand and to supply products that meet this demand in a timely fashion;

· inability to integrate effectively with the existing or newly introduced technologies, systems or applications of our existing and prospective customers;

· inability to protect against new types of attacks or techniques used by cyber attackers or other data thieves;

· defects in our products, errors or failures of our products;

· negative publicity or perceptions about the performance or effectiveness of our products;

· introduction or anticipated introduction of competing products by our competitors;

· installation, configuration or usage errors by our customers;

· easing or changing of regulatory requirements related to security; and

· reluctance of customers to purchase products incorporating open source software.

If we fail to anticipate market requirements or fail to develop and introduce product enhancements or new products to meet those needs in a timely manner, it could cause us to lose existing customers and prevent us from gaining new customers, which would significantly harm our business, financial condition and results of operations.

While we continue to invest significant resources in research and development to ensure that our products continue to address the cyber security risks that our customers face, the introduction of products embodying new technologies could also render our existing products or services obsolete or less attractive to customers. If we spend significant time and effort on research and development and are unable to generate an adequate return on our investment, our business and results of operations may be materially and adversely affected.

If our products do not effectively integrate with our customers’ IT infrastructure, or if our technology partners no longer support our products or allow us to integrate with their programs, our business could suffer.

Our products must effectively integrate with our customers’ existing or future IT infrastructure, which often has different specifications, utilizes multiple protocol standards, deploys products from multiple vendors and contains multiple generations of products that have been added over time. As a result, when problems occur in a network, it may be difficult to identify the sources of these problems. If we

44

find errors in the existing software or defects in the hardware used in our customers’ infrastructure or problematic network configurations or settings, we may have to modify our software or hardware so that our products will integrate with our customers’ infrastructure. In such cases, our products may be unable to provide significant performance improvements for applications deployed in our customers’ infrastructure. These issues could cause longer installation times for our products and could cause order cancellations, either of which would adversely affect our business, results of operations and financial condition. Additionally, any changes in our customers’ IT infrastructure that degrade the functionality of our products or services or give preferential treatment to competitive software could adversely affect the adoption and usage of our products.

Further, if our technology partners no longer support our products or allow us to integrate with customers’ IT infrastructure, or if we do not maintain these integrations, the functionality of our products may be reduced and our products may not be as marketable to certain existing and potential customers.

If our products are late in achieving or fail to achieve compliance with these certifications and standards, or our competitors achieve compliance with these certifications and standards, we may be disqualified from selling our products to such customers, or may otherwise be at a competitive disadvantage, either of which would harm our business, results of operations and financial condition.

If our products fail to help our customers achieve and maintain compliance with regulations and/or industry standards, our revenue and operating results could be harmed.

We generate a portion of our revenue from our product offerings that help organizations achieve and maintain compliance with regulations and industry standards both domestically and internationally. For example, many of our customers subscribe to our product offerings to help them comply with the security standards developed and maintained by the Payment Card Industry Security Standards Council, or the PCI Council, which apply to companies that process, transmit or store cardholder data. In addition, our product and service offerings are used by customers in the healthcare industry to help them comply with numerous federal and state laws and regulations related to patient privacy. In particular, the Health Insurance Portability and Accountability Act of 1996, or HIPAA, and the 2009 Health Information Technology for Economic and Clinical Health Act include privacy and data security standards that protect individual privacy by limiting the uses and disclosures of individually identifiable health information and implementing data security standards. The foregoing and other state, federal and international legal and regulatory regimes may affect our customers’ requirements for, and demand for, our products and professional services. Governments and industry organizations, such as the PCI Council, may also adopt new laws, regulations or requirements, or make changes to existing laws or regulations, that could impact the demand for, or value of, our products. If we are unable to adapt our products to changing legal and regulatory standards or other requirements in a timely manner, or if our products fail to assist with, or expedite, our customers’ cyber security defense and compliance efforts, our customers may lose confidence in our products, and could switch to products offered by our competitors or threaten or bring legal actions against us. In addition, if laws, regulations or standards related to data security, vulnerability management and other IT security and compliance requirements are relaxed or the penalties for non-compliance are changed in a manner that makes them less onerous, our customers may view government and industry regulatory compliance as less critical to their businesses, and our customers may be less willing to purchase our products. In any of these cases, our revenue and operating results could be harmed.

In addition, government and other customers may require our products to comply with certain privacy and security regulations, or other certifications and standards. If our products are late in achieving or fail to achieve or maintain compliance with these certifications and standards, or our competitors achieve compliance with these certifications and standards, we may be disqualified from selling our products to such customers, or may otherwise be at a competitive disadvantage, either of which would harm our business, results of operations and financial condition.

As a cyber security provider, we have been, and expect to continue to be, a target of cyber attacks that could adversely impact our reputation and operating results.

We will not succeed unless the marketplace is confident that we provide effective next-generation endpoint security protection. Because we sell next-generation endpoint security solutions, we may be an attractive target for attacks by cyber attackers or other data thieves, since a breach of our system could provide information regarding us or our customers. Accordingly, we have been, and expect to continue to be, a target of cyber attacks designed to interrupt or impede the performance of our products or the security of our cloud platform, penetrate our network security or our internal systems, or those of our customers, or to misappropriate proprietary information. For example, in 2012, we were subject to an unauthorized breach of one of our computer systems that was not protected by our platform. As a result of this attack, which we discovered in January 2013, a malicious third party gained temporary access to one

45

of our digital code-signing certificates. This third party then used this certificate to sign malware that would not be blocked by our Cb Protection security software. That malware was installed on the computers of several of our customers. While we have undertaken substantial remedial efforts to prevent similar incidents from occurring in the future, we cannot guarantee that we will not be the target of additional cyber attacks and that future cyber attacks will not be successful.

As a result of our IPO, we will likely experience increased visibility as a public company, which could have the effect of attracting the attention of more cyber attackers than would otherwise target us. If our systems are breached, attackers could learn critical information about how our products operate to help protect our customers’ endpoints, thereby making our customers more vulnerable to cyber attacks. In addition, if actual or perceived breaches of our platform occur, they could adversely affect the market perception of our products, negatively affecting our reputation, and may expose us to the loss of our proprietary information or information belonging to our customers, investigations or litigation and possible liability, including injunctive relief and monetary damages. Such security breaches could also divert the efforts of our technical and management personnel. In addition, such security breaches could impair our ability to operate our business and provide products to our customers. If this happens, our reputation could be harmed, our revenue could decline and our business could suffer.

Our business and operations are experiencing rapid growth, and if we do not appropriately manage our future growth, or are unable to scale our systems and processes, our operating results may be negatively affected.

We are a rapidly growing company. To manage future growth effectively, and in connection with our transition to being a public company, we will need to continue to improve and expand our internal IT systems, financial infrastructure and operating and administrative systems and controls, which we may not be able to do efficiently, in a timely manner or at all. Any future growth would add complexity to our organization and require effective coordination across our organization. Failure to manage any future growth effectively could result in increased costs, harm our results of operations and lead to investors losing confidence in our internal systems and processes.

If we are not successful in our continued international expansion, our operating results may be negatively affected.

We have a limited history of marketing, selling and supporting our products internationally. For both the three and nine months ended September 30, 2018, we generated approximately 17% of our revenue from customers located outside of the U.S. Our growth strategy is dependent, in part, on our continued international expansion. We expect to conduct a significant amount of our business with organizations that are located outside the U.S., particularly in Europe and Asia. As a result, we must hire and train experienced personnel to staff and manage our foreign operations. To the extent that we experience difficulties in recruiting, training, managing and retaining international employees, particularly managers and other members of our international sales team, we may experience difficulties in sales productivity in, or market penetration of, foreign markets. We also enter into strategic distributor and reseller relationships with companies in certain international markets where we do not have a local presence. If we are not able to maintain successful strategic distributor relationships with our international channel partners or recruit additional channel partners, our future success in these international markets could be limited. Business practices in the international markets that we serve may differ from those in the U.S. and may require us to include non-standard terms in customer contracts. To the extent that we enter into customer contracts in the future that include non-standard terms related to payment or performance obligations, our results of operations may be adversely impacted.

Our business, including the sales of our products by us and our channel partners, may be subject to foreign governmental regulations, which vary substantially from country to country and change from time to time. Our failure, or the failure by our channel partners, to comply with these regulations could adversely affect our business. Further, in many foreign countries it is common for others to engage in business practices that are prohibited by our internal policies and procedures or U.S. regulations applicable to us. Although we have implemented policies and procedures designed to comply with these laws and policies, there can be no assurance that our employees, contractors, channel partners and agents have complied, or will comply, with these laws and policies. Violations of laws or key control policies by our employees, contractors, channel partners or agents could result in delays in revenue recognition, financial reporting misstatements, fines, penalties or the prohibition of the importation or exportation of our products, and could have a material adverse effect on our business and results of operations. If we are unable to successfully manage the challenges of international expansion and operations, our business and operating results could be adversely affected.

46

Additionally, our international sales and operations are subject to a number of risks, including the following:

· greater difficulty in enforcing contracts and managing collections, as well as longer collection periods;

· higher costs of doing business internationally, including costs incurred in establishing and maintaining office space and equipment for our international operations;

· fluctuations in exchange rates between the U.S. dollar and foreign currencies in markets where we do business;

· management communication and integration problems resulting from cultural and geographic dispersion;

· costs associated with language localization of our products;

· risks associated with trade restrictions and foreign legal requirements, including any importation, certification and localization of our products that may be required in foreign countries;

· greater risk of unexpected changes in regulatory practices, tariffs and tax laws and treaties;

· costs of compliance with foreign laws and regulations and the risks and costs of non-compliance with such laws and regulations, including, but not limited to data privacy, data protection and data security regulations;

· compliance with anti-bribery laws, including, without limitation, the U.S. Foreign Corrupt Practices Act of 1977, as amended, the U.S. Travel Act and the UK Bribery Act 2010, violations of which could lead to significant fines, penalties and collateral consequences for our company;

· heightened risk of unfair or corrupt business practices in certain geographies and of improper or fraudulent sales arrangements that may impact financial results and result in restatements of, or irregularities in, financial statements;

· the uncertainty of protection for intellectual property rights in some countries;

· general economic and political conditions in these foreign markets, including political and economic instability in some countries;

· foreign exchange controls or tax regulations that might prevent us from repatriating cash earned outside the U.S; and

· double taxation of our international earnings and potentially adverse tax consequences due to changes in the tax laws of the U.S. or the foreign jurisdictions in which we operate.

These and other factors could harm our ability to generate future international revenue and, consequently, materially impact our business, results of operations and financial condition.

We provide service level commitments for cloud-based delivery of our products and support. Any future service disruption could obligate us to provide service credits and we could face subscription or support agreement terminations, which could adversely affect our revenue.

Our agreements with customers provide certain service level commitments, including with respect to uptime requirements for cloud-based delivery of our services and response time for support. If we are unable to meet the stated service level commitments or suffer extended periods of downtime that exceed the periods allowed under our customer agreements, we could be required to provide service credits or face subscription terminations, either of which could significantly impact our revenue.

Our customers depend on our customer support team to resolve technical issues relating to our products. We may be unable to respond quickly enough to accommodate short-term increases in customer demand for support services. Increased customer demand for these services, without corresponding revenue, could increase costs and adversely affect our operating results. Any failure to maintain high-quality customer support, or a market perception that we do not maintain high-quality support, could adversely affect our reputation

47

and our ability to sell our products to existing and prospective customers, or could result in terminations of existing customer agreements.

We are dependent on the continued services and performance of our senior management and other key employees, as well as on our ability to successfully hire, train, manage and retain qualified personnel, especially those in sales and marketing and research and development.

Our future performance depends on the continued services and contributions of our senior management, particularly Patrick Morley, our President and Chief Executive Officer, and other key employees to execute on our business plan and to identify and pursue new opportunities and product innovations. We do not maintain key man insurance for any of our executive officers or key employees. From time to time, there may be changes in our senior management team resulting from the termination or departure of our executive officers and key employees. Our senior management and key employees are generally employed on an at-will basis, which means that they could terminate their employment with us at any time. The loss of the services of our senior management, particularly Mr. Morley, or other key employees for any reason could significantly delay or prevent our development or the achievement of our strategic objectives and harm our business, financial condition and results of operations.

Our ability to successfully pursue our growth strategy will also depend on our ability to attract, motivate and retain our personnel, especially those in sales and marketing and research and development. We face intense competition for these employees from numerous technology, software and other companies, especially in certain geographic areas in which we operate, and we cannot ensure that we will be able to attract, motivate and/or retain additional qualified employees in the future. If we are unable to attract new employees and retain our current employees, we may not be able to adequately develop and maintain new products, or market our existing products at the same levels as our competitors and we may, therefore, lose customers and market share. Our failure to attract and retain personnel, especially those in sales and marketing, research and development and engineering positions, could have an adverse effect on our ability to execute our business objectives and, as a result, our ability to compete could decrease, our operating results could suffer and our revenue could decrease. Even if we are able to identify and recruit a sufficient number of new hires, these new hires will require significant training before they achieve full productivity and they may not become productive as quickly as we would like, or at all.

If we do not effectively expand, train and retain qualified sales and marketing personnel, we may be unable to acquire new customers or sell additional products to successfully pursue our growth strategy.

We depend significantly on our sales force to attract new customers and expand sales to existing customers. As a result, our ability to grow our revenue depends in part on our success in recruiting, training and retaining sufficient numbers of sales personnel to support our growth, particularly in the U.S., Europe, the Middle East, Africa and Asia Pacific. We expect to continue to expand our sales and marketing personnel significantly and face a number of challenges in achieving our hiring and integration goals. There is intense competition for individuals with sales training and experience. In addition, the training and integration of a large number of sales and marketing personnel in a short time requires the allocation of significant internal resources. We invest significant time and resources in training new sales force personnel to understand our products, platform and our growth strategy. Based on our past experience, it takes approximately six to twelve months before a new sales force member operates at target performance levels, depending on their role. However, we may be unable to achieve or maintain our target performance levels with large numbers of new sales personnel as quickly as we have done in the past. Our failure to hire a sufficient number of qualified sales force members and train them to operate at target performance levels may materially and adversely impact our projected growth rate.

If the general level of advanced cyber attacks declines, or is perceived by our current or potential customers to have declined, our business could be harmed.

Our business is substantially dependent on enterprises and governments recognizing that advanced cyber attacks are pervasive and are not effectively prevented by legacy security products. High visibility attacks on prominent enterprises and governments have increased market awareness of the problem of advanced cyber attacks and help to provide an impetus for enterprises and governments to devote resources to protecting against advanced cyber attacks, such as testing our products, purchasing them and broadly deploying them within their organizations. If advanced cyber attacks were to decline, or enterprises or governments perceived that the general level of advanced cyber attacks has declined, our ability to attract new customers and expand sales of our products to existing customers could be materially and adversely affected. A reduction in the threat landscape could increase our sales cycles and harm our business, results of operations and financial condition.

48

Organizations have been and may continue to be reluctant to purchase cyber security offerings that are cloud-based due to the actual or perceived vulnerability of cloud solutions.

Some organizations, particularly in certain geographies and industries, such as defense and financial services, have been and may continue to be reluctant to use cloud solutions for cyber security because they have concerns regarding the risks associated with the reliability or security of the technology delivery model associated with this solution. If we or other cloud service providers experience security incidents, breaches of customer data, disruptions in service delivery or other problems, the market for cloud solutions as a whole may be negatively impacted.

If we cannot maintain our company culture as we grow, we could lose the innovation, teamwork, passion and focus on execution that we believe contribute to our success and our business may be harmed.

We believe that a critical component to our success has been our company culture, which we believe fosters innovation, teamwork, passion for customers and focus on execution, and facilitates critical knowledge transfer, knowledge sharing and professional growth. We have invested substantial time and resources in building our team within this company culture. Any failure to preserve our culture could negatively affect our ability to retain and recruit personnel and to effectively focus on and pursue our corporate objectives. As we grow and develop the infrastructure of a public company, we may find it difficult to maintain these important aspects of our company culture. If we fail to maintain our company culture, our business may be adversely impacted.

Fluctuating economic conditions make it difficult to predict revenue for a particular period, and a shortfall in revenue may harm our operating results.

Our revenue depends significantly on general economic conditions and the demand for products in the next-generation endpoint security market. Economic weakness, customer financial difficulties and constrained spending on cyber security may result in decreased revenue and earnings. Such factors could make it difficult to accurately forecast our sales and operating results and could negatively affect our ability to provide accurate forecasts of our costs and expenses. In addition, concerns regarding continued budgetary challenges in the U.S. and Europe, geopolitical turmoil and terrorism in many parts of the world, and the effects of climate change have and may continue to put pressure on global economic conditions and overall spending on cyber security. Currently, most enterprises and governments have not allocated a fixed portion of their budgets to protect against next-generation advanced cyber attacks. If we do not succeed in convincing customers that our products should be an integral part of their overall approach to cyber security and that a fixed portion of their annual security budgets should be allocated to our products, general reductions in security spending by our customers are likely to have a disproportionate impact on our business, results of operations and financial condition. General economic weakness may also lead to longer collection cycles for payments due from our customers, an increase in customer bad debt, restructuring initiatives and associated expenses and impairment of investments. Furthermore, the continued weakness and uncertainty in worldwide credit markets, including the sovereign debt situation in certain countries in the European Union, or EU, may adversely impact the ability of our customers to adequately fund their expected capital expenditures, which could lead to delays or cancellations of planned purchases of our products.

Uncertainty about future economic conditions also makes it difficult to forecast operating results and to make decisions about future investments. Future or continued economic weakness for us or our customers, failure of our customers and markets to recover from such weakness, customer financial difficulties and reductions in spending on cyber security could have a material adverse effect on demand for our products, and consequently on our business, financial condition and results of operations.

If we are not able to maintain and enhance our brand or reputation as an industry leader, our business and operating results may be adversely affected.

We believe that maintaining and enhancing our reputation as a leader in next-generation endpoint security is critical to our relationship with our existing end-use customers and channel partners and our ability to attract new customers and channel partners. The successful promotion of our brand will depend on a number of factors, including our marketing efforts, our ability to continue to develop high-quality features for our products and our ability to successfully differentiate our products from those of our competitors. Our brand promotion activities may not be successful or yield increased revenue. In addition, independent industry analysts often provide reports of our solutions, as well as the solutions of our competitors, and perception of our solutions in the marketplace may be significantly influenced by these reports. If these reports are negative, or less positive as compared to those of our competitors’ products, our reputation may be adversely affected. Additionally, the performance of our channel partners may affect our brand and reputation if

49

customers do not have a positive experience with our products as implemented by our channel partners or with the implementation generally. The promotion of our brand requires us to make substantial expenditures, and we anticipate that the expenditures will increase as our market becomes more competitive, as we expand into new geographies and vertical markets and as more sales are generated through our channel partners. To the extent that these activities yield increased revenue, this revenue may not offset the increased expenses we incur. If we do not successfully maintain and enhance our brand and reputation, our business and operating results may be adversely affected.

Our brand, reputation and ability to attract, retain and serve our customers are dependent in part upon the reliable performance of our products and infrastructure.

Our brand, reputation and ability to attract, retain and serve our customers are dependent in part upon the reliable performance of, and the ability of our existing customers and new customers to access and use, our solutions and infrastructure. We have experienced, and may in the future experience, disruptions, outages and other performance problems due to a variety of factors, including infrastructure changes, equipment failure, human or software errors, capacity constraints and fraud or security attacks. In some instances, we may not be able to identify the cause or causes of these performance problems within an acceptable period of time.

We operate and maintain our infrastructure at our headquarters and by using third-party data centers located in the Boston, Massachusetts area. We also utilize Amazon Web Services, or AWS, for the delivery of our cloud-based products. In addition, our ability to access certain third-party software-as-a-service, or SaaS, solutions, such as Salesforce, is important to our operations and our ability to execute sales. Some elements of this complex system are operated by third parties that we do not control and that could require significant time to replace. We expect this dependence on third parties to continue. Interruptions in our systems or the third-party systems on which we rely, whether due to system failures, computer viruses, physical or electronic break-ins, or other factors, could affect the security or availability of our products, network infrastructure, cloud infrastructure and website.

Prolonged delays or unforeseen difficulties in connection with adding capacity or upgrading our network architecture when required may cause our service quality to suffer. Problems with the reliability or security of our systems could harm our reputation. Damage to our reputation and the cost of remedying these problems could negatively affect our business, financial condition and operating results.

Additionally, our existing data center facilities and third-party hosting providers have no obligations to renew their agreements with us on commercially reasonable terms or at all, and certain of the agreements governing these relationships may be terminated by either party at any time. If we are unable to maintain or renew our agreements with these providers on commercially reasonable terms or if in the future we add additional data center facilities or third-party hosting providers, we may experience costs or downtime as we transition our operations.

Any disruptions or other performance problems with our products could harm our reputation and business and may damage our customers’ businesses. Interruptions in our service delivery might reduce our revenue, cause us to issue credits to customers, subject us to potential liability and cause customers to not renew their purchases or our products.

In deploying our cloud-based SaaS products, we rely upon AWS to operate our cloud-based offerings; any disruption or interference with our use of AWS would adversely affect our business, results of operations and financial condition.

AWS is a third-party provider of cloud infrastructure services. We outsource substantially all of the infrastructure relating to our cloud offerings to AWS. Our Predictive Security Cloud resides on hardware owned or leased and operated by us at the AWS data centers. Customers of our cloud-based SaaS products need to be able to access our platform at any time, without interruption or degradation of performance, and we provide them with service level commitments with respect to uptime. Our cloud-based SaaS products depend on protecting the virtual cloud infrastructure hosted in AWS by maintaining its configuration, architecture, features and interconnection specifications, as well as the information stored in these virtual data centers and which third-party internet service providers transmit. Although we have disaster recovery plans that utilize multiple AWS locations, any incident affecting their infrastructure that may be caused by fire, flood, severe storm, earthquake or other natural disasters, cyber attacks, terrorist or other attacks, and other similar events beyond our control could negatively affect our cloud-based SaaS products. For example, in September 2015 and February 2017, AWS suffered significant outages that had a widespread impact on cloud-based software and services companies. Although our customers were not affected by that outage, a similar outage could render our cloud-based offerings inaccessible to customers. A prolonged AWS service disruption affecting our cloud-based offerings for any of the foregoing reasons would negatively impact our ability to serve our customers and could damage our reputation with current and potential customers, expose us to liability, cause us to

50

lose customers or otherwise harm our business. We may also incur significant costs for using alternative equipment or taking other actions in preparation for, or in reaction to, events that damage the AWS services we use.

In addition, AWS may terminate the agreement with us by providing two years’ prior written notice, and may terminate the agreement for cause with 30 days’ prior written notice, including any material breach of the agreement by us that we do not cure within the 30-day cure period. In the event that our AWS service agreements are terminated, or there is a lapse of service, elimination of AWS services or features that we utilize, interruption of internet service provider connectivity or damage to such facilities, we could experience interruptions in access to our platform as well as significant delays and additional expense in arranging or creating new facilities and services and/or re-architecting our cloud offering for deployment on a different cloud infrastructure service provider, which may adversely affect our business, operating results and financial condition.

If we fail to manage our operations infrastructure, our customers may experience service outages and/or delays.

Our future growth is dependent upon our ability to continue to meet the expanding needs of our customers and to attract new customers. As existing customers gain more experience with our products, they may broaden their reliance on our products, which will require that we expand our operations infrastructure as well as our dependence on third parties to support that infrastructure. We also seek to maintain excess capacity in our operations infrastructure to facilitate the rapid provision of new customer deployments. In addition, we need to properly manage our technological operations infrastructure to support changes in hardware and software parameters and the evolution of our solutions, all of which require significant lead time. If we do not accurately predict our infrastructure requirements, our existing customers may experience service outages that may subject us to financial penalties, financial liabilities and customer losses. If our operations infrastructure fails to keep pace with increased sales, customers may experience delays as we seek to obtain additional capacity, which could adversely affect our reputation and our revenue.

If our customers are unable to implement our products successfully, customer perceptions of our products may be impaired or our reputation and brand may suffer.

Our products are deployed in a wide variety of IT environments, including large-scale, complex infrastructures. Some of our customers have experienced difficulties implementing our products in the past and may experience implementation difficulties in the future. If our customers are unable to implement our products successfully, customer perceptions of our products may be impaired or our reputation and brand may suffer.

In addition, for our products to achieve their functional potential, our products must effectively integrate into our customers’ IT infrastructures, which have different specifications, utilize varied protocol standards, deploy products from multiple different vendors and contain multiple layers of products that have been added over time. Our customers’ IT infrastructures are also dynamic, with a myriad of devices and endpoints entering and exiting the customers’ IT systems on a regular basis, and our products must be able to effectively adapt to and track these changes.

Any failure by our customers to appropriately implement our products or any failure of our products to effectively integrate and operate within our customers’ IT infrastructures could result in customer dissatisfaction, impact the perceived reliability of our products, result in negative press coverage, negatively affect our reputation and harm our financial results.

We have in the past completed acquisitions and may acquire or invest in other companies or technologies in the future, which could divert management’s attention, fail to meet our expectations, result in additional dilution to our stockholders, increase expenses, disrupt our operations or otherwise harm our operating results.

We have in the past acquired, and we may in the future acquire or invest in, businesses, products or technologies that we believe could complement or expand our platform, enhance our technical capabilities or otherwise offer growth opportunities. For example, in February 2014, we acquired Carbon Black (our name at the time was Bit9, Inc.), a threat detection and response software company; in 2015, we acquired Objective Logistics Inc., a software company, and VisiTrend, Inc., a security analytics company; and in 2016, we acquired Confer Technologies, Inc., a next-generation antivirus software company. We may not be able to fully realize the anticipated benefits of these or any future acquisitions. The pursuit of potential acquisitions may divert the attention of management and cause us to incur various expenses related to identifying, investigating and pursuing suitable acquisitions, whether or not they are consummated.

51

There are inherent risks in integrating and managing acquisitions. If we acquire additional businesses, we may not be able to assimilate or integrate the acquired personnel, operations, products, services and technologies successfully or effectively manage the combined business following the acquisition and our management may be distracted from operating our business. We also may not achieve the anticipated benefits from the acquired business due to a number of factors, including, without limitation:

· unanticipated costs or liabilities associated with the acquisition;

· incurrence of acquisition-related costs, which would be recognized as a current period expense;

· inability to generate sufficient revenue to offset acquisition or investment costs;

· the inability to maintain relationships with customers and partners of the acquired business;

· the difficulty of incorporating acquired technology and rights into our platform and of maintaining quality and security standards consistent with our brand;

· delays in customer purchases due to uncertainty related to any acquisition;

· the need to integrate or implement additional controls, procedures and policies;

· challenges caused by distance, language and cultural differences;

· harm to our existing business relationships with business partners and customers as a result of the acquisition;

· the potential loss of key employees;

· use of resources that are needed in other parts of our business and diversion of management and employee resources;

· the inability to recognize acquired deferred revenue in accordance with our revenue recognition policies; and

· use of substantial portions of our available cash or the incurrence of debt to consummate the acquisition.

Acquisitions also increase the risk of unforeseen legal liability, including for potential violations of applicable law or industry rules and regulations, arising from prior or ongoing acts or omissions by the acquired businesses that are not discovered by due diligence during the acquisition process. Generally, if an acquired business fails to meet our expectations, our operating results, business and financial condition may suffer. Acquisitions could also result in dilutive issuances of equity securities or the incurrence of debt, which could adversely affect our business, results of operations and financial condition.

In addition, a significant portion of the purchase price of companies we acquire may be allocated to goodwill and other intangible assets, which must be assessed for impairment at least annually. If our acquisitions do not ultimately yield expected returns, we may be required to take charges to our operating results based on our impairment assessment process, which could harm our results of operations.

The failure of our customers to correctly use our products, or our failure to effectively assist customers in installing our products and provide effective ongoing support, may harm our business.

Our customers depend in large part on customer support delivered by us to resolve issues relating to the use of our products. However, even with our support, our customers are ultimately responsible for effectively using our products, and ensuring that their IT staff is properly trained in the use of our products, and complementary security products. The failure of our customers to correctly use our products, or our failure to effectively assist customers in installing our products and provide effective ongoing support, may result in an increase in the vulnerability of our customers’ IT infrastructures and sensitive business data. We are also in the process of expanding our certification program and professional service organization. It can take significant time and resources to recruit, hire and train qualified technical support and service employees. We may not be able to keep up with demand, particularly if the sales of our products exceed our internal forecasts. To the extent that we are unsuccessful in hiring, training and retaining adequate support resources, our ability to

52

provide adequate and timely support to our customers may be negatively impacted, and our customers’ satisfaction with our products may be adversely affected. Additionally, in unusual circumstances, if we were to need to rely on our sales engineers to provide post-sales support while we are growing our service organization, our sales productivity may be negatively impacted. Accordingly, our failure to provide satisfactory maintenance and technical support services could have a material and adverse effect on our business and results of operations.

The sales prices of our products and services may decrease, which may reduce our gross profits and adversely impact our financial results.

The sales prices for our products and services may decline for a variety of reasons, including competitive pricing pressures, discounts, a change in our mix of products and services, anticipation of the introduction of new products or promotional programs. Competition continues to increase in the market segments in which we participate, and we expect competition to further increase in the future, thereby leading to increased pricing pressures. Larger competitors with more diverse product and service offerings may reduce the price of products that compete with ours or may bundle them with other products and services. Additionally, currency fluctuations in certain countries and regions may negatively impact prices that partners and customers are willing to pay in those countries and regions. Furthermore, we anticipate that the sales prices and gross profits for our products will decrease over product life cycles. We cannot be certain that we will be successful in developing and introducing new products with enhanced functionality on a timely basis, or that our new product offerings, if introduced, will enable us to maintain our prices and gross profits at levels that will allow us to maintain positive gross margins and achieve profitability.

We incorporate technology from third parties into our products, and our inability to obtain or maintain rights to the technology could harm our business.

We incorporate technology from third parties into our products. We cannot be certain that our suppliers and licensors are not infringing the intellectual property rights of third parties or that the suppliers and licensors have sufficient rights to the technology in all jurisdictions in which we may sell our products. We may not be able to rely on indemnification obligations of third parties if some of our agreements with our suppliers and licensors may be terminated for convenience by them. If we are unable to obtain or maintain rights to any of this technology because of intellectual property infringement claims brought by third parties against our suppliers and licensors or against us, or if we are unable to continue to obtain such technology or enter into new agreements on commercially reasonable terms, our ability to develop and sell products, subscriptions and services containing such technology could be severely limited, and our business could be harmed. Additionally, if we are unable to obtain necessary technology from third parties, including certain sole suppliers, we may be forced to acquire or develop alternative technology, which may require significant time, cost and effort and may be of lower quality or performance standards. This would limit and delay our ability to offer new or competitive products, and increase our costs of production. If alternative technology cannot be obtained or developed, we may not be able to offer certain functionality as part of our products, subscriptions and services. As a result, our margins, market share and results of operations could be significantly harmed.

Our products contain third-party open source software components, and our failure to comply with the terms of the underlying open source software licenses could restrict our ability to sell our products.

Our products contain software licensed to us by third parties under so-called “open source” licenses. Open source software is typically freely accessible, usable and modifiable. Certain open source software licenses require a user who intends to distribute the open source software as a component of the user’s software to disclose publicly part or all of the source code to the user’s software. In addition, certain open source software licenses require the user of such software to make any derivative works of the open source code available to others on unfavorable terms or at no cost. This can subject previously proprietary software to open source license terms. From time to time, there have been claims against companies that distribute or use open source software in their products and services, asserting that such open source software infringes the claimants’ intellectual property rights. We could be subject to suits by parties claiming that what we believe to be licensed open source software infringes their intellectual property rights. Use and distribution of open source software may entail greater risks than use of third-party commercial software, as open source licensors generally do not provide warranties or other contractual protections regarding infringement claims or the quality of the code. In addition, certain open source licenses require that source code for software programs that are subject to the license be made available to the public and that any modifications or derivative works to such open source software continue to be licensed under the same terms.

53

Although we monitor our use of open source software in an effort both to comply with the terms of the applicable open source licenses and to avoid subjecting our products to conditions we do not intend, the terms of many open source licenses have not been interpreted by U.S. courts, and there is a risk that these licenses could be construed in a way that could impose unanticipated conditions or restrictions on our ability to commercialize our products. The terms of certain open source licenses require us to release the source code of our applications and to make our applications available under those open source licenses if we combine or distribute our applications with open source software in a certain manner. In the event that portions of our applications are determined to be subject to an open source license, we could be required to publicly release the affected portions of our source code, re-engineer all, or a portion of, those applications or otherwise be limited in the licensing of our applications. Disclosing our proprietary source code could allow our competitors to create similar products with lower development effort and time and ultimately could result in a loss of sales for us. Disclosing the source code of our proprietary software could also make it easier for cyber attackers and other third parties to discover vulnerabilities in or to defeat the protections of our products, which could result in our products failing to provide our customers with the security they expect. Any of these events could have a material adverse effect on our business, operating results and financial condition.

We therefore could also be subject to claims alleging that we have not complied with the restrictions or limitations of the applicable open source software license terms. In that event, we could incur significant legal expenses, be subject to significant damages, be enjoined from further sale and distribution of our products or solutions that use the open source software, be required to pay a license fee, be forced to reengineer our products and solutions or be required to comply with the foregoing conditions of the open source software licenses (including the release of the source code to our proprietary software), any of which could adversely affect our business. Even if these claims do not result in litigation or are resolved in our favor or without significant cash settlements, the time and resources necessary to resolve them could harm our business, results of operations, financial condition and reputation.

Our sales cycles can be long and unpredictable, and our sales efforts require considerable time and expense. As a result, our sales and revenue are difficult to predict and may vary substantially from period to period, which may cause our results of operations to fluctuate significantly.

Our results of operations may fluctuate, in part, because of the resource intensive nature of our sales efforts, the length and variability of our sales cycle and the short-term difficulty in adjusting our operating expenses. Our results of operations depend in part on sales to large organizations. The length of our sales cycle, from proof of concept to delivery of and payment for our platform, is typically three to nine months but can be more than a year for large enterprise customers. To the extent our competitors develop solutions that our prospective customers view as equivalent to ours, our average sales cycle may increase. Because the length of time required to close a sale varies substantially from customer to customer, it is difficult to predict exactly when, or even if, we will make a sale with a potential customer. As a result, large individual sales have, in some cases, occurred in quarters subsequent to those we anticipated, or have not occurred at all. The loss or delay of one or more large transactions in a quarter could impact our results of operations for that quarter and any future quarters for which revenue from that transaction is delayed. As a result of these factors, it is difficult for us to forecast our revenue accurately in any quarter. Because a substantial portion of our expenses are relatively fixed in the short term, our results of operations will suffer if our revenue falls below our or analysts’ expectations in a particular quarter, which could cause the price of our common stock to decline.

A portion of our revenue is generated by sales to government entities, which are subject to a number of challenges and risks.

Selling to government entities can be highly competitive, expensive and time-consuming, and often requires significant upfront time and expense without any assurance that we will win a sale. Government demand and payment for our solutions may also be impacted by changes in fiscal or contracting policies, changes in government programs or applicable requirements, the adoption of new laws or regulations or changes to existing laws or regulations, public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our solutions. Government entities also have heightened sensitivity surrounding the purchase of cyber security products due to the critical importance of their IT infrastructures, the nature of the information contained within those infrastructures and the fact that they are highly visible targets for cyber attacks. Accordingly, increasing sales of our products to government entities may be more challenging than selling to commercial organizations, especially given extensive certification, clearance and security requirements. Government agencies may have statutory, contractual or other legal rights to terminate contracts with us or channel partners. Further, in the course of providing our solutions to government entities, our employees and those of our channel partners may be exposed to sensitive government information. Any failure by us or our channel partners to safeguard and maintain the confidentiality of such information could subject us to liability and reputational harm, which could materially and adversely affect our results of operations and financial performance. Governments routinely investigate and audit government

54

contractors’ administrative processes, and any unfavorable audit may cause the government to shift away from our solutions and may result in a reduction of revenue, fines or civil or criminal liability if the audit uncovers improper or illegal activities, which could adversely impact our results or operations.

Our efforts to expand our international sales and operations may increasingly expose us to fluctuations in currency exchange rates, which could negatively affect our financial condition and results of operations.

Our reporting currency is the U.S. dollar, and we generate a substantial majority of our revenue and expenses in U.S. dollars. For both the three and nine months ended September 30, 2018, approximately 6% of our revenue was generated in foreign currencies from customers located outside of the U.S. Additionally, for the three and nine months ended September 30, 2018, we incurred approximately 9% and 8%, respectively, of our expenses outside of the U.S. in foreign currencies, primarily the British pound, principally with respect to salaries and related personnel expenses associated with our sales operations. The exchange rate between the U.S. dollar and foreign currencies has fluctuated substantially in recent years and may continue to fluctuate substantially in the future. Accordingly, as we continue with our anticipated international expansion, changes in exchange rates may have an increasingly adverse effect on our business, operating results and financial condition. To date, we have not engaged in any hedging strategies, and any such strategies, such as forward contracts, options and foreign exchange swaps related to transaction exposures that we may implement to mitigate this risk may not eliminate our exposure to foreign exchange fluctuations.

Changes in or interpretations of financial accounting standards may cause an adverse impact to our reported results of operations.

We prepare our consolidated financial statements in conformity with generally accepted accounting principles in the U.S., or GAAP. These principles are subject to interpretation by the Securities and Exchange Commission, or SEC, and various bodies formed to interpret and create appropriate accounting standards. It is possible that future requirements could change our current application of GAAP, resulting in a material adverse impact on our reported results of operations or financial position, and may even affect our reporting of transactions completed before the change is effective. New accounting pronouncements and varying interpretations of accounting pronouncements have occurred and may occur in the future. Changes to existing rules or the questioning of current practices may harm our operating results or the way we conduct our business.

We may require additional capital to support business growth, and this capital might not be available on acceptable terms, if at all.

We intend to continue to make investments to support our business growth and may require additional funds to respond to business challenges, including the need to develop new features or enhance our products, improve our operating infrastructure or acquire complementary businesses and technologies. Accordingly, we may need to engage in equity or debt financings to secure additional funds. If we raise additional funds through future issuances of equity or convertible debt securities, our existing stockholders could suffer significant dilution, and any new equity securities we issue could have rights, preferences and privileges superior to those of holders of our common stock. Any debt financing that we may secure in the future could involve restrictive covenants relating to our capital raising activities and other financial and operational matters, which may make it more difficult for us to obtain additional capital and to pursue business opportunities, including potential acquisitions. We may not be able to obtain additional financing on terms favorable to us, if at all. If we are unable to obtain adequate financing or financing on terms satisfactory to us when we require it, our ability to continue to support our business growth and to respond to business challenges could be significantly impaired, and our business may be adversely affected.

Our existing credit agreement contains operating and financial covenants that may adversely impact our business and the failure to comply with such covenants could prevent us from borrowing funds and could cause any outstanding debt to become immediately payable.

We are a party to a line of credit with Silicon Valley Bank. Borrowings under this line of credit are secured by substantially all of our assets, excluding certain intellectual property rights. We are also subject to various financial reporting requirements and financial covenants under the line of credit, including maintaining specified liquidity measurements. In addition, there are negative covenants restricting our activities, including limitations on dispositions, mergers or acquisitions; encumbering intellectual property; incurring indebtedness or liens; paying dividends and redeeming or repurchasing capital stock; making certain investments; and engaging in certain other business transactions. The obligations under the line of credit are subject to acceleration upon the occurrence of specified events of default, including a material adverse change in our business, operations or financial or other condition. These restrictions and covenants, as well as those contained in any future financing agreements that we may enter into, may restrict our ability to finance our

55

operations and to engage in, expand or otherwise pursue our business activities and strategies. Our ability to comply with these covenants may be affected by events beyond our control, and breaches of these covenants could result in a default under the credit agreement and any future financial agreements that we may enter into. If not waived, defaults could cause our outstanding indebtedness under our credit agreement and any future financing agreements that we may enter into to become immediately due and payable.

Our business is subject to the risks of earthquakes, fire, power outages, floods and other catastrophic events, and to interruption by manmade problems such as terrorism.

A significant natural disaster, such as an earthquake, fire or a flood, or a significant power outage could have a material adverse impact on our business, operating results and financial condition. In addition, natural disasters could affect our channel partners’ ability to perform services for us on a timely basis. In the event we or our channel partners are hindered by any of the events discussed above, our ability to provide our products to customers could be delayed.

In addition, our facilities and those of our third-party data centers and hosting providers are vulnerable to damage or interruption from human error, intentional bad acts, pandemics, earthquakes, hurricanes, floods, fires, war, terrorist attacks, power losses, hardware failures, systems failures, telecommunications failures and similar events. The occurrence of a natural disaster, power failure or an act of terrorism, vandalism or other misconduct, a decision by a third party to close a facility on which we rely without adequate notice, or other unanticipated problems could result in lengthy interruptions in provision or delivery of our products, potentially leaving our customers vulnerable to cyber attacks. The occurrence of any of the foregoing events could damage our systems and hardware or could cause them to fail completely, and our insurance may not cover such events or may be insufficient to compensate us for the potentially significant losses, including the potential harm to the future growth of our business, that may result from interruptions in our platform as a result of system failures.

All of the aforementioned risks may be exacerbated if the disaster recovery plans for us and our third-party data centers and hosting providers prove to be inadequate. To the extent that any of the above results in delayed or reduced customer sales, our business, financial condition and results of operations could be adversely affected.

Risks Related to Government Regulation, Data Collection, Intellectual Property and Litigation

Failure to comply with governmental laws and regulations could harm our business.

Our business is subject to regulation by various federal, state, local and foreign governments. In certain jurisdictions, these regulatory requirements may be more stringent than those in the U.S. Noncompliance with applicable regulations or requirements could subject us to investigations, sanctions, mandatory product recalls, enforcement actions, disgorgement of profits, fines, damages, civil and criminal penalties, injunctions or other collateral consequences. If any governmental sanctions are imposed, or if we do not prevail in any possible civil or criminal litigation, our business, results of operations and financial condition could be materially adversely affected. In addition, responding to any action will likely result in a significant diversion of management’s attention and resources and an increase in professional fees. Enforcement actions and sanctions could harm our business, reputation, results of operations and financial condition.

We are subject to governmental export controls and economic sanctions regulations that could impair our ability to compete in international markets and/or subject us to liability if we are not in compliance with applicable laws.

Like other U.S.-origin cyber security products, our products are subject to U.S. export control laws and regulations, including the U.S. Export Administration Regulations and various economic and trade sanctions regulations administered by the U.S. Treasury Department’s Office of Foreign Assets Control. Exports of these products must be made in compliance with these laws and regulations. If we fail to comply with these laws and regulations, we and certain of our employees could be subject to substantial civil and criminal penalties, including fines for our company and responsible employees or managers, and, in extreme cases, incarceration of responsible employees and managers and the possible loss of export privileges. Complying with export control laws and regulations, including obtaining the necessary licenses or authorizations, for a particular sale may be time-consuming, is not guaranteed and may result in the delay or loss of sales opportunities. Changes in export or sanctions laws and regulations, shifts in the enforcement or scope of existing laws and regulations, or changes in the countries, governments, persons or products targeted by such laws and regulations, could also result in decreased use of our products by, or in our decreased ability to export or sell our products to, existing or potential customers. A

56

decreased use of our products or limitation on our ability to export or sell our products could adversely affect our business, financial condition and results of operations.

Further, our products incorporate encryption technology. These encryption products may be exported outside of the U.S. only with the required export authorizations, including by a license, a license exception or other appropriate government authorizations; such items may also be subject to certain regulatory reporting requirements. Further, U.S. export control laws and economic sanctions prohibit the shipment or provision of certain products to U.S.-embargoed or sanctioned countries, governments or persons as well as the exposure of software code to nationals of embargoed countries. Although we take precautions to prevent our products from being provided or exposed to those subject to U.S. sanctions, such measures may be circumvented or inadvertently violated.

In addition, various countries regulate the import and domestic use of certain encryption technology, including through import permitting and licensing requirements, and have enacted laws that could limit our customers’ ability to implement our products in those countries.

Multinational efforts are currently underway as part of the Wassenaar Arrangement on Export Controls for Conventional Arms and Dual-Use Goods and Technologies, or the Wassenaar Arrangement, to impose additional restrictions on certain cyber security products. To implement the controls under the Wassenaar Arrangement in the U.S., on May 20, 2015, the U.S. Department of Commerce’s Bureau of Industry and Security, or BIS, published a proposed rule for public comment that would amend the Export Administration Regulations with regard to exports, reexports and transfers (in-country) of specified intrusion software, surveillance items and related software and technology. Under the proposed rule, intrusion software and surveillance items were defined broadly and would have established an export license requirement for all countries other than the U.S. and Canada for many commercially available penetration testing and network monitoring products. The proposed rule was ultimately withdrawn due to wide public objection, and the U.S. has agreed to renegotiate the breath of the language under the Wassenaar Arrangement. Should the U.S. adopt an onerous policy, this could affect our business and could result in loss of potential market in certain countries, increased administrative costs and delays or loss of sales opportunities.

Failure to comply with applicable anti-corruption legislation could result in fines, criminal penalties and materially adversely affect our business, financial condition and results of operations.

We are required to comply with anti-corruption and anti-bribery laws in the jurisdictions in which we operate, including the Foreign Corrupt Practices Act, or FCPA, in the U.S., the UK Bribery Act, or the Bribery Act, and other similar laws in other countries in which we do business. As a result of doing business in foreign countries, including through channel partners and agents, we will be exposed to a risk of violating anti-corruption laws. Some of the international locations in which we will operate have developing legal systems and may have higher levels of corruption than more developed nations. The FCPA prohibits providing anything of value to foreign officials for the purposes of obtaining or retaining business or securing any improper business advantage. We may deal with both governments and state-owned business enterprises, the employees of which are considered foreign officials for purposes of the FCPA. The provisions of the Bribery Act extend beyond bribery of foreign public officials and are more onerous than the FCPA in a number of other respects, including jurisdiction, non-exemption of facilitation payments and penalties.

Although we have adopted policies and procedures designed to ensure that we, our employees and third-party agents will comply with such laws, there can be no assurance that such policies or procedures will work effectively at all times or protect us against liability under these or other laws for actions taken by our employees, channel partners and other third parties with respect to our business. If we are not in compliance with anti-corruption laws and other laws governing the conduct of business with government entities and/or officials (including local laws), we may be subject to criminal and civil penalties and other remedial measures, which could harm our business, financial condition, results of operations, cash flows and prospects. In addition, investigations of any actual or alleged violations of such laws or policies related to us could harm our business, financial condition, results of operations, cash flows and prospects.

Because our products may collect and store user and related information, domestic and international privacy and cyber security concerns, and other laws and regulations, could result in additional costs and liabilities to us or inhibit sales of our products.

We, our channel partners and our customers are subject to a number of domestic and international laws and regulations that apply to online services and the internet generally. These laws, rules and regulations address a range of issues including data privacy and cyber security, breach notification and restrictions or technological requirements regarding the collection, use, storage, protection, retention or transfer of data. The regulatory framework for online services, data privacy and cyber security issues worldwide can vary substantially

57

from jurisdiction to jurisdiction, is rapidly evolving and is likely to remain uncertain for the foreseeable future. Many federal, state and foreign government bodies and agencies have adopted or are considering adopting laws, rules and regulations regarding the collection, use, storage and disclosure of information, web browsing and geolocation data collection, data analytics, cyber security and breach response and notification procedures. Interpretation of these laws, rules and regulations and their application to our products in the U.S. and foreign jurisdictions is ongoing and cannot be fully determined at this time.

In the U.S., these include rules and regulations promulgated under the authority of the Federal Trade Commission, the Electronic Communications Privacy Act, Computer Fraud and Abuse Act, HIPAA, the Gramm Leach Bliley Act and state breach notification laws, other state laws and regulations applicable to privacy and data security, as well as regulator enforcement positions and expectations reflected in federal and state regulatory actions, settlements, consent decrees and guidance documents.

Internationally, virtually every jurisdiction in which we operate and have customers and/or have prospective customers to which we market has established its own data security and privacy legal frameworks with which we, our channel partners or our customers must comply. Further, many federal, state and foreign government bodies and agencies have introduced, and are currently considering, additional laws and regulations. If passed, we will likely incur additional expenses and costs associated with complying with such laws, as well as face heightened potential liability if we are unable to comply with these laws.

Laws in the European Economic Area, or EEA, regulate transfers of EU personal data to third countries, such as the U.S., that have not been found to provide adequate protection to such personal data. We have in the past relied upon adherence to the U.S. Department of Commerce’s U.S.-EU Safe Harbor Framework which established a means for legitimating the transfer of personal data from the EEA to the U.S. However, the Court of Justice of the European Union invalidated the U.S.-EU Safe Harbor Framework in October 2015 and, in February 2016, EU and U.S. negotiators agreed to a new framework, the EU-U.S. Privacy Shield, which came into effect in July 2016. However, there are recent regulatory concerns about this framework, as well as litigation challenging other EU mechanisms for adequate data transfer (i.e., the standard contractual clauses). We are certified under the EU-U.S. Privacy Shield, and rely on a mixture of mechanisms to transfer EU personal data to the U.S. We could be impacted by changes in law as a result of the current challenges to these mechanisms by regulators and in the European courts which may lead to governmental enforcement actions, litigation, fines and penalties or adverse publicity, which could have an adverse effect on our reputation and business.

On April 27, 2016, the European Union adopted the General Data Protection Regulation 2016/679, or GDPR, that took effect on May 25, 2018 replacing the current data protection laws of each EU member state. The GDPR applies to any company established in the EU as well as to those outside the EU if they collect and use personal data in connection with the offering of goods or services to individuals in the EU or the monitoring of their behavior (for example, through email monitoring). The GDPR enhances data protection obligations for processors and controllers of personal data, including, for example, expanded disclosures about how personal information is to be used, limitations on retention of information, mandatory data breach notification requirements and onerous new obligations on services providers. Non-compliance with the GDPR can trigger steep fines of up to €20 million or 4% of total worldwide annual turnover, whichever is higher. Given the breadth and depth of changes in data protection obligations, preparing to meet the GDPR’s requirements before its application on May 25, 2018 required time, resources and a review of our technology and systems against the GDPR’s requirements. We have engaged a third party to assist us in undertaking a data protection review, and have implemented remedial changes towards GDPR compliance. Separate EU laws and regulations (and member states’ implementations thereof) govern the protection of consumers and of electronic communications and these are also evolving. For instance, the current European laws that cover the use of cookies and similar technology and marketing online or by electronic means are under reform. A draft of the new ePrivacy Regulation extends the strict opt-in marketing rules with limited exceptions to business-to-business communications, alters rules on third-party cookies, web beacons and similar technology and significantly increases penalties. We cannot yet determine the impact such future laws, regulations, and standards may have on our business. Such laws and regulations are often subject to differing interpretations and may be inconsistent among jurisdictions. We have incurred and may continue to incur substantial expense in complying with the new obligations to be imposed by the GDPR and we may be required to make significant changes in our business operations and product and services development, all of which may adversely affect our revenues and our business.

We and our customers are at risk of enforcement actions taken by certain EU data protection authorities until such point in time that we may be able to ensure that all transfers of personal data to us from the EEA are conducted in compliance with all applicable regulatory obligations, the guidance of data protection authorities and evolving best practices. We may find it necessary to establish systems to maintain personal data originating from the EU in the EEA, which may involve substantial expense and may cause us to need to divert resources from other aspects of our business, all of which may adversely affect our business.

58

Because the interpretation and application of privacy and data protection laws are still uncertain, it is possible that these laws may be interpreted and applied in a manner that is inconsistent with our existing practices or the features of our products. We may also be subject to claims of liability or responsibility for the actions of third parties with whom we interact or upon whom we rely in relation to various products, including but not limited to vendors and business partners. If so, in addition to the possibility of fines, lawsuits and other claims, we could be required to fundamentally change our business activities and practices or modify our products, which could have an adverse effect on our business. Any inability to adequately address privacy and/or data concerns, even if unfounded, or comply with applicable privacy or data protection laws, regulations and policies, could result in additional cost and liability to us, damage our reputation, inhibit sales and adversely affect our business.

The costs of compliance with, and other burdens imposed by, the laws, rules, regulations and policies that are applicable to the businesses of our customers may limit the use and adoption of, and reduce the overall demand for, our software. Even the perception of privacy concerns, whether or not valid, may harm our reputation, inhibit adoption of our products by current and future customers, or adversely impact our ability to attract and retain workforce talent. Our failure to comply with applicable laws and regulations, or to protect such data, could result in enforcement action against us, including fines, imprisonment of company officials and public censure, claims for damages by customers and other affected individuals, damage to our reputation and loss of goodwill (both in relation to existing customers and prospective customers), any of which could have a material adverse effect on our operations, financial performance and business.

Our intellectual property rights are valuable and any inability to protect our proprietary technology and intellectual property rights could substantially harm our business and operating results.

Our future success and competitive position depend in part on our ability to protect our intellectual property and proprietary technologies. To safeguard these rights, we rely on a combination of patent, trademark, copyright and trade secret laws and contractual protections in the U.S. and other jurisdictions, all of which provide only limited protection and may not now or in the future provide us with a competitive advantage. We maintain a program of identifying technology appropriate for patent protection. Our practice is to require employees and consultants to execute non-disclosure and proprietary rights agreements upon commencement of employment or consulting arrangements. These agreements acknowledge our exclusive ownership of all intellectual property developed by the individuals during their work for us and require that all proprietary information disclosed will remain confidential. Such agreements may not be enforceable in full or in part in all jurisdictions and any breach could have a negative effect on our business and our remedy for such breach may be limited.

We have approximately 20 U.S. patents and patent applications relating to our products. We cannot be certain that any patents will issue from any patent applications, that patents that issue from such applications will give us the protection that we seek or that any such patents will not be challenged, invalidated, or circumvented. Any patents that may issue in the future from our pending or future patent applications may not provide sufficiently broad protection and may not be enforceable in actions against alleged infringers. We have registered the “Carbon Black,””Cb Collective Defense Cloud,” “Arm Your Endpoints” and “Bit9” names and logos in the U.S. and certain other countries. We have registrations and/or pending applications for additional marks in the U.S. and other countries, including “Cb Predictive Security Cloud” and “Cb LiveOps”; however, we cannot be certain that any future trademark registrations will be issued for pending or future applications or that any registered trademarks will be enforceable or provide adequate protection of our proprietary rights. We also license software from third parties for integration into our products, including open source software and other software available on commercially reasonable terms. We cannot be certain that such third parties will maintain such software or continue to make it available.

In order to protect our unpatented proprietary technologies and processes, we rely on trade secret laws and confidentiality agreements with our employees, consultants, channel partners, vendors and others. Despite our efforts to protect our proprietary technology and trade secrets, unauthorized parties may attempt to misappropriate, reverse engineer or otherwise obtain and use them. In addition, others may independently discover our trade secrets, in which case we would not be able to assert trade secret rights, or develop similar technologies and processes. Further, the contractual provisions that we enter into may not prevent unauthorized use or disclosure of our proprietary technology or intellectual property rights and may not provide an adequate remedy in the event of unauthorized use or disclosure of our proprietary technology or intellectual property rights. Moreover, policing unauthorized use of our technologies, trade secrets and intellectual property is difficult, expensive and time-consuming, particularly in foreign countries where the laws may not be as protective of intellectual property rights as those in the U.S. and where mechanisms for enforcement of intellectual property rights may be weak. We may be unable to determine the extent of any unauthorized use or infringement of our products, technologies or intellectual property rights.

59

From time to time, legal action by us may be necessary to enforce our patents and other intellectual property rights, to protect our trade secrets, to determine the validity and scope of the intellectual property rights of others, to defend against claims of infringement or invalidity or to prevent the misappropriation of our intellectual property. Such litigation could result in substantial costs and diversion of resources and could negatively affect our business, operating results and financial condition.

Assertions by third parties of infringement or other violations by us of their intellectual property rights, whether or not correct, could result in significant costs and harm our business and operating results.

Patent and other intellectual property disputes are common in our industry. Some companies, including some of our competitors, some of whom have substantially more resources and have been developing relevant technologies for much longer than us, own large numbers of patents, copyrights and trademarks, which they may use to assert claims against us. Third parties have in the past and may in the future assert claims of infringement, misappropriation or other violations of intellectual property rights against us. They may also assert such claims against our customers or channel partners, whom we typically indemnify against claims that our products infringe, misappropriate or otherwise violate the intellectual property rights of third parties. If we do infringe a third party’s rights and are unable to provide a sufficient workaround, we may need to negotiate with holders of those rights to obtain a license to those rights or otherwise settle any infringement claim as a party that makes a claim of infringement against us may obtain an injunction preventing us from shipping products containing the allegedly infringing technology. As the number of products and competitors in our market increase and overlaps occur, claims of infringement, misappropriation and other violations of intellectual property rights may increase. Any claim of infringement, misappropriation or other violation of intellectual property rights by a third party, even those without merit, could cause us to incur substantial costs defending against the claim and could distract our management from our business. For example, in April 2018, we agreed to pay $3.9 million pursuant to a settlement agreement with a non-practicing entity that claimed we infringed upon certain patents held by such entity. See Note 11 to our unaudited consolidated financial statements included in this Quarterly Report on Form 10-Q.

The patent portfolios of our most significant competitors are larger than ours. This disparity may increase the risk that they may sue us for patent infringement and may limit our ability to counterclaim for patent infringement or settle through patent cross-licenses. In addition, future assertions of patent rights by third parties, and any resulting litigation, may involve patent holding companies or other adverse patent owners who have no relevant product revenues and against whom our own patents may therefore provide little or no deterrence or protection. There can be no assurance that we will not be found to infringe or otherwise violate any third-party intellectual property rights or to have done so in the past.

An adverse outcome of a dispute may require us to:

· pay substantial damages, including treble damages, if we are found to have willfully infringed a third party’s patents or copyrights;

· cease making, licensing or using products that are alleged to infringe or misappropriate the intellectual property of others;

· expend additional development resources to attempt to redesign our products or otherwise develop non-infringing technology, which may not be successful;

· enter into potentially unfavorable royalty or license agreements to obtain the right to use necessary technologies or intellectual property rights;

· take legal action or initiate administrative proceedings to challenge the validity and scope of the third-party rights or to defend against any allegations of infringement; and

· indemnify our partners and other third parties.

In addition, royalty or licensing agreements, if required or desirable, may be unavailable on terms acceptable to us, or at all, and may require significant royalty payments and other expenditures. Some licenses may also be non-exclusive, and therefore our competitors may have access to the same technology licensed to us. Any of the foregoing events could seriously harm our business, financial condition and results of operations.

60

Confidentiality arrangements with employees and others may not adequately prevent disclosure of trade secrets and other proprietary information.

We have devoted substantial resources to the development of our technology, business operations and business plans. In order to protect our trade secrets and proprietary information, we rely in significant part on confidentiality arrangements with our employees, licensees, independent contractors, advisors, channel partners and customers. These arrangements may not be effective to prevent disclosure of confidential information, including trade secrets, and may not provide an adequate remedy in the event of unauthorized disclosure of confidential information. In addition, if others independently discover trade secrets and proprietary information, we would not be able to assert trade secret rights against such parties. Effective trade secret protection may not be available in every country in which our products are available or where we have employees or independent contractors. The loss of trade secret protection could make it easier for third parties to compete with our products by copying functionality. In addition, any changes in, or unexpected interpretations of, the trade secret and employment laws in any country in which we operate may compromise our ability to enforce our trade secret and intellectual property rights. Costly and time-consuming litigation could be necessary to enforce and determine the scope of our proprietary rights, and failure to obtain or maintain trade secret protection could adversely affect our competitive business position.

We may be subject to damages resulting from claims that our employees or contractors have wrongfully used or disclosed alleged trade secrets of their former employers or other parties.

We could in the future be subject to claims that employees or contractors, or we, have inadvertently or otherwise used or disclosed trade secrets or other proprietary information of our competitors or other parties. Litigation may be necessary to defend against these claims. If we fail in defending against such claims, a court could order us to pay substantial damages and prohibit us from using technologies or features that are essential to our products, if such technologies or features are found to incorporate or be derived from the trade secrets or other proprietary information of these parties. In addition, we may lose valuable intellectual property rights or personnel. A loss of key personnel or their work product could hamper or prevent our ability to develop, market and support potential products or enhancements, which could severely harm our business. Even if we are successful in defending against these claims, such litigation could result in substantial costs and be a distraction to management.

Our operating results may be harmed if we are required to collect sales and use or other related taxes for our products in jurisdictions where we have not historically done so.

Taxing jurisdictions, including state, local and foreign taxing authorities, have differing rules and regulations governing sales and use or other taxes, and these rules and regulations are subject to varying interpretations that may change over time. In particular, significant judgment is required in evaluating our tax positions and our worldwide provision for taxes. While we believe that we are in material compliance with our obligations under applicable taxing regimes, one or more states, localities or countries may seek to impose additional sales or other tax collection obligations on us, including for past sales by us or our channel partners. It is possible that we could face sales tax audits and that such audits could result in tax-related liabilities for which we have not accrued. A successful assertion that we should be collecting additional sales or other taxes on our products in jurisdictions where we have not historically done so and do not accrue for sales taxes could result in substantial tax liabilities for past sales, discourage customers from purchasing our products or otherwise harm our business and operating results.

In addition, our tax obligations and effective tax rates could be adversely affected by changes in the relevant tax, accounting and other laws, regulations, principles and interpretations, including those relating to income tax nexus, by recognizing tax losses or lower than anticipated earnings in jurisdictions where we have lower statutory rates and higher than anticipated earnings in jurisdictions where we have higher statutory rates, by changes in foreign currency exchange rates, or by changes in the valuation of our deferred tax assets and liabilities. Although we believe our tax estimates are reasonable, the final determination of any tax audits or litigation could be materially different from our historical tax provisions and accruals, which could have a material adverse effect on our operating results or cash flows in the period or periods for which a determination is made.

Comprehensive tax reform legislation could adversely affect our business and financial condition.

The U.S. government has recently enacted comprehensive tax legislation that includes significant changes to the taxation of business entities, referenced herein as the Tax Reform Act. These changes include, among others, a permanent reduction to the corporate income tax rate, limiting interest deductions, adopting elements of a territorial tax system, assessing a repatriation tax or “toll-charge” on

61

undistributed earnings and profits of U.S.-owned foreign corporations, and introducing certain anti-base erosion provisions. The overall impact of this tax reform is uncertain, and our business and financial condition, including with respect to our non-U.S. operations, could be adversely affected. The overall impact of the Tax Reform Act on stockholders is uncertain, and this report does not address, other than as expressly addressed herein, the manner in which it may affect holders of our common stock. We urge investors to consult with their legal and tax advisors with respect to any such legislation and the potential tax consequences of investing in our common shares.

We may not be able to utilize a significant portion of our net operating loss carryforwards and research and development tax credit carryforwards.

As of December 31, 2017, we had federal and state net operating loss carryforwards of $231.0 million and $153.8 million, respectively, which if not utilized will begin to expire in 2023 and 2018, respectively, and federal and state research and development tax credit carryforwards of $4.2 million and $2.4 million, respectively, which if not utilized will begin to expire in 2026 and 2021, respectively. These net operating loss and tax credit carryforwards could expire unused and be unavailable to offset our future income tax liabilities. In addition, under Section 382 of the Internal Revenue Code of 1986, as amended, or the Code, and corresponding provisions of state law, if a corporation undergoes an “ownership change,” which is generally defined as a greater than 50% change, by value, in its equity ownership over a three-year period, the corporation’s ability to use its pre-change net operating loss carryforwards and other pre-change tax attributes to offset its post-change income may be limited. We have not determined if we have experienced Section 382 ownership changes in the past and if a portion of our net operating loss and tax credit carryforwards is subject to an annual limitation under Section 382. In addition, we may experience ownership changes in the future as a result of subsequent shifts in our stock ownership, some of which may be outside of our control. If we determine that an ownership change has occurred and our ability to use our historical net operating loss and tax credit carryforwards is materially limited, it would harm our future operating results by effectively increasing our future tax obligations.

Risks Related to Our Common Stock

Our stock price may be volatile, and you may lose some or all of your investment.

The market price of our common stock may be highly volatile and may fluctuate substantially as a result of a variety of factors, some of which are related in complex ways, including:

· actual or anticipated fluctuations in our financial condition and operating results;

· variance in our financial performance from expectations of securities analysts;

· changes in the prices of our products;

· changes in our projected operating and financial results;

· changes in laws or regulations applicable to our products;

· announcements by us or our competitors of significant business developments, acquisitions or new products;

· our involvement in any litigation;

· our sale of our common stock or other securities in the future, as well as the anticipation of lock-up releases;

· changes in senior management or key personnel;

· trading volume of our common stock;

· changes in the anticipated future size and growth rate of our market; and

· general economic, regulatory and market conditions.

62

The stock markets are subject to extreme price and volume fluctuations that have affected and continue to affect the market prices of equity securities of many companies. These fluctuations have often been unrelated or disproportionate to the operating performance of those companies. Broad market and industry fluctuations, as well as general economic, political, regulatory and market conditions, may negatively impact the market price of our common stock. In the past, companies that have experienced volatility in the market price of their securities have been subject to securities class action litigation. We may be the target of this type of litigation in the future, which could result in substantial costs and divert our management’s attention.

An active public trading market may not develop or be sustained.

The lack of an active market may impair your ability to sell your shares at the time you wish to sell them or at a price that you consider reasonable. The lack of an active market may also reduce the fair value of your shares. An inactive market may also impair our ability to raise capital to continue to fund operations by selling shares and may impair our ability to acquire other companies or technologies by using our shares as consideration.

If securities or industry analysts do not publish research or reports about our business, or publish negative reports about our business, our stock price and trading volume could decline.

The trading market for our common stock will depend, in part, on the research and reports that securities or industry analysts publish about us or our business. We do not have any control over these analysts. If our financial performance fails to meet analyst estimates or one or more of the analysts who cover us downgrade our shares or change their opinion of our shares, our share price would likely decline. If one or more of these analysts cease coverage of our company or fail to regularly publish reports on us, we could lose visibility in the financial markets, which could cause our share price or trading volume to decline.

The issuance of additional stock in connection with financings, acquisitions, investments, our stock incentive plans or otherwise will dilute all other stockholders.

Our amended and restated certificate of incorporation authorizes us to issue up to 500,000,000 shares of common stock and up to 25,000,000 shares of preferred stock with such rights and preferences as may be determined by our board of directors. Subject to compliance with applicable rules and regulations, we may issue our shares of common stock or securities convertible into our common stock from time to time in connection with a financing, acquisition, investment, our stock incentive plans or otherwise. Any such issuance could result in substantial dilution to our existing stockholders and cause the trading price of our common stock to decline.

We do not intend to pay dividends for the foreseeable future and, as a result, your ability to achieve a return on your investment will depend on appreciation in the price of our common stock.

We have never declared or paid any cash dividends on our common stock and do not intend to pay any cash dividends in the foreseeable future. We anticipate that we will retain all of our future earnings for use in the development of our business and for general corporate purposes. In addition, our ability to pay cash dividends is currently limited by the terms of our credit agreements, and any future credit agreements may contain terms prohibiting or limiting the amount of dividends that may be declared or paid on our common stock. Accordingly, investors must rely on sales of their common stock after price appreciation, which may never occur, as the only way to realize any future gains on their investments.

Concentration of ownership among our directors, executive officers and holders of 5% or more of our outstanding common stock may prevent new investors from influencing significant corporate decisions.

Our directors, executive officers and holders of more than 5% of our common stock, some of whom are represented on our board of directors, together with affiliates control a significant portion of our outstanding capital stock. As a result, these stockholders will be able to determine the outcome of matters submitted to our stockholders for approval. Some of these persons or entities may have interests that are different from yours, and this ownership could affect the value of your shares of common stock if, for example, these stockholders elect to delay, defer or prevent a change in corporate control, merger, consolidation, takeover or other business combination. This concentration of ownership may also adversely affect the market price of our common stock.

63

We are an “emerging growth company” and we cannot be certain if the reduced disclosure requirements applicable to emerging growth companies will make our common stock less attractive to investors.

We are an “emerging growth company,” as defined in the JOBS Act, and we may take advantage of certain exemptions from various reporting requirements that are applicable to other public companies that are not “emerging growth companies” including, but not limited to, the auditor attestation requirements of Section 404 of the Sarbanes-Oxley Act, reduced disclosure obligations regarding executive compensation in our periodic reports and proxy statements, and exemptions from the requirements of holding a non-binding advisory vote on executive compensation and stockholder approval of any golden parachute payments not previously approved. We cannot predict if investors will find our common stock less attractive if we choose to rely on these exemptions. If some investors find our common stock less attractive as a result, there may be a less active trading market for our common stock and our stock price may be more volatile.

We will incur increased costs as a result of operating as a public company, and our management will be required to devote substantial time to compliance with our public company responsibilities and corporate governance practices.

As a public company, and particularly after we are no longer an “emerging growth company,” we will continue to incur significant legal, accounting and other expenses that we did not incur as a private company. The Sarbanes-Oxley Act, the Dodd-Frank Wall Street Reform and Consumer Protection Act, the listing requirements of The Nasdaq Global Select Market and other applicable securities rules and regulations impose various requirements on public companies. Our management and other personnel will need to devote a substantial amount of time to compliance with these requirements. Moreover, these rules and regulations will increase our legal and financial compliance costs and will make some activities more time-consuming and costly. For example, we expect that these rules and regulations may make it more difficult and more expensive for us to obtain directors’ and officers’ liability insurance, which could make it more difficult for us to attract and retain qualified members of our board of directors. We cannot predict or estimate the amount of additional costs we will incur as a public company or the timing of such costs.

As a result of becoming a public company, we are obligated to develop and maintain proper and effective internal controls over financial reporting and any failure to maintain the adequacy of these internal controls may adversely affect investor confidence in our company and, as a result, the value of our common stock.

We will be required, pursuant to Section 404 of the Sarbanes-Oxley Act, or Section 404, to furnish a report by management on, among other things, the effectiveness of our internal control over financial reporting for the first fiscal year beginning after the effective date of the IPO. This assessment will need to include disclosure of any material weaknesses identified by our management in our internal control over financial reporting. Our independent registered public accounting firm will not be required to attest to the effectiveness of our internal control over financial reporting until our first annual report required to be filed with the SEC following the date we are no longer an “emerging growth company,” as defined in the JOBS Act. We will be required to disclose significant changes made in our internal control procedures on a quarterly basis.

We have commenced the costly and challenging process of compiling the system and processing documentation necessary to perform the evaluation needed to comply with Section 404, and we may not be able to complete our evaluation, testing and any required remediation in a timely fashion. Our compliance with Section 404 will require that we incur substantial accounting expense and expend significant management efforts. We currently do not have an internal audit group, and we will need to hire additional accounting and financial staff with appropriate public company experience and technical accounting knowledge and compile the system and process documentation necessary to perform the evaluation needed to comply with Section 404.

During the evaluation and testing process of our internal controls, if we identify one or more material weaknesses in our internal control over financial reporting, we will be unable to assert that our internal control over financial reporting is effective. We cannot be certain that there will not be material weaknesses or significant deficiencies in our internal control over financial reporting in the future. Any failure to maintain internal control over financial reporting could severely inhibit our ability to accurately report our financial condition or results of operations. If we are unable to conclude that our internal control over financial reporting is effective, or if our independent registered public accounting firm determines we have a material weakness or significant deficiency in our internal control over financial reporting, we could lose investor confidence in the accuracy and completeness of our financial reports, the market price of our common stock could decline, and we could be subject to sanctions or investigations by The Nasdaq Global Select Market, the SEC or other regulatory authorities. Failure to remedy any material weakness in our internal control over financial reporting, or to implement or maintain other effective control systems required of public companies, could also restrict our future access to the capital markets.

64

Anti-takeover provisions in our charter documents and Delaware law may delay or prevent an acquisition of our company, limit attempts by our stockholders to replace or remove our current management and limit the market price of our common stock.

Our amended and restated certificate of incorporation, amended and restated bylaws and Delaware law contain provisions that may have the effect of delaying or preventing a change in control of us or changes in our management. Our amended and restated certificate of incorporation and amended and restated bylaws include provisions that:

· authorize “blank check” preferred stock, which could be issued by our board of directors without stockholder approval and may contain voting, liquidation, dividend and other rights superior to our common stock;

· provide for a classified board of directors whose members serve staggered three-year terms;

· specify that special meetings of our stockholders can be called only by a majority of the members of our board of directors then in office and only those matters set forth in the notice of the special meeting may be considered or acted upon at a special meeting of stockholders;

· prohibit stockholder action by written consent;

· establish an advance notice procedure for stockholder proposals to be brought before an annual meeting of our stockholders, including proposed nominations of persons for election to our board of directors;

· provide that our directors may be removed only for cause;

· provide that vacancies on our board of directors may be filled only by a majority of directors then in office, even though less than a quorum;

· specify that no stockholder is permitted to cumulate votes at any election of directors;

· authorize our board of directors to modify, alter or repeal our amended and restated bylaws; and

· require supermajority votes of the holders of our common stock to amend specified provisions of our charter documents.

These provisions, alone or together, could delay or prevent hostile takeovers and changes in control or changes in our management.

In addition, because we are incorporated in Delaware, we are governed by the provisions of Section 203 of the Delaware General Corporation Law, which limits the ability of stockholders owning in excess of 15% of our outstanding voting stock to merge or combine with us in certain circumstances.

Any provision of our amended and restated certificate of incorporation, amended and restated bylaws or Delaware law that has the effect of delaying or deterring a change in control could limit the opportunity for our stockholders to receive a premium for their shares of our common stock, and could also affect the price that some investors are willing to pay for our common stock.

Our amended and restated bylaws designate the Court of Chancery of the State of Delaware or the United States District Court for the District of Massachusetts as the exclusive forum for certain litigation that may be initiated by our stockholders, which could limit our stockholders’ ability to obtain a favorable judicial forum for disputes with us.

Pursuant to our amended and restated bylaws, unless we consent in writing to the selection of an alternative forum, the Court of Chancery of the State of Delaware will be the sole and exclusive forum for (1) any derivative action or proceeding brought on our behalf, (2) any action asserting a claim of or based on a breach of a fiduciary duty owed by any of our current or former directors, officers or other employees to us or our stockholders, (3) any action asserting a claim against us or any of our current or former directors, officers, employees or stockholders arising pursuant to any provision of the Delaware General Corporation Law, our amended and restated bylaws or our amended and restated bylaws or (4) any action asserting a claim governed by the internal affairs doctrine. Our amended and restated bylaws will further provide that the United States District Court for the District of Massachusetts will be the exclusive forum for resolving any complaint asserting a cause of action arising under the Securities Act. In addition, our amended and restated bylaws

65

provide that any person or entity purchasing or otherwise acquiring any interest in shares of our common stock is deemed to have notice of and consented to the foregoing provisions. We have chosen the United States District Court for the District of Massachusetts as the exclusive forum for such causes of action because our principal executive offices are located in Waltham, Massachusetts. Some companies that have adopted similar federal district court forum selection provisions are currently subject to a suit in the Court of Chancery of the State of Delaware brought by stockholders who assert that the federal district court forum selection provision is not enforceable. We recognize that the federal district court forum selection clause may impose additional litigation costs on stockholders who assert the provision is not enforceable and may impose more general additional litigation costs in pursuing any such claims, particularly if the stockholders do not reside in or near the Commonwealth of Massachusetts. Additionally, the forum selection clauses in our amended and restated bylaws may limit our stockholders’ ability to obtain a favorable judicial forum for disputes with us. Alternatively, if the federal district court forum selection provision is found inapplicable to, or unenforceable in respect of, one or more of the specified types of actions or proceedings, we may incur additional costs associated with resolving such matters in other jurisdictions, which could have an adverse effect on our business, financial condition or results of operations. The United States District Court for the District of Massachusetts may also reach different judgments or results than would other courts, including courts where a stockholder considering an action may be located or would otherwise choose to bring the action, and such judgments may be more or less favorable to us than our stockholders.

ITEM 2.UNREGISTERED SALES OF EQUITY SECURITIES AND USE OF PROCEEDS.

(a)Recent Sales of Unregistered Equity Securities

None.

(b)Use of Proceeds from Initial Public Offering of Common Stock

We completed our IPO pursuant to a Registration Statement on FormS-1 (File No.333-224196), which was declared effective on May3, 2018. In the IPO, we issued 9,200,000 shares of common stock (inclusive of 1,200,000 shares of common stock sold by us pursuant to the full exercise of an overallotment option granted to the underwriters in connection with the offering) at a public offering price of $19.00 per shares. The managing underwriters for the IPO were Morgan Stanley& Co. LLC and J.P. Morgan Securities LLC. The IPO commenced on May3, 2018 and did not terminate until the sale of all the shares offered.

We received aggregate proceeds of $162.6 million from the IPO, net of underwriters’ discounts and commissions, and before deducting offering costs of approximately $4.9 million. No offering expenses were paid directly or indirectly to any of our directors or officers (or their associated) or persons owning 10.0% or more of any class of our equity securities or to any other affiliates.

Information related to use of proceeds from registered securities is incorporated herein by reference to the “Use of Proceeds” section of the Company’s final prospectus related to the IPO. There has been no material change in the planned use of proceeds from our IPO as described in our final prospectus.

(c)Issuer Purchases of Equity Securities

None.

66

ITEM 6.EXHIBITS.

Exhibit Number	Description
3.1	Ninth Amended and Restated Certificate of Incorporation (1)
3.2	Third Amended and Restated By-laws (2)
4.1	Formof Common Stock Certificate of the Registrant (3)
31.1*	Certification of Principal Executive Officer Pursuant to Rules13a-14(a)and 15d-14(a)under the Securities Exchange Act of 1934, as Adopted Pursuant to Section302 of the Sarbanes-Oxley Act of 2002.
31.2*	Certification of Principal Financial Officer Pursuant to Rules13a-14(a)and 15d-14(a)under the Securities Exchange Act of 1934, as Adopted Pursuant to Section302 of the Sarbanes-Oxley Act of 2002.
32.1**	Certification of Principal Executive Officer Pursuant to 18 U.S.C. Section1350, as Adopted Pursuant to Section906 of the Sarbanes-Oxley Act of 2002.
32.2**	Certification of Principal Financial Officer Pursuant to 18 U.S.C. Section1350, as Adopted Pursuant to Section906 of the Sarbanes-Oxley Act of 2002.
101.INS	XBRL Instance Document
101.SCH	XBRL Taxonomy Extension Schema Document
101.CAL	XBRL Taxonomy Extension Calculation Linkbase Document
101.DEF	XBRL Taxonomy Extension Definition Linkbase Document
101.LAB	XBRL Taxonomy Extension Label Linkbase Document
101.PRE	XBRL Taxonomy Extension Presentation Linkbase Document

(1) Filed as Exhibit 3.2 to Amendment No. 1 to Registrant’s Registration on Form S-1 filed with the Securities and Exchange Commission on April 23, 2018, and incorporated herein by reference

(2) Filed as Exhibit 3.4 to Amendment No. 1 to Registrant’s Registration on Form S-1 filed with the Securities and Exchange Commission on April 23, 2018, and incorporated herein by reference

(3) Filed as Exhibit 4.1 to Amendment No. 1 to Registrant’s Registration on Form S-1 filed with the Securities and Exchange Commission on April 23, 2018, and incorporated herein by reference

* Filed herewith.

** This certification is deemed not filed for purposes of Section 18 of the Securities Exchange Act of 1934, as amended, or otherwise subject to the liability of that section, nor shall it be deemed incorporated by reference into any filing under the Securities Act of 1933, as amended, or the Securities Exchange Act of 1934, as amended.

67

SIGNATURES

Pursuant to the requirements of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned thereunto duly authorized.

	CARBON BLACK,INC.
Date: October 25, 2018	By:	/s/ Patrick Morley
		Patrick Morley
		President, Chief Executive Officer and Director
		(Principal Executive Officer)
Date: October 25, 2018	By:	/s/ Mark P. Sullivan
		Mark P. Sullivan
		Executive Vice President and Chief Financial Officer
		(Principal Financial Officer and Principal Accounting Officer)

68