INTERNET SECURITY SYSTEMS INC/GA - 10-Q Quarterly Report

UNITED STATES
SECURITIES AND EXCHANGE COMMISSION
WASHINGTON, D.C. 20549

FORM 10-Q

(Mark One)


x		QUARTERLY REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934 For the quarterly period ended September 30, 2002

		OR

o		TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the transition period from ______________________________to______________________________

Commission File Number 000-23655

INTERNET SECURITY SYSTEMS, INC.

(Exact name of registrant as specified in its charter)


DELAWARE		58-2362189
(State or jurisdiction of		(I.R.S. Employer
incorporation or organization)		Identification No.)

6303 BARFIELD ROAD, ATLANTA, GEORGIA 30328

(Address of principal executive offices)

Registrant’s telephone number, including area code (404) 236-2600

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes x No o

Indicate the number of shares outstanding of each of the registrant’s classes of common stock, as of the latest practicable date.


		Number of Shares Outstanding
Title of each class		as of November 8, 2002
Common Stock, $0.001 par value		49,496,000

TABLE OF CONTENTS


		PAGE
		NUMBER

PART I. FINANCIAL INFORMATION
Item 1 Consolidated Financial Statements:
	Consolidated Balance Sheets at September 30, 2002 and December 31, 2001		3
	Consolidated Statements of Operations for the three months and nine months ended September 30, 2002 and September 30, 2001		4
	Consolidated Statements of Cash Flows for the nine months ended September 30, 2002 and September 30, 2001		5
	Notes to Consolidated Financial Statements		6
Item 2 Management’s Discussion and Analysis of Financial Condition and Results of Operations			11
Item 3 Quantitative and Qualitative Disclosures about Market Risk			24
Item 4 Controls and Procedures			24
PART II. OTHER INFORMATION			24
Item 1 Legal Proceedings			24
Item 6 Exhibits and Reports on Form 8-K			26

INTERNET SECURITY SYSTEMS, INC.
CONSOLIDATED BALANCE SHEETS
(Amounts in thousands, except share amounts)


					September 30,			December 31,
					2002			2001

					(UNAUDITED)
				ASSETS
Current assets:
	Cash and cash equivalents				$	123,699		$	108,038
	Marketable securities					54,792			55,129
	Accounts receivable, less allowance for doubtful accounts of $2,612 and $2,563, respectively					63,102			50,259
	Inventory					2,273			1,768
	Prepaid expenses and other current assets					6,280			6,018

			Total current assets			250,146			221,212
Property and equipment:
	Computer equipment					36,591			31,043
	Office furniture and equipment					22,287			20,872
	Leasehold improvements					20,258			17,835

						79,136			69,750
	Less accumulated depreciation					36,035			25,254

						43,101			44,496
Restricted marketable securities						12,500			12,500
Goodwill, less accumulated amortization of $27,381						200,464			197,060
Other intangibles, less accumulated amortization of $8,030 and $4,644, respectively						15,384			19,722
Other assets						9,296			5,994

	Total assets				$	530,891		$	500,984


				LIABILITIES AND STOCKHOLDERS’ EQUITY
Current liabilities:
	Accounts payable				$	2,803		$	3,553
	Accrued expenses					20,591			20,440
	Deferred revenues					52,092			48,139

			Total current liabilities			75,486			72,132
Other non-current liabilities						2,290			1,917
Commitments and contingencies Stockholders’ equity:
	Preferred stock, $.001 par value, 20,000,000 shares authorized, none issued or outstanding					—			—
	Common stock, $.001 par value, 120,000,000 shares authorized, 48,481,000 and 47,871,000 issued and outstanding, respectively					48			48
		Additional paid-in capital				442,037			430,449
		Deferred compensation				(745	)		(1,985	)
		Accumulated other comprehensive loss				(806	)		(2,312	)
		Retained earnings				14,570			735
		Less treasury stock, at cost (130,000 shares)				(1,989	)		—

				Total stockholders’ equity		453,115			426,935

				Total liabilities and stockholders’equity	$	530,891		$	500,984

INTERNET SECURITY SYSTEMS, INC.
CONSOLIDATED STATEMENTS OF OPERATIONS
(Amounts in thousands, except per share amounts)
(Unaudited)


			Three months ended						Nine months ended
			September 30,						September 30,

			2002			2001			2002			2001

Revenues:
	Product licenses and sales		$	30,150		$	27,435		$	90,550		$	91,699
	Subscriptions			24,153			17,663			67,263			48,259
	Professional services			7,465			7,636			22,363			25,641

				61,768			52,734			180,176			165,599
Costs and expenses:
	Cost of revenues:
		Product licenses and sales		1,928			1,401			5,599			11,552
		Subscriptions and professional services		12,766			12,788			38,637			38,083

		Total cost of revenues		14,694			14,189			44,236			49,635
	Research and development			8,692			9,276			26,120			26,531
	Sales and marketing			23,780			23,449			70,369			68,996
	General and administrative			5,918			5,509			18,194			15,105
	Charge for in-process research and development			—			—			—			2,910
	Write-off of lease obligation			—			—			—			1,072
	Amortization of other intangibles and stock-based compensation			1,326			2,213			4,286			3,451
	Amortization of goodwill			—			11,393			—			15,597

				54,410			66,029			163,205			183,297
Operating income (loss)				7,358			(13,295	)		16,971			(17,698	)
Interest income, net				877			1,524			2,479			5,274
Minority interest				(66	)		(156	)		(273	)		(156	)
Other income				2,068			13,620			3,904			15,258
Foreign currency exchange gain (loss)				145			(163	)		68			(445	)

Income before income taxes				10,382			1,530			23,149			2,233
Provision for income taxes				4,041			7,618			9,314			7,390

Net income (loss)			$	6,341		$	(6,088	)	$	13,835		$	(5,157	)

Basic net income (loss) per share of Common Stock			$	0.13		$	(0.13	)	$	0.29		$	(0.12	)

Diluted net income (loss) per share of Common Stock			$	0.13		$	(0.13	)	$	0.28		$	(0.12	)

Weighted average shares:
	Basic			48,393			47,693			48,080			44,764

	Diluted			48,855			47,693			48,865			44,764

INTERNET SECURITY SYSTEMS, INC.
CONSOLIDATED STATEMENTS OF CASH FLOWS
(Amounts in thousands)
(Unaudited)


				Nine months ended
				September 30,

				2002			2001

OPERATING ACTIVITIES Net income (loss)				$	13,835		$	(5,157	)
Adjustments to reconcile net income (loss) to net cash provided by operating activities:
			Depreciation		10,781			8,135
			Amortization of goodwill		—			15,597
			Amortization of other intangibles and stock-based compensation		4,286			3,451
			Accretion of discount on marketable securities		230			175
			Minority interest		273			156
			Charge for in-process research and development		—			2,910
			Income tax benefit from exercise of stock options		6,952			9,398
			Gain on issuance of subsidiary stock		(2,560	)		—
			Gain on sale of subsidiary stock		—			(15,252	)
			Other non-cash items		—			67
	Changes in assets and liabilities, excluding the effect of acquisitions:
			Accounts receivable		(11,566	)		1,271
			Inventory		(505	)		147
			Prepaid expenses and other assets		(3,377	)		(6,723	)
			Accounts payable and accrued expenses		(2,215	)		(6,214	)
			Deferred revenues		5,480			8,059

		NET CASH PROVIDED BY OPERATING ACTIVITIES			21,614			15,864
INVESTING ACTIVITIES Acquisitions, net of cash received					(1,348	)		(7,495	)
Net proceeds from maturity of marketable securities					63,315			105,492
Purchases of marketable securities					(63,208	)		(98,127	)
Purchases of property and equipment					(9,207	)		(26,683	)
Net proceeds from sale of subsidiary stock					—			16,529

		NET CASH USED IN INVESTING ACTIVITIES			(10,448	)		(10,284	)
FINANCING ACTIVITIES Proceeds from exercise of stock options					2,892			13,105
Proceeds from issuance of common stock					2,086			2,250
Purchase of treasury shares					(1,989	)		—

		NET CASH PROVIDED BY FINANCING ACTIVITIES			2,989			15,355
Foreign currency impact on cash					1,506			678

Net increase in cash and cash equivalents					15,661			21,613
Cash and cash equivalents at beginning of period					108,038			66,210

Cash and cash equivalents at end of period				$	123,699		$	87,823

SUPPLEMENTAL CASH FLOW DISCLOSURE Income taxes paid				$	2,770		$	—

INTERNET SECURITY SYSTEMS, INC.
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS

1. Basis of presentation and significant accounting policies

The consolidated financial statements of Internet Security Systems, Inc. (“ISS”) as of September 30, 2002 and for the three and nine months ended September 30, 2002 and 2001 are unaudited and, in the opinion of management, contain all adjustments, consisting of normal recurring items necessary for the fair presentation of the financial position and results of operations for the interim periods. The consolidated financial statements include the accounts of Internet Security Systems, Inc. and its majority-owned subsidiaries. The consolidated balance sheet at December 31, 2001 has been derived from the audited financial statements at that date but does not include all the footnotes required by accounting principles generally accepted in the United States for complete financial statements.

These consolidated financial statements should be read in conjunction with the Consolidated Financial Statements and Notes thereto included in our Annual Report on Form 10-K for the year ended December 31, 2001. The results of operations for the three and nine months ended September 30, 2002 are not necessarily indicative of the results to be expected for the entire year. All significant intercompany accounts and transactions have been eliminated. Certain previously reported amounts have been reclassified to conform to the current presentation format.

The preparation of financial statements and related disclosures in conformity with accounting principles generally accepted in the United States requires management to make estimates and assumptions that affect the amounts reported in the financial statements and accompanying notes. Actual results could differ from those estimates.

2. Business Combinations

On August 1, 2002 Internet Security Systems KK, our Asia-Pacific subsidiary, acquired a primary ISS KK distributor in Singapore, TriSecurity Holdings Pte Ltd. This acquisition provides our Asia-Pacific subsidiary direct support capabilities for their customers in Southeast Asia and allows ISS KK to expand its capabilities in this growing market. The consideration consisted of 1,000 shares of ISS KK stock and approximately $1.2 million of cash. Goodwill of approximately $4.0 million related to the purchase was recorded. There is additional annual contingent consideration dependent on the achievement of specified increasing levels of revenues and operating profits for the years 2002 through 2004. The total maximum additional consideration is 735 shares of ISS KK stock and will be recorded as additional purchase price.

The operating results of ISS include the operating results of TriSecurity Holdings Pte Ltd. since the date of acquisition.

3. Other income and expense

Other income for the third quarter of 2002 includes a $2.6 million gain related to the issuance of subsidiary shares in connection with the acquisition of TriSecurity Holdings Pte Ltd. The Company reported a gain on the difference between the fair market value of the shares issued and the book value of those shares, in accordance with Staff Accounting Bulletin No. 51 and company policy.

In the nine months ended September 30, 2002, other income also consists of a second quarter gain of $1.9 million on the sale of an investment in an ISS distributor in Japan. The shares of the publicly traded company were acquired when the distributor was privately held and were subsequently sold on the open market. The gain is substantially offset by second quarter expenses included in the general and administrative category resulting from the consolidation of Tokyo-based operations from several different locations to a new centralized headquarters in Tokyo. Costs associated with this move included lease termination costs, including remaining rent payments, write-off of leasehold improvements and moving costs.

Other income for the three and nine months ended September 30, 2001 includes a subsidiary IPO gain of $13.6 million from an initial public offering on the Japan over-the-counter market by the Company’s subsidiary responsible for Asia-Pacific operations. Proceeds of the IPO were retained by the subsidiary.

In the nine months ended September 30, 2001, other income included a second quarter non-recurring other income item of $1.6 million from the sale of approximately 2% of the outstanding shares of our Asia-Pacific subsidiary in March 2001. As part of the planning for an IPO in Japan of a minority interest in our Asia-Pacific subsidiary that was completed in September 2001, options were granted in the subsidiary as a means of key employee retention and approximately 2% of the outstanding shares were

INTERNET SECURITY SYSTEMS, INC.
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS – (Continued)

sold to employees and key partners. The price was established based on a valuation of the company by an independent appraisal firm. The gain represents the difference between proceeds received and the underlying basis in the stock.

In the quarter ended March 31, 2001, the Company recorded a $1.1 million write-off of the remaining lease obligation on our previous Atlanta office space. This non-recurring expense originated in the first quarter as available subleased space in the area grew substantially as the result of layoffs, closures and consolidations, diminishing the prospects of subleasing our old space.

4. Goodwill and intangible assets

The Company adopted Statement of Financial Accounting Standards (“SFAS”) No. 142, “Goodwill and Other Intangible Assets” on January 1, 2002. As a result, goodwill is no longer amortized, but is instead tested for impairment annually or sooner if circumstances indicate that it may no longer be recoverable. Upon adoption, the Company completed the transitional goodwill impairment assessment required by SFAS No. 142 and concluded that goodwill was not impaired at January 1, 2002.

Goodwill and intangible assets are comprised of the following (in thousands):


			September 30, 2002					December 31, 2001
			Gross Carrying		Accumulated			Gross Carrying		Accumulated
			Amount		Amortization			Amount		Amortization

Unamortized intangible assets:
	Goodwill		$	227,845	$	(27,381	)	$	224,441	$	(27,381	)

Amortized intangible assets:
	Core technology			3,853		(1,919	)		3,853		(1,557	)
	Developed technology			16,857		(4,960	)		17,808		(2,487	)
	Work force			215		(143	)		215		(116	)
	Customer relationships			2,490		(1,008	)		2,490		(484	)

		Total	$	23,414	$	(8,030	)	$	24,366	$	(4,644	)

The Company amortizes intangible assets over their estimated useful lives of eight years for core technology, five years for developed technology, six years for work force and three years for customer relationships. Amortization expense of intangible assets is as follows (in thousands):


		Three months ended				Nine months ended
		September 30,				September 30,
		2002		2001		2002		2001

Goodwill		$	—	$	11,393	$	—	$	15,597
Core technology			120		120		361		361
Developed technology			792		967		2,474		1,278
Work force			9		9		27		27
Customer relationships			207		208		524		277

	Total	$	1,128	$	12,697	$	3,386	$	17,540

The estimated future amortization expense of intangible assets as of September 30, 2002 is as follows (in thousands):


		Amount

Fiscal year:
	2002 (remaining three months)	$	1,129
	2003		4,483
	2004		4,096
	2005		3,888
	2006		1,788

Total		$	15,384

INTERNET SECURITY SYSTEMS, INC.
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS – (Continued)

The following table presents a reconciliation of previously reported net income (loss) and net income (loss) per share to the amounts adjusted for the exclusion of the amortization of goodwill (in thousands):


		Three months ended					Nine months ended
		September 30,					September 30,

		2002		2001			2002		2001

Net income (loss), reported		$	6,341	$	(6,088	)	$	13,835	$	(5,157	)
	Amortization of goodwill		—		11,393			—		15,597

Net income, as adjusted			6,341		5,305			13,835		10,440

Basic net income (loss) per share, as reported		$	0.13	$	(0.13	)	$	0.29	$	(0.12	)
Amortization of goodwill			—		0.24			—		0.35

Basic net income per share, as adjusted		$	0.13	$	0.11		$	0.29	$	0.23

Diluted net income (loss) per share, as reported		$	0.13	$	(0.13	)	$	0.28	$	(0.12	)
	Amortization of goodwill		—		0.24			—		0.35

Diluted net income per share, as adjusted		$	0.13	$	0.11		$	0.28	$	0.23

Outstanding options to purchase 881,000 and 1,344,000 shares of the Company’s common stock were not included in the computation of diluted net income (loss) per share in the three months and nine months ended September 30, 2001, respectively, as their impact on loss per share is antidilutive.

5. Comprehensive income (loss)

The components of comprehensive income (loss) are as follows (in thousands):


	Three months ended						Nine months ended
	September 30,						September 30,

	2002			2001			2002		2001

Net income (loss)	$	6,341		$	(6,088	)	$	13,835	$	(5,157	)
Change in cumulative translation adjustment		(903	)		1,074			1,506		678

Comprehensive income (loss)	$	5,438		$	(5,014	)	$	15,341	$	(4,479	)

6. Income (loss) per share

The computation of net income (loss) per share is as follows (amounts in thousands, except per share amounts):


		Three months ended					Nine months ended
		September 30,					September 30,

		2002		2001			2002		2001

Basic net income (loss) per share:
	Net income (loss)	$	6,341	$	(6,088	)	$	13,835	$	(5,157	)
	Weighted average number of common shares outstanding during the period		48,393		47,693			48,080		44,764

Basic net income (loss) per share		$	0.13	$	(0.13	)	$	0.29	$	(0.12	)

Diluted net income (loss) per share:
	Net income (loss)	$	6,341	$	(6,088	)	$	13,835	$	(5,157	)
	Weighted average number of common

INTERNET SECURITY SYSTEMS, INC.
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS – (Continued)


		Three months ended					Nine months ended
		September 30,					September 30,

		2002		2001			2002		2001

	shares outstanding during the period		48,393		47,693			48,080		44,764
Dilutive stock options			462		—			785		—

Total shares for purpose of calculating diluted net income (loss) per share			48,855		47,693			48,865		44,764

Diluted net income (loss) per share		$	0.13	$	(0.13	)	$	0.28	$	(0.12	)

7. Segment and geographic information

ISS conducts business in one operating segment, providing information security management solutions. The Company does, however, prepare information for internal use on a geographic basis (Americas, EMEA (Europe, Middle East and Africa) and Asia/Pacific). This information consists of the operating results of each geographic segment. The segment operating costs reported internally generally consist of direct sales expenses, an executive team and infrastructure to support its employee and customer and partner base, and supporting billing and financial systems. Unallocated corporate expenses include research and development, general and administrative costs that support the global organization and amortization of intangibles, stock based compensation and goodwill.

There are no intersegment sales. Our chief executive officer and chief financial officer evaluate performance based on operating profit or loss from operations by segment. Assets and liabilities are not discretely allocated or reviewed by segment.

The following table presents ISS’s revenues, operating expenses and operating income (loss) by geographic segment (amounts in thousands):


					Three months ended September 30, 2002											Three months ended September 30, 2001

			Americas		EMEA		Asia/Pacific		Unallocated			Total		Americas		EMEA			Asia/Pacific		Unallocated			Total

Revenues from external customers:
		Product licenses and sales	$	20,513	$	4,174	$	5,463	$	—		$	30,150	$	17,325	$	4,541		$	5,569	$	—		$	27,435
		Subscriptions		18,494		3,325		2,334		—			24,153		14,597		1,754			1,312		—			17,663
		Professional services		5,203		1,158		1,104		—			7,465		5,381		1,637			618		—			7,636

Total revenue				44,210		8,657		8,901		—			61,768		37,303		7,932			7,499		—			52,734
Cost of revenues:
	Product licenses and sales			1,915		—		13		—			1,928		1,399		2			—		—			1,401
	Subscriptions and professional services			8,571		2,046		2,149		—			12,766		9,215		1,897			1,676		—			12,788

Total cost of revenues				10,486		2,046		2,162		—			14,694		10,614		1,899			1,676		—			14,189
Operating expenses				15,847		5,502		2,431		15,936			39,716		14,882		6,287			2,280		28,391			51,840

Total expenses				26,333		7,548		4,593		15,936			54,410		25,496		8,186			3,956		28,391			66,029
Segment operating income (loss)			$	17,877	$	1,109	$	4,308	$	(15,936	)	$	7,358	$	11,807	$	(254	)	$	3,543	$	(28,391	)	$	(13,295	)


			Nine months ended September 30, 2002														Nine months ended September 30, 2001

			Americas		EMEA		Asia/Pacific		Unallocated			Total		Americas		EMEA			Asia/Pacific		Unallocated			Total

Revenues from external customers:
		Product licenses and sales	$	61,635	$	13,038	$	15,877	$	—		$	90,550	$	61,838		$	13,535	$	16,326	$			$	91,699
		Subscriptions		51,918		9,007		6,338		—			67,263		38,915			5,893		3,451		—			48,259
		Professional services		15,063		3,959		3,341		—			22,363		18,186			5,325		2,130		—			25,641

Total revenue				128,616		26,004		25,556		—			180,176		118,939			24,753		21,907		—			165,599
Cost of revenues:
	Product licenses and sales			5,544		—		55		—			5,599		11,288			254		10		—			11,552
	Subscriptions and professional services			26,200		6,407		6,030		—			38,637		28,545			5,515		4,023		—			38,083

Total cost of revenues				31,744		6,407		6,085		—			44,236		39,833			5,769		4,033		—			49,635
Operating expenses				49,053		14,664		6,652		48,600			118,969		45,326			16,574		7,096		64,666			133,662

Total expenses				80,797		21,071		12,737		48,600			163,205		85,159			22,343		11,129		64,666			183,297
Segment operating income (loss)			$	47,819	$	4,933	$	12,819	$	(48,600	)	$	16,971	$	33,780		$	2,410	$	10,778	$	(64,666	)	$	(17,698	)

INTERNET SECURITY SYSTEMS, INC.
NOTES TO CONSOLIDATED FINANCIALS - (Continued)

8. Recent accounting pronouncements

In July 2001, the Financial Accounting Standards Board issued Statement of Financial Accounting Standard No. 142, (“SFAS 142”), “Accounting for Goodwill and Other Intangibles”. Under SFAS 142, goodwill and indefinite lived intangible assets are no longer amortized, but are reviewed annually (or more frequently if impairment indicators arise) for impairment. Separable intangible assets that are not deemed to have an indefinite life will continue to be amortized over their useful lives. Companies were required to immediately adopt the amortization provisions of SFAS 142 as it relates to goodwill and intangible assets acquired after June 30, 2001. With respect to goodwill and intangible assets acquired prior to July 1, 2001, companies were required to adopt SFAS 142 in their fiscal year beginning after December 15, 2001. The Company adopted SFAS 142 effective January 1, 2002. Substantially all of the Company’s goodwill balance of $200.5 million as of September 30, 2002 was recorded in June 2001 in conjunction with the acquisition of Network ICE. In doing so, the Company determined that goodwill is not impaired, therefore, there was no transitional impairment charge to be recorded. The impact of the adoption as it relates to goodwill, which exists currently, is to eliminate amortization of goodwill expense beginning with the year ending December 31, 2002. In 2001, amortization of goodwill totaled $26.5 million.

On October 3, 2001, the FASB issued the Statement of Financial Accounting Standards No. 144 “Accounting for the Impairment or Disposal of Long-Lived Assets” (“SFAS 144”). SFAS 144 addresses financial accounting and reporting for the disposal of long-lived assets. SFAS 144 becomes effective for financial statements issued for fiscal years beginning after December 15, 2001, and interim periods within those fiscal years. The Company adopted SFAS 144 on January 1, 2002. The adoption did not have a material impact on the Company’s consolidated financial position, consolidated results of operations or consolidated cash flows.

9. Contingencies

Beginning on September 28, 2001, the Company and certain of its officers and directors were named as defendants in several lawsuits alleging violations of the federal securities laws, including Sections 10(b) and 20(a) of the Securities Exchange Act of 1934, as amended, and Rule 10b-5 thereunder. Six such actions were filed in the United States District Court for the Northern District of Georgia. All six actions have been consolidated into a single case and the court has appointed lead plaintiffs and lead plaintiff’s counsel. The consolidated amended complaint was filed October 9, 2002 and purports to be brought on behalf of a class of investors who purchased the Company’s stock during the period from April 5, 2001 through August 14, 2001 (the “Class Period”). The complaint generally alleges that the Company and the individual defendants violated the anti-fraud provisions of the federal securities laws and caused the Company’s stock to trade at artificially high prices by making misrepresentations relating to the Company’s financial condition and prospects during the Class Period. The complaint seeks damages in an unspecified amount. The Company’s response to the consolidated amended complaint is currently due by November 25, 2002. The Company believes that it has meritorious defenses and intends to defend the actions vigorously.

10. Subsequent event

On October 31, 2002, the Company completed the acquisition of privately held vCIS, Inc. of Santa Clara, California, the developer of patent-pending, next-generation, pre-emptive behavioral inspection technology. The technology prevents malicious code from executing and causing damage before it has an opportunity to interact with the enterprise network. The integrated pre-emptive behavioral technology is expected to be available for the desktop in the first quarter of 2003. Each outstanding share of vCIS common stock, no par value, was converted into the right to receive .04770 shares of ISS common stock, par value $0.001 per share. Additionally, each outstanding stock option to purchase shares of vCIS common stock was assumed by ISS and converted into a stock option to purchase shares of ISS Common Stock. ISS will issue an aggregate of approximately 1,000,000 shares of ISS Common Stock for the outstanding vCIS common stock and stock options assumed. Shares will be reserved for future exercise of stock options outstanding under the vCIS stock option plan assumed in the transaction. An in-process research and development charge is expected to be incurred in the fourth quarter of 2002 in accounting for this transaction. This charge may represent a significant portion of the total combined fair value of the common stock issued, stock options assumed and estimated acquisition costs of approximately $19.2 million.

INTERNET SECURITY SYSTEMS, INC.
MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION
AND RESULTS OF OPERATIONS

The following discussion should be read in conjunction with the Consolidated Financial Statements and related Notes thereto included elsewhere in this Quarterly Report on Form 10-Q. Except for the historical financial information, the matters discussed in this Quarterly Report on Form 10-Q may be considered “forward-looking” statements. Such statements include declarations regarding our current intent, belief or expectations. Such forward-looking statements are not guarantees of future performance and involve a number of risks and uncertainties. Actual results may differ materially from those indicated by such forward-looking statements. Among the important factors that could cause actual results to differ materially from those indicated by such forward-looking statements are the risk factors in this Quarterly Report on Form 10-Q, as well as the risk factors identified in the Annual Report on Form 10-K for the year ended December 31, 2001 as filed with the Securities and Exchange Commission and available at the SEC’s Web site at www.sec.gov.

OVERVIEW

We are a global leader in information protection solutions dedicated to protecting online assets. Our proactive line of defense protects networks, servers and desktops against an ever-changing spectrum of threats, with a comprehensive line of products and services designed specifically for the particular needs of enterprise, smaller enterprise, consumer and service provider markets. These threat protection solutions go beyond basic access control to deliver multiple layers of defense that detect, prevent and respond to threats prior to those threats causing damage to our customers’ business operations.

We provide a wide range of proactive protection that spans networks, servers and individual desktops, built around the need for comprehensive, cost-effective detection, prevention and response arising from attacks, misuse and security policy violations, all while ensuring the confidentiality, privacy, integrity and availability of proprietary information.

Our family of products is a critical element of an active Internet and networking security program within today’s world of global connectivity, enabling organizations to proactively monitor, detect and respond to risks to enterprise information. Our line of products is designed specifically for the particular needs of enterprise, smaller enterprise, consumer and service provider markets.

Our managed services offerings currently provide remote management of the industry’s best-of-breed security technology, focusing on security assessment and intrusion detection systems, and also including firewalls, VPNs, anti-virus and URL filtering software. We focus on serving as the trusted security provider to our customers by maintaining within our existing products the latest counter-measures to security risks, creating new innovative products based on our customers’ needs and providing professional and managed services.

Many factors affect financial performance, and past performance is no assurance of similar future performance. We expect, in the long-term, to continue to expand our domestic and international sales and marketing operations; increase our investment in product development including our proprietary threat and vulnerability database and managed services capabilities; seek acquisition candidates and alliances with partners and alliances with partners with products, technologies or services capabilities complimentary to our solutions; and improve our internal operating and financial infrastructure in support of our strategic goals and objectives. At the same time, we will adjust our organization size in light of current economic conditions and maintain emphasis on controlling discretionary spending and capital expenditures. While we believe in the long-term success of our business solutions, our prospects must be considered in light of the recent experience, risks and difficulties that are frequently encountered by companies in new and rapidly evolving markets. See “Risk Factors”.

Critical accounting policies

The consolidated financial statements were prepared in conformity with accounting principles generally accepted in the United States. As such, management is required to make certain estimates, judgments and assumptions it believes are reasonable based upon the information available. These estimates and assumptions affect the reported amounts of assets and liabilities at the date of the financial statements and the reported amounts of revenues and expenses during the periods presented. The significant accounting policies which management believes are the most critical to aid in fully understanding and evaluating our reported financial results include the following:

Revenue recognition

Revenue is recognized under Statement of Position (“SOP”) 97-2 as modified by SOP 98-9, when the following criteria have been met:

• persuasive evidence of an arrangement exists;

• delivery has occurred or services have been rendered;

INTERNET SECURITY SYSTEMS, INC.
MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION
AND RESULTS OF OPERATIONS – (Continued)

• price is fixed or determinable; and

• collection is probable.

We recognize perpetual license revenues from ISS-developed products upon (i) delivery of software or, if the customer has evaluation software, delivery of the software key and (ii) issuance of the related license, assuming that no significant vendor obligations or customer acceptance rights exist. Where payment terms are extended over periods greater than 12 months, revenue is recognized as such amounts become due. Product sales consist of (i) appliances sold in conjunction with ISS licensed software and (ii) software developed by third-party partners, combined in some instances with associated hardware appliances and partner maintenance services. These sales are recognized upon shipment to the customer.

License sales of enterprise and small enterprise products are generated both through a direct sales force and through various partners, including system integrators, value-added resellers and distributors. When our partners generate sales, revenues are recognized when the end user sale has occurred, which is identified through electronic delivery of a software key that is necessary to operate the product.

License sales of small office/home office and consumer products are made through a distributor to retail establishments and are sold directly to customers via the Internet. License revenue for sales made through resellers and distributors are recognized only when the product is sold to the end user.

Annual renewable maintenance is a separate component of each perpetual license agreement for ISS products with revenue recognized ratably over the maintenance term. Subscription revenues include maintenance, term licenses, and managed service arrangements. Term licenses allow customers to use our products and receive maintenance coverage for a specified period, generally 12 months. We recognize revenues from these term agreements ratably over the subscription term. Security monitoring services of information assets and systems are part of managed services and are recognized as such services are provided.

Professional services revenues include fee-based service engagements and training. Service engagements, typically billed on a time-and-materials basis, primarily focus on security assessments of customer networks and the development of customers’ security policies. We recognize such professional services revenues as the related services are rendered.

Multiple element arrangements can include any combination of hardware, software or services. When some elements are delivered prior to others in an arrangement, revenue is deferred until the delivery of the last element unless there is all of the following:

• vendor specific objective evidence (VSOE) of fair value of the undelivered elements;

• the functionality of the delivered elements is not dependent on the undelivered elements; and

• delivery of the delivered elements represents the culmination of the earnings process.

Our historical rate of return for our software products is negligible. We offer demonstration software available via download from our website that allows potential customers to see the functionality of the products on their own networks. We did not have any transactions in the first nine-months of either 2002 or 2001 involving reciprocal arrangements where goods or services were purchased from an organization at the same time that we licensed software or provided services to that organization.

Allowance for doubtful accounts

Our sales are global, with customers located in the United States, Europe, Latin America and the Asia/Pacific regions. We perform periodic credit evaluations of our customer’s financial condition and do not require collateral. Credit risk with respect to trade accounts receivable are limited due to the large number of entities that comprise the Company’s customer base. We provide for estimated credit losses as such losses become probable. To date, such losses have been within management’s expectations. We evaluate specific accounts when we become aware of a situation where a customer may not be able to meet its financial obligations due to a deterioration of its financial viability, credit ratings or bankruptcy. The allowance for doubtful accounts is established based on the best facts available to us and is reevaluated and adjusted as additional information is received.

INTERNET SECURITY SYSTEMS, INC.
MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION
AND RESULTS OF OPERATIONS – (Continued)

Our provisions for doubtful accounts during the three months ended September 30, 2002 and for the nine months ended September 30, 2002 amounted to $410,000 and $1,075,000, respectively. At December 31, 2001, our allowance for doubtful accounts included approximately $400,000 that had been reserved specifically for two customers. Because the amounts due from these customers were successfully collected in 2002, the allowance was decreased accordingly. During the first nine months of 2002, in response to the difficult current economic conditions, we wrote off approximately $626,000 of receivables that were deemed uncollectible due to the deteriorating condition of certain customers. Our September 30, 2002 allowance for doubtful accounts totals 4.0% of the $65.7 million of trade receivables.

While actual credit losses have historically been within management’s expectations and the provisions established, we cannot guarantee that we will continue to experience the same credit loss rates we have in the past. If the financial condition of our customers were to deteriorate, resulting in an impairment of their ability to make payments, additional allowances may be required.

Impairment of goodwill

We currently have a significant intangible asset related to goodwill of $200 million, with $195 million related to our June 2001 acquisition of Network ICE Corporation. The determination of whether or not this asset is impaired involves significant judgments based upon short and long-term projections of future performance. We have concluded that this amount is realizable based both on forecasted discounted cash flows through 2006 and on our stock market valuation. The forecasted discounted cash flows include positive cash flow for each year through 2006 and a minimum terminal value of approximately $289 million. Neither method indicated that our goodwill had been impaired and as a result, we did not record any impairment losses related to goodwill during the nine months ended September 30, 2002 and 2001.

Due to uncertain market conditions and potential changes in our strategy and products, it is possible that forecasts used to support our intangible assets may change in the future which could result in significant non-cash charges that would adversely affect our results of operations and financial condition.

Results of operations

The following table sets forth certain consolidated historical operating information, as a percentage of total revenues, for the periods indicated:


		Three months ended						Nine months ended
		September 30,						September 30,

		2002			2001			2002			2001

Product licenses and sales			49	%		52	%		50	%		55	%
Subscriptions			39	%		34	%		37	%		29	%
Professional services			12	%		14	%		13	%		16	%

	Total revenues		100	%		100	%		100	%		100	%

Cost of product revenues			3	%		3	%		3	%		7	%
Cost of subscription and professional service revenues			21	%		24	%		22	%		23	%
Research and development			14	%		18	%		14	%		16	%
Sales and marketing			38	%		44	%		39	%		42	%
General and administrative			10	%		10	%		10	%		9	%
Write-off of lease obligation			—			—			—			1	%
Charge for in-process research and development			—			—			—			2	%
Amortization of goodwill			—			22	%		—			9	%
Amortization of other intangibles and stock-based compensation			2	%		4	%		2	%		2	%

	Total costs and expenses		88	%		125	%		90	%		111	%

Operating income (loss)			12	%		(25	)%		10	%		(11	)%

INTERNET SECURITY SYSTEMS, INC.
MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION
AND RESULTS OF OPERATIONS – (Continued)

Revenues

Product licenses and sales

Product licenses and sales, including perpetual licenses and sales of partner software and hardware appliances, continued to be the primary source of revenue generation at 49% of total revenues for the three-month period ended September 30, 2002 and 52% for the corresponding period in 2001. Product licenses and sales represented 50% of total revenues for the nine-month period ended September 30, 2002, as compared to 55% for the same period in 2001. The decrease in product licenses and sales as a percentage of total revenues from 2001 to 2002 is due to the decrease in the sales of third-party products.

We continue sales of third-party products as part of our managed security services offerings, otherwise de-emphasizing the direct sales of third-party products. As a result, third-party product revenues decreased from 4% of total revenues in the quarter ended September 30, 2001 to 3% in the corresponding period of 2002. On a year-to-date basis, third-party product revenues decreased as a percentage of total revenues from 10% in 2001 to 3% in 2002.

License sales of small office/home office and consumer products are made through distributors to retail establishments and are sold directly to customers via the Internet. License revenue for sales made through our distributors is recognized only when the product is sold to the end user.

Subscriptions

Subscription revenues consist of maintenance, term licenses of product usage and security-monitoring fees for managed services offerings. Subscriptions revenue represented 39% of total revenues in the three months ended September 30, 2002 increasing from 34% of total revenues in the three months ended September 30, 2001. Maintenance continues to represent the largest portion of our subscription revenue, accounting for 27% of total revenues in the three months ended September 30, 2002 and 23% of total revenues in the comparable period of 2001. We continue to increase our software client base that generates maintenance revenues, through a combination of maintenance contracts associated with new product licenses and a high renewal rate of existing contracts.

Monitoring fees represented 8% of total revenues in the third quarter of 2002, a one-percentage point increase over the corresponding period of 2001. We continue to focus on our intrusion protection offerings, which resulted in a 6% increase in monitoring revenues in the third quarter of 2002 as compared to the second quarter of 2002.

On a year-to-date basis, subscriptions revenue represented 37% of total revenues in the nine months ended September 30, 2002, as compared to 29% in the nine months ended September 30, 2001. The year-to-date increase is primarily the result of increased maintenance. Security-monitoring fees increased 19% in the first nine months of 2002 compared with 2001 despite decreasing non-core services during 2001. Specifically, we eliminated a security offering combined with internet service provider services in the fourth quarter of 2001, and eliminated contracts where the partner contracted for capacity, but did not achieve the underlying end-user contracts. In addition, we have had some customers bring firewall management in-house. As a result, management of our products is a larger portion of our managed services business which we perceive as providing long-term value to our customers.

Professional services

Professional services revenue represented 12% of total revenues in the three months ended September 30, 2002, decreasing from 13% in the corresponding period of 2001. For the nine months ended September 30, 2002, professional services revenue was 13% of revenue, which was a decrease from 16% in the corresponding period of 2001. During 2002, professional services as a percentage of total revenues decreased partially due to continued customer reluctance to spend discretionary dollars on professional services. Also contributing to this decline was a narrowing of our consulting offerings to focus on high-value offerings that utilize our X-Force

INTERNET SECURITY SYSTEMS, INC.
MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION
AND RESULTS OF OPERATIONS – (Continued)

expertise, and choosing to use partners to provide deployment and other offerings where appropriate. We also decreased the number of training classes related to third-party products and increased our emphasis on courses related to ISS solutions.

Geographic regions

Geographically, we derived the majority of our revenues from sales to customers within the Americas region; however, international operations continued to be a significant contributor to revenues. Revenues by region represented the following percentages of total revenues for the periods indicated:


	Three months ended						Nine months ended
	September 30,						September 30,

	2002			2001			2002			2001

Americas		72	%		71	%		71	%		72	%
EMEA		14	%		15	%		15	%		15	%
Asia/Pacific Rim		14	%		14	%		14	%		13	%

Costs and Expenses

Cost of product licenses and sales

Cost of revenues from product licenses and sales consists of several components. Costs associated with licensing our software products are minor. Substantially all of the cost of product licenses and sales represents payments to partners for their products that we integrate with our products or directly provide to our customers as part of a single solution source. We experienced lower margins on these sales in the third quarter of 2002 compared to 2001. As a result, costs of product revenues as a percentage of total revenues remained constant at 3% for the three months ended September 30, 2002 and 2001, even though third party revenues declined.

On a year-to-date basis, cost of product revenues decreased from 7% of total revenues for the nine months ended September 30, 2001 to 3% for the nine months ended September 30, 2002, as sales of partner software and hardware appliances represented a lower percentage of total revenues. This decrease was consistent with our movement away from the direct sales of third-party products, except where related to ISS managed services.

Cost of subscriptions and services

Cost of subscription and services includes the cost of our technical support personnel who provide assistance to customers under maintenance agreements, the security operations center (“SOC”) costs of providing managed security monitoring services and the costs related to our professional services and training. These costs decreased from 24% of total revenues in the three months ended September 30, 2001 to 21% of total revenues in the three months ended September 30, 2002. A similar trend existed on a year-to-date basis as these costs decreased from 23% of total revenues for the nine months ended September 30, 2001 to 22% in 2002.

As a result of the difficult economic conditions combined with our effort to focus on core professional services, costs associated with our professional services and education services decreased, both in dollars and as a percentage of total revenues. Costs were controlled through a reduction in personnel that began in the third quarter of 2001, a narrowing of our consulting offerings to focus on services that directly contribute to our protection platform strategy, and a decrease in the number of training classes related to third party products. We also continue to emphasize control over discretionary spending and capital expenditures.

Costs associated with our technical support personnel and our security operations centers increased in 2002 to handle our increasing customer base. As our subscription revenue base increased we added personnel around the globe to handle additional customers under maintenance agreements and under managed security monitoring services. We made an increased investment in automated systems and personnel resources for our Asia/Pacific SOC, which began operating in the third quarter of 2001.

Research and development

INTERNET SECURITY SYSTEMS, INC.
MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION
AND RESULTS OF OPERATIONS – (Continued)

Research and development expenses consist of salary and related costs of research and development personnel, including costs for employee benefits, and depreciation of computer equipment. These costs include those associated with maintaining and expanding the X-Force, our internal team of security experts.

We believe our primary research and product development and managed service offerings are important to retaining our leadership position in the market. In the third quarter of 2002, we continued the release of major enhancements to our product lines. After releasing RealSecure Network Protector 7.0 and RealSecure Server Sensor 3.5 in the second quarter, we released RealSecure Desktop Protector 3.5 in the third quarter, which added improved scalability and the ability to block outbound network traffic as well as new protection from malicious application execution. We also provided enhancements to our management consoles and our vulnerability assessment products as well as RealSecure Guard, RealSecure Sentry, and RealSecure Gigabit Sentry.

Research and development expenses were 14% of total revenues in the three months ended September 30, 2002, compared to 18% in the comparable period of 2001 as we have been able to provide new product offerings and enhancements with fewer headcount. An example of this efficiency is our protocol analysis framework that allows us to gain engineering efficiency as it requires fewer signature updates than traditional IDS software. On a year-to-date basis these costs represented 14% of total revenues in 2002, a decrease from 16% of total revenues in the comparable period of 2001.

While we are committed to continue our investment in X-Force research capabilities that we believe to be a differentiator for ISS, we intend to continue to seek more leverage in the research and development area while enhancing current technologies and developing new technologies.

Sales and marketing

Sales and marketing expenses consist of salaries, travel expenses, commissions, advertising, maintenance of our website, trade show expenses, costs of recruiting sales and marketing personnel and costs of marketing materials.

Gaining leverage in sales and marketing is a key objective for us. This is evidenced by the decrease in these expenses as a percentage of total revenues from 44% in the three months ended September 30, 2001 to 38% in the comparable period of 2002. For the nine-month periods ended September 30, these expenses decreased as a percentage of revenues from 42% in 2001 to 39% in 2002. We have undertaken several initiatives over the last year to achieve this decrease. During the third quarter of 2001 we resized our operations, resulting in personnel reductions and decreases in various operating expenses. As a result, the 2001 periods included costs of severance associated with the personnel reductions. In areas where revenue demand did not support our cost base, such as Latin America and Europe, we reduced headcount in the third quarter of 2002. We also continue to achieve leverage in our sales and marketing efforts by focusing our direct sales force and continued expansion of the channel as a source of product sales. The channel continues to be an important source of global revenue for us as we use its capabilities to reach not just departmental and small companies, but larger customers as well. Although we decreased our sales and marketing expenses as a percentage of total revenues, we did increase our advertising costs. Beginning in the first quarter of 2002, and completed in the second quarter of 2002, we launched our first television and print advertising campaign designed to demonstrate the multitude of threats that can compromise the security of a company’s networks, servers or desktops. This campaign was aimed at increasing awareness of the ISS brand, especially at the mainstream business market.

We intend to continue to expand our channel sales capabilities, focus on controlling discretionary spending and capital expenditures and adjust our organization in light of economic conditions. While we expect to continue to gain leverage in our sales and marketing costs in the future, our ability to do so will be largely dependent on economic and competitive conditions in future periods.

General and administrative

General and administrative expenses of $5.9 million in the third quarter of 2002 and $5.5 million in the third quarter of 2001 represented approximately 10% of total revenues in both 2002 and 2001. On a year-to-date basis, general and administrative expenses increased from 9% of total revenues in 2001 to 10% in 2002. This year-to-date increase in 2002 related to non-recurring expenses associated with a relocation of our Asia/Pacific headquarters in Tokyo during the second quarter of 2002. Excluding these non-recurring charges, general and administrative expenses remained at 9% of total revenue in the three months ended September 30, 2002 compared to the same period of 2001.

INTERNET SECURITY SYSTEMS, INC.
MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION
AND RESULTS OF OPERATIONS – (Continued)

Other general and administrative expenses consist of personnel-related costs for executive, administrative, finance and human resources, information systems and other support services costs, and legal, accounting and other professional service fees.

Charge for in-process research and development and write-off of lease obligation

Operating expenses for the nine-month period ended September 30, 2001 included a $2.9 million charge for the write-off of in-process research and development costs associated with the Network ICE acquisition in June 2001. At that time, in-process research and development had not reached technological feasibility based on identifiable technological risk factors which indicated that even though successful completion was expected, it was not assured at the acquisition date and was immediately charged to operations.

In the nine months ended September 30, 2001, we recorded a first quarter $1.1 million write-off of the remaining lease obligation on our previous Atlanta headquarters office space. This non-recurring expense originated in the first quarter of 2001 as available subleased space in the area grew substantially in that quarter as the result of layoffs, closures and consolidations by many companies, decreasing the prospects of subleasing our old space.

Amortization

We incurred amortization expense of $1.3 million and $13.6 million in the three months ended September 30, 2002 and 2001, respectively. Amortization expense for the nine-month periods ended September 30, 2002 and 2001 was $4.3 million and $19.0 million, respectively. These decreases were due to the adoption of SFAS No. 142 on January 1, 2002, under which the carrying values of goodwill and intangible assets deemed to have indefinite lives are no longer amortized, but are subject to an annual impairment test. In 2002, amortization relates to intangible assets and stock-based compensation, resulting from acquisitions accounted for under the purchase method.

Interest income

The market rate of interest paid on investment-quality commercial paper and similar investments dropped from approximately 4.4% during the third quarter of 2001 to approximately 2.0% in the third quarter of 2002. As a result, interest income decreased despite an increase in total cash and cash equivalents and interest-bearing marketable securities. Specifically, net interest income decreased from $1.5 million in the quarter ended September 30, 2001 to $877,000 in the comparable quarter of 2002, and from $5.3 million in the nine-months ended September 30, 2001 to $2.5 million in the corresponding period of 2002.

Minority interest

Minority interest totaled $66,000 in the three months ended September 30, 2002 and $273,000 in the nine months ended September 30, 2002. Minority interest expense for the three months and nine months ended September 30, 2001 was not material. Minority interest represents the portion of earnings that would be distributed to shares not held by us if the Asia/Pacific Rim subsidiary declared a dividend equal to its earnings.

Other income

Other income for the third quarter of 2002 includes a $2.6 million gain related to the issuance of subsidiary shares in the acquisition of a Singapore company by our Asia-Pacific subsidiary. The gain represents the difference between the fair market value of the shares issued in the acquisition and the book value of those shares.

In the nine months ended September 30, 2002, other income also consists of a second quarter gain of $1.9 million on the sale of an investment in an ISS distributor in Japan. The shares of the publicly traded company were acquired when the distributor was privately held and were subsequently sold on the open market. The gain is substantially offset by expenses included in the general and administrative category resulting from the consolidation of Tokyo-based operations from several different locations to a new centralized headquarters in Tokyo. Costs associated with this move included lease termination costs, including remaining rent payments, write-off of leasehold improvements and moving costs.

Pretax income for the three and nine months ended September 30, 2001 includes a subsidiary IPO gain of $13.6 million from an initial public offering on the Japan over-the-counter market by the Company’s subsidiary responsible for Asia and Pacific Rim operations. Proceeds of the IPO were retained by the subsidiary.

INTERNET SECURITY SYSTEMS, INC.
MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION
AND RESULTS OF OPERATIONS – (Continued)

Also included in pretax income in the nine months ended September 30, 2001, is a non-recurring other income item of $1.6 million generated from the sale of approximately 2% of the outstanding shares of our Asia-Pacific subsidiary in March 2001. As part of the planning for an IPO in Japan of a minority interest in our Asia-Pacific subsidiary that was completed in September 2001, options were granted in the subsidiary as a means of key employee retention and approximately 2% of the outstanding shares were sold to employees and key partners. The price was established based on a valuation of the company by an independent appraisal firm. The gain represents the difference between proceeds received and the underlying basis in the stock.

Foreign currency exchange loss

Foreign currency transactions resulted in the exchange gain of $145,000 and $68,000 in the three months and nine months ended September 30, 2002, respectively, and the exchange loss of $163,000 and $445,000 in the three months and nine months ended September 30, 2001, respectively.

Provision for (benefit from) income taxes

The effective tax rate was 39% and 40% for the three and nine months ended September 30, 2002, respectively. For the comparable periods of 2001 the provision for income taxes was approximately 500% of pre-tax loss for the three months ended September 30, 2001 and 330% of pre-tax loss for the nine month ended September 30, 2001. As a result of the acquisition of Network ICE during the second quarter of 2001, we expensed approximately $26.3 million of goodwill amortization that was not deductible for income tax purposes.

Under APB Opinion No. 28, “Interim Financial Reporting”, we are required to estimate the annual effective income tax rate each time an interim report is issued. As of September 30, 2002, we estimated the annual effective income tax rate for the calendar year 2002 to be 39%.

The effective tax rate for 2002 differs from the statutory rate primarily due to the impact of acquisition related intangibles that are not deductible for income tax purposes, primarily attributable to the acquisition of Network ICE during the second quarter of 2001. The income tax calculation for the third quarter of 2001 included the impact of goodwill amortization resulting from the Network ICE acquisition that is no longer amortized, effective January 1, 2002, under Statement of Financial Accounting Standard No. 142.

While we record income tax expense on domestic income, domestic taxes payable are reduced by deductions related to the employee exercise of stock options. The tax benefit of these deductions was recorded as additional paid-in capital. Taxes paid generally relate to our foreign operations.

Liquidity and Capital Resources

Net cash provided by operations in the first nine months of 2002 was $21.6 million and included net income of $13.8 million, non-cash depreciation and amortization expense charges of $15.1 million, income tax benefit from employee exercises of stock options of $7.0 million and growth in deferred revenues of $5.5 million. These sources of cash were partially offset by a reduction in net assets and liabilities, excluding cash, of $17.7 million.

Investing activities in the first nine months of 2002 included the purchase of $63.2 million of marketable securities, primarily commercial paper, offset by net proceeds from the maturity of marketable securities of $63.3 million. These assets have quality characteristics similar to cash equivalents, except their maturities when we acquire them are longer than three months. We also invested in equipment totaling $9.2 million as we provided existing and new personnel with improved computer hardware and incurred leasehold improvement costs related primarily to a new Asia/Pacific headquarters in Tokyo.

Our financing activities provided $3.0 million of cash in the nine months ended September 30, 2002. Our financing activities consisted of proceeds from the exercise of stock options by our employees and from the issuance of common stock through our Employee Stock Purchase Plan, and the use of cash to repurchase 130,000 of our common stock. In July of 2002 we announced our plan to repurchase up to $50 million of our common stock over the next twelve months utilizing cash on hand and cash flow generated from operations. In the third quarter of 2002 we purchased 130,000 shares of our common stock on the open market at a cost of $2.0 million.

INTERNET SECURITY SYSTEMS, INC.
MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION
AND RESULTS OF OPERATIONS – (Continued)

We do not have any off-balance sheet financing arrangements or any relationships with “structured finance” or “special purpose” entities. Other than our non-cancelable operating leases for office space, we do not have any contractual obligations that would impact our liquidity. Our payment for operating leases is secured by three stand-by letters of credit totaling approximately $13.3 million. The stand-by letters of credit are annually renewable over the duration of the applicable leases. We do not anticipate utilizing these stand-by letters of credit to provide any liquidity needs

As of September 30, 2002, we had $178.5 million of cash and cash equivalents and marketable securities, consisting primarily of money market accounts and investment grade commercial paper. An additional $12.5 million of commercial paper investments are pledged as collateral for stand-by letters of credit related to the operating leases of our facilities and are shown on the balance sheet as restricted cash. We believe that such cash and cash equivalents and marketable securities will be sufficient to meet our working capital needs and capital expenditures for the foreseeable future. From time to time we evaluate possible acquisition and investment opportunities in businesses, products and technologies that are complimentary to ours. In the event we determine to pursue such opportunities, we may use our available cash and cash equivalents. Pending such uses, we will continue to invest our available cash in investment grade, interest-bearing investments.

Risk Factors

Forward-looking statements are inherently uncertain as they are based on various expectations and assumptions concerning future events and are subject to known and unknown risks and uncertainties. Our forward-looking statements contained in this Quarterly Report and elsewhere should be considered in light of the following important risk factors. Variations from our stated intentions or failure to achieve objectives could cause actual results to differ from those projected in our forward-looking statements. With respect to our Business Outlook published in our earnings press release each quarter, the public can continue to rely on the revenue and earnings expectations prior to the start of our “quiet period” unless we have published a notice stating otherwise. Toward the end of each quarter, we have a “quiet period” when we will not comment concerning the previously published financial expectations, and we disclaim any obligation to update during the quiet period. The public should not rely on previously published expectations during the “quiet period”. The “quiet period” runs from the 15th of the last month of the quarter until our earnings release during the first month of the following quarter. We otherwise undertake no obligation to update publicly any forward-looking statements for any reason, even if new information becomes available or other events occur in the future.

We Operate in a Rapidly Evolving Market

We began operations in 1994 and achieved profitability in 1999. We operate in a new and rapidly evolving market and must, among other things:

• respond to competitive developments;

• continue to upgrade and expand our product and services offerings; and

• continue to attract, retain and motivate our employees.

We cannot be certain that we will successfully address these issues. As a result, we cannot assure our investors that we will be able to continue to operate profitably in the future.

Our Future Operating Results Will Likely Fluctuate Significantly

As a result of our limited operating history, we cannot predict our future revenues and operating results with certainty. However, we do expect our future revenues and operating results to fluctuate due to a combination of factors, including:

• the growth in the acceptance of, and activity on, the Internet and the World Wide Web, particularly by corporate, institutional and government users;

INTERNET SECURITY SYSTEMS, INC.
MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION
AND RESULTS OF OPERATIONS – (Continued)

• the extent to which the public perceives that unauthorized access to and use of online information are threats to network security;

• the volume and timing of orders, including seasonal trends in customer purchasing;

• our ability to develop new and enhanced product and managed service offerings and expand our professional services capabilities;

• our ability to provide scalable managed services offerings through our partners in a cost effective manner;

• foreign currency exchange rates that affect our international operations;

• product and price competition in our markets; and

• general economic conditions, both domestically and in our foreign markets.

We increasingly focus our efforts on sales of enterprise-wide security solutions, which consist of our entire product suite and related professional services, and managed security services, rather than on the sale of component products. As a result, each sale requires substantial time and effort from our sales and support staff. In addition, the revenues associated with particular sales vary significantly depending on the number of products licensed by a customer, the number of devices used by the customer and the customer’s relative need for our professional services. Large individual sales, or even small delays in customer orders, can cause significant variation in our license revenues and results of operations for a particular period. The timing of large orders is usually difficult to predict and, like many software and services companies, many of our customers typically complete transactions in the last month of a quarter.

We cannot predict our operating expenses based on our past results. Instead, we establish our spending levels based in large part on our expected future revenues. As a result, if our actual revenues in any future period fall below our expectations, our operating results likely will be adversely affected because very few of our expenses vary with our revenues. Because of the factors listed above, we believe that our quarterly and annual revenues, expenses and operating results likely will vary significantly in the future.

Our ability to provide timely guidance and meet the expectations of investors with respect to our operating and financial results is impacted by the tendency of a majority of our sales to be completed in the last month of a quarter. We may not be able to determine whether we will experience material deviations from guidance or expectations until the end of a quarter.

We Face Intense Competition in Our Market

The market for network security monitoring, detection and response solutions is intensely competitive, and we expect competition to increase in the future. We cannot guarantee that we will compete successfully against our current or potential competitors, especially those with significantly greater financial resources or brand name recognition. Our chief competitors generally fall within one of five categories:

• internal information technology departments of our customers and the consulting firms that assist them in formulating security systems;

• relatively smaller software companies offering relatively limited applications for network and Internet security;

• large companies, including Symantec Corp., Cisco Systems, Inc. and Enterasys Networks, Inc., that sell competitive products and offerings, as well as other large software companies that have the technical capability and resources to develop competitive products;

• software or hardware companies like Cisco Systems, Inc. that could integrate features that are similar to our products into their own products; and

• small and large companies with competitive offerings to components of our managed services offerings.

INTERNET SECURITY SYSTEMS, INC.
MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION
AND RESULTS OF OPERATIONS – (Continued)

Mergers or consolidations among these competitors, or acquisitions of small competitors by larger companies, such as Symantec’s acquisition of Recourse Technologies and Riptech Inc., completed in the third quarter of 2002, would make such combined entities potentially more formidable competitors to us if such products and offerings are effectively integrated. Large companies may have advantages over us because of their longer operating histories, greater name recognition, larger customer bases or greater financial, technical and marketing resources. As a result, they may be able to adapt more quickly to new or emerging technologies and changes in customer requirements. They can also devote greater resources to the promotion and sale of their products than we can. In addition, these companies have reduced and could continue to reduce, the price of their security monitoring, detection and response products and managed security services, which increases pricing pressures within our market.

Several companies currently sell software products (such as encryption, firewall, operating system security and virus detection software) that our customers and potential customers have broadly adopted. Some of these companies sell products that perform the same functions as some of our products. In addition, the vendors of operating system software or networking hardware may enhance their products to include the same kinds of functions that our products currently provide. The widespread inclusion of comparable features to our software in operating system software or networking hardware could render our products obsolete, particularly if such features are of a high quality. Even if security functions integrated into operating system software or networking hardware are more limited than those of our software, a significant number of customers may accept more limited functionality to avoid purchasing additional software.

For the above reasons, we may not be able to compete successfully against our current and future competitors. Increased competition may result in price reductions, reduced gross margins and loss of market share.

We Face Rapid Technological Change in Our Industry and Frequent Introductions of New Products

Rapid changes in technology pose significant risks to us. We do not control nor can we influence the forces behind these changes, which include:

• the extent to which businesses and others seek to establish more secure networks;

• the extent to which hackers and others seek to compromise secure systems;

• evolving computer hardware and software standards;

• changing customer requirements; and

• frequent introductions of new products and product enhancements.

To remain successful, we must continue to change, adapt and improve our products in response to these and other changes in technology. Our future success hinges on our ability to both continue to enhance our current line of products and professional services and to introduce new products and services that address and respond to innovations in computer hacking, computer technology and customer requirements. We cannot be sure that we will successfully develop and market new products that do this. Any failure by us to timely develop and introduce new products, to enhance our current products or to expand our professional services capabilities in response to these changes could adversely affect our business, operating results and financial condition.

Our products involve very complex technology, and as a consequence, major new products and product enhancements require a long time to develop and test before going to market. Because this amount of time is difficult to estimate, we have had to delay the scheduled introduction of new and enhanced products in the past and may have to delay the introduction of new and enhanced products enhancements in the future.

The techniques computer hackers use to gain unauthorized access to, or to sabotage, networks and intranets are constantly evolving and increasingly sophisticated. Furthermore, because new hacking techniques are usually not recognized until used against one or more targets, we are unable to anticipate most new hacking techniques. To the extent that new hacking techniques harm our

INTERNET SECURITY SYSTEMS, INC.
MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION
AND RESULTS OF OPERATIONS – (Continued)

customers’ computer systems or businesses, affected or prospective customers may believe that our products are ineffective, which may cause them or prospective customers to reduce or avoid purchases of our products.

Risks Associated with Our Global Operations

The expansion of our international operations includes our presence in dispersed locations throughout the world, including throughout Europe and the Asia/Pacific and Latin America regions. Our international presence and expansion exposes us to risks not present in our U.S. operations, such as:

• the difficulty in managing an organization spread over various countries located across the world;

• compliance with, and unexpected changes in, a wide range of complex regulatory requirements in countries where we do business;

• increased financial accounting and reporting burdens and complexities and potentially adverse tax consequences;

• excess taxation due to overlapping tax structures;

• fluctuations in foreign currency exchange rates resulting in losses or gains from transactions and expenses denominated in foreign currencies;

• reduced protection for intellectual property rights in some countries; and

• export license requirements and restrictions on the export of certain technology, especially encryption technology and trade restrictions.

Despite these risks, we believe that we must continue to expand our operations in international markets to support our growth. To this end, we intend to establish additional foreign sales operations, expand our existing offices, hire additional personnel, expand our international sales channels and customize our products for local markets. If we fail to execute this strategy, our international sales growth will be limited.

Our Networks, Products and Services May be Targeted by Hackers

Like other companies, our websites, networks, information systems, products and services may be targets for sabotage, disruption or misappropriation by hackers. As a leading network security solutions company, we are a high profile target. Although we believe we have sufficient controls in place to prevent disruption and misappropriation, and to respond to situations, we expect these efforts by hackers to continue. If these efforts are successful, our operations, reputation and sales could be adversely affected.

We Must Successfully Integrate Acquisitions

As part of our growth strategy, we have and may continue to acquire or make investments in companies with products, technologies or professional services capabilities complementary to our solutions. When engaging in acquisitions, we could encounter difficulties in assimilating new personnel and operations into our company. These difficulties may disrupt our ongoing business, distract our management and employees, increase our expenses and adversely affect our results of operations. These difficulties could also include accounting requirements, such as impairment charges related to goodwill or expensing in-process research and development costs. We cannot be certain that we will successfully overcome these risks with respect to any future acquisitions or that we will not encounter other problems in connection with our recent or any future acquisitions. In addition, any future acquisitions may require us to incur debt or issue equity securities. The issuance of equity securities could dilute the investment of our existing stockholders.

We Depend on Our Intellectual Property Rights and Use Licensed Technology

We rely primarily on copyright and trademark laws, trade secrets, confidentiality procedures and contractual provisions to protect our proprietary rights. We have obtained one United States patent and have 17 patent applications under review. We also believe that the technological and creative skills of our personnel, new product developments, frequent product enhancements, our name

INTERNET SECURITY SYSTEMS, INC.
MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION
AND RESULTS OF OPERATIONS – (Continued)

recognition, our professional services capabilities and delivery of reliable product maintenance are essential to establishing and maintaining our technology leadership position. We cannot assure you that our competitors will not independently develop technologies that are similar to ours.

Despite our efforts to protect our proprietary rights, unauthorized parties may attempt to copy aspects of our products or to obtain and use information that we regard as proprietary. Policing unauthorized use of our products is difficult. While we cannot determine the extent to which piracy of our software products occurs, we expect software piracy to be a persistent problem. In addition, the laws of some foreign countries do not protect our proprietary rights to as great an extent as do the laws of the United States and many foreign countries do not enforce these laws as diligently as U.S. government agencies and private parties.


ITEM 3.		QUANTITATIVE AND QUALITATIVE DISCLOSURES ABOUT MARKET RISK

Item 7a.		*Quantitative and Qualitative Disclosures About Market Risk*

Interest Rate Sensitivity

The primary objective of our investment activities is to preserve principal while at the same time maximize the income we receive from our investments without significantly increasing risk. Some of the securities that we have invested in may be subject to market risk. This means that a change in prevailing interest rates may cause the principal amount of the investment to fluctuate. For example, if we hold a security that was issued with a fixed interest rate at the then-prevailing rate and the prevailing interest rate later rises, the market value of our investment will probably decline. To minimize this risk, we maintain our portfolio of cash equivalents and marketable securities in a variety of relatively short-term investments, including commercial paper and overnight repurchase agreements. Our marketable securities at September 30, 2002 mature as follows: $16.9 million within three months, $24.9 million in three to six months and $12.9 million in more than six months.

Risk Associated with Foreign Exchange Rates

We are subject to foreign exchange risk as a result of exposures to changes in currency exchange rates. Our foreign operations are, for the most part, naturally hedged against exchange rate fluctuations since both revenues and expenses of each foreign affiliate are denominated in the same currency. As a result, an unfavorable change in the exchange rate for any particular foreign subsidiary would result in lower revenues and expenses with regards to operating results, and lower assets and liabilities with regards to the balance sheet. Therefore, we do not engage in formal hedging activities, but we do periodically review the potential impact of this risk to ensure that the risk of significant potential losses remains minimal.


ITEM 4.		CONTROLS AND PROCEDURES

As required by SEC rules, we have evaluated the effectiveness of the design and operation of our disclosure controls and procedures within 90 days of the filing of this quarterly report. This evaluation was carried out under the supervision and with the participation of our management, including our principal executive officer and principal financial officer. Based on this evaluation, these officers have concluded that the design and operation of our disclosure controls and procedures are effective. There were no significant changes to our internal controls or in other factors that could significantly affect disclosure controls subsequent to the date of their evaluation.

Disclosure controls and procedures are our controls and other procedures that are designed to ensure that information required to be disclosed by us in the reports that we file or submit under the Securities Exchange Act of 1934 is recorded, processed, summarized and reported, within the time periods specified in the SEC’s rules and forms. Disclosure controls and procedures include, without limitation, controls and procedures designed to ensure that information required to be disclosed by us in the reports that we file under the Exchange Act is accumulated and communicated to our management, including principal executive officer and principal financial officer, as appropriate, to allow timely decisions regarding required disclosure.


PART II		OTHER INFORMATION

ITEM 1.		LEGAL PROCEEDINGS

Beginning on September 28, 2001, the Company and certain of its officers and directors were named as defendants in several lawsuits alleging violations of the federal securities laws, including Sections 10(b) and 20(a) of the Securities Exchange Act of 1934, as amended, and Rule 10b-5 thereunder. Six such actions were filed in the United States District Court for the Northern District of Georgia. All six actions have been consolidated into a single case and the court has appointed lead plaintiffs and lead plaintiff’s counsel. The consolidated complaint was filed October 9, 2002 and purports to be brought on behalf of a class of investors who purchased the Company’s stock during the period from April 5, 2001 through August 14, 2001 (the “Class Period”). The complaint generally alleges that the Company and the individual defendants violated the anti-fraud provisions of the federal securities laws and caused the Company’s stock to trade at artificially high prices by making misrepresentations relating to the Company’s financial condition and prospects during the Class Period. The complaint seeks damages in an unspecified amount.

The Company’s response to the consolidated amended complaint is currently due by November 25, 2002. The Company believes that it has meritorious defenses and intends to defend the actions vigorously.


ITEM 6.		EXHIBITS AND REPORTS ON FORM 8-K


(a)	Exhibits

	3.1	—	Restated Certificate of Incorporation (filed as Exhibit 3.1 to the Company’s Quarterly Report on Form 10-Q, dated November 14, 2000 and incorporated by reference herein)

	3.2	—	Bylaws (filed as Exhibit 3.2 to the Company’s Registration Statement on Form S-1, Registration No. 333-44529 and incorporated by reference herein)

	11	—	Computation of Per Share Earnings.*

	99.1	—	Certification Pursuant to 18 U.S.C. Section 1350, as Adopted Pursuant to Section 906 of the Sarbanes-Oxley Act of 2002.

	99.2	—	Certification Pursuant to 18 U.S.C. Section 1350, as Adopted Pursuant to Section 906 of the Sarbanes-Oxley Act of 2002.
(b)	Reports on Form 8-K.

	ISS filed a report on Form 8-K on July 24, 2002 with respect to the adoption of a shareholder rights plan.

Data required by SFAS No. 128, “Earnings Per Share,” is provided in note 6 to the consolidated financial statements in this report.

INTERNET SECURITY SYSTEMS, INC. SIGNATURES

Pursuant to the requirements of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned thereunto duly authorized.


		INTERNET SECURITY SYSTEMS, INC.

Date: November 13, 2002	By:		/s/ Richard Macchia
			Chief Financial Officer Vice President and Chief Financial Officer

			(Duly Authorized Officer and Principal Financial Officer)

	By:		/s/ Maureen Richards
			Corporate Controller (Chief Accounting Officer)

CERTIFICATION

I, Thomas E. Noonan, certify that:

1. I have reviewed this quarterly report on Form 10-Q of Internet Security Systems, Inc.;

2. Based on my knowledge, this quarterly report does not contain any untrue statement of a material fact or omit to state a material fact necessary to make the statements made, in light of the circumstances under which such statements were made, not misleading with respect to the period covered by this quarterly report;

3. Based on my knowledge, the financial statements, and other financial information included in this quarterly report, fairly present in all material respects the financial condition, results of operations and cash flows of the registrant as of, and for, the periods presented in this quarterly report;

4. The registrant’s other certifying officers and I are responsible for establishing and maintaining disclosure controls and procedures (as defined in Exchange Act Rules 13a-14 and 15d-14) for the registrant and we have:

a) designed such disclosure controls and procedures to ensure that material information relating to the registrant, including its consolidated subsidiaries, is made known to us by others within those entities, particularly during the period in which this quarterly report is being prepared;

b) evaluated the effectiveness of the registrant’s disclosure controls and procedures as of a date within 90 days prior to the filing date of this quarterly report (the “Evaluation Date”); and

c) presented in this quarterly report our conclusions about the effectiveness of the disclosure controls and procedures based on our evaluation as of the Evaluation Date;

5. The registrant’s other certifying officers and I have disclosed, based on our most recent evaluation, to the registrant’s auditors and the audit committee of registrant’s board of directors (or persons performing the equivalent function):

a) all significant deficiencies in the design or operation of internal controls which could adversely affect the registrant’s ability to record, process, summarize and report financial data and have identified for the registrant’s auditors any material weaknesses in internal controls; and

b) any fraud, whether or not material, that involves management or other employees who have a significant role in the registrant’s internal controls; and

6. The registrant’s other certifying officers and I have indicated in this quarterly report whether or not there were significant changes in internal controls or in other factors that could significantly affect internal controls subsequent to the date of our most recent evaluation, including any corrective actions with regard to significant deficiencies and material weaknesses.

Date: November 13, 2002

/s/ Thomas E. Noonan

Thomas E. Noonan
Chairman, President and
Chief Executive Officer

CERTIFICATION

I, Richard Macchia, certify that:

1. I have reviewed this quarterly report on Form 10-Q of Internet Security Systems, Inc.;

b) evaluated the effectiveness of the registrant’s disclosure controls and procedures as of a date within 90 days prior to the filing date of this quarterly report (the “Evaluation Date”); and

c) presented in this quarterly report our conclusions about the effectiveness of the disclosure controls and procedures based on our evaluation as of the Evaluation Date;

b) any fraud, whether or not material, that involves management or other employees who have a significant role in the registrant’s internal controls; and

Date: November 13, 2002

/s/ Richard Macchia

Richard Macchia
Vice President and
Chief Financial Officer

	•		persuasive evidence of an arrangement exists;

	•		delivery has occurred or services have been rendered;

	•		price is fixed or determinable; and

	•		collection is probable.

	•		vendor specific objective evidence (VSOE) of fair value of the undelivered elements;

	•		the functionality of the delivered elements is not dependent on the undelivered elements; and

	•		delivery of the delivered elements represents the culmination of the earnings process.

	•		respond to competitive developments;

	•		continue to upgrade and expand our product and services offerings; and

	•		continue to attract, retain and motivate our employees.

	•		the extent to which the public perceives that unauthorized access to and use of online information are threats to network security;

	•		the volume and timing of orders, including seasonal trends in customer purchasing;

	•		our ability to develop new and enhanced product and managed service offerings and expand our professional services capabilities;

	•		our ability to provide scalable managed services offerings through our partners in a cost effective manner;

	•		foreign currency exchange rates that affect our international operations;

	•		product and price competition in our markets; and

	•		general economic conditions, both domestically and in our foreign markets.

	•		internal information technology departments of our customers and the consulting firms that assist them in formulating security systems;

	•		relatively smaller software companies offering relatively limited applications for network and Internet security;

	•		large companies, including Symantec Corp., Cisco Systems, Inc. and Enterasys Networks, Inc., that sell competitive products and offerings, as well as other large software companies that have the technical capability and resources to develop competitive products;

	•		software or hardware companies like Cisco Systems, Inc. that could integrate features that are similar to our products into their own products; and

	•		small and large companies with competitive offerings to components of our managed services offerings.

	•		the extent to which businesses and others seek to establish more secure networks;

	•		the extent to which hackers and others seek to compromise secure systems;

	•		evolving computer hardware and software standards;

	•		changing customer requirements; and

	•		frequent introductions of new products and product enhancements.

	•		the difficulty in managing an organization spread over various countries located across the world;

	•		compliance with, and unexpected changes in, a wide range of complex regulatory requirements in countries where we do business;

	•		increased financial accounting and reporting burdens and complexities and potentially adverse tax consequences;

	•		excess taxation due to overlapping tax structures;

	•		fluctuations in foreign currency exchange rates resulting in losses or gains from transactions and expenses denominated in foreign currencies;

	•		reduced protection for intellectual property rights in some countries; and

	•		export license requirements and restrictions on the export of certain technology, especially encryption technology and trade restrictions.


	1.	I have reviewed this quarterly report on Form 10-Q of Internet Security Systems, Inc.;


	2.	Based on my knowledge, this quarterly report does not contain any untrue statement of a material fact or omit to state a material fact necessary to make the statements made, in light of the circumstances under which such statements were made, not misleading with respect to the period covered by this quarterly report;


	3.	Based on my knowledge, the financial statements, and other financial information included in this quarterly report, fairly present in all material respects the financial condition, results of operations and cash flows of the registrant as of, and for, the periods presented in this quarterly report;


	4.	The registrant’s other certifying officers and I are responsible for establishing and maintaining disclosure controls and procedures (as defined in Exchange Act Rules 13a-14 and 15d-14) for the registrant and we have:


	/s/ Thomas E. Noonan Thomas E. Noonan Chairman, President and Chief Executive Officer


	/s/ Richard Macchia Richard Macchia Vice President and Chief Financial Officer