##### Table of Contents



UNITED STATES
SECURITIES AND EXCHANGE COMMISSION WASHINGTON, D.C. 20549
 FORM 10-Q (Mark One)[X]
    
    QUARTERLY REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIESEXCHANGE ACT OF 1934For the quarterly period ended March 31, 2004OR[  ]
    
    TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIESEXCHANGE ACT OF 1934For the transition period from _________ to _________
 Commission File Number 000-23655 INTERNET SECURITY SYSTEMS, INC. (Exact name of registrant as specified in its charter) DELAWARE
(State or jurisdiction of
incorporation or organization)
    
    58-2362189
(I.R.S. Employer
Identification No.)
 6303 BARFIELD ROAD, ATLANTA, GEORGIA 30328
(Address of principal executive offices) Registrants telephone number, including area code (404) 236-2600 Indicate by check mark whether the registrant (1) has filed all reports
required to be filed by Section 13 or 15(d) of the Securities Exchange Act of
1934 during the preceding 12 months (or for such shorter period that the
registrant was required to file such reports), and (2) has been subject to such
filing requirements for the past 90 days. Yes [X]  No
[  ] Indicate by check mark whether the registrant is an accelerated filer (as
defined in Rule 12b-2 of the Exchange Act). Yes
[X]  No [  ] Indicate the number of shares outstanding of each of the registrants
classes of common stock, as of the latest practicable date. Title of each class of common stock
Common stock, $0.001 par value
    
    Number of Shares
Outstanding
as of April 30, 2004
48,401,000




---



PAGENUMBERPART I  FINANCIAL INFORMATIONItem 1 Consolidated Financial Statements:Consolidated Balance Sheets at March 31, 2004 and December 31, 2003Consolidated Statements of Operations for the three months ended March 31, 2004 and March 31, 2003Consolidated Statements of Cash Flows for the three months ended March 31, 2004 and March 31, 2003Notes to Consolidated Financial StatementsItem 2 Managements Discussion and Analysis of Financial Condition and Results of OperationsItem 3 Quantitative and Qualitative Disclosures about Market RiskItem 4 Controls and ProceduresPART II  OTHER INFORMATIONItem 1
Legal ProceedingsItem 2
Changes in Securities, Use of Proceeds and Issuer Purchases of Equity
SecuritiesItem 6 Exhibits and Reports on Form 8-KEX-10.1 AMENDMENTS TO LEASE, ATLANTA HEADQUARTERSEX-31.1 SECTION 302 CERTIFICATION OF CEOEX-31.2 SECTION 302 CERTIFICATION OF CFOEX-32.1 SECTION 906 CERTIFICATION OF CEOEX-32.2 SECTION 906 CERTIFICATION OF CFO
  2




---



##### Table of Contents



PART I. FINANCIAL INFORMATION 
 Item 1. Consolidated Financial Statements INTERNET SECURITY SYSTEMS, INC. 
 CONSOLIDATED BALANCE SHEETS
  March 31,
    
    December 31,2004
    
    2003(unaudited)ASSETSCurrent assets:Cash and cash equivalents
    
    $
    148,397
    
    
    $
    184,551Marketable securities
    
    
    62,356
    
    
    
    53,630Accounts receivable, less allowance for doubtful accounts
of $2,924 and $2,755, respectively
    
    
    65,301
    
    
    
    66,588Inventory
    
    
    1,168
    
    
    
    750Prepaid expenses and other current assets
    
    
    8,382
    
    
    
    10,732Total current assets
    
    
    285,604
    
    
    
    316,251Property and equipment:Computer equipment and software
    
    
    52,483
    
    
    
    45,261Office furniture and equipment
    
    
    21,530
    
    
    
    21,311Leasehold improvements
    
    
    21,746
    
    
    
    21,67495,759
    
    
    
    88,246Less accumulated depreciation
    
    
    55,738
    
    
    
    52,42740,021
    
    
    
    35,819Restricted cash and marketable securities
    
    
    12,760
    
    
    
    12,760Goodwill, less accumulated amortization of $27,381
    
    
    223,578
    
    
    
    201,303Other intangible assets, less accumulated amortization of
$15,243 and $13,499, respectively
    
    
    24,532
    
    
    
    9,728Other assets
    
    
    7,527
    
    
    
    5,421Total assets
    
    $
    594,022
    
    
    $
    581,282LIABILITIES AND STOCKHOLDERS EQUITYCurrent liabilities:Accounts payable
    
    $
    5,654
    
    
    $
    5,145Accrued expenses
    
    
    24,196
    
    
    
    26,092Deferred revenues
    
    
    69,768
    
    
    
    61,129Other current liabilities
    
    
    1,297
    
    
    
    Total current liabilities
    
    
    100,915
    
    
    
    92,366Other non-current liabilities
    
    
    5,601
    
    
    
    2,573Commitments and contingenciesStockholders equity:Preferred stock, $.001 par value, 20,000,000 shares authorized,
none issued or outstanding
    
    
    
    
    
    
    Common stock, $.001 par value, 120,000,000 shares authorized,
50,241,000 and 49,841,000 issued, respectively
    
    
    50
    
    
    
    50Additional paid-in capital
    
    
    482,950
    
    
    
    475,062Deferred compensation
    
    
    (4,687
    )
    
    
    (92
    )Accumulated other comprehensive income
    
    
    6,673
    
    
    
    7,452Retained earnings
    
    
    27,471
    
    
    
    22,251Treasury stock, at cost (1,683,000 and 1,310,000 shares, respectively)
    
    
    (24,951
    )
    
    
    (18,380
    )Total stockholders equity
    
    
    487,506
    
    
    
    486,343Total liabilities and stockholders equity
    
    $
    594,022
    
    
    $
    581,282
 See accompanying notes 3




---



##### Table of Contents



INTERNET SECURITY SYSTEMS, INC. 
 CONSOLIDATED STATEMENTS OF OPERATIONS
 
 Three months endedMarch 31,2004
    
    2003Revenues:Product licenses and sales
    
    $
    28,785
    
    
    $
    26,264Subscriptions
    
    
    32,842
    
    
    
    26,898Professional services
    
    
    5,437
    
    
    
    6,29167,064
    
    
    
    59,453Costs and expenses:Cost of revenues:Product licenses and sales
    
    
    4,108
    
    
    
    1,441Subscriptions and professional services
    
    
    11,673
    
    
    
    12,348Total cost of revenues
    
    
    15,781
    
    
    
    13,789Research and development
    
    
    11,251
    
    
    
    9,671Sales and marketing
    
    
    24,354
    
    
    
    21,176General and administrative
    
    
    6,251
    
    
    
    5,540Amortization of other intangibles and stock-based
compensation
    
    
    1,774
    
    
    
    1,40459,411
    
    
    
    51,580Operating income
    
    
    7,653
    
    
    
    7,873Interest income
    
    
    528
    
    
    
    643Minority interest
    
    
    (127
    )
    
    
    (88
    )Other income, net
    
    
    57
    
    
    
    24Foreign currency exchange gain
    
    
    77
    
    
    
    244Income before income taxes
    
    
    8,188
    
    
    
    8,696Provision for income taxes
    
    
    2,968
    
    
    
    3,334Net income
    
    $
    5,220
    
    
    $
    5,362Basic net income per share of Common Stock
    
    $
    0.11
    
    
    $
    0.11Diluted net income per share of Common Stock
    
    $
    0.10
    
    
    $
    0.11Weighted average shares:Basic
    
    
    48,646
    
    
    
    49,539Diluted
    
    
    50,133
    
    
    
    49,963
 See accompanying notes 4




---



##### Table of Contents



INTERNET SECURITY SYSTEMS, INC. 
 CONSOLIDATED STATEMENTS OF CASH FLOWS
 
 Three months endedMarch 31,2004
    
    2003Operating activitiesNet income
    
    $
    5,220
    
    
    $
    5,362Adjustments to reconcile net income to net cash provided by operating activities:Depreciation
    
    
    3,311
    
    
    
    3,537Amortization of other intangibles and stock-based compensation
    
    
    1,774
    
    
    
    1,404Accretion of discount on marketable securities
    
    
    (21
    )
    
    
    90Minority interest
    
    
    127
    
    
    
    88Deferred compensation expense
    
    
    332
    
    
    
    Income tax benefit from exercise of stock options
    
    
    2,271
    
    
    
    2,783Gain on issuance of subsidiary stock
    
    
    (74
    )
    
    
    (47
    )Changes in assets and liabilities, excluding the effects of acquisitions:Accounts receivable
    
    
    2,049
    
    
    
    6,393Inventory
    
    
    (418
    )
    
    
    459Prepaid expenses and other assets
    
    
    259
    
    
    
    (1,271
    )Accounts payable and accrued expenses
    
    
    (2,222
    )
    
    
    (1,230
    )Other current liabilities
    
    
    714
    
    
    
    Deferred revenues
    
    
    6,154
    
    
    
    (1,476
    )Net cash provided by operating activities
    
    
    19,476
    
    
    
    16,092Investing activitiesAcquisitions, net of cash received
    
    
    (33,991
    )
    
    
    Purchases of marketable securities
    
    
    (20,221
    )
    
    
    (14,366
    )Net proceeds from maturity of marketable securities
    
    
    11,516
    
    
    
    21,966Release of restricted cash and marketable securities
    
    
    
    
    
    
    565Purchases of property and equipment
    
    
    (7,061
    )
    
    
    (1,373
    )Net proceeds from issuance of subsidiary stock
    
    
    113
    
    
    
    69Net cash provided by (used in) investing activities
    
    
    (49,644
    )
    
    
    6,861Financing activitiesProceeds from exercise of stock options
    
    
    533
    
    
    
    101Proceeds from employee stock purchase plan
    
    

    750
    
    
    
    823Purchases of treasury stock
    
    
    (6,571
    )
    
    
    (1,776
    )Net cash used in financing activities
    
    
    (5,288
    )
    
    
    (852
    )Foreign currency impact on cash
    
    
    (698
    )
    
    
    (308
    )Net increase (decrease) in cash and cash equivalents
    
    
    (36,154
    )
    
    
    21,793Cash and cash equivalents at beginning of period
    
    
    184,551
    
    
    
    148,317Cash and cash equivalents at end of period
    
    $
    148,397
    
    
    $
    170,110Supplemental cash flow disclosureIncome taxes paid
    
    $
    1,176
    
    
    $
    465
 See accompanying notes 5




---



##### Table of Contents



INTERNET SECURITY SYSTEMS, INC. 
 NOTES TO CONSOLIDATED FINANCIAL STATEMENTS
 Note 1. Significant Accounting Policies Basis of Presentation The consolidated financial statements of Internet Security Systems, Inc.
(ISS or the Company) as of March 31, 2004 and for the three months ended
March 31, 2004 and 2003 are unaudited and, in the opinion of management,
contain all adjustments, consisting of normal recurring items, necessary for
the fair presentation of the financial position and results of operations of
the Company for the interim periods. The consolidated financial statements
include the accounts of the Company and its majority-owned subsidiaries. The
consolidated balance sheet at December 31, 2003 has been derived from the
audited financial statements at that date but does not include all of the
footnotes required by accounting principles generally accepted in the United
States for complete financial statements. These consolidated financial statements should be read in conjunction with
the Consolidated Financial Statements and Notes thereto included in our Annual
Report on Form 10-K for the year ended December 31, 2003. The results of
operations for the three months ended March 31, 2004 are not necessarily
indicative of the results to be expected for the entire year. All significant
intercompany accounts and transactions have been eliminated. Certain prior year amounts have been reclassified to conform to current
year presentation. The preparation of financial statements and related disclosures in
conformity with accounting principles generally accepted in the United States
requires management to make estimates and assumptions that affect the amounts
reported in the financial statements and accompanying notes. Actual results may
differ from those estimates, and such differences may be material to the
consolidated financial statements. Goodwill and Intangibles Goodwill and intangible assets are comprised of the following, as of the
dates indicated (in thousands): March 31, 2004
    
    December 31, 2003Gross Carrying
    
    Accumulated
    
    Gross Carrying
    
    AccumulatedAmount
    
    Amortization
    
    Amount
    
    AmortizationGoodwill
    
    $
    250,959
    
    
    $
    (27,381
    )
    
    $
    228,684
    
    
    $
    (27,381
    )Amortized intangible assets:Core technology
    
    
    3,853
    
    
    
    (2,641
    )
    
    
    3,853
    
    
    
    (2,521
    )Developed technology
    
    
    33,839
    
    
    
    (11,075
    )
    
    
    17,808
    
    
    
    (9,576
    )Customer relationships
    
    
    2,083
    
    
    
    (1,527
    )
    
    
    1,566
    
    
    
    (1,402
    )Total
    
    $
    39,775
    
    
    $
    (15,243
    )
    
    $
    23,227
    
    
    $
    (13,499
    )
 The changes in the carrying amounts of goodwill and other intangibles from
December 31, 2003 to March 31, 2004 were primarily a result of the purchase of
Cobion AG (Cobion) (see Note 3) and additional consideration related to a
2002 acquisition of TriSecurity Holdings Pte Ltd., resulting in approximately
$22.3 million of goodwill and $16.5 million of other intangibles being recorded
during the first quarter of 2004. The remaining fluctuation is the result of
currency translation adjustments. The Company amortizes intangible assets over their estimated useful lives
of eight years for core technology, five years for developed technology, three
to six years for work force and three years for customer relationships.
Amortization expense of intangible assets is as follows (in thousands): Three months endedMarch 31,2004
    
    2003Core technology
    
    $
    120
    
    
    $
    120Developed technology
    
    
    1,499
    
    
    
    890Work force
    
    
    
    
    
    
    109Customer relationships
    
    
    125
    
    
    
    129Total
    
    $
    1,744
    
    
    $
    1,248
 6




---



##### Table of Contents



The estimated future amortization expense of intangible assets as of March
31, 2004 is as follows (in thousands): AmountYear ending December 31,2004
    
    $
    5,4372005
    
    
    7,1712006
    
    
    5,0632007
    
    
    3,1312008
    
    
    3,108Total
    
    $
    23,910
 Stock-Based Compensation Statement of Financial Accounting Standard 123, Accounting for
Stock-Based Compensation(SFAS 123), as amended by SFAS 148, Accounting for
Stock-Based Compensation  Transition and Disclosure, establishes accounting
and reporting standards for stock-based employee compensation plans. As
permitted by SFAS 123, ISS continues to account for stock-based compensation in
accordance with Accounting Principles Board Opinion No. 25, Accounting for
Stock Issued to Employees(APB 25), and has elected the pro forma disclosure
alternative of SFAS 123. Although SFAS 123 allows the Company to continue to follow APB 25
guidelines, the following table shows pro forma net loss and pro forma net loss
per share for the periods indicated as if the Company had adopted SFAS 123. The
following table illustrates the effect on net income per share if the
provisions of SFAS 123 had been applied. The pro forma impact of applying SFAS
123 as illustrated below will not necessarily be representative of the pro
forma impact in future years. Pro forma information is as follows (amounts in
thousands, except per share amounts): Three months endedMarch 31,2004
    
    2003Net income, as reported
    
    $
    5,220
    
    
    $
    5,362Pro forma stock compensation expense
computed under the fair value method, net
of income taxes
    
    
    (6,422
    )
    
    
    (6,684
    )Pro forma net loss
    
    
    (1,202
    )
    
    
    (1,322
    )Basic net income per share of Common
Stock, as reported
    
    $
    0.11
    
    
    $
    0.11Diluted net income per share of
Common Stock, as reported
    
    $
    0.10
    
    
    $
    0.11Pro forma basic and diluted net loss per
share of Common Stock
    
    $
    (0.02
    )
    
    $
    (0.03
    )
 In the first quarter of 2004, 280,000 restricted shares were issued to
officers and certain key employees of ISS. These shares shall vest in two
installments: 50% will vest two years from the grant date, and the remaining
50% will vest three years from the grant date. Upon issuance of restricted
shares, unearned compensation is recorded in stockholders equity as deferred
compensation equal to the market value of the restricted shares and is
recognized as compensation expense ratably over the vesting periods, as
applicable. Total compensation expense for restricted stock awards, including
the expense for 13,000 restricted shares issued to directors in 2003, amounted
to $385,000 in the first quarter of 2004. Recently Issued Accounting Standards In December 2003, the SEC issued Staff Accounting Bulletin No. 104 (SAB
104), Revenue Recognition, which supercedes Staff Accounting Bulletin No.
101 (SAB 101), Revenue Recognition in Financial Statements. The primary
purpose of SAB 104 is to rescind accounting guidance contained in SAB 101
related to multiple element revenue arrangements, which was superceded as a
result of the issuance of Emerging Issues Task Force 00-21 (EITF 00-21),
Accounting for Revenue Arrangements with Multiple Deliverables. SAB 104 also
incorporated certain sections of the SECs Revenue Recognition in Financial
StatementsFrequently Asked Questions and Answers document. While the wording
of SAB 104 has changed to reflect the issuance of EITF 00-21, the 7




---



##### Table of Contents



revenue recognition principles of SAB 101 remain largely unchanged by the
issuance of SAB 104. The adoption of SAB 104 did not have a material impact on
the Companys consolidated financial position, results of operations or cash
flows. In January 2003, the FASB issued Financial Interpretation No. 46,
Consolidation of Variable Interest Entities (FIN 46), which addresses
consolidation by business enterprises of variable interest entities that
either: (1) do not have sufficient equity investment at risk to permit the
entity to finance its activities without additional subordinated financial
support, or (2) the equity investors lack an essential characteristic of a
controlling financial interest. In December 2003, the FASB issued Financial
Interpretation No. 46-R, Consolidation of Variable Interest Entities (FIN
46-R), which represents a revision to FIN No. 46. The provisions of FIN 46-R
are effective for interests in variable interest entities as of the first
interim or annual period ending after December 15, 2003. The adoption of FIN 46
and FIN 46-R did not have a material impact on the Companys financial
position, results of operations or liquidity as the Company did not have any
variable interest entities that required consolidation or disclosure under FIN 46 or FIN
46-R. Note 2. Income Taxes The Company recorded tax provisions of $3.0 million and $3.3 million for
the three-month periods ended March 31, 2004 and 2003, respectively. While
income tax expense was recorded on domestic income, the amount of domestic
taxes payable was reduced by deductions related to the employee exercise of
stock options in current and prior periods. The tax benefit of these deductions
was recorded as additional paid-in-capital. Taxes paid generally relate to
foreign operations and certain state taxes for which net operating loss
deductions have been suspended. The effective tax rate was approximately 36% and 38% for the quarters
ended March 31, 2004 and 2003, respectively. The effective rates differ from
the statutory rates due primarily to the impact of acquisition related
intangibles that are not deductible for income tax purposes. As of March 31, 2004, ISS had a net operating loss carryforward of
approximately $14.6 million related to US operations. The tax benefit of this
carryforward will be recorded as additional paid-in-capital as realized. There
are also approximately $8.0 million of research and development tax credit
carryforwards that expire between 2011 and 2023 and foreign tax credit
carryforwards of $2.9 million that expire between 2006 and 2008. In addition, Cobion, which was acquired by ISS in January 2004, has a net
operating loss carryforward of approximately $9.1 million. The tax value of
this loss has been recorded as a deferred tax asset and the Company will not
recognize a provisional benefit as this loss is utilized. Note 3. Business Acquisition On January 14, 2004, ISS acquired Cobion, a privately held company based
in Kassel, Germany. Cobion provides content filtering and anti-spam technology
that protects individuals and enterprises against unwanted Web content, spam,
misuse of information and lost productivity. The Company intends to continue to
sell the Cobion product on a stand-alone basis as well as include the
technology in the Companys multi-function Proventia appliance in 2004. Total cash consideration for all of the outstanding
shares of Cobion and the acquisition related fees was approximately $33.5 million. The Company adopted a plan
to restructure Cobion whereby certain Cobion employees will be terminated over
a six-month period following the acquisition. As a result, acquisition costs
included the accrual of $172,000 of severance costs associated with these
terminations. As of March 31, 2004, the Company had not yet paid out any
severance. The Company will begin paying out severance against this
accrual in the second quarter of 2004. The operating results of Cobion are included in the consolidated financial
statements of ISS from the date of acquisition. The adjusted aggregate purchase
price was allocated based on a valuation report of the Cobion intangibles as
follows (in thousands): Net tangible liabilities of Cobion
    
    $
    (2,705
    )Developed technology
    
    
    16,030Customer relationships
    
    
    516Deferred income taxes
    
    
    (2,655
    )
 8




---



##### Table of Contents



Goodwill
    
    
    22,328$
    33,514
 The Company will amortize these intangible assets over their estimated
useful lives of five years for developed technology and three years for
customer relationships. The tangible assets of Cobion acquired in the merger consisted primarily
of cash, accounts receivable and fixed assets. The liabilities of Cobion
assumed in the merger consisted primarily of accounts payable, accrued expenses
and deferred revenue. The following summarizes the unaudited pro forma
results of operations of the Company for the first quarter of 2003, assuming
the acquisition of Cobion was concluded as of the beginning of 2003: (i) revenues of $59.7 million,
(ii) net income of $4.0 million and (iii) basic and diluted net income per share of Common
Stock of $.08. Net income and basic and diluted net income per share of Common Stock have been
adjusted to reflect the amortization of intangibles. Unaudited pro forma results are not included for the corresponding period of 2004,
as the impact of the acquisition would have been immaterial to the consolidated results of operations. This
pro forma information is not necessarily indicative of what combined operations would have been if ISS had control of Cobion
from the beginning of 2003. In August 2002, Internet Security Systems KK (ISS KK), acquired
privately held TriSecurity Holdings Pte Ltd. (TriSecurity), a primary ISS KK
distributor in Singapore. During the first quarter of 2003, ISS KK amended the
agreement and agreed to make payment of 245 shares of ISS KK in each of the
first quarters of 2004 and 2005, relating to annual contingent consideration
payments defined in the 2002 purchase agreement. Due to regulatory issues, the
agreement was amended prior to the 2004 payment to make the 2004 and 2005
payments in cash in lieu of shares. Additional consideration of $498,000 was
paid in February 2004 based on the fair market value of the 245 shares, and is
reflected as additional goodwill at March 31, 2004. Note 4. Comprehensive Income The components of comprehensive income are as follows (in thousands): Three months endedMarch 31,2004
    
    2003Net income, as reported
    
    $
    5,220
    
    
    $
    5,362Change in cumulative translation adjustment
    
    
    (779
    )
    
    
    (349
    )Comprehensive income
    
    $
    4,441
    
    
    $
    5,013
 Note 5. Income per Share The following table sets forth the computation of basic and diluted net income
per share (amounts in thousands, except per share amounts): Three months endedMarch 31,2004
    
    2003Numerator:Net income
    
    $
    5,220
    
    
    $
    5,362Denominator:Denominator for basic net
income per share   weighted
average shares
    
    
    48,646
    
    
    
    49,539Effect of dilutive stock options
    
    
    1,487
    
    
    
    424Denominator for diluted net
income per share   weighted
average shares
    
    
    50,133
    
    
    
    49,963
 9




---



##### Table of Contents



Three months endedMarch 31,2004
    
    2003Basic net income per share
    
    $
    0.11
    
    
    $
    0.11Diluted net income per share
    
    $
    0.10
    
    
    $
    0.11
 Note 6. Segment and Geographic Information ISS conducts business in one operating segment; providing information
security management solutions. The Company does, however, prepare operating
results for internal use on a geographic basis. These geographical based
operating costs consist of direct sales expenses, infrastructure to support its
employee and customer and partner base, supporting billing and financial
systems and a management team. Corporate expenses that are not charged directly
to the other segments include research and development, general and
administrative costs that support the global organization, amortization of
intangibles, stock-based compensation and goodwill and costs that are one-time
in nature, such as acquired in-process research and development. The accounting policies of the segments are the same as those described in
the summary of significant accounting policies. There are no inter-segment
sales. Our chief executive officer and chief financial officer evaluate
performance based on operating profit or loss from operations, and trade
accounts receivable for each segment. Other than trade accounts receivable,
assets and liabilities are not discretely allocated or reviewed by segment. In accordance with SFAS No. 131, Disclosures about Segments of an
Enterprise and Related Information, the Company has included a summary of the
segment financial information reported internally. The geographic segments are
the Americas, Europe, Middle East and Africa (EMEA), and the Asia/Pacific
region. The following table presents ISSs revenues, operating expenses and
operating income (loss) by reportable geographic segment (in thousands): As of and for the three months endedMarch 31, 2004Americas
    
    EMEA
    
    Asia/Pac
    
    Unallocated
    
    TotalRevenues from external customers:Product licenses
and sales
    
    $
    16,979
    
    
    $
    7,129
    
    
    $
    4,677
    
    
    $
    
    
    
    $
    28,785Subscriptions
    
    
    22,784
    
    
    
    6,591
    
    
    
    3,467
    
    
    
    
    
    
    
    32,842Professional services
    
    
    3,174
    
    
    
    889
    
    
    
    1,374
    
    
    
    
    
    
    
    5,437Total revenue
    
    
    42,937
    
    
    
    14,609
    
    
    
    9,518
    
    
    
    
    
    
    
    67,064Cost of revenues:Product licenses and sales
    
    
    2,476
    
    
    
    851
    
    
    
    781
    
    
    
    
    
    
    
    4,108Subscriptions and professional
services
    
    
    7,812
    
    
    
    1,261
    
    
    
    2,600
    
    
    
    
    
    
    
    11,673Total cost of revenues
    
    
    10,288
    
    
    
    2,112
    
    
    
    3,381
    
    
    
    
    
    
    
    15,781Operating expenses
    
    
    15,423
    
    
    
    6,995
    
    
    
    1,936
    
    
    
    19,276
    
    
    
    43,630Total expenses
    
    
    25,711
    
    
    
    9,107
    
    
    
    5,317
    
    
    
    19,276
    
    
    
    59,411Segment operating income (loss)
    
    $
    17,226
    
    
    $
    5,502
    
    
    $
    4,201
    
    
    $
    (19,276
    )
    
    $
    7,653Accounts receivable, net
    
    $
    39,790
    
    
    $
    13,305
    
    
    $
    12,206
    
    
    $
    
    
    
    $
    65,301Property and
equipment, net
    
    $
    31,998
    
    
    $
    1,807
    
    
    $
    6,216
    
    
    $
    
    
    
    $
    40,021
 As of and for the three months endedMarch 31, 2003Americas
    
    EMEA
    
    Asia/Pac
    
    Unallocated
    
    TotalRevenues from external customers:Product licenses
and sales
    
    $
    18,053
    
    
    $
    4,964
    
    
    $
    3,247
    
    
    $
    
    
    
    $
    26,264Subscriptions
    
    
    20,134
    
    
    
    4,177
    
    
    
    2,587
    
    
    
    
    
    
    
    26,898Professional services
    
    
    3,989
    
    
    
    1,037
    
    
    
    1,265
    
    
    
    
    
    
    
    6,291Total revenue
    
    
    42,176
    
    
    
    10,178
    
    
    
    7,099
    
    
    
    
    
    
    
    59,453Cost of revenues:Product licenses and sales
    
    
    1,416
    
    
    
    
    
    
    
    25
    
    
    
    
    
    
    
    1,441Subscriptions and professional
services
    
    
    8,235
    
    
    
    1,952
    
    
    
    2,161
    
    
    
    
    
    
    
    12,348Total cost of revenues
    
    
    9,651
    
    
    
    1,952
    
    
    
    2,186
    
    
    
    
    
    
    
    13,789Operating expenses
    
    
    14,288
    
    
    
    5,090
    
    
    
    1,798
    
    
    
    16,615
    
    
    
    37,791Total expenses
    
    
    23,939
    
    
    
    7,042
    
    
    
    3,984
    
    
    
    16,615
    
    
    
    51,580Segment operating income (loss)
    
    $
    18,237
    
    
    $
    3,136
    
    
    $
    3,115
    
    
    $
    (16,615
    )
    
    $
    7,873Accounts receivable, net
    
    $
    27,966
    
    
    $
    12,267
    
    
    $
    10,074
    
    
    $
    
    
    
    $
    50,307Property and
equipment, net
    
    $
    31,998
    
    
    $
    1,807
    
    
    $
    6,216
    
    
    $
    
    
    
    $
    40,021
 10




---



##### Table of Contents



Note 7. Commitments and Contingencies The Company and certain of its officers and directors were named as
defendants in a consolidated amended complaint that was filed in the United
States District Court for the Northern District of Georgia on October 9, 2002.
The lawsuit purported to be brought on behalf of a class of investors who
purchased the Companys stock during the period from April 5, 2001 through
August 14, 2001 (the Class Period). The lawsuit alleged violations of the
federal securities laws, including Sections 10(b) and 20(a) of the Securities
Exchange Act of 1934, as amended, and Rule 10b-5 thereunder. The complaint
sought damages in an unspecified amount. On September 3, 2003, the court
dismissed, with prejudice, the consolidated amended complaint. The plaintiffs
moved the court to reconsider its dismissal order and to grant them leave to
amend their complaint. The court denied the plaintiffs motion on April 13,
2004 and the plaintiffs have until May 13, 2004 to appeal the order dismissing
the consolidated amended complaint. Note 8. Exit or Disposal Activities In the fourth quarter of 2003, the Company committed to a plan of cost
reduction and exit activities through the closing of its engineering operations
in Reading, U.K. and Sydney, Australia. The Reading office was closed effective
November 30, 2003 and all costs associated with the closing of this facility
were charged to expense in 2003. The Sydney office will remain open through the
first half of 2004, with a small number of key employees. The costs of
severance associated with terminated employees were expensed in 2003. The following is a summary of the exit costs associated with engineering
operations and managed services (in thousands): One-timetermination
    
    Contractbenefits
    
    termination
    
    Other
    
    TotalAccrual at December 31, 2003
    
    $
    152
    
    
    $
    184
    
    
    $
    31
    
    
    $
    367Cash payments
    
    
    (152
    )
    
    
    (7
    )
    
    
    (23
    )
    
    
    (182
    )Accrual at March 31, 2004
    
    $
    
    
    
    $
    177
    
    
    $
    8
    
    
    $
    185
 One-time termination benefits consisted of severance and benefits for
involuntarily terminated employees. The contract termination costs include
costs for remaining lease payments on vacated facilities and costs associated
with vacating the facility. Other costs consisted primarily of write-off of
abandoned fixed assets and the write-off of leasehold improvements related to
the vacated facilities. The Company expects to utilize the balance of the exit
costs by June 30, 2004. 11




---



##### Table of Contents



INTERNET SECURITY SYSTEMS, INC. 
 Item 2. Managements Discussion and Analysis of Financial Condition and Results of Operations The following Managements Discussion and Analysis of Financial Condition
and Results of Operations should be read in conjunction with the Consolidated
Financial Statements and related Notes thereto included elsewhere in this
Quarterly Report onForm 10-Q, as well as the Managements Discussion and
Analysis of Financial Condition and Results of Operations and the Consolidated
Financial Statements and Notes thereto included in our Annual Report on Form
10-K for the year ended December 31, 2003 as filed with the Securities and
Exchange Commission (SEC). Except for the historical financial information, many of the matters
discussed in this Item 2 may be considered forward-looking statements.
Forward-looking statements can be identified by the use of words such as may,
will, should, could, continue, future, potential, believe,
project, plan, intend, seek, estimate, predict, expect,
anticipate and similar expressions, or the negative of such terms, or other
comparable terminology. Forward-looking statements also include the assumptions
underlying or relating to any of the foregoing statements. Such forward-looking
statements are not guarantees of future performance and involve a number of
risks and uncertainties. Our actual results could differ materially from those
anticipated in these forward-looking statements as a result of various factors,
including those set forth below under the caption Risk Factors and those
otherwise described from time to time in our Securities and Exchange Commission
reports filed after thisForm 10-Q. All forward-looking statements included in
thisForm 10-Qare based on information available to ISS on the date hereof. We
assume no obligation (except where required by law) to update any
forward-looking statements for any events or circumstances occurring after the
date of thisForm 10-Q. Overview We protect gateways, networks, servers and desktops against an
ever-changing spectrum of threats, with a comprehensive line of products and
services designed specifically for the enterprise, service provider, risk
management, small business and consumer markets. These threat protection
solutions go beyond basic access control to deliver multiple layers of defense
that detect, prevent and respond to threats prior to those threats causing
damage to our customers business operations. Our family of products is a critical element of an active Internet and
networking security program within todays world of global connectivity,
enabling organizations to proactively monitor, detect and respond to risks to
enterprise information. Prior to 2003, our products were exclusively software,
providing intrusion detection and vulnerability assessment solutions. In 2003,
we began to sell a new line of products called Proventia, which includes an
appliance pre-loaded and configured with our network-based software solutions
for intrusion detection and in-line intrusion prevention. Initial customer
response has been positive, with this line representing 49% of product and
license sale revenues for the first quarter of 2004. We believe this new
product line is critical to our product sales growth and the ongoing
subscription revenues associated with such sales. In the fourth quarter of 2003, our product offerings expanded to include
multi-function Proventia appliances that include firewall, virtual private
network (VPN), and anti-virus protection in addition to intrusion protection.
We expect to add content filtering and anti-spam to this product line in the
second quarter of 2004. We believe this expanded product offering significantly
increases our market opportunity as well as our risk from broader competition.
While there were increasing levels of sales of this product since being
introduced in December 2003, our expectations for future revenue growth are
dependent on successfully penetrating both our existing intrusion protection
market and new network security markets with this multi-function appliance.
This product also has a different pricing model than our traditional pricing
models and results in a more significant portion of the sales price being
deferred and recognized as subscription revenues over a specified term. Our managed services offerings currently provide remote management of our
best-of-breed security technology, focusing on security assessment and
intrusion detection systems, and include firewalls, VPNs, anti-virus and URL
filtering software. We focus on serving as the trusted security provider to our
customers by maintaining within our existing products the latest
counter-measures to security risks, creating new innovative products based on
our customers needs and providing professional and managed services. In an
effort to create differentiation, we emphasize the management of our own
products, which has allowed us to announce a new offering in early 2004 called
managed protection services. We expect this new service to provide guaranteed
protection to customers who meet the requirements of the program. The program
provides for a fixed cash payment if the protection system is compromised by an
exploit for which protection is guaranteed. We will use historical experience
to determine potential payouts under this program and accrue such in accordance
with current accounting requirements. Since the program has just begun, there
are no required accruals as of March 31, 2004. 12




---



##### Table of Contents



Many factors will affect our future financial performance, especially our
ability to differentiate our offerings from competitors that include much
larger companies with greater marketing capabilities, financial resources and
brand recognition. In order to continue to create such differentiation, we
expect to continue to expand our domestic and international sales and marketing
operations, seek acquisition candidates and alliances with partners whose
products, technologies or services capabilities are complementary to our
solutions; and improve our internal operating and financial infrastructure in
support of our strategic goals and objectives. At the same time, we expect to
adjust our organization size in light of changing economic conditions and
maintain emphasis on controlling discretionary spending and capital
expenditures. While we believe in the long-term success of our business
solutions, our prospects must be considered in light of the recent experience,
risks and difficulties that are frequently encountered by companies serving
rapidly evolving markets. See Risk Factors. Critical Accounting Policies The consolidated financial statements were prepared in conformity with
accounting principles generally accepted in the United States. As such,
management is required to make certain estimates, judgments and assumptions it
believes are reasonable based upon the information available. These estimates
and assumptions affect the reported amounts of assets and liabilities at the
date of the financial statements and the reported amounts of revenues and
expenses during the periods presented. The significant accounting policies
which management believes are the most critical to aid in fully understanding
and evaluating our reported financial results include the following: Revenue recognition We recognize revenue in the following three categories:  -
    
    Product licenses and sales, which include revenue from sales of perpetual
software licenses and products;-
    
    Subscription revenues, which include product support and content updates,
term licenses, and managed service arrangements; and-
    
    Professional services revenues, which includes fee-based service
engagements and training. We recognize software license revenue under Statement of Position (SOP)
97-2, Software Revenue Recognition, as modified by SOP 98-9, Software Revenue
Recognition with Respect to Certain Transactions, when the following criteria
have been met:  -
    
    persuasive evidence of an arrangement exists;-
    
    delivery has occurred or services have been rendered;-
    
    price is fixed or determinable; and-
    
    collection is probable. Product licenses and sales We recognize perpetual software license revenues upon (1) delivery of
software or, if the customer has evaluation software, delivery of the software
key and (2) issuance of the related license, assuming that no significant
vendor obligations or customer acceptance rights exist. Where payment terms are
extended over periods greater than 12 months, revenue is recognized as such
amounts become due and payable. Product sales consist primarily of appliances
sold in conjunction with ISS licensed software. These sales are recognized upon
shipment to the customer provided all other revenue recognition criteria are
met. Sales of enterprise products are generated both through direct sales to
end-users as well as through various partners, including system integrators,
value-added resellers and distributors. License revenue is recognized when the
sale has occurred for an identified end user through electronic delivery of a
software key that is necessary to operate the product, provided all other
revenue recognition criteria are met. At the point of delivery, the end-user
has no right of return. Subscription revenues 13




---



##### Table of Contents



Renewable product support and content updates are separate components of
product licenses and sales. Term licenses allow customers to use our products
and receive product support coverage and content updates for a specified
period, generally 12 months. We generally invoice for product support, content
updates and term licenses at the beginning of the term and recognize revenue
ratably over the subscription term. Security monitoring and management services
for information assets and systems are part of managed services and associated
revenues are recognized and billed as such services are provided. Historically, our appliance and software sales have been accounted for
primarily as revenue at the time of sale, with product support and content
updates generally representing between 20% and 30% of the license or product
amount. With the introduction of our Proventia multi-function appliances, we
expect to significantly alter this ratio, as the majority of the initial price
paid by the customer will be for content provided for a specified term. This
will result in the subscription component being recorded initially in deferred
revenues and recognized over the term as subscription revenue. Professional services revenues Service engagements are typically billed on either a fixed fee or
time-and-materials basis and primarily consist of security assessments of
customer networks and the development of customers security policies. These
offerings are intended to support our goal of providing products and managed
services. We prefer to have our partners provide these services where
practical. We recognize such professional services revenues as the related
services are rendered. Multiple element arrangements can include any combination of our products
and services listed above. When some elements are delivered prior to others in
an arrangement, all revenue is deferred until the delivery of the last element
unless all of the following exist:  -
    
    vendor specific objective evidence (VSOE) of fair value of the
undelivered elements;-
    
    the functionality of the delivered elements is not dependent on the
undelivered elements; and-
    
    delivery of the delivered elements represents the culmination of the
earnings process. When these criteria have been met, we allocate revenue to the delivered
software product using the residual method. Under the residual method, we
allocate discounts inherent in the arrangement entirely to the product that is
initially delivered and recognize the other elements as they are delivered
based on the VSOE, which is typically determined
by the company selling those elements separately. Our historical rate of product returns by customers of our
products is negligible. We offer evaluation software available
via download from our website and evaluation units for appliance-based products
that allow potential customers to see the functionality of the products on
their own networks. Allowance for doubtful accounts Our sales are global, with customers located in the United States, Europe,
Middle East, Latin America and Asia/Pacific regions. We perform periodic credit
evaluations of our customers financial condition and do not require
collateral. We provide for estimated credit losses as such losses become
probable. We evaluate specific accounts when we become aware of a situation
where a customer may not be able to meet its financial obligations due to
deterioration of its liquidity or financial viability, credit ratings or
bankruptcy. The allowance for doubtful accounts is established based on the
best facts available to us and is reevaluated and adjusted as additional
information is received. At March 31, 2004, the allowance for doubtful accounts
totaled $2.9 million, or 4.3% of the $68.2 million of total trade receivables.
This 4.3% allowance percentage of receivables reflects our practice to leave
accounts on our general ledger and provide reserves pending final resolution of
collectibility rather than write-off such accounts. During the first quarters
of 2004 and 2003, we incurred bad debt expense of $289,000 and $412,000
respectively. While actual credit losses have historically been within managements
expectations and the provisions established, we cannot guarantee that we will
continue to experience the same credit loss rates we have in the past. If the
financial condition of our customers were to deteriorate, resulting in an
impairment of their ability to make payments, additional allowances may be
required. 14




---



##### Table of Contents



Impairment of goodwill and other long-lived and intangible assets We review goodwill for impairment on an annual basis or on an interim
basis whenever events or changes in circumstances indicate that the carrying
amount of an asset may not be recoverable. All other long-lived and intangible
assets are reviewed for impairment whenever events or circumstances indicate
that the carrying amount of an asset may not be recoverable. Such impairment
loss would be measured as the difference between the carrying amount of the
asset and its fair value based on the present value of estimated future cash
flows. Significant judgment is required in the forecasting of future operating
results, which are used in the preparation of projected cash flows. Due to
uncertain market conditions and potential changes in our strategy and products,
it is possible that forecasts used to support our intangible assets may change
in the future which could result in significant non-cash charges that would
adversely affect our results of operations. We currently have goodwill and other acquisition related intangibles of
approximately $248 million, with $195 million of goodwill related to our June
2001 acquisition of Network ICE Corporation (Network ICE) and $22 million of
goodwill related to the January 2004 acquisition of Cobion. The determination
of whether or not goodwill is impaired involves significant judgments based
upon short and long-term projections of future performance. We have concluded
that this amount is realizable based on forecasted discounted cash flows
through 2007 and on our stock market valuation. Neither method indicated that
our goodwill had been impaired and, as a result, we did not record any
impairment losses related to goodwill during the quarter ended March 31, 2004.
Other intangibles of approximately $25 million are principally acquired
technology from the Network ICE and Cobion acquisitions that are a primary
component in our current product offerings. Acquisitions We believe that our total solutions approach will positively impact our
revenue. This includes our products, managed services offerings, and product
content and support. While we expect the expansion of these product and service
offerings to originate primarily from internal development, our strategy
includes acquiring products, technologies and service capabilities that fit
within our strategy and could potentially accelerate the timing of the
commercial introduction of such products and technologies. On January 14, 2004, we acquired Cobion, a privately held company based in
Kassel, Germany. Cobion provides content filtering and anti-spam technology
that protects individuals and enterprises against unwanted Web content, spam,
misuse of information and lost productivity. We intend to continue to sell the
Cobion product on a stand-alone basis as well as include the technology in our
multi-function Proventia appliance in 2004. ISS paid cash of approximately $33.5 million for all of the outstanding
shares of Cobion and the acquisition related fees. We also adopted a plan to
restructure Cobion whereby certain Cobion employees will be terminated over a
six-month period following the acquisition. As a result, acquisition costs
included the accrual of $172,000 of severance costs associated with these
terminations. As of March 31, 2004, we had not yet paid out any severance and
the full balance remained in accrued expenses on the Consolidated Balance
Sheet. We will begin paying out severance against this accrual in the second
quarter of 2004. Results of Operations The following table sets forth our consolidated historical operating
information, as a percentage of total revenues, for the periods indicated: Three months endedMarch 31,2004
    
    2003Consolidated Statements of Operations Data:Product licenses and sales
    
    
    43
    %
    
    
    44
    %Subscriptions
    
    
    49
    %
    
    
    45
    %Professional services
    
    
    8
    %
    
    
    11
    %Total revenues
    
    
    100
    %
    
    
    100
    %Cost of revenues:Product licenses and sales
    
    
    6
    %
    
    
    2
    %Subscriptions and
professional services
    
    
    18
    %
    
    
    21
    %Total cost of revenues
    
    
    24
    %
    
    
    23
    %Research and development
    
    
    17
    %
    
    
    16
    %Sales and marketing
    
    
    36
    %
    
    
    36
    %
 15




---



##### Table of Contents



Three months endedMarch 31,2004
    
    2003General and administrative
    
    
    9
    %
    
    
    9
    %Amortization of intangibles and stock-based compensation
    
    
    3
    %
    
    
    3
    %Total costs and expenses
    
    
    89
    %
    
    
    87
    %Operating income
    
    
    11
    %
    
    
    13
    %
 Revenues Product licenses and sales Product licenses and sales, including perpetual licenses and sales of
partner software and hardware appliances, represented 43% of total revenues for
the three month period ended March 31, 2004 and was comparable to the 44% for
the corresponding period in 2003. However, the products making up this revenue
component have changed significantly over the last twelve months. Since the second quarter of 2003, we have delivered the Proventia family
of network protection appliances that collectively provides unified,
multi-function protection capabilities designed to identify and prevent many
forms of attack with minimal user intervention. They are designed to operate in
demanding network environments while being easy to deploy, easy to use and
centrally managed, all in an effort to make our solution more cost-effective.
By the first quarter of 2004, Proventia represented 49% of our product and
license revenues and we experienced a 10% overall growth in product and license
revenues to $28.8 million over the first quarter of 2003. Our future growth is dependent on a continuation of the positive market
response to our Proventia family of products. During 2004, we expect to extend
Proventia to our server and desktop solutions. This expected growth is critical
as it represents not only product and license revenues, but also subscription
revenues from product support and content. This is particularly important with
respect to our multi-function Proventia appliances where the majority of the
sale amount is typically associated with software blades licensed on a
subscription basis and therefore recognized as subscription revenue over the
license period. Our present product roadmap focuses our development on product offerings
and enhancements that will provide broader Proventia appliance offerings and
continue to improve central control and manageability, easier deployment and
more refined information. We expect that this focus will make our products more
cost effective to implement and maintain and will increase the future level of
product licenses and sales. Subscriptions Subscriptions revenue represented 49% of total revenues in the three
months ended March 31, 2004 increasing from 45% of total revenues in the three
months ended March 31, 2003. This was an increase of 22% from $26.9 million in
the first quarter of 2003 to $32.8 million in the first quarter of 2004.
Subscriptions revenue consists of product support and content updates, term
licenses of products and security-monitoring fees for managed services
offerings. Product content and support revenues, the largest component of
subscriptions revenue, remained constant at 31% of total revenues in the three
months ended March 31, 2003 and 2004. Product content and support includes
hardware support of our Proventia appliances, software updates, technical
support and security content, which are provided through contracts executed
with customers for a specified term and billed at the time of contract. Such
billings are recorded as deferred revenues on our balance sheet and amortized
as subscription revenue over the term of the contract. We expect product
content and support revenues to increase in the future as our client base that
generates product content and support revenues expands and the impact of the
pricing model of our multi-function Proventia appliance. Managed services revenue accounted for 13% of total revenues for the
quarter ended March 31, 2004, as compared with 10% in the corresponding period
of 2003. We believe this increase was due to a strong demand in the market for
proven, financially sound, managed security service providers. We are marketing
managed services both directly to end users and through partners, including a
number of new arrangements with integrators and service providers that include
managed services as a part of their service offerings to their customers. We
also expect sales of managed services to continue to grow steadily as we focus
our efforts on marketing new, innovative offerings, such as our managed
protection services, to new and existing customers. Managed
protection services
is a premium service combining vulnerability assessment, managed protection,
and other professional services. Professional services Professional services revenue decreased both in absolute dollars and as a
percentage of total revenue from 11% in the three months ended March 31, 2003
to 8% in the three months ended March 31, 2004. This trend is largely the
result of our conscious effort to look 16




---



##### Table of Contents



to our system integration and channel partners to serve as the primary
resource to fulfill the services and education needs of our customers. Geographic regions Geographically, we derived the majority of our revenues from sales to
customers within the Americas region. Revenues by region represented the
following percentages of total revenues for the periods indicated: Three months endedMarch 31,2004
    
    2003Americas
    
    
    64
    %
    
    
    71
    %EMEA
    
    
    22
    %
    
    
    17
    %Asia/Pacific Rim
    
    
    14
    %

    
    
    12
    %
 While there have been changes in the proportion of revenues generated by
each region, all of the regions experienced growth in revenues when comparing
the first quarters of 2004 and 2003. Revenues in EMEA benefited not only from
volume growth, but also from a strengthening currency over the last twelve
months, since products are primarily sold in the Euro currency. The financial
data for each segment can be found in Note 6 to the Consolidated Financial
Statements. Costs and Expenses Personnel Personnel and related costs represent our largest expense category. We
ended the first quarter of 2004 with 1,230 employees, up from 1,150 at the
beginning of the year. This increase occurred primarily in engineering, sales
and marketing and general and administrative from the January acquisition of
Cobion. We also had increases in growth areas such as managed services. Cost of product licenses and sales Cost of product licenses and sales consists of several components. Costs
associated with licensing our software products are minor. The substantial
portion of our cost of product licenses and sales represents the hardware cost
of our Proventia appliances and payments to partners for their products that we
sell or integrate with our managed service offerings. This cost, as a
percentage of product licenses and sales revenue, increased from 5% in the
quarter ended March 31, 2003 to 14% in the quarter ended March 31, 2004. The
increase is connected with the introduction of the Proventia appliance line
beginning in the second quarter of 2003 and we expect the increase in cost of
product licenses and sales to continue to increase in future periods with the
continued growth of Proventia appliance sales. Cost of subscriptions and professional services Cost of subscriptions and professional services includes the cost of our
technical support personnel who provide assistance to customers under product
support agreements, the security operations center costs of providing managed
security monitoring services and the costs related to our professional services
and training. These costs, as a percentage of subscription and professional
services revenues, decreased from 37% in the three months ended March 31, 2003
to 30% in the three months ended March 31, 2004. Costs associated with our technical support personnel and our security
operations centers increased as we added personnel to handle additional
customers. We gained efficiencies in our security operations centers and
restructured our support groups to be more productive so personnel increased at
a much lower rate than revenue growth, contributing to the decrease in those
costs as a percentage of total revenues. While we continue to seek increased
productivity, we do expect to increase costs with a continued increase in
revenues in the future. Offsetting this increase of costs associated with our technical support
personnel and our security operations centers is a decrease in costs associated
with our professional services and education services. These costs decreased
both in absolute dollars and as a percentage of total revenues from the quarter
ended March 31, 2003 to the comparable quarter of 2004. These cost decreases
accompanied the decrease in revenues that occurred through (i) a continued
narrowing of our consulting offerings to focus on services 17




---



##### Table of Contents



that directly contribute to our protection platform strategy, (ii) the
outsourcing of educational training outside of Atlanta to authorized partners,
and (iii) a decrease in the number of training classes related to third-party
products. Research and development Research and development expenses consist of salary and related costs of
research and development personnel, including costs for employee benefits, and
depreciation on computer equipment. These costs include those associated with
maintaining and expanding the X-Force, our internal team of security experts.
We believe our primary research and product development and managed service
offerings are important to retaining our leadership position in the market. We continue to add functionality to our product family, providing gateway,
network, server and desktop-based solutions, as well as to our security
management applications. These improvements, as well as new offerings, are
intended to provide our customers with more powerful and easier-to-use
solutions for security management across the enterprise. In March 2004, we
introduced the Proventia M30 Multi-Function Protection Appliance, an
all-in-one appliance that identifies and blocks known and unknown threats, as
well as unwanted traffic, in a single easy-to-use and manage device. Research and development expenses increased in absolute dollars from $9.7
million in the three months ended March 31, 2003 to $11.3 million in the three
months ended March 31, 2004. Research and development expenses represented 16%
of total revenues in the three months ended March 31, 2003 and 17% of total
revenues in the three months ended March 31, 2004. This is principally due to
the acquisition of Cobion and the amortization of development source code that
was licensed in the first quarter of 2004 and is used in our Proventia
products. While we are committed to continue our investment in X-Force research and
development capabilities, which we believe distinguishes ISS from its
competitors, we intend to seek leverage in future periods in the research and
development area while enhancing current technologies and developing new
technologies. Sales and marketing Sales and marketing expenses consist of salaries, travel expenses,
commissions, advertising, maintenance of our website, trade show expenses,
costs of recruiting sales and marketing personnel and costs of marketing
materials. Sales and marketing expenses increased in absolute dollars from
$21.2 million in the three months ended March 31, 2003 to $24.4 million in the
corresponding period of 2004, but remained constant as a percentage of revenues
at 36% of total revenues. This increase in absolute dollars is mainly due to an
increase in our overall sales headcount. We expect to achieve leverage in our sales efforts by focusing our direct
touch sales force on large customers that are served either directly by us or
through large systems integrators. This channel, which includes systems
integrators, value-added resellers and distributors, will continue to be of
increasing importance to us. We intend to use its capabilities to reach larger
customers through joint selling efforts and to reach departmental and small
companies, especially for our Proventia multi-function appliance, which we
believe has much more appeal to these companies. General and administrative General and administrative expenses consist of personnel-related costs for
executive, administrative, finance and human resources, internal information
systems and other support services costs, and legal, accounting and other
professional service fees. General and administrative expenses of $6.3 million in the first quarter
of 2004 and $5.5 million in the first quarter of 2003 represented 9% of total
revenues in both periods. The increase in amount is primarily the result of
increased costs associated with public company matters such as directors and
officers insurance, audit fees and compliance with various regulatory matters
such as the Sarbanes-Oxley Act of 2002. Additionally, we began to use
restricted stock, in addition to stock options, as an equity component of
compensation beginning in the first quarter of 2004. Amortization We incurred amortization expense related to intangible assets and
stock-based compensation of $1.8 million in the three months ended March 31,
2004 and $1.4 million in the three months ended March 31, 2003. These
intangible assets and stock-based compensation resulted from acquisitions
accounted for under the purchase method of accounting and are amortized over
their 18




---



##### Table of Contents



estimated useful lives. The increase is a result of the amortization of
intangibles related to our acquisition of Cobion in the first quarter of 2004. Interest income Interest income decreased from $643,000 in the quarter ended March 31,
2003 to $528,000 in the comparable quarter of 2004 as the market rate of
interest paid on investment-quality commercial paper and similar investments
dropped from approximately 1.4% during the first quarter of 2003 to
approximately 1.1% in the first quarter of 2004. Provision for income taxes Our effective tax rate was approximately 36% and 38% for the quarters
ended March 31, 2004 and 2003, respectively. The effective rates differ from
the statutory rates primarily due to the impact of acquisition related
intangibles that are not deductible for income tax purposes. Liquidity and Capital Resources Our financial position remained strong through the first quarter of 2004.
Our cash and cash equivalents and marketable security investments were $210.8
million at March 31, 2004. Our investments in marketable securities consist
solely of highly rated debt obligations with maturities of 12 months or less. We meet our working capital needs and capital equipment needs with cash
provided by operations. Cash provided by operations in the first three months
of 2004 totaled $19.5 million. The major components of cash flows provided by
operating activities were net income of $5.2 million, non-cash depreciation and
amortization expense charges of $5.1 million, income tax benefit from employee
exercises of stock options of $2.3 million, increase in deferred revenues of
$6.2 million and a decrease in net accounts receivable of $2.0 million. An important element of our liquidity is the collection of our accounts
receivable. We measure our accounts receivable management by our days sales
outstanding (DSO). This is a measurement of accounts receivable divided by
billings in the quarter, represented by the sum of revenues plus the change in
the deferred revenues liability account balance. This measurement was 78 days
at March 31, 2004, within our publicly stated target range of 75 to 85 days. Our net cash used in investing activities of $49.6 million in the first
three months of 2004 resulted primarily from our acquisition of Cobion. The
license for development source code used in our Proventia products was the
primary component of our capital purchases of $7.1 million. Investing
activities also included changes in our marketable securities that have quality
characteristics similar to cash equivalents, except their maturities when we
acquire them are longer than three months. The cash flow statement included the
purchase of $20.2 million of intermediate term marketable securities, primarily
interest-bearing government obligations and commercial paper, offset by net
proceeds from the maturity of marketable securities of $11.5 million. Our financing activities used $5.3 million of cash in the first three
months of 2004 principally due to the repurchase of our common stock under an
authorized plan to repurchase up to $50 million. In the first quarter of 2004,
we repurchased 373,000 shares of our common stock on the open market at an
aggregate cost of $6.6 million. Since the inception of the plan, we have
purchased 1.7 million shares at an average cost of $14.83 per share for a total
cash outlay of approximately $25.0 million. Also, in the first three months of
2004, the exercise of stock options by our employees and the issuance of common
stock through our employee stock purchase plan generated funds of approximately
$1.3 million. We believe our cash and cash equivalents and marketable securities will be
sufficient to meet our working capital needs and capital expenditures for the
foreseeable future. Furthermore, we are not aware of any trends, events, or
uncertainties that are reasonably likely to result in any significant change to
our liquidity. From time to time, we evaluate possible acquisition and
investment opportunities in businesses, products or technologies that are
complementary to ours. In the event we determine to pursue such opportunities,
we may use our available cash and cash equivalents and marketable securities
for this purpose. Off-Balance Sheet Arrangements 19




---



##### Table of Contents



Payments for certain of our operating leases are secured by two
collateralized stand-by letters of credit totaling approximately $10.3 million
at March 31, 2004. These stand-by letters of credit guarantee our payment
obligations on the leases and are renewable annually over the duration of the
applicable leases. If we default on the lease payments, the landlords can make
a claim against the letters of credit. We, in turn, would be liable to the
letter of credit issuers. Our stand-by letters of credit are collateralized by
securities worth $12.8 million at March 31, 2004. Other than these
non-cancelable operating leases, we have no off-balance sheet financing
arrangements, any relationships with structured finance or special purpose
entities, or any contractual obligations with unconsolidated entities that are
reasonably likely to impact our liquidity. Risk Factors Forward-looking statements are inherently uncertain as they are based on
various expectations and assumptions concerning future events and are subject
to known and unknown risks and uncertainties. Our forward-looking statements
contained in this Quarterly Report on Form 10-Q and elsewhere should be
considered in light of the following important risk factors. Variations from
our stated intentions or failure to achieve objectives could cause actual
results to differ from those projected in our forward-looking statements. With
respect to our Business Outlook published in our earnings press release for the
quarter ended March 31, 2004, you may continue to rely on this Business Outlook
prior to the start of our quiet period for the quarter ending June 30, 2004
(the Q2 Quiet Period), unless we have published a notice stating otherwise.
During the Q2 Quiet Period, ISS and its corporate representatives will not
comment concerning our previously published Business Outlook. During the Q2
Quiet Period, the Companys press releases and filings with the SEC on Forms
10-K and 10-Q should be considered historical, speaking as of a date prior to
the Q2 Quiet Period only and not subject to update by the Company. The Q2
Quiet Period is expected to run from June 15, 2004 until financial results for
the quarter ending June 30, 2004 are released in July 2004. There are many factors that affect ISS business and the results of its
operations, some of which are beyond ISS control. The following is a
description of some of the important factors that may cause the actual results
of ISS operations in future periods to differ materially from those currently
expected or desired. We encourage you to read this section carefully. We Operate in a Rapidly Evolving Market We operate in a new and rapidly evolving market and must, among other
things:  
    
    respond to competitive developments;
    
    continue to upgrade and expand our product and services offerings; and
    
    continue to attract, retain and motivate our employees. We cannot be certain that we will successfully address these issues. As a
result, we cannot assure our investors that we will be able to continue to
operate profitably in the future. We introduced our new Proventia appliance line, beginning with the A
Series in April 2003. The G Series and M Series were introduced in the fourth
quarter of 2003. As a result of our limited history with these products, it may
be difficult to plan or project our revenues accurately. The revenue and income
potential of these products is unproven and the markets addressed by these
products are volatile. If these products fail to gain market acceptance, our
revenue could be below our expectations and our operating results could be
adversely affected. Our Future Operating Results Will Likely Fluctuate Significantly We cannot predict our future revenues and operating results with
certainty. However, we do expect our future revenues and operating results to
fluctuate due to a combination of factors, including:  
    
    the growth in the acceptance of, and activity on, the Internet and
the world wide web, particularly by corporate, institutional and
government users;
    
    the extent to which the public perceives that unauthorized access to
and use of online information are threats to network security; 20




---



##### Table of Contents




    
    customer budgets;
    
    the mix of product sales among the various products offered by ISS
and whether revenue is recognized upon sale or deferred to subsequent
periods;
    
    the volume and timing of orders, including seasonal trends in
customer purchasing;
    
    our ability to develop new and enhanced product and managed service
offerings and expand our professional services capabilities;
    
    the introduction and acceptance rate of ISS branded appliances, including increased cost of goods sold;
    
    our ability to accurately forecast and produce demanded quantities of our appliance products and models;
    
    availability of component parts of appliance products and reliance on contract manufacturers to produce such products;
    
    our ability to provide scalable managed services offerings through our partners in a cost effective manner;
    
    foreign currency exchange rates that affect our international operations;
    
    product and price competition in our markets; and
    
    general economic conditions, both domestically and in our foreign markets. We increasingly focus our efforts on sales of enterprise-wide security
solutions, which consist of our entire product suite and related professional
services, and managed security services, rather than on the sale of component
products. As a result, each sale requires substantial time and effort from our
sales and support staff. In addition, the revenues associated with particular
sales vary significantly depending on the number of products licensed by a
customer, the number of devices used by the customer and the customers
relative need for our professional services. Large individual sales, or even
small delays in customer orders, can cause significant variation in our license
revenues and results of operations for a particular period. The timing of large
orders is usually difficult to predict and, like many software and services
companies, many of our customers typically complete transactions in the last
month of a quarter. We cannot predict our operating expenses based on our past results.
Instead, we establish our spending levels based in large part on our expected
future revenues. As a result, if our actual revenues in any future period fall
below our expectations, our operating results likely will be adversely affected
because very few of our expenses vary with our revenues. Because of the factors
listed above, we believe that our quarterly and annual revenues, expenses and
operating results likely will vary significantly in the future. Our ability to provide timely guidance and meet the expectations of
investors with respect to our operating and financial results is impacted by
the tendency of a majority of our sales to be completed in the last month of a
quarter. We may not be able to determine whether we will experience material
deviations from guidance or expectations until the end of a quarter. Dependence on Third Party Suppliers and Manufacturers We carry little inventory of our appliance products and we rely on
suppliers to deliver necessary components to our contract manufacturers in a
timely manner based on the forecasts we provide. We currently purchase some
Proventia appliance components and contract manufacturing services from single
or limited sources. If shortages occur, supplies are interrupted, or we under
forecast sales of demanded models, we may not be able to deliver products to
our customers and our revenue and operating results would be adversely
affected. Because our supply of hardware is based on short-term forecasts and
purchase orders, our contract manufacturers are not obligated to purchase
components for greater quantities over longer periods. We provide six-month
forecasts of our demand to our contract manufacturers. If we overestimate our
requirements, our contract manufacturers may have excess inventory, which could
increase our costs. If we underestimate our requirements, our contract
manufacturers may have an inadequate component inventory and, based on lead
times, this could interrupt manufacturing and result in delays in shipments and
revenues. We Face Intense Competition in Our Market 21




---



##### Table of Contents



The market for network security monitoring, detection and response solutions is
intensely competitive, and we expect competition to increase in the future. We
cannot guarantee that we will compete successfully against our current or
potential competitors, especially those with significantly greater financial
resources or brand name recognition. Our chief competitors generally fall
within the following categories:  
    
    large companies, including Symantec Corp., Cisco Systems, Inc.,
Netscreen Technologies, Inc. (which is being acquired by Juniper
Networks, Inc.), and Network Associates, Inc., that sell competitive
products and offerings, as well as other large software companies that
have the technical capability and resources to develop competitive
products;
    
    software or hardware network infrastructure companies like Cisco
Systems, Inc. and Juniper Networks, Inc. that could integrate features
that are similar to our products into their own products; and
    
    relatively smaller software companies offering relatively limited applications for network and Internet security;
    
    small and large companies with competitive offerings to components of our managed services offerings. Mergers or consolidations among these competitors, or acquisitions of
small competitors by larger companies, represent risks. For example, Symantec
Corp., Cisco Systems, Inc., and Network Associates, Inc. have acquired smaller
companies that have intrusion prevention technologies during the past several
years, and Juniper Networks, Inc. announced it is acquiring Netscreen
Technologies, Inc. These acquisitions will make these entities potentially more
formidable competitors to us if such products and offerings are effectively
integrated. Large companies may have advantages over us because of their longer
operating histories, greater name recognition, larger customer bases or greater
financial, technical and marketing resources. As a result, they may be able to
adapt more quickly to new or emerging technologies and changes in customer
requirements. They can also devote greater resources to the promotion and sale
of their products than we can. In addition, these companies have reduced and
could continue to reduce, the price of their security monitoring, detection and
response products and managed security services, which increases pricing
pressures within our market. Several companies currently sell software products (such as encryption,
firewall, operating system security and virus detection software) that our
customers and potential customers have broadly adopted. Some of these companies
sell products that perform the same functions as some of our products. In
addition, the vendors of operating system software or networking hardware may
enhance their products to include the same kinds of functions that our products
currently provide. The widespread inclusion of comparable features to our
software in operating system software or networking hardware could render our
products less competitive or obsolete, particularly if such features are of a
high quality. Even if security functions integrated into operating system
software or networking hardware are more limited than those of our products, a
significant number of customers may accept more limited functionality to avoid
purchasing additional products. In addition, with the introduction of our multi-function M Series
Proventia appliance, we have offerings that compete with vendors of firewalls,
VPNs, anti-virus systems, and content and spam filtering. These
offerings are competitive with a broader spectrum of network security companies, as well as
those that also offer multi-function appliances or broad product suites, like
Symantec Corp. For the above reasons, we may not be able to compete successfully against
our current and future competitors. Increased competition may result in price
reductions, reduced gross margins and loss of market share. We Face Rapid Technological Change in Our Industry and Frequent Introductions
of New Products Rapid changes in technology pose significant risks to us. We do not
control nor can we influence the forces behind these changes, which include:  
    
    the extent to which businesses and others seek to establish more secure networks;
    
    the extent to which hackers and others seek to compromise secure systems;
    
    evolving computer hardware and software standards;
    
    changing customer requirements; and 22




---



##### Table of Contents




    
    frequent introductions of new products and product enhancements. To remain successful, we must continue to change, adapt and improve our
products in response to these and other changes in technology. Our future
success hinges on our ability to both continue to enhance our current line of
products and professional services and to introduce new products and services
that address and respond to innovations in computer hacking, computer
technology and customer requirements. We cannot be sure that we will
successfully develop and market new products that do this. Any failure by us to
timely develop and introduce new products, to enhance our current products or
to expand our professional services capabilities in response to these changes
could adversely affect our business, operating results and financial condition. Our products involve very complex technology, and as a consequence, major
new products and product enhancements require a long time to develop and test
before going to market. Because this amount of time is difficult to estimate,
we have had to delay the scheduled introduction of new and enhanced products in
the past and may have to delay the introduction of new and enhanced products in
the future. The techniques computer hackers use to gain unauthorized access to, or to
sabotage, networks and intranets are constantly evolving and increasingly
sophisticated. Furthermore, because new hacking techniques are usually not
recognized until used against one or more targets, we are unable to anticipate
most new hacking techniques. To the extent that new hacking techniques harm our
customers computer systems or businesses, affected or prospective customers
may believe that our products are ineffective, which may cause them or
prospective customers to reduce or avoid purchases of our products. Undetected Product Errors or Defects Could Result in Loss of Revenues, Delayed
Market Acceptance and Claims Against Us We offer warranties on our products, allowing the end customer to have any
defective product repaired, or to receive a replacement product for it during
the warranty period, or in certain circumstances return the product for a
refund. Our products may contain undetected errors or defects. If there is a
broad product failure across our customer base, we may decide to replace all
affected products or we may decide to refund the purchase price for defective
units. Such defects and actions may adversely affect our ability to record
revenue. Some errors are discovered only after a product has been installed and
used by end customers. Any errors discovered after commercial release could
result in loss of revenues and claims against us. We offer warranties on our service levels for managed security services.
If we do not meet warranties, the customer generally may obtain credits for
service. We also offer a managed protection service. This new service is
expected to provide guaranteed protection to customers who meet the
requirements of the program. The program provides for a fixed cash payment if
the protection system is compromised by an exploit for which protection is
guaranteed. We will use historical experience to determine potential payouts
under this program but because the program has just begun, we have no basis to
estimate or accrue for payments. If we are unable to fix errors or other product problems that later are
identified after full deployment, or if we fail to meet our service levels for
managed security services, in addition to the consequence described above, we
could experience:  
    
    failure to achieve market acceptance;
    
    loss of customers;
    
    loss of or delay in revenues and loss of market share;
    
    diversion of development resources;
    
    increased service and warranty costs;
    
    legal actions by our customers; and
    
    increased insurance costs. Our Products are Complex and Are Operated in a Wide Variety of Computer
Configurations, Which Could Result in Errors or Product Failures Because we offer very complex products, undetected errors, failures or
bugs may occur when they are first introduced or when new versions are
released. Our products often are installed and used in large-scale computing
environments with different operating systems, system management software and
equipment and networking configurations, which may cause errors or failures in
our products or may expose undetected errors, failures or bugs in our products.
We discover software errors, failures and bugs in certain of our product
offerings after their introduction and have experienced delays and could
experience lost revenues during the period required to correct these errors.
Our customers computer environments are often characterized by a wide variety
of standard and non- 23




---



##### Table of Contents



standard configurations that make pre-release testing for programming or
compatibility errors very difficult and time-consuming. Despite testing,
errors, failures or bugs may not be found in new products or releases after
commencement of commercial shipments. Errors, failures or bugs in products
released by us could result in negative publicity, product returns, loss of or
delay in market acceptance of our products or claims by customers or others. In addition, if an actual or perceived breach of network security occurs
in one of our end customers security systems, regardless of whether the breach
is attributable to our products, the market perception of the effectiveness of
our products could be harmed. Because the techniques used by computer hackers
to access or sabotage networks change frequently and generally are not
recognized until launched against a target, we may be unable to anticipate
these techniques. Alleviating any of these problems could require significant
expenditures of our capital and resources and could cause interruptions, delays
or cessation of our product licensing, which could cause us to lose existing or
potential customers and would adversely affect results of operations. We Might Have to Defend Lawsuits or Pay Damages in Connection With Any Alleged
or Actual Failure of Our Products and Services Because our products and services provide and monitor network security and
may protect valuable information, we could face claims for product liability,
tort or breach of warranty. Anyone who circumvents our security measures could
misappropriate the confidential information or other property of end customers
using our products, or interrupt their operations. If that happens, affected
end customers or others may sue us. In addition, we may face liability for
breaches caused by faulty installation of our products by our service and
support organizations. Provisions in our contracts relating to warranty
disclaimers and liability limitations may be unenforceable. Some courts, for
example, have found contractual limitations of liability in standard computer
and software contracts to be unenforceable in some circumstances. Defending a
lawsuit, regardless of its merit, could be costly and could divert management
attention. Our business liability insurance coverage may be inadequate or
future coverage may be unavailable on acceptable terms or at all. Risks Associated with Our Global Operations The expansion of our international operations includes our presence in
dispersed locations throughout the world, including throughout Europe and the
Asia/Pacific and Latin America regions. Our international presence and
expansion exposes us to risks not present in our U.S. operations, such as:  
    
    the difficulty in managing an organization spread over various
countries located across the world;
    
    compliance with, and unexpected changes in, a wide range of complex
regulatory requirements in countries where we do business;
    
    duties and tariffs imposed on importation of our products in other
jurisdictions where other manufacturers may not bear those same costs;
    
    increased financial accounting and reporting burdens;
    
    potentially adverse tax consequences;
    
    fluctuations in foreign currency exchange rates resulting in losses
or gains from transactions and expenses denominated in foreign
currencies;
    
    reduced protection for intellectual property rights in some countries;
    
    reduced protection for enforcement of creditor and contractual rights in some countries; and
    
    import and export license requirements and restrictions on the import
and export of certain technology, especially encryption technology and
trade restrictions. Despite these risks, we believe that we must continue to expand our
operations in international markets to support our growth. To this end, we
intend to establish additional foreign sales operations, expand our existing
offices, hire additional personnel, expand our international sales channels and
customize our products for local markets. If we fail to execute this strategy,
our international sales growth will be limited. 24




---



##### Table of Contents



Our Networks, Products and Services May be Targeted by Hackers Like other companies, our websites, networks, information systems,
products and services may be targets for sabotage, disruption or
misappropriation by hackers. As a leading network security solutions company,
we are a high profile target. Although we believe we have sufficient controls
in place to prevent disruption and misappropriation, and to respond to such
situations, we expect these efforts by hackers to continue. If these efforts
are successful, our operations, reputation and sales could be adversely
affected. We Must Successfully Integrate Acquisitions As part of our growth strategy, we have and may continue to acquire or
make investments in companies with products, technologies or professional
services capabilities complementary to our solutions. When engaging in
acquisitions, we could encounter difficulties in assimilating or completing the
development of the technologies, new personnel and operations into our company.
These difficulties may disrupt our ongoing business, distract our management
and employees, increase our expenses and adversely affect our results of
operations. These difficulties could also include accounting requirements, such
as impairment charges related to goodwill or expensing in-process research and
development costs. We cannot be certain that we will successfully overcome
these risks with respect to any future acquisitions or that we will not
encounter other problems in connection with our recent or any future
acquisitions. In addition, any future acquisitions may require us to incur debt
or issue equity securities. The issuance of equity securities could dilute the
investment of our existing stockholders. Our Proprietary Rights May be Difficult to Enforce We rely primarily on copyright, trademark, patent and trade secrets laws,
confidentiality procedures and contractual provisions to protect our
proprietary rights. We have obtained one United States patent and have a number
of patent applications pending, as well as numerous trademarks and trademark
applications pending. There can be no assurance that patents will be issued
from pending applications, or that claims allowed on any patents will be
sufficiently broad to protect our technology. There can be no assurance that
any issued patents will not be challenged, invalidated or circumvented, or that
any rights granted under these patents will actually provide competitive
advantages to us. Despite our efforts to protect our proprietary rights,
unauthorized parties may attempt to copy aspects of our products or to obtain
and use information that we regard as proprietary. Policing unauthorized use of
our products is difficult. While we cannot determine the extent to which piracy
of our software products occurs, we expect software piracy to be a persistent
problem. In addition, the laws of some foreign countries do not protect our
proprietary rights to as great an extent as do the laws of the United States,
and many foreign countries do not enforce these laws as diligently as U.S.
government agencies and private parties. If we are unable to protect our
proprietary rights to the totality of the features in our software and products
(including aspects of our software and products protected other than by patent
rights), we may find ourselves at a competitive disadvantage to others who need
not incur the additional expense, time and effort required to create the
innovative products that have enabled us to be successful. We May Be Found to Infringe the Proprietary Rights of Others Third parties may assert claims or initiate litigation related to
exclusive patent, copyright, trademark and other intellectual property rights
to technologies that are relevant to our business. Because of the large number
of patents in the Internet, networking, security and software fields, the
secrecy of some pending patents and the rapid rate of issuance of new patents,
it is not economically practical (or even possible) to determine in advance
whether a product (or any of its components) infringe or will infringe the
patent rights of others. Third party asserted claims and/or initiated
litigation can include claims against us or our manufacturers, suppliers, or
customers, alleging infringement of their proprietary rights with respect to
our existing or future products (or components of those products). Regardless
of the merit of these claims, they can be time-consuming, result in costly
litigation and diversion of technical and management personnel, or require us
to develop a non-infringing technology or enter into license agreements. There
can be no assurance that licenses will be available on acceptable terms and
conditions, if at all, in these circumstances, or that any indemnification that
might be available to us would be adequate to cover our costs of defense.
Furthermore, because of the potential for large judgments, which are not
necessarily predictable, it is not unusual to find even arguably unmeritorious
claims settled for significant funds. If any infringement or other intellectual
property claim made against us by a third party is successful, or if we fail to
develop non-infringing technology or license the proprietary rights on
commercially reasonable terms and conditions, our business, operating results,
financial condition and liquidity could be materially and adversely affected. We Must Continue to Attract and Retain Personnel in a Competitive Marketplace 25




---



##### Table of Contents



We believe that our future success will depend in part on our ability to
recruit and retain highly skilled management, sales, marketing and technical
personnel. To accomplish this, we believe that we must provide personnel with a
competitive compensation package, including stock options, restricted stock or
similar incentive stock awards. Increases in shares available for issuance
under our incentive stock plans and new incentive stock plans require
stockholder approval in many cases, and institutional stockholders, or
stockholders generally, may not approve future plans or increases. Our current
incentive stock plan expires in September 2005 and we believe that sufficient
shares are available for issuance under that plan to meet our needs until it
expires. We currently expect to propose a new incentive stock plan to
stockholders at our annual stockholders meeting in 2005. Additionally, the
accounting industry has recently determined that corporations will include a
compensation expense in their statement of operations relating to the issuance
of employee stock options. This will most likely become effective in calendar
year 2005. As a result, we may decide to issue fewer stock options and may be
impaired in our efforts to attract and retain necessary personnel. Conversely,
issuing a comparable number of stock options could adversely impact our results
of operations. Some Provisions in the ISS Certificate of Incorporation and Bylaws Make a
Takeover of ISS Difficult Our certificate of incorporation and bylaws contain provisions that could
have the effect of making it more difficult for a third party to acquire, or of
discouraging a third party from attempting to acquire, control of ISS. These
provisions:  
    
    establish a classified board of directors;
    
    create preferred stock purchase rights that grant to holders of common stock the right to purchase shares of Series A Junior Preferred
Stock in the event that a third party acquires 20% or more of the voting
power of our outstanding common stock;
    
    prohibit the right of our stockholders to act by written consent;
    
    limit calling special meetings of stockholders; and
    
    impose a requirement that holders of 66 2/3% of the outstanding shares of common stock are required to amend the provisions relating to
the classification of our board of directors and action by written
consent of stockholders. 
 Item 3. Quantitative and Qualitative Disclosures About Market Risk We have no material changes to the disclosure on this matter made in our
Annual Report on Form 10-K for the year ended December 31, 2003. 
 Item 4. Controls and Procedures Our management, with the participation of the Chief Executive Officer and
Chief Financial Officer, evaluated the effectiveness of our disclosure controls
and procedures as of the end of the period covered by this quarterly report.
Based on such evaluation, these officers have concluded that, as of such date,
our disclosure controls and procedures were effective to provide reasonable
assurance that information required to be disclosed in the reports the Company
files or submits under the Securities Exchange Act of 1934 is recorded,
processed, summarized and reported on a timely basis. There have not been any changes in the Companys internal control over
financial reporting during the quarter ended March 31, 2004 that have
materially affected, or are reasonably likely to materially affect, our
internal control over financial reporting. 
 PART II. OTHER INFORMATION 
 Item 1. Legal Proceedings The Company and certain of its officers and directors were named as
defendants in a consolidated amended complaint that was filed in the United
States District Court for the Northern District of Georgia on October 9, 2002.
The lawsuit purported to be brought on behalf of a class of investors who
purchased the Companys stock during the period from April 5, 2001 through
August 14, 2001 (the Class Period). The lawsuit alleged violations of the
federal securities laws, including Sections 10(b) and 20(a) of the Securities
Exchange Act of 1934, as amended, and Rule 10b-5 thereunder. The complaint
sought damages in an unspecified amount. On 26




---



##### Table of Contents



September 3, 2003, the court dismissed, with prejudice, the consolidated
amended complaint. The plaintiffs moved the court to reconsider its dismissal
order and to grant them leave to amend their complaint. The court denied the
plaintiffs motion on April 13, 2004 and the plaintiffs have until May 13, 2004
to appeal the order dismissing the consolidated amended complaint. 
 Item 2. Changes in Securities, Use of Proceeds and Issuer Purchases of Equity Securities (e) The following table provides information about purchases by the Company of
its common stock during the three months ended March 31, 2004: All such
purchases were made pursuant to a repurchase plan publicly announced on July
18, 2002 under which the Company has been authorized by the Board to purchase
up to $50 million. The plan terminates on July 14, 2004. Through March 31,
2004, the Company has purchased approximately 1.7 million shares at an
aggregate cost of approximately $25.0 million. Issuer Purchases of Equity Securities Total Number of
    
    Approximate DollarShares Purchased as
    
    Value of SharesPart of Publicly
    
    that May Yet BeTotal Number of
    
    Average Price Paid
    
    Announced Plans or
    
    Purchased Under thePeriod
    
    Shares Purchased
    
    Per Share
    
    Programs
    
    Plans or Programs1/1/04-1/31/04
    
    
    
    
    
    $
    
    
    
    
    
    
    
    $
    31,620,0002/1/04-2/29/04
    
    
    195,000
    
    
    $
    17.70
    
    
    
    1,505,500
    
    
    $
    28,168,0003/1/04-3/31/04
    
    
    177,500
    
    
    $
    17.57
    
    
    
    1,683,000
    
    
    $
    25,049,000
 
 Item 6. Exhibits and Reports on Form 8-K  (a)
    
    Exhibits. 3.1
    
    Restated Certificate of Incorporation (filed as Exhibit 3.1 to
the Companys Quarterly Report on Form 10-Q, dated November
14, 2000 and incorporated by reference herein).3.2
    
    Bylaws (filed as Exhibit 3.2 to the Companys Registration
Statement on Form S-1, Registration No. 373-44529 and
incorporated by reference herein).3.3
    
    Certificate of Designations of Series A Junior Participating
Preferred Stock dated July 24, 2002 (filed as Exhibit 3.3 to
the Companys Annual Report on Form 10-K, filed March 28, 2003
and incorporated by reference herein).4.1
    
    Specimen Common Stock certificate (filed as Exhibit 4.3 to the
Companys Registration Statement on Form S-8, Registration No.
333-100954, filed November 1, 2002 and incorporated by
reference herein).4.2
    
    Form of Rights Certificate (filed as Exhibit 4.2 to the
Companys Current Report on Form 8-K filed July 24, 2002 and
incorporated by reference herein.)4.3
    
    See Exhibits 3.1 and 3.2 for provisions of the Certificate of
Incorporation and Bylaws of the Company defining the rights of
holders of the Companys Common Stock.4.4
    
    1999 Network ICE Stock Option Plan, incorporated by reference
to Exhibit 4.1 to Form S-8, Registration No. 333-62658, filed
on June 8, 2001.4.5
    
    Restated 1995 Stock Incentive Plan (as amended and restated as
 27




---



##### Table of Contents



of May 23, 2001) incorporated by reference to Exhibit 4.2 to
Form S-8, Registration No. 333-62658, filed June 8, 2001.4.6
    
    Netrex, Inc. 1998 Stock Plan incorporated by reference to
Exhibit 99.15 to Form S-8, Registration Statement No.
333-89563, filed October 22, 1999.4.7
    
    vCIS, Inc. 2001 Stock Plan incorporated by reference to
Exhibit 4.1 to Form S-8, Registration Statement No.
333-100954, filed November 1, 2002.10.1
    
    Amendments to lease for Atlanta headquarters and research and
development facility modifying the lease for Atlanta headquarters
and research and development facility (filed as Exhibit 10.10 to the
Companys Annual Report on Form 10-K, dated March 30, 2000).11
    
    Computation of Per Share Earnings *31.1
    
    Certification of principal executive officer pursuant to
Section 302 of the Sarbanes-Oxley Act of 2002.31.2
    
    Certification of principal financial officer pursuant to
Section 302 of the Sarbanes-Oxley Act of 2002.32.1
    
    Certification pursuant to 18 U.S.C. Section 1350, as adapted
pursuant to Section 906 of the Sarbanes-Oxley Act of 2002.32.2
    
    Certification pursuant to 18 U.S.C. Section 1350, as adapted
pursuant to Section 906 of the Sarbanes-Oxley Act of 2002.*
    
    Data required by SFAS No. 128, Earnings Per Share, is
provided in Note 5 to the consolidated financial statements in
this report
  (b)
    
    Reports on Form 8-K. ISS furnished the following reports on Form 8-K during the reporting
period:  
    
    On January 14, 2004 ISS furnished a report on Form 8-K pursuant to
Item 12 thereof relating to a press release regarding the date it
released its financial results for the quarter ended December 31, 2003
and updating its Business Outlook for the quarter ending December 31,
2004.
    
    On January 28, 2004 ISS furnished a report on Form 8-K pursuant to
Item 12 thereof relating to a press release regarding its financial
results for the quarter ended December 31, 2003 and providing its
Business Outlook for the quarter ending March 31, 2004 and fiscal year
ending December 31, 2004. 28




---



##### Table of Contents



SIGNATURES Pursuant to the requirements of the Securities Exchange Act of 1934, the
Registrant has duly caused this report to be signed on its behalf by the
undersigned thereunto duly authorized. INTERNET SECURITY SYSTEMS, INC.(Registrant)Date:
May 10, 2004
    
    By /s/ Richard MacchiaSenior Vice President, Finance and Administrationand Chief Financial Officer (on behalf of registrant andas principal financial officer)
 29