INTERNET SECURITY SYSTEMS INC/GA - 10-Q Quarterly Report

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Back to GetFilings.com

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

WASHINGTON, D.C. 20549

FORM 10-Q

(Mark One)

[X]

QUARTERLY REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the quarterly period ended March 31, 2005

¨	TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the transition period from to

Commission File Number 000-23655

INTERNET SECURITY SYSTEMS, INC.

(Exact name of registrant as specified in its charter)

DELAWARE

58-2362189

(State or jurisdiction of

incorporation or organization)

(I.R.S. Employer

Identification No.)

6303 BARFIELD ROAD, ATLANTA, GEORGIA 30328

(Address of principal executive offices)

Registrant’s telephone number, including area code (404) 236-2600

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes x No ¨

Indicate by check mark whether the registrant is an accelerated filer (as defined in Rule 12b-2 of the Exchange Act). Yes x No ¨

Indicate the number of shares outstanding of each of the registrant’s classes of common stock, as of the latest practicable date.

Title of each class of common stock

Common stock, $0.001 par value

Number of Shares

Outstanding

as of April 29, 2005

45,625,378


		PAGE NUMBER
	PART I – FINANCIAL INFORMATION

Item 1	Consolidated Financial Statements:

	Consolidated Balance Sheets at March 31, 2005 and December 31, 2004	3

	Consolidated Statements of Operations for the three months ended March 31, 2005 and March 31, 2004	4

	Consolidated Statements of Cash Flows for the three months ended March 31, 2005 and March 31, 2004	5

	Notes to Consolidated Financial Statements	6

Item 2	Management’s Discussion and Analysis of Financial Condition and Results of Operations	12

Item 3	Quantitative and Qualitative Disclosures about Market Risk	25

Item 4	Controls and Procedures	25

	PART II - OTHER INFORMATION

Item 1	Legal Proceedings	26

Item 2	Unregistered Sale of Equity Securities and Use of Proceeds	26

Item 6	Exhibits	27

EX-31.1 SECTION 302 CERTIFICATION OF THE CEO

EX-31.2 SECTION 302 CERTIFICATION OF THE CFO

EX-32.1 SECTION 906 CERTIFICATION OF THE CEO

EX-32.2 SECTION 906 CERTIFICATION OF THE CFO

PART I. FINANCIAL INFORMATION

Item 1. Consolidated Financial Statements

INTERNET SECURITY SYSTEMS, INC.

CONSOLIDATED BALANCE SHEETS

(amounts in thousands, except share and per share amounts)


	March 31, 2005			December 31, 2004
	(unaudited)
ASSETS
Current assets:
Cash and cash equivalents	$	174,229		$	140,148
Marketable securities		40,087			70,901
Accounts receivable, less allowance for doubtful accounts of $3,181 and $3,099, respectively		73,150			75,353
Inventory		2,589			2,506
Prepaid expenses and other current assets		12,725			12,728

Total current assets		302,780			301,636

Property and equipment:
Computer equipment and software		53,666			52,412
Office furniture and equipment		18,144			18,091
Leasehold improvements		21,015			21,098

		92,825			91,601
Less accumulated depreciation		59,790			57,161

		33,035			34,440

Restricted cash and marketable securities		10,300			10,300
Goodwill, less accumulated amortization of $27,381		223,325			224,065
Other intangible assets, less accumulated amortization of $22,586 and $20,951, respectively		17,193			19,763
Other assets		8,343			8,698

Total assets	$	594,976		$	598,902

LIABILITIES AND STOCKHOLDERS’ EQUITY
Current liabilities:
Accounts payable	$	5,313		$	6,911
Accrued expenses		24,931			25,238
Deferred revenues		70,316			70,246

Total current liabilities		100,560			102,395
Non-current portion of deferred revenues		8,165			8,432
Other non-current liabilities		6,735			6,495
Commitments and contingencies

Stockholders’ equity:
Preferred stock, $.001 par value, 20,000,000 shares authorized, none issued or outstanding		—			—
Common stock, $.001 par value, 120,000,000 shares authorized, 50,937,000 and 50,754,000 issued, respectively		51			51
Additional paid-in capital		502,372			499,534
Deferred compensation		(2,592	)		(3,197	)
Accumulated other comprehensive income		6,882			11,041
Retained earnings		56,389			48,544
Treasury stock, at cost (5,314,000 and 4,871,000 shares, respectively)		(83,586	)		(74,393	)

Total stockholders’ equity		479,516			481,580

Total liabilities and stockholders’ equity	$	594,976		$	598,902

See accompanying notes

INTERNET SECURITY SYSTEMS, INC.

CONSOLIDATED STATEMENTS OF OPERATIONS

(amounts in thousands, except per share amounts)

(unaudited)


	Three months ended March 31,
	2005			2004
Revenues:
Product licenses and sales	$	32,270		$	28,785
Subscriptions		38,838			32,842
Professional services		5,684			5,437

		76,792			67,064
Costs and expenses:
Cost of revenues:
Product licenses and sales		6,385			4,548
Amortization of acquired technology		1,786			1,619
Subscriptions and professional services		13,158			11,673

Total cost of revenues		21,329			17,840

Research and development		10,291			10,811
Sales and marketing		26,109			24,354
General and administrative		7,344			6,251
Amortization of other intangibles and stock-based compensation		44			155

		65,117			59,411

Operating income		11,675			7,653
Interest income		1,059			528
Other income (expense), net		(539	)		(67	)
Gain on issuance of subsidiary stock		63			74

Income before income taxes		12,258			8,188
Provision for income taxes		4,413			2,968

Net income	$	7,845		$	5,220

Basic net income per share of Common Stock	$	0.17		$	0.11

Diluted net income per share of Common Stock	$	0.16		$	0.10

Weighted average shares and equivalent shares:
Basic		45,495			48,646

Diluted		47,609			50,133

See accompanying notes

INTERNET SECURITY SYSTEMS, INC.

CONSOLIDATED STATEMENTS OF CASH FLOWS

(amounts in thousands)

(unaudited)


	Three months ended March 31,
	2005			2004
Operating activities
Net income	$	7,845		$	5,220
Adjustments to reconcile net income to net cash provided by operating activities:
Depreciation		2,629			3,311
Amortization of acquired technology, other intangibles and stock-based compensation		1,830			1,774
Accretion of discount on marketable securities		(231	)		(21	)
Deferred compensation expense		573			332
Minority interest		10			127
Income tax benefit from exercise of stock options		286			2,271
Gain on issuance of subsidiary stock		(63	)		(74	)
Changes in assets and liabilities, excluding the effects of acquisitions:
Accounts receivable		2,203			2,049
Inventory		(83	)		(418	)
Prepaid expenses and other assets		78			259
Accounts payable and accrued expenses		(1,391	)		(1,508	)
Deferred revenues		(197	)		6,154

Net cash provided by operating activities		13,489			19,476

Investing activities
Acquisitions, net of cash received		(764	)		(33,991	)
Purchases of marketable securities		(35,057	)		(20,221	)
Net proceeds from maturity of marketable securities		36,352			11,516
Net proceeds from sales of marketable securities		29,750			—
Purchases of property and equipment		(1,224	)		(7,061	)
Net proceeds from issuance of subsidiary stock		117			113

Net cash provided by (used in) investing activities		29,174			(49,644	)

Financing activities
Proceeds from exercise of stock options		1,847			533
Proceeds from employee stock purchase plan		732			750
Purchases of treasury stock		(9,193	)		(6,571	)

Net cash used in financing activities		(6,614	)		(5,288	)

Foreign currency impact on cash		(1,968	)		(698	)

Net increase (decrease) in cash and cash equivalents		34,081			(36,154	)
Cash and cash equivalents at beginning of period		140,148			184,551

Cash and cash equivalents at end of period	$	174,229		$	148,397

Supplemental cash flow disclosure
Income taxes paid	$	1,999		$	1,176

See accompanying notes

INTERNET SECURITY SYSTEMS, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS

(unaudited)

Note 1. Significant Accounting Policies

Basis of Presentation

The consolidated financial statements of Internet Security Systems, Inc. (“ISS” or the “Company”) as of March 31, 2005 and for the three months ended March 31, 2005 and 2004 are unaudited and, in the opinion of management, contain all adjustments, consisting of normal recurring items, necessary for the fair presentation of the financial position and results of operations of the Company for the interim periods. The consolidated financial statements include the accounts of the Company and its majority-owned subsidiaries. The consolidated balance sheet at December 31, 2004 has been derived from the audited financial statements at that date but does not include all of the footnotes required by U.S. generally accepted accounting principles for complete financial statements.

These consolidated financial statements should be read in conjunction with the Consolidated Financial Statements and Notes thereto included in the Company’s Annual Report on Form 10-K, as amended, for the year ended December 31, 2004. The results of operations for the three months ended March 31, 2005 are not necessarily indicative of the results to be expected for the entire year. All significant intercompany accounts and transactions have been eliminated.

The preparation of financial statements and related disclosures in conformity with U.S. generally accepted accounting principles requires management to make estimates and assumptions that affect the amounts reported in the financial statements and accompanying notes. Actual results will differ from those estimates, and such differences may be material to the consolidated financial statements.

Goodwill and Intangibles

Goodwill and intangible assets are comprised of the following, as of the dates indicated (in thousands):


	March 31, 2005					December 31, 2004
	Gross Carrying Amount		Accumulated Amortization			Gross Carrying Amount		Accumulated Amortization
Goodwill	$	250,706	$	(27,381	)	$	251,446	$	(27,381	)

Amortized intangible assets:
Core technology		3,853		(3,122	)		3,853		(3,002	)
Developed technology		33,870		(17,716	)		34,775		(16,235	)
Customer relationships		2,056		(1,748	)		2,086		(1,714	)

Total	$	39,779	$	(22,586	)	$	40,714	$	(20,951	)

The change in the carrying amounts of goodwill and developed technology from December 31, 2004 to March 31, 2005 was the result of additional consideration related to a 2002 acquisition of TriSecurity Holdings Pte Ltd., payment of approximately $20,000 of final severance payments and related purchase accounting adjustments for the 2004 Cobion acquisition, and reductions due to currency translation adjustments.

The Company amortizes intangible assets over their estimated useful lives of eight years for core technology, five years for developed technology and three years for customer relationships. Amortization related to core technology and developed technology is classified as a component of cost of revenues. Amortization expense of intangible assets is as follows (in thousands):


	Three months ended March 31,
	2005		2004
Core technology	$	120	$	120
Developed technology		1,666		1,499
Customer relationships		44		125

Total	$	1,830	$	1,744

The Company amortized $375,000 and $440,000 in the three months ended March 31, 2005 and 2004, respectively, relating to the purchase of a software license used in certain of its products. These costs are included in cost of product licenses and sales.

The estimated future amortization expense of intangible assets as of March 31, 2005 is as follows (in thousands):


	Amount
Year ending December 31,
2005 (nine months)	$	5,495
2006		5,228
2007		3,266
2008		3,204

Total	$	17,193

Accounting for stock-based compensation

Statement of Financial Accounting Standard 123, “Accounting for Stock-Based Compensation” (“SFAS 123”), as amended by SFAS 148, “Accounting for Stock-Based Compensation - Transition and Disclosure,” establishes accounting and reporting standards for stock-based employee compensation plans. As permitted by SFAS 123, ISS continues to account for stock-based compensation in accordance with Accounting Principles Board Opinion No. 25, “Accounting for Stock Issued to Employees” (“APB 25”), and has elected the pro forma disclosure alternative of SFAS 123.

Although SFAS 123 allows the Company to continue to follow APB 25 guidelines, the following table shows pro forma net income (loss) and pro forma net income (loss) per share for the periods indicated as if the Company had adopted SFAS 123. The pro forma impact of applying SFAS 123 as illustrated below will not necessarily be representative of the pro forma impact in future years. Pro forma information is as follows (amounts in thousands, except per share amounts):


	Three months ended March 31,
	2005			2004
Net income, as reported	$	7,845		$	5,220
Add: Stock-based compensation included in reported net income, net of income taxes		367			246
Less: Stock-based compensation expense computed under the fair value method, net of income taxes		(4,138	)		(6,668	)

Pro forma net income (loss)	$	4,074		$	(1,202	)

Basic net income (loss) per share of Common Stock
As reported	$	0.17		$	0.11

Pro forma		0.09			(0.02	)

Diluted net income (loss) per share of Common Stock
As reported	$	0.16		$	0.10

Pro forma		0.09			(0.02	)

The fair value of options at date of grant was estimated using the Black-Scholes model with the following assumptions:


	Three months ended March 31,
	2005		2004
Expected life (years)	4.6		5
Risk free interest rates	3.83	%	2.83	%
Expected volatility	.41	%	.50	%
Expected dividend yield	—		—

During 2004, 316,000 restricted shares were issued to directors, officers and certain key employees of ISS. The shares issued to directors vest when the Company holds its annual stockholders meeting in 2005 and the shares issued to officers and certain key employees vest in two installments: 50% vests two years from the grant date, and the remaining 50% vests three years from the grant date. Upon issuance of restricted shares, unearned compensation is recorded in stockholders’ equity as deferred compensation equal to the market value of the restricted shares and is recognized as compensation expense over the vesting period. Total compensation expense for restricted stock awards amounted to $573,000 and $385,000 in the three months ended March 31, 2005 and 2004, respectively.

Gain on issuance of subsidiary shares

The gain on issuance of subsidiary shares results from our Asia/Pacific subsidiary (“ISS KK”) issuing shares related to the exercise of ISS KK stock options. In 2005 ISS KK issued 154 shares at an average exercise price of approximately $760 per share. Our ownership percentage of the subsidiary remained at 87% at March 31, 2005. Deferred income taxes have been provided in the period in which the gain is recognized.

Note 2. Income Taxes

The Company recorded tax provisions of $4.4 million and $3.0 million for the three-month periods ended March 31, 2005 and 2004, respectively. While income tax expense was recorded on domestic income, the amount of domestic taxes payable was reduced by deductions related to the exercise of employee stock options in current and prior periods. The tax benefit of these deductions was recorded as additional paid-in capital. Taxes paid generally relate to certain foreign operations and state taxes.

The effective tax rate was approximately 36% for the three months ended March 31, 2005 and 36.25% for the three months ended March 31, 2004. The effective rates differ from the Federal statutory rate due primarily to certain operating expenses that are not deductible for income tax purposes, state income taxes, foreign operations taxed at different rates and Federal tax credits

Note 3. Business Acquisition

In August 2002, Internet Security Systems KK (“ISS KK”), our Asia-Pacific subsidiary, acquired a distributor in Singapore, TriSecurity Holdings Pte Ltd. (“TriSecurity”). TriSecurity was the sole distributor for ISS KK in Southeast Asia, including India, and its business was almost exclusively focused on ISS solutions. This acquisition provides our Asia-Pacific subsidiary direct support capabilities for their customers in Southeast Asia and allows ISS KK to expand its capabilities in this growing market. The consideration consisted of 1,000 shares of ISS KK stock and approximately $1.2 million of cash. Goodwill of approximately $4.0 million related to the purchase was recorded. During the first quarter of 2003, ISS KK amended the agreement and agreed to make payment of 245 shares of ISS KK in each of the first quarters of 2004 and 2005, relating to annual contingent consideration payments defined in the 2002 purchase agreement. Due to regulatory issues, the agreement was amended prior to the 2004 payment to make the 2004 and 2005 payments in cash in lieu of shares. Additional consideration of $764,000 and $498,000 was paid in February 2005 and 2004, respectively, based on the fair market value of the 245 shares, and is reflected in goodwill.

Note 4. Comprehensive Income

The components of comprehensive income are as follows (in thousands):


	Three months ended March 31,
	2005			2004
Net income, as reported	$	7,845		$	5,220
Change in cumulative translation adjustment		(4,159	)		(779	)

Comprehensive income	$	3,686		$	4,441

Note 5. Income per Share

The following table sets forth the computation of basic and diluted net income per share (amounts in thousands, except per share amounts):


	Three months ended March 31,
	2005		2004
Numerator:
Net income	$	7,845	$	5,220

Denominator:
Denominator for basic net income per share - weighted average shares		45,495		48,646
Effect of dilutive stock options		2,114		1,487

Denominator for diluted net income per share - weighted average shares and equivalents		47,609		50,133

Basic net income per share	$	0.17	$	0.11

Diluted net income per share	$	0.16	$	0.10

In the three months ended March 31, 2005 and 2004, 3,559,000 and 3,657,000 options, respectively, were not included in the computation of diluted income per share because the options’ exercise price was greater than the average market price of the common shares, and their impact would have been anti-dilutive.

Note 6. Segment and Geographic Information

ISS conducts business in one operating segment: providing information security management solutions. The Company does, however, prepare operating results for internal use on a geographic basis. These geographical based operating costs consist of direct sales expenses, infrastructure to support its employee and customer and partner base, supporting billing and financial systems and a management team. Corporate expenses that are not charged directly to the other segments include research and development, general and administrative costs that support the global organization, amortization of acquired technology, amortization of licensed development source code, amortization of intangibles and stock based compensation and costs that are one-time in nature, such as acquired in-process research and development.

The accounting policies of the segments are the same as those described in the summary of significant accounting policies. There are no inter-segment sales. Our chief executive officer and chief financial officer evaluate performance based on operating profit or loss from operations, and trade accounts receivable for each segment. Other than trade accounts receivable, assets and liabilities are not discretely allocated or reviewed by segment.

In accordance with SFAS No. 131, “Disclosures about Segments of an Enterprise and Related Information,” the Company has included a summary of the segment financial information reported internally. The geographic segments are the Americas, Europe, Middle East and Africa (“EMEA”), and the Asia/Pacific region.

The following table presents ISS’s revenues, operating expenses and operating income (loss) by reportable geographic segment (in thousands):


	Americas		EMEA		Asia/Pacific		Unallocated			Total
As of or for the three months ended March 31, 2005
Revenues from external customers:
Product licenses and sales	$	19,058	$	6,807	$	6,405	$	—		$	32,270
Subscriptions		24,758		9,148		4,932		—			38,838
Professional services		3,563		467		1,654		—			5,684

Total revenue		47,379		16,422		12,991		—			76,792
Cost of revenues:
Product licenses and sales		3,671		1,214		1,125		375			6,385
Amortization of acquired technology		—		—		—		1,786			1,786
Subscriptions and professional services		9,033		1,294		2,831		—			13,158

Total cost of revenues		12,704		2,508		3,956		2,161			21,329
Operating expenses		15,947		7,718		2,443		17,680			43,788

Total expenses		28,651		10,226		6,399		19,841			65,117

Segment operating income (loss)	$	18,728	$	6,196	$	6,592	$	(19,841	)	$	11,675

Accounts receivable, net	$	38,003	$	19,892	$	15,255	$	—		$	73,150

Property and equipment, net	$	26,211	$	1,602	$	5,222	$	—		$	33,035

As of or for the three months ended March 31, 2004
Revenues from external customers:
Product licenses and sales	$	16,979	$	7,129	$	4,677	$	—		$	28,785
Subscriptions		22,784		6,591		3,467		—			32,842
Professional services		3,174		889		1,374		—			5,437

Total revenue		42,937		14,609		9,518		—			67,064
Cost of revenues:
Product licenses and sales		2,476		851		781		440			4,548
Amortization of acquired technology		—		—		—		1,619			1,619
Subscriptions and professional services		7,812		1,261		2,600		—			11,673

Total cost of revenues		10,288		2,112		3,381		2,059			17,840
Operating expenses		15,423		6,995		1,936		17,217			41,571

Total expenses		25,711		9,107		5,317		19,276			59,411

Segment operating income (loss)	$	17,226	$	5,502	$	4,201	$	(19,276	)	$	7,653

Accounts receivable, net	$	39,790	$	13,305	$	12,206	$	—		$	65,301

Property and equipment, net	$	31,998	$	1,807	$	6,216	$	—		$	40,021

Note 7. Commitments and Contingencies

Our sales agreements with customers generally contain infringement indemnity provisions. We have not previously incurred costs to settle claims or pay awards under these indemnification obligations. As a result, we believe the estimated fair value of these obligations is nominal. Accordingly, we have no liabilities recorded for these agreements as of March 31, 2005. In addition, we warrant that our software products will perform in all material respects in accordance with our standard published specifications in effect at the time of delivery of the licensed products to the customer for ninety days. We also warrant that for one year after shipment, all hardware will be free from defects in materials and workmanship under normal authorized use, consistent with the instructions contained in the product documentation. Additionally, we warrant that our services will be performed consistent with generally accepted industry standards or specific service levels through completion of the agreed upon services. We have not incurred significant recurring expense under our product or service warranties and hardware warranties are covered by the manufacturer warranties. As a result, we believe the estimated fair value of these agreements is nominal. Accordingly, we have no liabilities recorded for these agreements as of March 31, 2005.

Payments for certain operating leases for our office space are secured by four collateralized standby letters of credit totaling $8.8 million at March 31, 2005. These standby letters of credit guarantee payments on certain lease obligations and are renewed annually unless cancelled by either party. The lease obligations have terms that expire at various dates through 2013. The beneficiary of the standby letters of credit can draw on the letters of credit if we default on the related lease obligation. Each standby letter of credit is collateralized by securities. At March 31, 2005, $10.3 million of commercial paper investments are pledged as collateral and are shown on the balance sheet as restricted cash and marketable securities.

On August 17, 2004, the Company’s Georgia operating subsidiary filed in the United States District Court for the Northern District of Georgia a declaratory judgment action (the “Georgia Action”) against SRI International, Inc. (“SRI”). The action seeks the court’s declaration that our products and services do not infringe any valid claim of five patents held by SRI and seeks declaration that certain claims of those patents are invalid. SRI filed a motion to dismiss the action, which we opposed. On August 26, 2004, SRI filed in the United States District Court for Delaware a complaint against the Company and Symantec Corporation (the “Delaware Action”). The complaint in the Delaware Action alleges that our SiteProtector and Proventia products infringe upon claims of two of the five patents at issue in the Georgia Action. The Delaware Action seeks unspecified damages and injunctive relief. The Company filed a motion to dismiss the Delaware Action, which SRI opposed. On April 13, 2005, the Company’s motion was denied, without prejudice, with the opportunity to re-file it after discovery and clarification of the distinction between our Delaware parent company and our Georgia operating company. On or about April 25, 2005, SRI filed an amended complaint adding the Company’s Georgia operating subsidiary as a separate defendant to the Delaware Action. The Company and its subsidiary have not yet responded to the amended complaint and discovery in the Delaware Action has not yet opened. We intend to defend the Delaware Action vigorously and believe we have meritorious defenses.

Note 8. Recently Issued Accounting Standards

On December 16, 2004, the Financial Accounting Standards Board issued SFAS Statement No. 123 (revised 2004) (SFAS 123R), Share-Based Payment, which is a revision of SFAS Statement No. 123, Accounting for Stock-Based Compensation. SFAS No. 123R supersedes APB Opinion No. 25, Accounting for Stock Issued to Employees. Statement 123R requires all share-based payments to employees, including grants of employee stock options, to be recognized in the financial statements based on their fair values (i.e., pro forma disclosure is no longer an alternative to financial statement recognition). On April 14, 2005, the Securities and Exchange Commission adopted a new rule, Staff Accounting Bulletin (“SAB”) No. 107, amending the effective date for SFAS 123R. Under the effective date provisions included in SFAS 123R, the Company would be required to implement SFAS 123R as of the first interim or annual period beginning after June 15, 2005. SAB No. 107 allows the Company to implement SFAS 123R at the beginning of the next fiscal year that begins after June 15, 2005. SAB No.107 affects none of the accounting provisions of SFAS 123R. While the proforma information under SFAS 123 indicates that expensing of stock options will have a material impact on the Company’s financial results, the specific impact of SFAS 123R is not known as the Company is currently evaluating valuation and transition methods permitted under SFAS 123R and it is also dependent on future stock option activity.

Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations

The following Management’s Discussion and Analysis of Financial Condition and Results of Operations should be read in conjunction with the Consolidated Financial Statements and related Notes thereto included elsewhere in this Form 10-Q.

Except for the historical financial information, many of the matters discussed in this Form 10Q may be considered “forward-looking” statements. Forward-looking statements can be identified by the use of words such as “may,” “will,” “should,” “could,” “continue,” “future,” “potential,” “believe,” “project,” “plan,” “intend,” “seek,” “estimate,” “predict”, “expect”, “anticipate” and similar expressions, or the negative of such terms, or other comparable terminology. Forward-looking statements also include the assumptions underlying or relating to any of the foregoing statements. Such forward-looking statements are not guarantees of future performance and involve a number of risks and uncertainties. Our actual results could differ materially from those anticipated in these forward-looking statements as a result of various factors, including those set forth below under the caption “Risk Factors” and those otherwise described from time to time in our Securities and Exchange Commission reports filed after this Form 10-Q. All forward-looking statements included in this Form 10-Q are based on information available to us on the date hereof. We assume no obligation (except where required by law) to update any forward-looking statements for any events or circumstances occurring after the date of this Form 10-Q.

In this Form 10-Q, the words “Internet Security Systems,” “ISS,” “the Company,” “we,” “our,” “ours,” and “us” refer to Internet Security Systems, Inc., and its subsidiaries.

Internet Security Systems and SiteProtector are trademarks and service marks, and the Internet Security Systems logo, X-Force, Proventia and RealSecure are registered trademarks and service marks, of Internet Security Systems, Inc.

Overview

We focus on providing enterprise-wide pre-emptive protection. We provide such protection with our comprehensive line of products and services. These include ISS’ SiteProtector centralized management system; a product family consisting of network and host intrusion prevention, integrated security appliances, desktop protection and vulnerability protection; and ISS’ Managed Security Services and Professional Security Services. The integrated security appliance includes, in addition to intrusion prevention, firewall, virtual private network, anti-virus protection, content filtering and e-mail security, including anti-spam.

This combination of products and services forms our Proventia Enterprise Security Platform (“ESP”), which contributes to business process optimization by maintaining a delicate balance between IT-performance, availability and risk — ultimately stopping cyber threats before they impact operations. Unlike traditional approaches to security, which focus on improving reaction times, Proventia ESP is designed to avoid security incidents by combining continuous vulnerability assessment and threat prevention with enterprise-wide information management and reporting capabilities. Our objective is to enable companies to shield security vulnerabilities across their entire IT infrastructure — before attacks are released.

We currently plan to continue to evolve the Proventia Enterprise Security Platform by further automating enterprise security policy and delivering it within the context of existing IT processes.

Our managed services offerings currently provide remote management of our best-of-breed security technology, focusing on security assessment and intrusion detection, intrusion prevention and desktop protection systems, and include firewalls, VPNs, anti-virus and URL filtering software. We focus on serving as the trusted security provider to our customers by maintaining within our existing products the latest counter-measures to security risks, creating new innovative products based on our customers’ needs and providing professional and managed services.

Many factors will affect our future financial performance, especially our ability to differentiate our offerings from competitors that include much larger companies with greater marketing capabilities, financial resources and brand recognition. In order to continue to create such differentiation, we expect to continue to expand our domestic and international sales and marketing operations, seek acquisition candidates and alliances with partners whose products, technologies or services capabilities are complementary to our solutions; and improve our internal operating and financial infrastructure in support of our strategic goals and objectives. At the same time, we expect to adjust our organization size in light of changing economic conditions and maintain emphasis on controlling discretionary spending and capital expenditures. While we believe in the long-term success of our business solutions, our prospects must be considered in light of the recent experience, risks and difficulties that are frequently encountered by companies serving rapidly evolving markets. See “Risk Factors”.

Critical Accounting Policies

The consolidated financial statements were prepared in conformity with U.S. generally accepted accounting principles (“GAAP”). As such, management is required to make certain estimates, judgments and assumptions it believes are reasonable based upon the information available. These estimates and assumptions affect the reported amounts of assets and liabilities at the date of the financial statements and the reported amounts of revenues and expenses during the periods presented. The significant accounting policies which

management believes are the most critical to aid in fully understanding and evaluating our reported financial results include the following:

Revenue recognition

We recognize revenue in the following categories:

•

Product licenses and sales, which include revenue from sales of perpetual software licenses and products;

•

Subscription revenues, which include product support and content updates, term licenses, subscription licenses and managed service arrangements; and

•

Professional services revenues, which includes fee-based service engagements and training.

We recognize software license revenue under Statement of Position (“SOP”) 97-2, Software Revenue Recognition, as modified by SOP 98-9, Software Revenue Recognition with Respect to Certain Transactions, when the following criteria have been met:

•

persuasive evidence of an arrangement exists;

•

delivery has occurred or services have been rendered;

•

price is fixed or determinable; and

•

collection is probable.

Product licenses and sales

We recognize perpetual software license revenues, assuming all other revenue recognition criteria are met, upon (1) delivery of the software and (2) issuance of the related license, assuming that no significant vendor obligations or customer acceptance rights exist. Where payment terms are extended over periods greater than twelve months, revenue is recognized as such amounts become due and payable. Revenue is also deferred when payment terms are extended for periods less than twelve months and such sales are deemed either not to be fixed or determinable or collection is not probable based on evaluation of all terms of the transaction.

Product sales consist primarily of appliances sold in conjunction with ISS licensed software. These sales are recognized upon shipment to the customer provided all other revenue recognition criteria for software license revenue recognition are met.

Sales of products are generated both through direct sales to end-users as well as through various partners, including system integrators, value-added resellers and distributors. Revenue from product licenses and sales is recognized when the sale has occurred for an identified end user, provided all other revenue recognition criteria are met. We offer evaluation software available via download from our website and evaluation units for appliance-based products that allow potential customers to see the functionality of the products on their own networks prior to purchase. At the point of delivery, the customer has no right of return.

Subscription revenues

Subscription revenues consist of renewable customer support, term licenses and security monitoring and management services. Renewable customer support is a separate component of product licenses and sales. Term licenses allow customers to use our products and receive product support coverage and content updates for a specified period, generally twelve months. We generally invoice for customer support and term licenses at the beginning of the term and recognize revenue ratably over the subscription term. Security monitoring and management services for information assets and systems are part of managed services and associated revenues are recognized and billed as such services are provided.

Historically, our software and intrusion prevention appliance sales have been accounted for primarily as revenue at the time of sale, with customer support generally representing between 20% and 30% of the related license or product amount. The majority of the initial price paid by the customer for certain Proventia integrated security appliance models currently is for selected content blades, which customers acquire for a specified term that is recognized over such term as subscription revenue. During the second quarter of 2005, we are changing the pricing model for our Proventia integrated security appliances to our historical model. Under this model customers acquire the appliance and most content blades, which are recorded as product revenue at the time of sale, and pay annual customer support fees at an average rate of 22% of the product price.

Professional services revenues

Service engagements are typically billed on either a fixed fee or time-and-materials basis and primarily consist of security assessments of customer networks and the development of customers’ security policies. These offerings are intended to support our goal of providing products and managed services. We prefer to have our partners provide these services where practical. We recognize such professional services revenues as the related services are rendered.

Multiple elements arrangements

Our sales of product and/or software licenses are multiple element arrangements that include product support and content updates and may include other subscription or professional services delivered after the product or software license. Revenue is generally recognizable before delivery of every element of the arrangement when all of the following requirements exist:

•

vendor specific objective evidence (“VSOE”) of fair value exists for the undelivered elements;

•

the functionality of the delivered elements is not dependent on the undelivered elements; and

•

delivery of the delivered elements represents the culmination of the earnings process.

We recognize the difference between the total arrangement fee and the amount deferred for the undelivered elements as product and license revenues. We allocate revenue to the delivered products and licenses using the residual method. Under the residual method, we allocate discounts inherent in the arrangement to products and customer support associated with products that are initially delivered and recognize the other elements as they are delivered based on the VSOE, which is determined based on transactions where the company sells those elements separately. We determine fair value of the undelivered elements based on historical evidence of our stand-alone sales of these elements to third parties.

Allowance for doubtful accounts

Our sales are global, with customers located in the Americas, EMEA, and Asia/ Pacific regions. We perform periodic credit evaluations of our customer’s financial condition and do not require collateral. We provide for estimated credit losses as such losses become probable. We evaluate specific accounts when we become aware of a situation where a customer may not be able to meet its financial obligations due to deterioration of its liquidity or financial viability, credit ratings or bankruptcy. The allowance for doubtful accounts is established based on the best facts available to us and is reevaluated and adjusted as additional information is received. At March 31, 2005, the allowance for doubtful accounts totaled $3.2 million, or 4.2% of the $76.3 million of total trade receivables. This 4.2% allowance of receivables reflects our practice to leave accounts on our general ledger and provide reserves pending final resolution of collectibility rather than to write-off such accounts. Our bad debt expense for the quarter ended March 31, 2005 amounted to $145,000 compared to $289,000 in the corresponding period of 2004.

We continued to monitor the Asia situation that contributed to a higher bad debt expense level in 2002. In January 2004, a new distributor for China assumed the rights and the obligations of the distribution agreement for ISS products from the old distributor. In connection with this agreement, we modified the new distributor’s obligations, which resulted in an additional $200,000 of bad debt expense recorded in the fourth quarter of 2003 and the write-off of $1.1 million against the allowance account. We established a firm repayment schedule and received timely payments under this schedule, which resulted in full payment of the receivable as of March 31, 2005.

While actual credit losses have historically been within management’s expectations and the provisions established, we cannot guarantee that we will continue to experience the same credit loss rates we have in the past. If the financial condition of our customers were to deteriorate, resulting in an impairment of their ability to make payments, additional allowances may be required.

Impairment of goodwill and other long-lived and intangible assets

We review goodwill for impairment on an annual basis or on an interim basis whenever events or changes in circumstances indicate that the carrying amount of an asset may not be recoverable. All other long-lived and intangible assets are reviewed for impairment whenever events or circumstances indicate that the carrying amount of an asset may not be recoverable. Such impairment loss would be measured as the difference between the carrying amount of the asset and its fair value based on the present value of estimated future cash flows. Significant judgment is required in the forecasting of future operating results, which are used in the preparation of projected cash flows. Due to uncertain market conditions and potential changes in our strategy and products, it is possible that forecasts used to support our intangible assets may change in the future, which could result in significant non-cash charges that would adversely affect our results of operations.

We currently have goodwill and other acquisition related intangibles, net of accumulated amortization, of approximately $241 million, with $195 million of goodwill related to our June 2001 acquisition of Network ICE Corporation (“Network ICE”) and approximately $22 million of goodwill related to the January 2004 acquisition of Cobion, a privately held company based in Kassel,

Germany (“Cobion”). The determination of whether or not goodwill is impaired involves significant judgments based upon short and long-term projections of future performance. We have concluded that this amount is realizable based on forecasted discounted cash flows through 2008 and on our stock market valuation. Neither method indicated that our goodwill had been impaired and, as a result, we did not record any impairment losses related to goodwill during the quarter ended March 31, 2005. Other intangibles of approximately $17 million are principally acquired technology from the Network ICE and Cobion acquisitions that are components in our current product offerings.

Recently Issued Accounting Standards

On December 16, 2004, the Financial Accounting Standards Board issued SFAS Statement No. 123 (revised 2004) (SFAS 123R), Share-Based Payment, which is a revision of SFAS Statement No. 123, Accounting for Stock-Based Compensation. SFAS No. 123R supersedes APB Opinion No. 25, Accounting for Stock Issued to Employees. Statement 123R requires all share-based payments to employees, including grants of employee stock options, to be recognized in the financial statements based on their fair values (i.e., pro forma disclosure is no longer an alternative to financial statement recognition). On April 14, 2005, the Securities and Exchange Commission adopted a new rule, Staff Accounting Bulletin (“SAB”) No. 107, amending the effective date for SFAS 123R. Under the effective date provisions included in SFAS 123R, the Company would be required to implement SFAS 123R as of the first interim or annual period beginning after June 15, 2005. SAB No. 107 allows the Company to implement SFAS 123R at the beginning of the next fiscal year that begins after June 15, 2005. SAB No.107 affects none of the accounting provisions of SFAS 123R. While the pro forma information under SFAS 123 in Note 1 to the financial statements indicates that expensing of stock options will have a material impact on the Company’s financial results, the specific impact of SFAS 123R is not known as the Company is currently evaluating valuation and transition methods permitted under SFAS 123R and it is also dependent on future stock option activity.

Results of Operations

The following table sets forth our consolidated historical operating information, as a percentage of total revenues, for the periods indicated:


	Three months ended March 31,
	2005		2004
Consolidated Statements of Operations Data:
Product licenses and sales	42	%	43	%
Subscriptions	51	%	49	%
Professional services	7	%	8	%

Total revenues	100	%	100	%

Cost of revenues:
Product licenses and sales	8	%	7	%
Amortization of acquired technology	3	%	3	%
Subscriptions and professional services	17	%	17	%

Total cost of revenues	28	%	27	%
Research and development	13	%	16	%
Sales and marketing	34	%	37	%
General and administrative	10	%	9	%
Amortization of intangibles and stock-based compensation	—	%	—	%

Total costs and expenses	85	%	89	%

Operating income	15	%	11	%

Revenues

Product licenses and sales

The Proventia family of network protection appliances provides unified, multi-function protection capabilities designed to identify and prevent many forms of attack with minimal user intervention. These products are designed to operate in demanding network environments while being easy to deploy, easy to use and centrally managed, all in an effort to make our solution more cost-effective.

Product licenses and sales in the three months ended March 31, 2005 increased by 12% compared with the three months ended March 31, 2004 due to continued positive market response to our Proventia line. Proventia grew from 49% of product license and sales in the first quarter of 2004 to 64% of product license and sales revenues in the first quarter of 2005. This revenue category decreased slightly to 42% of total revenues in the first quarter of 2005 compared to 43% in the corresponding period of 2004 due to the higher growth rate of subscription revenues.

Our future growth is dependent on a continuation of the positive market response to our Proventia family of products. In the first quarter of 2005 we extended Proventia to our PC desktop and laptop solutions, which were delivered as a software offering. We also expect to extend Proventia to our server solutions in the future. Our present product roadmap also focuses on product offerings and enhancements that will continue to improve central control and manageability, easier deployment and more refined information as well as broader Proventia appliance offerings. We expect that this focus will continue to make our products more cost effective to implement and maintain the goal of increasing the future level of product licenses and sales. Such sales represent not only product and license revenues, but also subscription revenues from customer support.

Subscriptions

Subscription revenues consist of customer support revenues, which include product and technical support and content updates, security-monitoring fees for managed services offerings, and term licenses of products. Subscriptions revenue represented 51% of total revenues in the three months ended March 31, 2005 and 49% of total revenues the three months ended March 31, 2004. This increase from $32.8 million in the first quarter of 2004 to $38.8 million in the first quarter of 2005 represents growth of 18%.

The largest component of subscription revenues, customer support, increased to 33% of total revenues in the first quarter of 2005 from 31% of total revenues in the corresponding period of 2004. It includes hardware support of our Proventia appliances, software updates and software blades, technical support and security content that includes advisory updates from X-Force, our internal team of security experts. Customer support is provided through contracts executed with customers for a specified term and billed at the time of contract. Such billings are recorded as deferred revenues on our balance sheet and amortized as subscriptions revenue over the term of the contract. We expect customer support revenues to increase in the future as our client base that generates such support revenues expands.

Managed services revenues increased to 14% of total revenues in the three months ended March 31, 2005, as compared with 13% in the three months ended March 31, 2004. We believe these increases were due to a strong demand in the market for proven, financially sound, managed security service providers. We are marketing managed services both directly to end users and through partners, including a number of new arrangements with integrators and service providers that include managed services as a part of their service offerings to their customers. We also expect sales of managed services to continue to grow steadily as we focus our efforts on marketing offerings to new and existing customers that meet changing needs in today’s environment.

Professional services

Professional services revenue increased in absolute dollars from $5.4 million in the three months ended March 31, 2004 to $5.7 million in the three months ended March 31, 2005, representing 5% growth. Professional services revenues declined to 7% of total revenues in 2005 from 8% in 2004. We continue to focus on high-value offerings that utilize our X-Force expertise, and look to our system integration and channel partners to serve as the primary resource to fulfill the services and education needs of our customers.

Geographic regions

Geographically, we derived the majority of our revenues from sales to customers within the Americas region. Revenues by region represented the following percentages of total revenues for the periods indicated:

While there have been changes in the proportion of revenues generated by each region, all of the regions experienced growth in revenues in 2005. The financial data for each segment can be found in Note 6 to the Consolidated Financial Statements.

Costs and Expenses

Personnel

Personnel and related costs represent our largest expense category. Our headcount remained relatively constant in the first quarter of 2005 at approximately 1,200 employees.

Cost of product licenses and sales

Cost of product licenses and sales consists of several components. The substantial portion of our cost of product licenses and sales represents the hardware cost of our Proventia appliances. It also includes development source code that we licensed at the beginning of 2004, which is being amortized over its estimated useful life of four years. Costs associated with licensing our software products are minor. As a percentage of product licenses and sales revenues, these costs increased from 16% in the first quarter of 2004 to 20% in the first quarter of 2005. The increase in costs is attributable to the 45% increase in Proventia appliance revenues in the 2005 period.

We also incurred $1.8 million in the three months ended March 31, 2005 and $1.7 million in the three months ended March 31, 2004 of amortization expense related to core and developed technology that was recorded as a result of acquisitions accounted for under the purchase method of accounting.

Cost of subscriptions and professional services

Cost of subscriptions and professional services includes the cost of our technical support personnel who provide assistance to customers under product support agreements, the security operations center (“SOC”) costs of providing managed security monitoring services and the costs related to our professional services and training. These costs were $13.2 million in the three months ended March 31, 2005 and $11.7 million in the three months ended March 31, 2004. Costs associated with our technical support personnel and our SOC’s increased the first quarter of 2005 compared to the same period of 2004 as we added personnel and equipment to handle additional customers. These costs were 30% of subscription and professional services revenues in both the three months ended March 31, 2005 and 2004.

Research and development

Research and development expenses consist of salary and related costs of research and development personnel, including costs for employee benefits, and depreciation on computer equipment. These costs include those associated with maintaining and expanding the X-Force, our internal team of security experts. We believe our primary research and product development and managed service offerings are important to retaining our leadership position in the market.

We continue to add functionality to our product family, providing gateway, network, server and desktop-based solutions, as well as to our vulnerability assessment and security management applications. These improvements, as well as new offerings, are intended to provide our customers with more powerful and easier-to-use solutions for security management across the enterprise. Examples of product introductions in the first three months of 2005 include the following:

•

Proventia Desktop: This product adds two significant new features to our existing RealSecure Desktop product: Virus Prevention System (“VPS”) and Buffer Overflow Exploit Prevention (“BOEP”). VPS uses a patent-pending behavioral analysis method to stop known and unknown viruses, Trojans and worms. BOEP prevents hackers from taking advantage of frequently discovered buffer overflow vulnerabilities and running malicious code on the desktop.

•

Proventia G400 and G2000: These intrusion prevention appliances offer the flexibility of either 400 megabit or 2 gigabit throughput, and enhanced management features such as spy-ware blocking, improved policy management and high-availability.

Research and development expenses decreased in absolute dollars from $10.8 million in the three months ended March 31, 2004 to $10.3 million in the three months ended March 31, 2005, and decreased from 16% to 13% of total revenues for these periods. The decrease is primarily as a result of our continued efforts to streamline operations as we relocated some engineering functions from our California development facility to Atlanta and offshore and completed the closure of our Sydney engineering facility.

While we are committed to continue our investment in X-Force research and development capabilities, which we believe distinguishes ISS from its competitors, we intend to seek leverage in future periods in the research and development area while enhancing current technologies and developing new technologies.

Sales and marketing

Sales and marketing expenses consist of salaries, travel expenses, commissions, advertising, maintenance of our website, trade show expenses, costs of recruiting sales and marketing personnel and costs of marketing materials.

Sales and marketing expenses increased in absolute dollars from $24.4 million in the first three months of 2004 to $26.1 million in the first three months of 2005, but decreased as a percentage of total revenues from 37% to 34%. We added quota-carrying headcount and had higher variable commission expense associated with higher product license and sales revenues, but gained leverage from our sales force as we continue to increase the percentage of sales fulfilled through the channel.

We expect to continue to achieve leverage in our sales efforts by focusing our direct sales force on large customers that are served either directly by us or through large systems integrators. Our channel, which includes systems integrators, value-added resellers and distributors, will continue to be of increasing importance to us, measured quantitatively by an increasing level of product revenue originating through the channel. The channel represented approximately 77% of our sales in the first quarter of 2005 as compared to 55% in 2004. We intend to use its capabilities to reach larger customers through joint selling efforts and to reach departmental and small companies.

General and administrative

General and administrative expenses consist of personnel-related costs for executive, administrative, finance and human resources, internal information systems and other support services costs, and legal, accounting and other professional service fees. General and administrative expenses of $7.3 million in the three months ended March 31, 2005 and $6.3 million in the three months ended March 31, 2004 represented approximately 10% of our total revenues in 2005 and 9% in 2004.

The largest increase was approximately $525,000 for internal and external resources to assist in the design and execution of control testing related to financial control compliance work required by Sarbanes Oxley Act Section 404 and related audit costs.

Interest income

Interest income increased from $528,000 in the quarter ended March 31, 2004 to $1.1 million in the comparable quarter of 2005 due to an increase in the yield on investment-quality commercial paper and similar investments from approximately 1.2% in the first quarter of 2004 to approximately 2.5% during the first quarter of 2005.

Other income (expense), net

Other income (expense) consisted of minority interest expense of $127,000 in 2004 and $10,000 in 2005 and foreign currency exchange gain in 2004 of $77,000 and a loss of $535,000 in 2005. The foreign currency loss was primarily due to the change in the Euro in the first quarter of 2005.

Gain on issuance of subsidiary shares

The gain on issuance of subsidiary shares resulted from our Asia/Pacific subsidiary issuing shares related to the exercise of ISS KK stock options. In 2005 ISS KK issued 154 shares at an average exercise price of approximately $760 per share. Our ownership percentage of the subsidiary remained at 87% at March 31, 2005. Deferred income taxes have been provided in the period in which the gain is recognized.

Provision for income taxes

Our effective tax rate was approximately 36% for the three months ended March 31, 2005 and 36.25% for the three months ended March 31, 2004. The effective rates differ from the Federal statutory rate due primarily to certain operating expenses that are not deductible for income tax purposes, state income taxes, foreign operations taxed at different rates and Federal tax credits

Liquidity and Capital Resources

Our financial position remained strong through the first three months of 2005. Our cash and cash equivalents and marketable security investments were $214.3 million at March 31, 2005. Our investments in marketable securities consisted solely of highly rated debt obligations with maturities of twelve months or less.

We continue to meet our working capital needs and capital equipment needs with cash provided by operations. Cash provided by operations in the first three months of 2005 totaled $13.5 million. The major components of cash flows provided by operating activities were net income of $7.8 million, non-cash depreciation and amortization expense charges of $4.5 million, non-cash deferred compensation expense of $573,000, and a decrease in accounts receivable of $2.2 million. Also included in cash flow from operations was $0.3 million of income tax benefit from exercise of stock options, which will be classified as a financing activity with the expected adoption in calendar 2006 of Statement 123R, Share Based Payments, issued by the Financial Accounting Standards Board.

An important element of our liquidity is the collection of our accounts receivable. We measure our accounts receivable management by our day’s sales outstanding (“DSO”). This is a measurement of accounts receivable divided by billings in the quarter, represented by the sum of revenues plus the change in the deferred revenues liability account balance. This measurement was 86 days at March 31, 2005, slightly above our target range of 75 to 85 days.

Our net cash provided by investing activities was $29.2 million in the first three months of 2005. Investing activities included changes in our marketable securities that have quality characteristics similar to cash equivalents, except their maturities when we acquire them are longer than three months. The cash flow statement included the purchase of $35.1 million of intermediate term marketable securities, primarily interest-bearing government obligations and commercial paper, offset by net proceeds from the maturity of marketable securities of $66.1 million. Also included in cash flow from operations was $0.3 million of income tax benefit from exercise of stock options, which will be classified as a financing activity with the expected adoption in calendar 2006 of Statement 123R, Share Based Payments, issued by the Financial Accounting Standards Board.

Our financing activities used $6.6 million of cash in the first three months of 2005. This was principally due to the repurchase of 443,000 shares of our common stock in the open market at an aggregate cost of $9.2 million. The original stock repurchase plan expired in July 2004 and a new repurchase program to repurchase up to $50 million of our common stock through July 2005 was authorized by the Board of Directors in July 2004. Since the inception of the stock repurchase plans, we have purchased 5.3 million shares at an average cost of $15.77 per share for a total cash outlay of approximately $83.6 million. We can purchase up to an additional $14 million under the current program. Also, in the first three months of 2005, the exercise of stock options by our employees and the issuance of common stock through our employee stock purchase plan generated funds of approximately $2.6 million.

We believe our cash and cash equivalents and marketable securities will be sufficient to meet our working capital needs and capital

expenditures for the foreseeable future. Furthermore, we are not aware of any trends, events, or uncertainties that are reasonably likely to result in any significant change to our liquidity. From time to time, we evaluate possible acquisition and investment opportunities in businesses, products or technologies that are complementary to ours. In the event we determine to pursue such opportunities, we may use our available cash and cash equivalents and marketable securities for this purpose.

Off-Balance Sheet Arrangements

Payments for certain of our operating leases are secured by four collateralized stand-by letters of credit totaling approximately $8.8 million at March 31, 2005. These stand-by letters of credit guarantee our payment obligations on the leases and are renewable annually over the duration of the applicable leases. If we default on the lease payments, the landlords can make a claim against the letters of credit. We, in turn, would be liable to the letter of credit issuers. Our stand-by letters of credit are collateralized by securities worth $10.3 million at March 31, 2005. Other than these non-cancelable operating leases, we have no off-balance sheet financing arrangements, any relationships with “structured finance” or “special purpose” entities, or any contractual obligations with unconsolidated entities that are reasonably likely to impact our liquidity.

Risk Factors

There are many factors that affect ISS’ business and the results of its operations, some of which are beyond ISS’ control. The following is a description of some of the important factors that may cause the actual results of ISS’ operations in future periods to differ materially from those currently expected or desired. We encourage you to read this section carefully.

We Operate in a Rapidly Evolving Market

We operate in a rapidly evolving market and must, among other things:

•

respond to competitive developments;

•

continue to upgrade and expand our product and services offerings; and

•

continue to attract, retain and motivate our employees.

We cannot be certain that we will successfully address these issues. As a result, we cannot assure our investors that we will be able to continue to operate profitably in the future.

We introduced our Proventia appliance line in April 2003 that includes intrusion prevention and integrated security protection. While market response to these products has had a positive impact on our operating results, failure to continue to gain further market acceptance could result in revenues below our expectations and our operating results could be adversely affected.

Our Future Operating Results Will Likely Fluctuate Significantly

We cannot predict our future revenues and operating results with certainty. However, we do expect our future revenues and operating results to fluctuate due to a combination of factors, including:

•

the extent to which the public perceives that unauthorized access to and use of online information are threats to network security;

•

customer budgets;

•

the mix of product sales among the various products offered by ISS and whether revenue is recognized upon sale or deferred to subsequent periods;

•

the volume and timing of orders, including seasonal trends in customer purchasing;

•

our ability to develop new and enhanced product and managed service offerings;

•

the introduction and acceptance rate of ISS branded appliances, including increased cost of goods sold;

•

our ability to accurately forecast and produce demanded quantities of our appliance products and models;

•

availability of component parts of appliance products and reliance on contract manufacturers to produce such products;

•

our ability to provide scalable managed services offerings in a cost effective manner;

•

foreign currency exchange rates that affect our international operations;

•

product and price competition in our markets; and

•

general economic conditions, both domestically and in our foreign markets.

We focus our efforts on sales of enterprise-wide security solutions, which consist of our entire product suite and related professional services, and managed security services, rather than on the sale of component products. As a result, each sale requires substantial time and effort from our sales and support staff. In addition, the revenues associated with particular sales vary significantly depending on the number of products acquired by a customer, the number of devices used by the customer and the customer’s relative need for our professional services. Large individual sales, or even small delays in customer orders, can cause significant variation in our license revenues and results of operations for a particular period. The timing of large orders is usually difficult to predict and, like many software-based technology companies, many of our customers typically complete transactions in the last month of a quarter.

We cannot predict our operating expenses based on our past results. Instead, we establish our spending levels based in large part on our expected future revenues. As a result, if our actual revenues in any future period fall below our expectations, our operating results likely will be adversely affected because very few of our expenses vary with our revenues. Because of the factors listed above, we believe that our quarterly and annual revenues, expenses and operating results likely will vary significantly in the future.

Our ability to provide timely guidance and meet the expectations of investors with respect to our operating and financial results is affected by the tendency of a majority of our product and license sales to be completed in the last month of a quarter. We may not be able to determine whether we will experience material deviations from guidance or expectations until the end of a quarter.

Dependence on Third Party Suppliers and Manufacturers

We carry little inventory of our appliance products and we rely on suppliers to deliver necessary components to our contract manufacturers in a timely manner based on the forecasts we provide. We currently purchase some Proventia appliance components and contract manufacturing services from single or limited sources. If shortages occur, supplies are interrupted, or we underestimate demand for models, we may not be able to deliver products to our customers and our revenue and operating results would be adversely affected. Because our supply of hardware is based on short-term forecasts and purchase orders, our contract manufacturers are not obligated to purchase components for greater quantities over longer periods. We provide forecasts of our demand to our contract manufacturers. If we overestimate our requirements, our contract manufacturers may have excess inventory, which could increase our costs. If we underestimate our requirements, our contract manufacturers may have an inadequate component inventory and, based on lead times, this could interrupt manufacturing and result in delays in shipments and revenues.

We Face Intense Competition in Our Market

The market for network security monitoring, detection, prevention and response solutions is intensely competitive, and we expect competition to increase in the future. We cannot guarantee that we will compete successfully against our current or potential competitors, especially those with significantly greater financial resources or brand name recognition. Our chief competitors generally fall within the following categories:

•

large companies, including Symantec Corp., Cisco Systems, Inc., Juniper Networks, Inc., and McAfee, Inc., that sell competitive products and offerings, as well as other large software companies that have the technical capability and resources to develop competitive products;

•

software or hardware network infrastructure companies like Cisco Systems, Inc. and Juniper Networks, Inc. that could integrate features that are similar to our products into their own products;

•

smaller software companies offering relatively limited applications for network and Internet security; and

•

small and large companies with competitive offerings to components of our managed services offerings.

Mergers or consolidations among these competitors, or acquisitions of small competitors by larger companies, represent risks. For example, Symantec Corp., Cisco Systems, Inc., McAfee, Inc., and Juniper Networks, Inc. have acquired during the past several years smaller companies, which have intrusion detection or prevention technologies. These acquisitions will make these entities potentially more formidable competitors to us if such products and offerings are effectively integrated. Large companies may have advantages over us because of their longer operating histories, greater name recognition, larger customer bases or greater financial, technical and marketing resources. As a result, they may be able to adapt more quickly to new or emerging technologies and changes in customer requirements. They can also devote greater resources to the promotion and sale of their products than we can. In addition, these companies have reduced and could continue to reduce, the price of their security monitoring, detection, prevention and response products and managed security services, which increases pricing pressures within our market.

Several companies currently sell software products (such as encryption, firewall, operating system security and virus detection software) that our customers and potential customers have broadly adopted. Some of these companies sell products that perform the same functions as some of our products. In addition, the vendors of operating system software or networking hardware may enhance their products to include the same kinds of functions that our products currently provide. The widespread inclusion of comparable features to our software in operating system software or networking hardware could render our products less competitive or obsolete, particularly if such features are of a high quality. Even if security functions integrated into operating system software or networking hardware are more limited than those of our products, a significant number of customers may accept more limited functionality to avoid purchasing additional products.

In addition, with the introduction of our Proventia integrated security appliance, we have offerings that compete with vendors of firewalls, VPNs, anti-virus systems, and content and spam filtering products. These offerings are competitive with a broader spectrum of network security companies, as well as those that also offer integrated security appliances or broad product suites.

For the above reasons, we may not be able to compete successfully against our current and future competitors. Increased competition may result in price reductions, reduced gross margins and loss of market share.

We Face Rapid Technological Change in Our Industry and Frequent Introductions of New Products

Rapid changes in technology pose significant risks to us. We do not control nor can we influence the forces behind these changes, which include:

•

the extent to which businesses and others seek to establish more secure networks;

•

the extent to which hackers and others seek to compromise secure systems;

•

evolving computer hardware and software standards;

•

changing customer requirements; and

•

frequent introductions of new products and product enhancements.

To remain successful, we must continue to change, adapt and improve our products in response to these and other changes in technology. Our future success hinges on our ability to both continue to enhance our current line of products and professional services and to introduce new products and services that address and respond to innovations in computer hacking, computer technology and customer requirements. We cannot be sure that we will successfully develop and market new products that do this. Any failure by us to timely develop and introduce new products, to enhance our current products or to expand our professional services capabilities in response to these changes could adversely affect our business, operating results and financial condition.

Our products involve very complex technology and, as a consequence, major new products and product enhancements require a long time to develop and test before going to market. Because this amount of time is difficult to estimate, we have had to delay the scheduled introduction of new and enhanced products in the past and may have to delay the introduction of new and enhanced products in the future.

The techniques computer hackers use to gain unauthorized access to, or to sabotage, networks and intranets are constantly evolving and increasingly sophisticated. Furthermore, because new hacking techniques are usually not recognized until used against one or more targets, we are unable to anticipate most new hacking techniques. To the extent that new hacking techniques harm our customers’ computer systems or businesses, affected or prospective customers may believe that our products are ineffective, which may cause them or prospective customers to reduce or avoid purchases of our products.

Undetected Product Errors or Defects Could Result in Loss of Revenues, Delayed Market Acceptance and Claims Against Us

We offer warranties on our products, allowing the end customer to have any defective product repaired, or to receive a replacement product for it during the warranty period, or in certain circumstances return the product for a refund. Our products may contain undetected errors or defects. If there is a broad product failure across our customer base, we may decide to replace all affected products or we may decide to refund the purchase price for defective units. Such defects and actions may adversely affect our ability to record revenue. Some errors are discovered only after a product has been installed and used by end customers. Any errors discovered after commercial release could result in loss of revenues and claims against us.

We offer warranties on our service levels for managed security services. If we do not meet warranties, the customer generally may obtain credits for service.

If we are unable to fix errors or other product problems that later are identified after full deployment, or if we fail to meet our service levels for managed security services, in addition to the consequences described above, we could experience:

•

failure to achieve market acceptance;

•

loss of customers;

•

loss of or delay in revenues and loss of market share;

•

diversion of development resources;

•

increased service and warranty costs;

•

legal actions by our customers; and

•

increased insurance costs.

Our Products are Complex and Are Operated in a Wide Variety of Computer Configurations, Which Could Result in Errors or Product Failures

Because we offer very complex products, undetected errors, failures or bugs may occur when they are first introduced or when new versions are released. Our products often are installed and used in large-scale computing environments with different operating systems, system management software and equipment and networking configurations, which may cause errors or failures in our products or may expose undetected errors, failures or bugs in our products. We discover errors, failures and bugs in certain of our product offerings after their introduction and have experienced delays and could experience lost revenues during the period required to correct these errors. Our customers’ computer environments are often characterized by a wide variety of standard and non-standard configurations that make pre-release testing for programming or compatibility errors very difficult and time-consuming. Despite testing, errors, failures or bugs may not be found in new products or releases until after commencement of commercial shipments. Errors, failures or bugs in products released by us could result in negative publicity, product returns, loss of or delay in market acceptance of our products or claims by customers or others.

In addition, if an actual or perceived breach of network security occurs in one of our end customer’s security systems, regardless of whether the breach is attributable to our products, the market perception of the effectiveness of our products could be harmed. Because the techniques used by computer hackers to access or sabotage networks change frequently and generally are not recognized until launched against a target, we may be unable to anticipate these techniques. Alleviating any of these problems could require significant expenditures of our capital and resources and could cause interruptions, delays or cessation of our product licensing, which could cause us to lose existing or potential customers and would adversely affect results of operations.

We Might Have to Defend Lawsuits or Pay Damages in Connection With Any Alleged or Actual Failure of Our Products and Services

Because our products and services provide and monitor network security and may protect valuable information, we could face claims for product liability, tort or breach of warranty. Anyone who circumvents our security measures could misappropriate the confidential information or other property of end customers using our products, or interrupt their operations. If that happens, affected end customers or others may sue us. In addition, we may face liability for breaches caused by faulty installation of our products by our service and support organizations. Provisions in our contracts relating to warranty disclaimers and liability limitations may be unenforceable. Some courts, for example, have found contractual limitations of liability in standard computer and software contracts to be unenforceable in some circumstances. Defending a lawsuit, regardless of its merit, could be costly and could divert management attention. Our business liability insurance coverage may be inadequate or future coverage may be unavailable on acceptable terms or at all.

Risks Associated with Our Global Operations

The expansion of our international operations includes our presence in dispersed locations throughout the world, including throughout EMEA and the Asia/ Pacific and Latin America regions. Our international presence and expansion exposes us to risks not present in our U.S. operations, such as:

•

the difficulty in managing an organization spread over various countries located across the world;

•

compliance with, and unexpected changes in, a wide range of complex regulatory requirements in countries where we do business;

•

duties and tariffs imposed on importation of our products in other jurisdictions where other manufacturers may not bear those same costs;

•

increased financial accounting and reporting burdens;

•

potentially adverse tax consequences;

•

fluctuations in foreign currency exchange rates resulting in losses or gains from transactions and expenses denominated in foreign currencies;

•

reduced protection for intellectual property rights in some countries;

•

reduced protection for enforcement of creditor and contractual rights in some countries; and

•

import and export license requirements and restrictions on the import and export of certain technology, especially encryption technology and trade restrictions.

Despite these risks, we believe that we must continue to expand our operations in international markets to support our growth. To this end, we intend to establish additional foreign sales operations, expand our existing offices, hire additional personnel, expand our international sales channels and customize our products for local markets. If we fail to execute this strategy, our international sales growth will be limited.

Our Networks, Products and Services May be Targeted by Hackers

Like other companies, our websites, networks, information systems, products and services may be targets for sabotage, disruption or misappropriation by hackers. As a leading network security solutions company, we are a high profile target. Although we believe we have sufficient controls in place to prevent disruption and misappropriation, and to respond to such situations, we expect these efforts by hackers to continue. If these efforts are successful, our operations, reputation and sales could be adversely affected.

We Must Successfully Integrate Acquisitions

As part of our growth strategy, we have and may continue to acquire or make investments in companies with products, technologies or professional services capabilities complementary to our solutions. When engaging in acquisitions, we could encounter difficulties in assimilating or completing the development of the technologies, new personnel and operations into our company. These difficulties may disrupt our ongoing business, distract our management and employees, increase our expenses and adversely affect our results of operations. These difficulties could also include accounting requirements, such as impairment charges related to goodwill or other intangible assets or expensing in-process research and development costs. We cannot be certain that we will successfully overcome these risks with respect to any future acquisitions or that we will not encounter other problems in connection with our recent or any future acquisitions. In addition, any future acquisitions may require us to incur debt or issue equity securities. The issuance of equity securities could dilute the investment of our existing stockholders.

Our Proprietary Rights May be Difficult to Enforce

We rely primarily on copyright, trademark, patent and trade secrets laws, confidentiality procedures and contractual provisions to protect our proprietary rights. We hold one United States patent, one Taiwanese patent, and have a number of patent applications pending. We also hold numerous United States and foreign trademarks and have a number of trademark applications pending. There can be no assurance that patents will be issued from pending applications, or that claims allowed on any patents will be sufficiently broad to protect our technology. There can be no assurance that any issued patents will not be challenged, invalidated or circumvented, or that any rights granted under these patents will actually provide competitive advantages to us. Despite our efforts to protect our proprietary rights, unauthorized parties may attempt to copy aspects of our products or to obtain and use information that we regard as proprietary. Policing unauthorized use of our products is difficult. While we cannot determine the extent to which piracy of our software products occurs, we expect software piracy to be a persistent problem. In addition, the laws of some foreign countries do not protect our proprietary rights to as great an extent as do the laws of the United States, and many foreign countries do not enforce these laws as diligently as U.S. government agencies and private parties. If we are unable to protect our proprietary rights to the totality of the features in our software and products (including aspects of our software and products protected other than by patent rights), we may find ourselves at a competitive disadvantage to others who need not incur the additional expense, time and effort required to create the innovative products that have enabled us to be successful.

We May Be Found to Infringe the Proprietary Rights of Others

Third parties may assert claims or initiate litigation related to exclusive patent, copyright, trademark and other intellectual property rights to technologies that are relevant to our business. Because of the large number of patents in the Internet, networking, security and software fields, the secrecy of some pending patents and the rapid rate of issuance of new patents, it is not economically practical (or even possible) to determine in advance whether a product (or any of its components) infringe or will infringe the patent rights of others. Third party asserted claims and/or initiated litigation can include claims against us or our manufacturers, suppliers, or customers, alleging infringement of proprietary rights with respect to our existing or future products (or components of those products). Regardless of the merit of these claims, they can be time-consuming, result in costly litigation and diversion of technical and management personnel, or require us to develop a non-infringing technology or enter into license agreements. There can be no assurance that licenses will be available on acceptable terms and conditions, if at all, in these circumstances, or that any indemnification that might be available to us would be adequate to cover our costs of defense. Furthermore, because of the potential for large judgments, which are not necessarily predictable, it is not unusual to find even arguably unmeritorious claims settled for significant funds. If any infringement or other intellectual property claims made against us by a third party is successful, or if we fail to develop non-infringing technology or license the proprietary rights on commercially reasonable terms and conditions, our business, operating results, financial condition and liquidity could be materially and adversely affected.

We Must Continue to Attract and Retain Personnel in a Competitive Marketplace

We believe that our future success will depend in part on our ability to recruit and retain highly skilled management, sales, marketing and technical personnel. To accomplish this, we believe that we must provide personnel with a competitive compensation package, including stock options, restricted stock or similar incentive stock awards. Our current incentive stock plan expires in September 2005 and we believe that sufficient shares are available for issuance under that plan to meet our needs until it expires. We have proposed a new incentive stock plan to stockholders for consideration at our annual stockholders meeting in 2005, but there is no assurance that shareholders will approve such plan, which would impair our ability to attract and retain necessary personnel.

Some Provisions in the ISS Certificate of Incorporation and Bylaws Make a Takeover of ISS Difficult

Our certificate of incorporation and bylaws contain provisions that could have the effect of making it more difficult for a third party to acquire, or of discouraging a third party from attempting to acquire, control of ISS. These provisions:

•

establish a classified board of directors;

•

create preferred stock purchase rights that grant to holders of common stock the right to purchase shares of Series A Junior Preferred Stock in the event that a third party acquires 20% or more of the voting power of our outstanding common stock;

•

prohibit the right of our stockholders to act by written consent;

•

limit calling special meetings of stockholders; and

•

impose a requirement that holders of 66²/3% of the outstanding shares of common stock are required to amend the provisions relating to the classification of our board of directors and action by written consent of stockholders.

Item 3. Quantitative and Qualitative Disclosures About Market Risk

We have no material changes to the disclosure on this matter made in our Annual Report on Form 10-K for the year ended December 31, 2004.

Item 4. Controls and Procedures

Disclosure Controls and Procedures

ISS’ management, with the participation of the Chief Executive Officer and Chief Financial Officer, evaluated the effectiveness of our disclosure controls and procedures, as defined in Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934, as of March 31, 2005. No system of controls, no matter how well designed and operated, can provide absolute assurance that the objectives of the system of controls are met, and no evaluation of controls can provide absolute assurance that the system of controls has operated effectively in all cases. Our disclosure controls and procedures however are designed to provide reasonable assurance that the objectives of disclosure controls and procedures are met.

As described in our management’s report on our internal control over financial reporting included in ISS’ 2004 Form 10-K, ISS’ management and independent registered public accounting firm identified a material weakness as of December 31, 2004 in ISS’ internal control over financial reporting, as defined in Rules 13a-15(f) and 15d-15(f) under the Securities Exchange Act, related to

revenue recognition for sales contracts with multiple revenue elements. That material weakness in internal control over financial reporting also affected the effectiveness of our disclosure controls and procedures, resulting in our conclusion that disclosure controls and procedures were not effective as of December 31, 2004.

During the first quarter of 2005, we improved ISS’ disclosure controls and procedures and internal control over financial reporting in an effort to remediate this material weakness and other control deficiencies that were identified and evaluated in connection with the determination of the material weakness. The remediation included:

•

conducting additional training, and establishing ongoing training, on complex revenue recognition principles for our contract administration and accounting staff; and

•

establishing an additional level of management review for any contracts that exceed specific materiality thresholds.

As a result of such remediation, management concluded that, as of March 31, 2005, our disclosure controls and procedures were effective to provide reasonable assurance that information required to be disclosed in the reports the Company files or submits under the Securities Exchange Act of 1934 is recorded, processed, summarized and reported on a timely basis.

Changes in Internal Control Over Financial Reporting

There have not been any changes in ISS’ internal control over financial reporting during the quarter ended March 31, 2005 that have materially affected, or are reasonably likely to materially affect, such controls, other than the remediation described above.

PART II. OTHER INFORMATION

Item 1. Legal Proceedings

Item 2. Unregistered Sale of Equity Securities and Use of Proceeds

The following table provides information about purchases by the Company of its common stock during the three months ended March 31, 2005. All such purchases were made in open-market transactions pursuant to a repurchase plan publicly announced on July 21, 2004. Under this repurchase plan, the Company has been authorized by the Board to repurchase up to $50 million of its outstanding common stock over the 12 months ending July 19, 2005. The Company had a prior repurchase plan in place that terminated on July 14, 2004 and no further purchases can be made under that plan. Through March 31, 2005, the Company had purchased approximately 5.3 million shares at an aggregate cost of approximately $83.6 million under the current and prior repurchase plans.

Issuer Purchases of Equity Securities


Period	Total Number of Shares Purchased	Average Price Paid Per Share		Total Number of Shares Purchased as Part of Publicly Announced Plans or Programs	Approximate Dollar Value of Shares that May Yet Be Purchased Under the Plans or Programs
1/1/05-1/31/05	—	$	—	—	$	23,033,000
2/1/05-2/28/05	287,000	$	20.67	287,000	$	17,101,000
3/1/05-3/31/05	156,000	$	20.90	156,000	$	13,841,000

Item 6. Exhibits


10.10+		Form of Executive Incentive Plan (filed as Exhibit 10.1 to the Company’s Current Report on Form 8-K, filed February 3, 2005, and incorporated by reference herein).

11**	—	Computation of Per Share Earnings

31 .1*	—	Certification of principal executive officer pursuant to Section 302 of the Sarbanes-Oxley Act of 2002.

31 .2*	—	Certification of principal financial officer pursuant to Section 302 of the Sarbanes-Oxley Act of 2002.

32 .1*	—	Certification Pursuant to 18 U.S.C. Section 1350. as Adopted Pursuant to Section 906 of the Sarbanes-Oxley Act of 2002

32 .2*	—	Certification Pursuant to 18 U.S.C. Section 1350. as Adopted Pursuant to Section 906 of the Sarbanes-Oxley Act of 2002

*	Identifies those filed exhibits with this Form 10-Q.

+	Management contract or compensatory plan

**	Data required by SFAS No. 128, “Earnings Per Share”, is provided in Note 5 to the consolidated financial statements in this report.

SIGNATURES

Pursuant to the requirements of the Securities Exchange Act of 1934, the Registrant has duly caused this report to be signed on its behalf by the undersigned thereunto duly authorized.


	INTERNET SECURITY SYSTEMS, INC.
	(Registrant)

Date: May 10, 2005	By	/s/ Richard Macchia
		Senior Vice President Finance and Administration
		and Chief Financial Officer (on behalf of registrant
		and as principal financial officer)

Three months ended
March 31,

Asia/Pacific