Use these links to rapidly review the document
Table of Contents
PART IV

Table of Contents

UNITED STATES
SECURITIES AND EXCHANGE COMMISSION
Washington, D.C. 20549

FORM 10-K

Commission File Number 0-24752

Wave Systems Corp.
(Exact name of registrant as specified in its charter)

413-243-1600
(Registrant's telephone number, including area code)

Securities registered pursuant to Section 12(b) of the Act: None

Securities registered pursuant to Section 12(g) of the Act:

Class A Common Stock, $.01 par value
(Title of Class)

          Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. YES o    NO ý

          Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. YES o    NO ý

          Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. YES ý    NO o

          Indicate by check mark whether the registrant has submitted electronically and posted on its corporate Website, if any, every Interactive Data File required to be submitted and posted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter), during the preceding 12 months (or for such shorter period that the registrant was required to submit and post such files). YES o    NO ý

          Indicate by check mark if disclosure of delinquent filers pursuant to Item 405 of Regulation S-K (§229.405) is not contained herein, and will not be contained, to the best of registrant's knowledge, in definitive proxy or information statements incorporated by reference in Part III of this Form 10-K or any amendment to this Form 10-K. o

          Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, or a smaller reporting company. See definitions of "accelerated filer", "large accelerated filer" and "smaller reporting company" in Rule 12b-2 of the Exchange Act. (Check one).

          Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Act). YES o    NO ý

          The aggregate market value of the shares of Common Stock of the registrant held by non-affiliates based on the closing price (as reported by NASDAQ) of such common stock on the last business day of the registrant's most recently completed second fiscal quarter (June 30, 2009) was approximately $73 million. (For purposes of this calculation, the market value of a share of Class B Common Stock was assumed to be the same as a share of Class A Common Stock, into which it is convertible.)

          As of March 12, 2010, there were 78,459,621 shares of the registrant's Class A Common Stock and 38,232 shares of the registrant's Class B Common Stock outstanding.

DOCUMENTS INCORPORATED BY REFERENCE:

          Portions of our definitive Proxy Statement for the 2010 Annual Meeting of Stockholders, to be filed pursuant to Regulation 14A on or before April 30, 2010, have been incorporated by reference into Part III of this annual report.

Table of Contents

        EXCEPT FOR HISTORICAL INFORMATION CONTAINED HEREIN, THIS FORM 10-K CONTAINS FORWARD-LOOKING STATEMENTS WITHIN THE MEANING OF THE U.S. SECURITIES LITIGATION REFORM ACT OF 1995. THESE STATEMENTS INVOLVE KNOWN AND UNKNOWN RISKS AND UNCERTAINTIES THAT MAY CAUSE WAVE'S ACTUAL RESULTS OR OUTCOMES TO BE MATERIALLY DIFFERENT FROM THOSE ANTICIPATED AND DISCUSSED HEREIN. FURTHER, WAVE OPERATES IN AN INDUSTRY SECTOR WHERE SECURITIES VALUES MAY BE VOLATILE AND MAY BE INFLUENCED BY REGULATORY AND OTHER FACTORS BEYOND WAVE'S CONTROL. IMPORTANT FACTORS THAT WAVE BELIEVES MIGHT CAUSE SUCH DIFFERENCES ARE DISCUSSED IN THE CAUTIONARY STATEMENTS ACCOMPANYING THE FORWARD-LOOKING STATEMENTS AND IN THE RISK FACTORS DETAILED IN PART I, ITEM 1 OF THIS FORM 10-K. IN ASSESSING FORWARD-LOOKING STATEMENTS CONTAINED HEREIN, READERS ARE URGED TO READ CAREFULLY ALL RISK FACTORS AND CAUTIONARY STATEMENTS CONTAINED IN THIS FORM 10-K.

Table of Contents

Table of Contents

Table of Contents

PART I

Item 1.    Business

General

        Reference to "Wave", "we", "us", "our" or "the Company" refer to Wave Systems Corp. Wave was incorporated in Delaware under the name Indata Corp. on August 12, 1988. We changed our name to Cryptologics International, Inc. on December 4, 1989. We changed our name again to Wave Systems Corp. on January 22, 1993. Our principal executive offices are located at 480 Pleasant Street, Lee, Massachusetts 01238 and our telephone number is (413) 243-1600.

        Wave develops, produces and markets products for hardware-based digital security, including security applications and services that are complementary to and work with the specifications of the Trusted Computing Group, www.trustedcomputinggroup.org ("TCG"), an industry standards organization comprised of computer and device manufacturers, software vendors and other computing products manufacturers. Specifications developed by the TCG are designed to address a broad range of current and evolving digital security issues. These issues include: identity protection, data security, digital signatures, electronic transaction integrity, platform trustworthiness, network security and regulatory compliance.

        Since 2008, we have held a permanent seat on the TCG Board of Directors (the "TCG Board"), joining permanent members AMD, Fujitsu, HP, IBM, Infineon, Intel, Lenovo, Microsoft, Sun and Seagate Technology. Wave has also elevated its membership status to the highest level of TCG "Promoter." Permanent members of the TCG Board provide guidance to the organization's work groups in the creation of the specifications to protect PCs and other computing devices from attacks and to help prevent data loss and theft. Wave's enhanced membership status allows it to take a more active role in helping to develop, define and promote hardware-enabled trusted computing security technologies, including related hardware building blocks and software interfaces. Wave is eligible to serve on and chair the TCG Board, Work Groups and Special Committees; is able to submit revisions and addendum proposals for specifications with design guides; and may review and comment on design guides prior to their adoption.

        One of the current TCG specifications recommends a hardware-based trusted computing platform, which is a platform that uses a semiconductor device, known as a Trusted Platform Module ("TPM") that contains protected storage and performs protected activities, including platform authentication, protected cryptographic processes and capabilities allowing for the attestation of the state of the platform which provides the first level of trust for the computing platform (a "Trusted Platform"). The TPM is a hardware chip that is separate from the platform's main CPU(s) that enables secure protection of files and other digital secrets, and performs critical security functions such as generating, storing and protecting "cryptographic keys," which are secret codes used to decipher encrypted or coded data. While TPMs provide the anchor for hardware security, known as the "root of trust", trust is achieved by integrating the TPM within a carefully architected trust infrastructure and supporting the TPM with essential operational and lifecycle services, such as key management and credential authentication.

        Prior to the formation of the TCG, Wave developed its pioneering EMBASSY® (EMBedded Application Security SYstem) Trust System. The EMBASSY Trust System is a combination of client hardware consisting of the EMBASSY 2100 security chip (the "EMBASSY chip"), and software consisting of the Trust Assurance Network ("TAN"), a back-office infrastructure that manages its security functions. As the market for TPM-enabled products has developed with computing devices being shipped in volume by leaders in the PC industry, Wave has enabled the development work on the EMBASSY Trust System to support security hardware based on the TCG specifications, by repurposing these product assets. Wave has since developed a set of applications known as the EMBASSY Trust

2

Table of Contents

Suite, EMBASSY Trust Server products, middleware and software tools to work with various other chip manufacturers' TCG-enabled TPMs that are now available. Wave's products are unique in the fact that they support cross platform interoperability for the currently available TPM chips from Nuvoton Technology Corporation, Atmel, Broadcom, Infineon Technologies AG, and ST Microelectronics and have been verified for usage on TPM platforms shipped by Dell, Acer, Intel, Lenovo, HP, NEC and Fujitsu.

        Wave's operations to date have consisted primarily of product development, performance under contract to develop products and marketing and sales to personal computer ("PC") and semi-conductor chip ("Chip") original equipment manufacturers ("OEMs"), resellers, and enterprises. Wave has been successful in signing distribution and reseller contracts with Intel, Nuvoton, ST Microelectronics, Dell Products LP ("Dell"), Acer and Broadcom. In November 2009 Wave entered into a reseller agreement with Hewlett-Packard Company ("HP") that permits HP to distribute and sell Wave's software products through HP sales channels. In December 2008, Wave completed an amendment to its software license agreement with its largest OEM customer, Dell. Under the new arrangement, the per-unit royalties that Wave receives for each OEM PC model shipping with Wave's EMBASSY Trust Suite software were increased by at least 100% per unit, retroactive to November 1, 2008.

        Due to the early stage nature of its market category, Wave is unable to predict with a high enough level of certainty whether enough revenue will be generated in calendar 2010 to fund its cash flow requirements. Given the uncertainty with respect to Wave's revenue forecast for 2010, Wave may be required to raise additional capital through either equity or debt financing in order to adequately fund its capital requirements for the year ending December 31, 2010. As of December 31, 2009, we had approximately $1.9 million of cash on hand and negative working capital of approximately $2.0 million. Considering our current cash balance and Wave's projected operating cash requirements, we project that we have enough liquid assets to continue operating through December 31, 2010. Due to our current cash position, our capital needs over the next year and beyond, the fact that we may require additional financing and uncertainty as to whether we will achieve our sales forecast for our products and services, substantial doubt exists with respect to our ability to continue as a going concern.

Formation of the Trusted Computing Group and introduction of TCG Compliant Products

        The TCG was formed in April 2003 by the Promoting Founders—AMD, HP, IBM, Intel, and Microsoft. Wave Systems was initially invited to join the founding group as a Contributing Member. Since 2008, Wave has held a permanent seat on the TCG Board. The TCG has significantly expanded the industry participation in security hardware standards and now includes industry leaders offering additional platforms such as storage devices, cell phones, PDAs and consumer electronics. Since 2005, the rate of adoption of TPMs continued to grow with the availability of TPM-equipped PCs and servers from additional PC OEMs including Acer, Dell, HP and Lenovo. The overall number of TPM-equipped PC models being offered from the OEMs shipping with TPMs, combined with the increased number of OEMs that have introduced TPM-equipped models, has continued to accelerate the rate at which TPMs are being shipped by the PC industry. Within the TCG there are TCG Working Groups that are developing specifications to extend TCG technologies to other devices such as storage devices, network products, servers, peripherals and mobile devices.

        The offering of products using TCG specifications to the PC market is an important development in the creation of the market for hardware-based computer security. Wave is continuing to execute its strategy to leverage its EMBASSY Trust System in an effort to become a leading developer of software, applications and services for this market. Wave is providing solutions in the market that are designed to work with many commercially available products using TCG specifications.

3

Table of Contents

Products and Services

        Although Wave's revenue has grown considerably in 2009 versus prior years, Wave's revenue in 2009 of approximately $18,890,000 was still less than its operating expenses, which were approximately $22,216,000. For the years ended December 31, 2009, 2008, and 2007, Wave incurred losses to common shareholders of approximately $3,346,000, $21,206,000 and $19,952,000 respectively. At December 31, 2009, we had an accumulated deficit of approximately $348,036,000. There can be no assurance that we will ever be successful in achieving significant commercial acceptance of our products and services.

Client-side Applications

EMBASSY Trust Suite

        The current version of the EMBASSY Trust Suite consists of a set of applications and services that is designed to bring functionality and user value to TPM-enabled products. Designed to make the TPM easy for users to set up and use, the EMBASSY Trust Suite includes the EMBASSY Security Center (the "ESC"), Trusted Drive Manager ("TDM"), Document Manager ("DM"), Private Information Manager ("PIM") and Key Transfer Manager ("KTM").

        The ESC enables the user to set up and configure the TPM platform. In addition to the basic function of making the TPM operational, the ESC is designed to enable the user to manage extended TPM-based security settings and policies, including strong authentication, Windows logon preferences to add biometrics and streamlined password policy management. In January 2009, the TCG published storage specifications for another major trusted hardware component, the self-encrypting drive or SED. The ESC software contains advanced lifecycle management tools for the SED. Trusted Drive Manager is the software utilized for managing SEDs. SEDs are designed to provide advanced data protection technology and they differ from software-based full disk encryption in that encryption takes place in hardware, in a manner designed to provide a more robust security without slowing processing speeds. Because the drives are factory-installed, the systems can be configured such that encryption is "always on," for the protection of proprietary information. SEDs from Seagate (DriveTrustTM technology) and Samsung, which earlier this year unveiled the first solid-state SED using flash memory, come bundled with Wave's client software EMBASSY® Trusted Drive Manager, for pre-boot authentication and initialization of the drive. During 2009 Wave worked with other disk drive OEMs such as Toshiba, Fujitsu, and Hitachi to develop support for their self-encrypting drives which are based on the new TCG storage specifications. Enterprises can also select Wave's EMBASSY® Remote Administration Server for the centralized administration and management of the drives, which are designed to provide detailed event logs for compliance reporting.

        Data protection is also addressed by the DM, which is offered to provide document encryption, decryption and client- side storage of documents. The DM works with Microsoft Windows and Microsoft Office to secure documents against unauthorized users and hackers. Wave's software is Windows 7 and Vista ready, building upon the operating systems data protection feature sets, providing full-featured EMBASSY solutions for data protection and strong authentication.

        Password management can be a security challenge due to the increasing number of passwords required and the tendency of users to select easily guessed passwords. To help address these password issues, PIM uses the TPM to securely store and manage user information such as user names, passwords, credit card numbers and other personal information. It retrieves login information to efficiently fill in applications, web forms and web login information.

        Backup and recovery of keys used for logon, signing, and protection of data can be an essential requirement for deployment of TPM-based systems. KTM is an archive application for the cryptographic keys that is designed to provide a simple, yet full-featured, method to securely archive, restore and transfer keys, having the property of being migratable, that are secured by the TPM.

4

Table of Contents

        Additionally, Wave has developed TPM Wizards as part of the EMBASSY Trust Suite, which can allow users to setup and use the TPM for securing 802.11x wireless networks, the Windows Encrypting File System and encrypted email.

        Wave plans to continue to develop and enhance the current products being developed within this product group and to develop new applications and services as the trusted computing market continues to evolve. Current planned development costs for this product group are expected to be approximately $3.5 million for the year ending December 31, 2010.

Middleware and Tools

TCG-Enabled Toolkit

        The Wave TCG-Enabled Toolkit is a compilation of software designed to assist application developers writing new applications or modifying existing ones to function on TCG-compliant platforms. Wave provides two versions of the Toolkit, Discovery and Commercial, which can enable developers to leverage basic and enhanced TCG services such as integrated key lifecycle management, including key escrow and key recovery. The Discovery Toolkit offers application developers a license for internal evaluation only whereas the Commercial Toolkit is a license for external redistribution.

Wave TCG-Enabled Cryptographic Service Provider ("CSP")

        Wave offers a TCG-enabled CSP, which can allow software developers to utilize the enhanced security of a TCG standards-based platform, facilitating a common user experience independent of the platform. It is also designed to enable applications to utilize functionality available on TCG-compliant platforms directly through the Microsoft cryptographic application programming interface without requiring user knowledge of any specific TCG software stack layer.

        Current planned development costs for this product group are expected to be approximately $4.3 million for the year ending December 31, 2010.

EMBASSY Trust Server Applications

EMBASSY Key Management Server ("EKMS")

        EKMS is a server application that is designed to provide corporate-level backup and transition of the TPM keys, a process known as key migration. Key migration using EKMS is designed to help prevent the risk of serious data loss in the event that a TPM, hard drive or motherboard becomes corrupted, or a user leaves the organization. For instance, an organization may require access to a former employee's encrypted data or TPM-secured keys for business continuity or disaster recovery purposes. EKMS enables enterprise-level key protection services while ensuring proper archive procedures and recovery capabilities.

EMBASSY Authentication Server ("EAS")

        EAS is offered to provide centralized management, provisioning and enforcement of multifactor domain access policies. With EAS, authentication policies can be based on TPM credentials, Smart Card credentials, user passwords and fingerprint templates. With EAS, authentication policies can be provisioned and managed from the domain controller. EAS has an integrated biometric template capability with support for a variety of third-party vendors.

EMBASSY Remote Administration Server ("ERAS")

        ERAS is a server product that is offered to provide centralized management and auditing of TPMs and SEDs. ERAS is designed to give IT administrators the ability to deploy and remotely

5

Table of Contents

manage SED and TPM systems, including initialization, pre-boot authentication management, recovery, and repurposing of TPMs and SEDs. ERAS is designed to provide auditing capabilities that aid in compliance management by allowing for validation of TPM and SED security settings and to allow IT administrators to assess the risk of whether a lost or compromised PC is adequately secure. ERAS is designed to facilitate enterprise adoption of TPM and SED technology as it provides IT administrators with tools to utilize the security of these devices while reducing deployment and management costs. The latest version of EMBASSY Trust Suite, including TDM, incorporates support for Seagate's Momentus FDE 7200-RPM SED and Samsung's SEDs (standard and solid-state versions)—both shipping on Dell's E-Series notebook PCs. In December 2008, Wave and Fujitsu Computer Products of America, Inc. showcased their SED solution at the Network World IT Roadmap Conference & Expo in San Francisco. Fujitsu's 2.5-inch High Definition Drive was the first technology that met the Opal Security Subsystem Class (SSC) specification—an industry standard issued by the TCG. The SSC specification gives vendors an industry standard for developing SEDs that secure data. Wave's products currently support SED offerings from Fujitsu, Toshiba, Samsung, Hitachi, Seagate and others based on Opal SED specifications.

        Current planned development costs for this product are expected to be approximately $1.6 million for the year ending December 31, 2010.

Electronic/Digital Signature and Electronic Document Management

eSign Transaction Management Suite

        Our eSign Transaction Management Suite, also known as eTMS ("eTMS"), originally consisted of four core products: SmartIdentity, SmartSignature, SmartSAFE and SmartConnect. SmartSignature Version 3.0 is a digital signature application that can connect signers and institutions—banks, insurance companies, enterprises, etc.—through a digital signature process. Wave's SmartSignature Server 4.02.02, a server-side electronic signature application, enables individuals to electronically sign and store virtually any format of document, while connected to a server, as opposed to the signing taking place on the client PC. Wave's SmartSigning Rooms Version 2.03 was designed to enhance the functionality of SmartSAFE, enabling an organization to offer signers a secure virtual environment to review, annotate and electronically sign documents. An enhancement to eTMS known as SmartClose has been designed to allow for mortgage closing documents to be signed and notarized in a secure environment. The electronic note is then registered through the Mortgage Electronic Registry System, a system for electronically tracking mortgage ownership and servicing rights. SmartClose also offers lenders protection against borrowers claiming not to have understood their debt obligation by requiring the borrower to electronically sign and initial key line items while providing audit capabilities for the entire transaction. SmartClose has been designed to allow a lender to originate, sign, track, access, store and transfer electronic mortgages. SmartSAFE is the core component of eTMS that provides the record retention of these electronically signed documents. SmartSAFE meets the requirements of Federal Rule 901 which requires that the user demonstrate that electronic documents offered as evidence in a legal proceeding are authentic.

        To increase the security associated with identity protection and digital signing credentials, Wave's SmartSignature is designed for the support of TPMs. SmartSAFE Version 5.0.3h is a web-based document management application where signed documents are archived and tracked. SmartSAFE was designed to provide an easy to use environment where a client institution can view, manage, store and transfer sensitive signed and unsigned documents. These products can allow a document to be executed, verified, accepted and filed in minutes at a lower cost compared to many traditional paper-based documentation methods. SmartIdentity is an optional service to verify a signer's identity through strong authentication methods, including issuing encrypted digital certificates based on public key infrastructure technology. Wave plans to continue to allocate resources toward marketing and sales to promote these products.

6

Table of Contents

        Wave's eTMS, in addition to supporting TPMs, is also being independently marketed in the insurance, mortgage, banking, government and other markets, offering digital and electronic signature solutions that are designed to comply with the Electronic Signatures in Global and National Commerce Act ("ESIGN") and Uniform Electronic Transaction Act ("UETA"). Through direct and reseller channels, many organizations have used eTMS functionality to automate paper processes. Some of the flagship organizations that are currently utilizing eTMS include: Ellie Mae, ala mode, DocuTech, SigniaDocs, Xerox Mortgage Services and Insurance Administrative Solutions. Wave has focused on digital signature applications that can make effective use of the stronger security features provided by trusted computing platforms.

        Current planned development costs for this product are expected to be approximately $350,000 for the year ending December 31, 2010.

Broadband Media Distribution Services

        Wave offered broadband content distribution products and services through Wavexpress and its TVTonic consumer media service, which was a joint venture between Wave and Sarnoff Corporation. On September 23, 2008, Wave, Sarnoff Corporation and Wavexpress entered into a Restructuring Agreement and an Amended and Restated Stockholder Agreement whereby, among other things, the parties agreed to terminate the Joint Venture Agreement between the parties, dated October 15, 1999. As of December 31, 2009, Wave owned 97.3% of Wavexpress, while Sarnoff owned 1.7% (on a fully diluted basis).

        On December 1, 2008, Wavexpress announced that it had suspended its TVTonic consumer media service and was exploring opportunities to sell or license its technology to third parties that may provide "download and play" services.

Markets and Business Strategy

Our Market

        Software has traditionally secured critical information on networks and PCs and allowed for user access to various applications. However, virus attacks and breaches of security have in many cases demonstrated that software, on its own, is not always capable of completely securing a network or platform. Because of these security concerns, we believe that there is a need in the computer industry for the development and deployment of a more robust and reliable security infrastructure including new security hardware in devices to guard against these persistent security risks. The TCG was formed to develop, define and promote open industry standard specifications for embedded hardware-enabled trusted computing and security technologies, including secure hardware and software interfaces across multiple platforms, peripherals and devices. The underlying premise of the creation of a Trusted Platform that meets the TCG specification is that only when a platform is secured by hardware, in effect creating a root of trust and a security environment which can be authenticated within the computer itself, will the information stored on the platform be adequately secure. Wave is seeking to become a software, application and services leader in hardware-based digital security and e-commerce products markets. We believe Wave has been a pioneer in developing hardware-based computer security systems and that we are distinctively positioned to take advantage of our unique knowledge, significant technology assets and trusted computing intellectual properties.

        Hardware-based trusted computing solutions can involve a new approach to conducting business and exchanging information using computer systems. We believe that these solutions will require traditional software-based security to be augmented with next generation hardware-based security and an enhanced support infrastructure. Intensive marketing and sales efforts have been, and will continue to be, necessary, in order to generate demand for products using Wave's technology and to ensure that Wave's solution is accepted in this emerging market. Our objective is to make our EMBASSY branded

7

Table of Contents

products and services the preferred applications and infrastructure for Trusted Platforms. We believe that the key components in achieving this goal include:

Capitalizing on Information Security Industry Trends

        We believe that security remains one of the top industry priorities across multiple segments of the user and product value chains. Wave believes that a key differentiator of its EMBASSY Trust Suite is that it is interoperable across all of the currently available TPM-enabled Windows platforms, as well as supporting all shipping SEDs from multiple vendors, and provides for ease of use. Key industry initiatives and security specifications that will require the addition of trusted hardware are moving forward in a number of platforms. The issuance of TCG's Opal self-encrypting drive industry specification standard for developing SEDs is one example of this. The Opal security subsystem storage specification gives developers a "blueprint" for developing SEDs. In addition to our work with Seagate and Samsung, Wave is working with Fujitsu, Toshiba, Hitachi and others to develop Opal-compliant SED solutions. Other past platforms requiring the addition of trusted hardware include Microsoft's Windows 7 and Vista operating systems, Intel's LaGrande/vPro secure computing program, and AMD's Secure Execution Mode. Similar programs are under consideration in network devices and mobile devices such as PDAs and cell phones and consumer electronics devices.

        Wave has designed its products with features and functionality that we believe may uniquely position us to capitalize on information security industry issues and trends. Wave believes that the following could be important issues and trends for our strategic objectives:

•

Requirements to authenticate the identity of both platforms and users for access to protected resources and information



•

Need to protect sensitive information on mobile PCs which may be stolen or lost



•

Need to comply with consumer laws and state and federal legislation requiring identity theft protection



•

User managed security features



•

Major privacy concerns



•

Rapid development of new e-commerce business and distribution models



•

Lack of adequate security for e-commerce and vulnerability to attacks



•

Convergence of consumer electronics and PCs



•

Legal status of digital identities and digital signatures, including development of next generation web services which require digital signature solutions



•

Increased focus on security and privacy by government entities



•

Rampant piracy of digital goods including music, video, software and the need for digital goods providers to securely distribute their content and prevent theft

        Wave plans to continue to pursue strategic relationships with hardware manufacturers, independent software vendors, systems integrators and companies involved in the development of commerce in electronic content and services to achieve broad market acceptance of its products as a platform for security solutions and commerce performed in user devices.

Pursuing Strategic Marketing and Distribution Alliances

        We intend to expand Wave's strategic alliances with key partners that could distribute our products in enterprise, government and eventually consumer markets, and to build upon our alliances with such

8

Table of Contents

industry leaders as Intel, Dell, Acer, HP, Lenovo, NEC and others in the PC industry. In addition, we are engaged in strategic activities with semi-conductor manufacturers Broadcom, ST Microelectronics, Nuvoton, Atmel and Infineon Technologies to support and/or deploy EMBASSY applications with their TPMs designed to the TCG specifications. TCG has expanded its scope to include networking systems, trusted peripherals, data storage devices, mobile wireless products and consumer electronics devices. Wave expects additional secure storage devices and data protection alternatives to be introduced in 2010 and thereafter and believes that its trusted computing offerings can provide significant value in these new markets and on these platforms and thus, is working to establish relationships with key partners in each of these markets.

Enhancing Our Current Product Offerings and Products in Development

        We intend to continue to develop and extend our existing product offerings to include features and functionality to meet customer requirements and market demand. Planned development efforts that enhance or utilize existing technologies include building upon and enhancing our EMBASSY Trust Suite and eTMS applications.

        Client and server solutions supporting both the operations and life cycle management of Trusted Platforms is a major focus area for Wave. New products that Wave is planning on developing over the ensuing period will consist primarily of new TCG client and server software services and enabling tools that will expand upon its portfolio of TCG trusted computing applications and services in the following areas:

•

Cross-platform interoperability:    TCG hardware is provided by multiple suppliers and supporting software is offered by multiple vendors. In order to assist applications from independent software vendors to work with any of these multiple combinations of products, Wave is developing TCG specific toolkits that provide for interoperability across platforms. Wave plans to continue to expand the functions available to systems integrators ("SIs"), independent software vendors ("ISVs") and independent hardware vendors ("IHVs") within these enabling toolkits in an effort to make it easier to bring new applications to Trusted Platforms.



•

Client applications:    Wave's EMBASSY Trust Suite provides important end user PC applications such as EMBASSY Security Center, Trusted Drive Manager, Document Manager, Private Information Manager and Key Transfer Manager. Wave plans to continue to add new client applications and enhance the current applications with advanced functions to exploit the strong security of the TCG platforms.



•

Server applications:    Trusted devices require a number of life cycle management products to address the set up, registration, operations and systems management requirements of the platforms. Wave's current server and life cycle management products consist of the EKMS, EAS and ERAS. Wave plans to enhance these products with future versions and to expand these products to offer additional trust services.

        At Digital ID World in September 2009 Wave released and demonstrated a beta version of id.wave.com, its new identity service for strong authentication and single-sign on to Web services and applications in the Cloud. This service takes advantage of the TPM security chip to secure users' authentication identities with keys held in the TPM. Also, during the 2009 Intel Developers Forum, Wave demonstrated remote, out-of-band management of self-encrypting drives using Intel® vPro™ Technology with Wave's EMBASSY® client and server software. The solution allows a secure network unlock of the drives automatically by an administrator, regardless of whether the PC is powered on and independent of the PC's operating system. Wave believes that these development efforts will likely be significant and Wave intends to expend a substantial portion of its research and development resources towards these enhancements as well as significant marketing and corporate development funds to introduce the products and build market demand. As a result, our continued research and development

9

Table of Contents

efforts will require substantial capital resources, which may necessitate the need for further funding so that Wave may ultimately be able to capitalize on the emerging market opportunities for its products and services.

Marketing, Sales and Customers

        Because Wave's products involve a new approach to conducting business and exchanging information using computer systems, we believe market acceptance of these products will require that traditional software-based security be enhanced and/or replaced with next generation products designed using the TCG and related specifications. Intensive marketing and sales efforts have been and will continue to be necessary in order to increase recognition of and generate demand for products using Wave's technology and to ensure that Wave's solutions are accepted in this emerging market. Our current primary focus is on closing business with chip OEMs, PC OEMs, enterprise customers and systems integrators. Wave has also undertaken steps to develop and establish reseller channels for our products.

        Wave's business model targets revenues from various sources: licensing of our technology including EMBASSY Trust Suite client applications; tools and enabling software; and client/server-based trusted software solutions for the lifecycle management of keys and authentication of Trusted Platforms.

        Wave has identified six key markets where we believe our products could provide unique benefits:

•

PCs—TCG's standards-based specifications for trusted hardware is leading a growing number of PC OEMs toward increased deployment of TPM hardware. The current focus for both TCG and Wave is on business PC platforms, but Wave plans to extend these platforms to consumer PCs over time. Wave anticipates providing enabling tools to SIs, ISVs, and IHVs in order to take advantage of the new trusted computing features of these platforms.



•

Secure Storage Devices and Data Protection Devices—Based on significant industry requirements for data protection solutions and as the TCG-based specifications are released for trusted drives, Wave anticipates expanding its range of support for new products from IHVs and platform OEMs.



•

Network Products and Mobile Devices—As TCG-based specifications are released and product deployment develops, Wave plans to extend its products to support these new trusted computing platforms and marketing to the associated OEMs, SI, ISVs, IHVs, and service providers for these devices.



•

Banking and Finance—In addition to our European initiatives to be a leader in delivering solutions that are designed to comply with European standards, we are cultivating interest and support from financial institutions for utilizing TCG-compliant platforms.



•

Government and Enterprise—Wave believes the market for electronic security systems in governmental units and large business enterprises is growing and that this market represents a key opportunity for Wave's TCG-compliant offerings.



•

Medical and Healthcare—Major government initiatives and investments associated with Health Information Technology are aimed at creating a nationwide electronic medical infrastructure, which would require high levels of security to protect unauthorized access to patient information and improved data security for storage of sensitive records. Wave believes that its security solutions may play a role as these initiatives and investments are developed.

        Directly and through our partners, Wave is actively targeting opportunities in these markets as we believe our products provide a wide range of security and trust capabilities not offered in any other single solution.

10

Table of Contents

        Wave's sales for the year ended December 31, 2009 consisted primarily of licensing its software applications, engineering and support services. Of the total revenue realized for the years ended December 31, 2009, 2008 and 2007, 100% was derived from Wave's EMBASSY computer security products and services. Customers from which Wave derived revenue in 2009 in excess of 10% or total revenues that would have a material adverse effect on Wave's business if Wave were to lose such customers are as follows:

        Wave's business plan will continue to depend heavily on a small number of OEM customers, partners and prospective customers, the loss of, or lack of substantial future revenues from any of whom, may have a material adverse effect on our business plan going forward. In 2009, Wave worked to expand its presence as a security solutions provider marketing to small, medium and large business enterprises and will continue to actively market its products and services to these enterprises in concert with its OEM customer base. In late December 2009 Wave received a series of significant license and maintenance orders for its ERAS software from a U.S.-based automotive company. The orders were received by Wave through an OEM partner and totaled approximately $5.7 million, including approximately $1.9 million for software licenses and annual maintenance delivered and invoiced at the end of 2009. On average, the orders account for tens of thousands of new licenses per year for each of the next three years, along with maintenance orders for each of the next five years. The remaining orders are cancelable by the customer.

Segment Reporting

        Information required by this item is incorporated herein by reference to "Segment Information" in Note 16 of the Notes to Consolidated Financial Statements.

Financial Information about Geographic Areas

        Information required by this item is incorporated herein by reference to "Segment Information" in Note 16 of the Notes to Consolidated Financial Statements.

Competition

Wave EMBASSY Digital Security Products

        We operate in the information security market, a highly competitive and fragmented environment that is characterized by rapidly evolving technology. Many of our competitors and potential competitors have substantially greater financial, technical and marketing resources than us. Also, many current and potential competitors have greater name recognition and more extensive customer bases to leverage, allowing these competitors to gain market share or product acceptance to our detriment. In addition, the rate of market acceptance of trusted computing solutions is still in the formative and early stages, despite the substantial increase in distribution of the technology. The markets for our products are developing and, while the TCG specifications have provided the basis for the industry to move forward, significant standards work efforts need to be accomplished in order for the system supporting trusted computing to move forward. Wave's potential competitors include security solutions providers such as RSA Security, Inc. (a division of EMC), Symantec, Computer Associates, Verisign, Inc., Entrust, Inc., Utimaco (acquired by Sophos), SafeNet and major systems integrators such as IBM, HP and EDS. In addition, Wave competes with other client security applications companies that are developing trusted computer applications including Softex, Phoenix, Infineon and Microsoft. The competitive factors defining these evolving markets include product features, compatibility, standards compliance, quality

11

Table of Contents

and reliability, ease of use, performance, customer service and support, distribution and price. Wave believes its products meet the requirements to be successful viable products in these markets. The features of Wave's products that should allow it to compete favorably through product differentiation include: cross-platform, interoperable solutions; easy-to-use features; and leading edge trusted client/server infrastructure solutions. In addition, Wave continues to offer digital signature products, which can be enhanced when combined with trusted computing platforms and features.

        In the market for data protection products there are well established software companies which provide software-based full disk encryption products and supporting infrastructure, including PointSec (acquired by Checkpoint), Utimaco (acquired by Sophos), Credant, PGP, SafeBoot (acquired by McAfee), Secude, WinMagic, GuardianEdge and others. As the market for hardware-based full disk encryption products evolves, these companies have begun to provide support for the new trusted drives, similar to Wave's products which support these products today.

        One of the market challenges facing Wave is the establishment of a newly defined market category within the overall information security market for trusted computing software and services that includes a more complex business model for adoption. While the TCG specifications define a very complex and comprehensive cryptographic system that require significant skills and resources, the market for security solutions that are as complex as those developed by Wave is in a formative stage of development. As a result, commercialization of these technologies has been slow to develop. It is also possible for other competitors to develop similar offerings to compete with our products or for new technologies to emerge that could replace existing technology that our products rely on, thereby making our products non-competitive or obsolete. We can offer no assurances that Wave's products will become industry standards or become widely accepted by the marketplace.

International Market

        Most of our software products are controlled under various United States export control laws and regulations and may require export licenses for certain exports of the products and components outside of the United States and Canada. With respect to our EMBASSY Trust Suite and EMBASSY Trust Server software applications, we have applied for and received export classifications that allow us to export our products, without a license and with no restrictions, to any country throughout the world with the exception of Cuba, Iran, Iraq, Libya, North Korea, Sudan and Syria.

        We believe the export classifications that we have received for our software products allow us to sell our products internationally in an effective, competitively advantageous manner. Enhancements to existing products may, and new products will, be subject to reviews by the Bureau of Export Administration to determine what export classification they will receive. Some of our partners demand that our products be allowed to be exported without restrictions and/or reporting requirements. Current export regulations have, in part, allowed us to receive the desired classification without undue cost or effort. However, the export regulations may be modified at any time. Modifications to the export regulations could prevent us from exporting our existing and future products in an unrestricted manner without a license, as we are currently allowed for the products that we've received classification, or make it more difficult to receive the desired classification. If export regulations were to be modified in such a way, we may be put at a competitive disadvantage with respect to selling our products internationally.

12

Table of Contents

Proprietary Rights and Licenses and Intellectual Property

        Our success depends, in part, on our ability to enjoy or obtain protection for our products and technologies under United States and foreign patent laws, copyright laws and other intellectual property laws, to preserve our trade secrets and to operate without infringing the proprietary rights of other parties. Any issued patent owned or licensed by us may not, however, afford adequate protection to us and may be challenged, invalidated, infringed upon or circumvented. Furthermore, you should understand that our activities may infringe upon patents owned by others.

        Wave has been issued twelve (12) United States patents relating to encryption and to our proprietary EMBASSY and Wave Commerce technology. We also have seven (7) patents pending before the United States Patent Office. In addition, we have two (2) foreign patents and twenty-nine (29) pending foreign patent applications. Our patents are material to protecting some of our technology.

        We rely on trade secrets and proprietary know-how, which we protect, in part, by confidentiality agreements with our employees and contract partners. However, we caution you that our confidentiality agreements may be breached and we may not have adequate remedies if such a breach occurs. Furthermore, we can provide no assurance that our trade secrets will not otherwise become known or be independently discovered by competitors.

        We also rely on copyright law to prevent the unauthorized duplication of our software and hardware products. We have and will continue to protect our software and our copyright interest therein through agreements with our consultants. We can provide no assurance that copyright laws will adequately protect our technology.

Research and Development

        Wave's products incorporate encryption/decryption, client and server software applications and other technologies in which we have made a substantial investment in research and development. We will likely be required to continue to make substantial investments in the design of information security applications and services, including the EMBASSY Trust Suite, EMBASSY Server applications and eTMS products. For the years ended December 31, 2009, 2008 and 2007, we spent approximately $7.8 million, $11.7 million and $10.6 million, respectively, on research and development activities. Planned development expenditures for the year ended December 31, 2010 are expected to be approximately $9.8 million.

Employees

        As of December 31, 2009, we employed one hundred and two (102) full-time employees, fifty-seven (57) of whom were involved in sales, marketing and administration and forty-five (45) of whom were involved in research and development. As of December 31, 2009, we retained the services of three (3) full-time consultants. We believe our employee relations are satisfactory.

Available Information

        Wave makes available, free of charge on its website by means of a link to www.nasdaq.com, its annual report on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K and amendments to those reports filed or furnished pursuant to Section 13(a) or 15(d) of the Exchange Act. Reports may be viewed and obtained on the Company's website, www.wave.com, or by calling Investor Relations at (212) 835-8500.

        The public may read and copy any materials the Company files with the SEC at the SEC's Public Reference Room at 100 F Street, N.E., Washington, DC 20549. Information on the operation of the Public Reference Room may be obtained by calling the SEC at 1-800-SEC-0330. The SEC also

13

Table of Contents

maintains an Internet site that contains reports, proxies and information statements, and other information regarding issuers that file electronically with the SEC at http://www.sec.gov.

Item 1A.    Risk Factors

         Our business, financial condition and results of operation may be adversely affected by the unprecedented economic and market conditions.

        The current global economic downturn could significantly and adversely affect our business, financial condition and results of operation in various ways. The decline in economic conditions has negatively impacted the demand for our products and services and our ability to conduct our business, thereby reducing our revenues and earnings. In addition, the economic downturn has negatively impacted, and/or may negatively impact, among other things:

•

our continued growth and development of our business;



•

our liquidity;



•

our ability to raise capital and obtain financing; and



•

the price of our common stock.

         We have a history of net losses and expect net losses will continue. If we continue to operate at a loss, our business will not be financially viable.

        We have experienced significant losses and negative cash flow from operations since our inception. We have not realized a net operating profit in any quarter since we began our operations. Wave's revenue in 2009 was less than operating expenses as our products have not yet attained widespread commercial acceptance. This is due in part to the early stage nature of the digital security industry in which we operate. As of December 31, 2009, we had an accumulated deficit of approximately $348.0 million and negative working capital of approximately $2.0 million. Given the lack of widespread adoption of the technology for our products and services, there is little basis for evaluating the financial viability of our business and our long-term prospects. You should consider our prospects in light of the risks, expenses and difficulties that companies in their early stage of development encounter, particularly companies in new and rapidly evolving markets, such as digital security and online commerce.

        To achieve profitability we must, among other things:

•

Continue to convince chip, personal computer motherboard, personal computer and computer peripheral manufacturers to license and distribute our products and services and/or make them available to their customers through their sales channels;



•

Convince computer end users and enterprise computer users to purchase our upgrade software and server products for trusted computing:



•

Convince consumers to choose to order, purchase and accept products using our products and services;



•

Continue to maintain the necessary resources, especially talented software programmers;



•

Continue to develop relationships with personal computer manufacturers, computer chip manufacturers and computer systems integrators to facilitate and to maximize acceptance of our products and services; and



•

Generate substantial revenue, complete one or more commercial or strategic transactions or raise additional capital to support our operations until we can generate sufficient revenues and cash flows.

14

Table of Contents

        If we do not succeed in these objectives, we will not generate revenues; hence, our business will not be sustainable.

         We may be unable to raise or generate the additional financing or cash flow which will be necessary to continue as a going concern for the next twelve months.

        Since we began our operations, we have incurred net losses and experienced significant negative cash flow from operations. This is due to the early stage nature of market development for our products and services and the digital security industry as a whole. Wave expects to continue to incur substantial additional expenses associated with continued research and development and business development activities that will be necessary to commercialize our technology. We may be unable to raise or generate the additional financing or cash flow which will be necessary to continue as a going concern for the next twelve months.

        In addition to our efforts to generate revenue sufficient to fund our operations, or complete one or more commercial or strategic transactions, Wave may evaluate additional financing options to generate additional capital in order to continue as a going concern, to capitalize on business opportunities and market conditions and to insure the continued development of our technology, products and services. We do not know if additional financing will be available or that, if available, it will be available on favorable terms. If we issue additional shares of our stock, our stockholders' ownership will be diluted and the shares issued may have rights, preferences or privileges senior to those of our common stock. In addition, if we pursue debt financing we may be required to pay interest costs. The failure to generate sufficient cash flow to fund our forecasted expenditures would require us to reduce our cash burn rate, which would in turn impede our ability to achieve our business objectives. Even if we are successful in raising additional capital, uncertainty with respect to Wave's viability will continue until we are successful in achieving our objectives. Furthermore, although we may be successful at achieving our business objectives, a positive cash flow from operations may not ultimately be realized unless we are able to sell our products and services at a profit. Given the early stage nature of the markets for our products and services, considerable uncertainty exists as to whether or not Wave's business model is viable. If we are not successful in generating sufficient cash flow or obtaining additional funding, we may be unable to continue our operations, develop or enhance our products, take advantage of future opportunities, respond to competitive pressures or continue as a going concern.

         A single customer accounts for a significant portion of our revenues and, therefore, the loss of that customer may have a material adverse effect on our results of operations.

        We expect that a small number of customers will continue to account for a large portion of our revenues for the foreseeable future. We have one customer that accounted for approximately 81% of our revenue for the year ended December 31, 2009. If our relationship with any of our significant customers were disrupted, we could lose a significant portion of our anticipated revenues which may have a material adverse effect on our results of operations.

        Factors that could influence our relationships with our customers include, among other things:

•

our ability to sell our products at prices that are competitive with our competitors;



•

our ability to maintain features and quality standards for our products sufficient to meet the expectations of our customers; and



•

our ability to produce and deliver a sufficient quantity of our products in a timely manner to meet our customers' requirements.

15

Table of Contents

         If our OEM customers fail to purchase our components or to sell sufficient quantities of their products incorporating our components, or if our OEM customers' sales timing and volume fluctuates, it may have a material adverse effect on our results of operations.

        Sales to a relatively small number of OEM customers, as opposed to direct retail sales to end customers, comprise a large portion of our revenues. For example, we have one customer that accounted for approximately 81% of our revenue for the year ended December 31, 2009. Our ability to make sales to OEM customers depends on our ability to compete on price, delivery and quality. The timing and volume of these sales depend upon the sales levels and shipping schedules for the products into which our OEM customers incorporate our products. Thus, even if we develop a successful component, our sales will not increase unless the product into which our component is incorporated is successful. If our OEM customers decide not to incorporate our products as components of their products, or fail to sell a sufficient quantity of products incorporating our components, or if the OEM customers' sales timing and volume fluctuate, it may lead to a reduction in our sales and have a material adverse effect on our results of operations.

         Our market is in the early stage of development so we are unable to accurately ascertain the size and growth potential for revenue in such a market.

        The market for our products and services is still developing and is continually evolving. As a result, substantial uncertainty exists with respect to the size of the market for these products and the level of capital that will be required to meet the evolving technical requirements of the marketplace.

        Wave's business model relies on an assumed market of tens of millions of units shipping with built-in security hardware and for Wave to be successful selling its upgraded version of client and server software products to the users of such units. Because this market remains in the early stage of development, there is significant uncertainty with respect to the validity of the future size of the market. If the market for computer systems that utilize our products and services does not grow to the extent necessary for us to realize our business plan, we may not be successful.

        As this early stage market develops and evolves, significant capital will likely be required to fund the resources needed to meet the changing technological demands of the marketplace. There is uncertainty with respect to the level of capital that may be required to meet these changing technological demands. If the amount of capital resources needed exceeds our ability to obtain such capital, we may not be a viable enterprise.

         Wave is not established in the industry so we may not be accepted as a supplier or service provider to the market.

        Wave's offering represents a highly complex architecture designed to solve many of the security issues currently present with computer systems, such as identity theft, fraudulent transactions, virus attacks, unauthorized access to restricted networks and other security problems that users of computer systems generally encounter. We are uncertain as to whether the marketplace will accept our solution to these security problems. We will not be successful if the market does not accept the value proposition that we perceive to be present in our products and services.

        Although Wave has expended considerable resources in developing technology and products that utilize our technology and in business development activities in an attempt to drive the development of the hardware security market, we do not have a track record as a substantial supplier or service provider to consumers of computer systems. Therefore, uncertainty remains as to whether we will be accepted as a supplier to the enterprise and consumer markets, which will likely be necessary for us to be a successful commercial enterprise.

16

Table of Contents

         Our products have not been accepted as industry standards, which may slow their sales growth.

        We believe platforms adopting integrated hardware security into the PC will become a significant standard feature in the overall PC marketplace. However, our technologies have not been accepted as industry standards. Standards for trusted computing are still evolving. To be successful, we must obtain acceptance of our technologies as industry standards, modify our products and services to meet whatever industry standards ultimately develop, or adapt our products to be complementary to whatever these standards become. If we fail to do any of these, we will not be successful in commercializing our technology; and therefore, we will not generate sales to fund our operations and develop into a self-sustaining, profitable business.

         If we do not keep up with technological changes, our product development and business growth will suffer.

        Because the market in which we operate is characterized by rapidly changing technology, changes in customer requirements, frequent new products, service introductions and enhancements, and emerging industry standards, our success will depend, among other things, upon our ability to improve our products, develop and introduce new products and services that keep pace with technological developments, remain compatible with changing computer system platforms, respond to evolving customer requirements and achieve market acceptance on a timely and cost effective basis. If we do not identify, develop, manufacture, market and support new products and deploy new services effectively and timely, our business will not grow, our financial results will suffer, and we may not have the ability to remain in business.

         We are subject to risks relating to potential security breaches of our software products.

        Although we have implemented in our products various security mechanisms, our products and services may nevertheless be vulnerable to break-ins, piracy and similar disruptive problems caused by Internet users. Any of these disruptions would harm our business. Advances in computer capabilities, new discoveries in the field of security, or other developments may result in a compromise or breach of the technology we use to protect products and information in electronic form. Computer break-ins and other disruptions would jeopardize the security of information stored in and transmitted through the computer systems of users of our products, which may result in significant liability to us and may also deter potential customers.

        A party who is able to circumvent our security measures could misappropriate proprietary electronic content or cause interruptions in our operations and those of our strategic partners. We may be required to expend significant capital and other resources to protect against security breaches or to alleviate problems caused by breaches. Our attempts to implement contracts that limit our liability to our customers, including liability arising from a failure of security features contained in our products and services, may not be enforceable. We currently do not have product liability insurance to protect against these risks.

         Competition and competing technologies may render some or all of our products non-competitive or obsolete.

        An increasing number of market entrants have introduced or are developing products and services that compete with Wave's. Our competitors may be able to develop products and services that are more attractive to customers than our products and services. Many of our competitors and potential competitors have substantially greater financial, technical and marketing resources than we have. Also, many current and potential competitors have greater name recognition and larger customer bases that could be leveraged to enable them to gain market share or product acceptance to our detriment. Wave's potential competitors include security solutions providers such as RSA Security, Inc. (a division

17

Table of Contents

of EMC), Symantec, Computer Associates, Verisign, Inc., Entrust, Inc., Utimaco (acquired by Sophos), SafeNet, WinMagic, Secude and GuardianEdge and major systems integrators such as IBM, HP and EDS. In addition, Wave competes with other client security applications companies that are developing trusted computing applications, including Softex Incorporated, Phoenix Technologies Ltd., Infineon Technologies AG and Microsoft.

        Other companies have developed or are developing technologies that are, or may become, the basis for competitive products in the field of security and electronic content distribution. Some of those technologies may have an approach or means of processing that is entirely different from ours. Existing or new competitors may develop products that are superior to ours or that otherwise achieve greater market acceptance than ours. Due to Wave's early stage, and lower relative name recognition compared to many of our competitors and potential competitors, our competitive position in the marketplace is vulnerable.

         We have a high dependence on relationships with strategic partners that must continue or our ability to successfully produce and market our products will be impaired.

        Due in large part to Wave's early stage and lower name recognition, we depend upon strategic partners such as large, well established personal computer and semiconductor manufacturers and computer systems' integrators to adopt our products and services within the Trusted Computing marketplace. These companies may choose not to use our products and could develop or market products or technologies that compete directly with us. We cannot predict whether these third parties will commit the resources necessary to achieve broad-based commercial acceptance of our technology. Any delay in the use of our technology by these partners could impede or prohibit the commercial acceptance of our products. Although we have established some binding commitments from some of our strategic partners, there can be no assurance that we will be able to enter into additional definitive agreements or that the terms of such agreements will be satisfactory. It will be necessary for Wave to expand upon our current business relationships with our partners, or form new ones, in order to sell more products and services for Wave to become a viable, self-sufficient enterprise.

         Product defects or development delays may limit our ability to sell our products.

        We may experience delays in the development of our new products and services and the added features and functionality to our existing products and services that our customers and prospective customers are demanding. If we are unable to successfully develop products that contain the features and functionality being demanded by these customers and prospective customers in a timely manner, we may lose business to our competitors. In addition, despite testing by us and potential customers, it is possible that our products may nevertheless contain defects. Development delays or defects could have a material adverse effect on our business if such defects and delays result in our inability to meet the market's demand.

         If we lose our key personnel, or fail to attract and retain additional personnel, we will be unable to continue to develop our products and technology.

        We believe that our future success depends upon the continued service of our key technical and management personnel and on our ability to attract and retain highly skilled technical, management, sales and marketing personnel. Our industry is characterized by a high level of employee mobility and aggressive recruiting of skilled personnel. There can be no assurance that our current employees will continue to work for us or that we will be able to hire any additional personnel necessary for our growth. Our future success also depends on our continuing ability to identify, hire, train and retain other highly qualified technical and managerial personnel. Competition for these employees can be intense. We may not be able to attract, assimilate or retain qualified technical and managerial

18

Table of Contents

personnel in the future, and the failure of us to do so would have a material adverse effect on our business.

         We have a limited ability to protect our intellectual property rights and others could infringe on or misappropriate our proprietary rights.

        Our success depends, in part, on our ability to enjoy or obtain protection for our products and technologies under United States and foreign patent laws, copyright laws and other intellectual property laws and to preserve our trade secrets. We cannot assure you that any patent owned or licensed by us will provide us with adequate protection or will not be challenged, invalidated, infringed or circumvented.

        We rely on trade secrets and proprietary know-how, which we protect, in part, by confidentiality agreements with our employees and contract partners. However, our confidentiality agreements may be breached, and we may not have adequate remedies for these breaches. Our trade secrets may also otherwise become known or be independently discovered by competitors. We also rely on intellectual property laws to prevent the unauthorized duplication of our software and hardware products. While we have and will continue to protect our software and our patented technology, intellectual property laws may not adequately protect our technology. We have registered trademark and service mark registrations with the United States Patent and Trademark Office for the marks WaveMeter and WaveNet, EMBASSY, Second Shift (the Wave juggler logo), WaveDirect and Charity Wave. Wave intends to apply for additional name and logo marks in the United States and foreign jurisdictions, as appropriate, but we cannot assure you that federal registration of any of these trademarks will be granted.

         Regulation of international transactions may limit our ability to sell our products in foreign markets.

        Most of our software products are controlled under various United States export control laws and regulations and may require export licenses for certain exports of the products and components outside of the United States and Canada. With respect to our EMBASSY Trust Suite and EMBASSY Trust Server software applications, we have applied for and received export classifications that allow us to export our products, without a license and with no restrictions, to any country throughout the world with the exception of Cuba, Iran, Iraq, Libya, North Korea, Sudan and Syria.

        Enhancements to existing products may, and new products will be subject to reviews by the Bureau of Export Administration to determine what export classification they will receive. Some of our partners demand that our products be allowed to be exported without restrictions and/or reporting requirements. Current export regulations have, in part, allowed us to receive the desired classification without undue cost or effort. However, the export regulations may be modified at any time. Currently, we are allowed to export the products for which we've received classification, in an unrestricted manner without a license. However, modifications to the export regulations could prevent us from exporting our existing and future products in an unrestricted manner without a license. Such modifications could also make it more difficult to receive the desired classification. If export regulations were to be modified in such a way, we may be put at a competitive disadvantage with respect to selling our products internationally.

        In addition, import and export regulations of encryption/decryption technology vary from country to country. We may be subject to different statutory or regulatory controls in different foreign jurisdictions, and as such, our technology may not be permitted in these foreign jurisdictions. Violations of foreign regulations or regulation of international transactions could prevent us from being able to sell our products in international markets. Our success depends in large part to having access to international markets. A violation of foreign regulations could limit our access to such markets and have a negative effect on our results of operations.

19

Table of Contents

         Our stock price is volatile.

        The price of our Class A Common Stock has been and likely will continue to be subject to wide fluctuations in response to a number of events and factors, such as:

•

quarterly variations in operating results;



•

announcements of technological innovations, new products, acquisitions, capital commitments or strategic alliances by us or our competitors;



•

the operating and stock price performance of other companies that investors may deem comparable to us; and



•

news reports relating to trends in our markets.

        In addition, the stock market in general, and the market prices for technology-related companies in particular, have experienced significant price and volume fluctuations. These broad market fluctuations may adversely affect the market price of our Class A Common Stock or any of our other securities for which a market develops, regardless of our operating performance. Securities class action litigation has often been instituted against companies that have experienced periods of volatility in the market price for their securities. It is possible that we could become the target of litigation of this kind that would require substantial management attention and expense. The diversion of management's attention and capital resources could have a material adverse affect on our business. In addition, any negative publicity or perceived negative publicity of any such litigation could have an adverse impact on our business.

         We may be subject to conflicts of interest that could adversely slow our corporate governance process.

        Our current Board of Directors does not include any representatives of our strategic partners. However, our Board of Directors has included in the past, and may include in the future, representatives of our strategic partners. It is possible that those corporations may be competing against us, or each other, directly or indirectly. A director who also represents another company may voluntarily abstain from voting on matters where there could be conflicts of interest. Even if such a director does abstain, his presence on the Board could affect the process or the results of the Board's deliberations. We have adopted no policies or procedures to reduce or avoid such conflicts. If such conflicts of interest arise, they may have a materially adverse effect on our business.

         Governmental regulation may slow our growth and decrease our profitability.

        There are currently few laws or regulations that apply directly to the Internet. Because our business is dependent in significant respect on the Internet, the adoption of new local, state, national or international laws or regulations may decrease the growth of Internet usage or the acceptance of Internet commerce, which could, in turn, decrease the demand for our products and services and increase our costs or otherwise have a material adverse effect on our business.

        Tax authorities in a number of states are currently reviewing the appropriate tax treatment of companies engaged in Internet commerce. New state tax regulations may subject us to additional state sales, use and income taxes.

         If we make any acquisitions, we will incur a variety of costs and may never realize the anticipated benefits.

        If appropriate opportunities become available, we may attempt to acquire businesses, technologies, services or products that we believe are a strategic fit with our business. If we do undertake any transaction of this sort, the process of integrating an acquired business, technology, service or product may result in operating difficulties and expenditures and may absorb significant management attention

20

Table of Contents

that would otherwise be available for ongoing development of our business. Moreover, we may never realize the anticipated benefits of any acquisition. Future acquisitions could result in potentially dilutive issuances of equity securities, the incurrence of debt, contingent liabilities and/or amortization expenses related to certain intangible assets and increased operating expenses, which could adversely affect our results of operations and financial condition.

         If our common stock ceases to be listed for trading on the NASDAQ Capital Market, it may harm our stock price and make it more difficult to sell shares.

        Our common stock is listed on the NASDAQ Capital Market. In order to maintain our NASDAQ listing, NASDAQ Marketplace Rule 4450(b)(4) requires that the bid price for our common stock not fall below $1.00 per share for a period of 30 consecutive trading days. Because of the volatility in our common stock price, there can be no assurance that we will be able to maintain compliance with this requirement. If our minimum bid price remains below $1.00 for 30 consecutive trading days, under the current NASDAQ Capital Market rules, we will have a period of 180 days to attain compliance by meeting the minimum bid price requirement for 10 consecutive days during the compliance period. In the event that we do not regain compliance during such 180 day period, we would be entitled to an additional 180 day compliance period if we meet the other initial listing requirements of the NASDAQ Capital Market at the end of such initial 180 day period. If our common stock ceases to be listed for trading on the NASDAQ Capital Market, we expect that our common stock would be traded on the NASD's Over-the-Counter Bulletin Board (OTC-BB). The level of trading activity of our common stock may decline if it is no longer listed on the NASDAQ Capital Market. As such, if our common stock ceases to be listed for trading on the NASDAQ Capital Market for any reason, it may harm our stock price, increase the volatility of our stock price and make it more difficult to sell your shares of our common stock.

Item 1B.    Unresolved Staff Comments

        None.

Item 2.    Properties

        Summarized below is a listing of properties leased by Wave. Our principal research and development activities are conducted at the Princeton and Cupertino facilities. We believe our office facilities are suitable and adequate for our business as it is presently conducted.

Item 3.    Legal Proceedings

        None.

Item 4.    Removed and Reserved

21

Table of Contents

PART II

Item 5.    Market for Registrant's Common Equity, Related Stockholder Matters and Issuer Purchases of Equity Securities

        On July 24, 2006, our Board of Directors approved a reverse stock split of our common stock at a ratio of one-for-three, causing each three outstanding shares of Class A common stock and Class B common stock to convert automatically into one share of Class A common stock or Class B common stock, respectively. The par value of Class A common stock and Class B common stock remains $0.01 per share. The reverse split became effective at the close of business on July 25, 2006. In lieu of fractional shares, stockholders received a cash payment based on an average trading price of the Class A common stock prior to the effectiveness of the reverse split. Except as otherwise noted, all references to common share and per common share amounts (including warrant shares, shares reserved for issuance and applicable exercise prices) for all periods presented have been retroactively restated to reflect this reverse split.

Market Information & Dividends

        The Class A Common Stock trades on the NASDAQ Capital Market under the symbol "WAVX". The following table sets forth, for the periods indicated, the high and low sales prices per share for the Class A Common Stock. There is no established trading market for our Class B Common Stock.

        As of March 8, 2010, there were approximately 18,600 holders of our Class A Common Stock. As of such date, there were 13 holders of our Class B Common Stock.

        On March 15, 2010 the last sale price reported on the NASDAQ Capital Market for the Class A Common Stock was $3.37.

        We have never declared, nor paid, cash dividends on our Class A Common Stock. We currently anticipate that we will retain all future earnings, if any, to fund the development and growth of our business and do not anticipate paying cash dividends on our Class A Common Stock in the foreseeable future.

22

Table of Contents

Performance Graph

        The following line graph compares the Company's cumulative total return to stockholders with the cumulative total return of the NASDAQ Market Value Index and the Computer Related Services SIC Code Index from December 31, 2004 through December 31, 2009. These comparisons assume the investment of $100 on December 31, 2004 and the reinvestment of dividends. The stock performance on the graph is not necessarily indicative of future stock price performance.

Wave Systems Corp.
Comparison of Cumulative Total Return to Stockholders
December 31, 2004 through December 31, 2009

COMPARISON OF 5-YEAR CUMULATIVE TOTAL RETURN AMONG WAVE SYSTEMS CORP.,
NASDAQ MARKET INDEX AND SIC CODE INDEX

ASSUMES $100 INVESTED ON JAN. 01, 2005
ASSUMES DIVIDEND REINVESTED
FISCAL YEAR ENDING DEC. 31, 2009

Comparison of cumulative total return of one or more companies, peer groups, industry indexes, and/or broad markets

The current composition of SIC Code 7379—Computer Related Services, NEC—is as follows:
Acxiom Corporation
Adept Technology, Inc.
Advanced Techno Grp Ltd
Agilysys, Inc.

23

Table of Contents

Allscripts-Misys Healthcare Solutions Inc
Analysts International
Answers Corporation
AsiaInfo Holdings, Inc.
Aspyra, Inc.
Assure Data, Incorporated
Atlas Technology Group, Inc.
Attunity, Ltd.
Austin Chalk Oil and Gas, Ltd.
Avenue Exchange Corp.
Avistar Communications Corporation
Belzberg Technologies
Blackbaud, Inc.
Blue Coat Systems, Inc.
China Digital Media Corporation
Cimatron Ltd.
CompuMed, Inc.
Computer Horizons Corp.
Data Storage Corp.
Digital Angel Corporation
Dun & Bradstreet Corporation
Edgewater Technology, Inc.
Formula Systems (1985), Ltd. ADR
General Dynamics
Henry Jack & Associates Inc
hereUare, Inc.
Hewlett-Packard Company
IHS, Inc. A
IncrediMail, Ltd.
Inova Technology, Inc.
IOWorldMedia, Inc.
Juniper Networks, Inc.
MDI, Inc.
Navisite, Inc.
Netplex Group, Inc.
Northcore Technologies, Inc.
One Bio Corporation
Open Text Corporation
PICO Holdings, Inc.
QSGI, Inc.
Rackspace Hosting Inc
Roomlinx, Inc
Roomlinx, Inc Pref Share
Sap AG ADR
Scientific Games Corporation
SIN Holdings Incorporated
SXC Health Solutions Corporation
TechTeam Global, Inc.
Telecom Italia Media Spa AZ
Trintech Group PLC ADR
ubroadcast, inc.

24

Table of Contents

Uni Core Holdings Corporation
Verizon Communications Inc.
Xplore Technologies Corporation
Zix Corporation

Securities Authorized for Issuance Under Equity Compensation Plans

        The following pertains to Wave's equity compensation plans as of December 31, 2009:

        Wave equity compensation plans approved by security holders are comprised of 3,866,273 shares of the 1994 Employee Stock Option Plan, 726,902 shares of the 1994 Non-Employee Directors Stock Option Plan and 555,279 shares of the 2004 Employee Stock Purchase Plan.

        Wave equity compensation plans not approved by security holders are comprised of the following:

        Pursuant to placement agency agreements that Wave entered into with Securities Research Associates ("SRA"), in connection with several sales of Class A Common Stock offerings, Wave issued warrants to purchase 845,568 shares of Class A Common Stock at prices ranging from $0.28 to $1.33 per share. No additional warrants are required to be granted pursuant to the placement agency agreements. These warrants are currently exercisable and expire February 11, 2011 through April 8, 2012.

        In connection with an agreement that Wave entered into with an outside sales representative, in 2003 Wave issued warrants to purchase 14,788 shares of Class A Common Stock at prices ranging from $2.85 to $4.35 per share, pursuant to an individual compensation plan with the sales representative. No additional warrants are required to be granted pursuant to the individual compensation plan for the sales representative. These warrants are currently exercisable and expire January 1, 2013 through April 30, 2013.

        In connection with an agreement that Wave entered into with an outside sales representative, in 2007 Wave issued a warrant to purchase 5,000 shares of Class A Common Stock at an exercise price of $1.99 per share, pursuant to an individual compensation plan with the sales representative. No additional warrants are required to be granted pursuant to the individual compensation plan for the sales representative. This warrant is currently exercisable and expires on August 7, 2012.

        Wavexpress issued equity compensation to certain of its employees pursuant to the Wavexpress 1999 Stock Incentive Plan.

25

Table of Contents

Item 6.    Selected Financial Data

        The selected historical consolidated financial data presented below as of December 31, 2009 and 2008 and for the years ended December 31, 2009, 2008, and 2007 are derived from our audited Consolidated Financial Statements contained in Item 8 of this report. The historical consolidated financial data as of December 31, 2007, 2006, and 2005 and for the years ended December 31, 2006 and 2005 are derived from our audited Consolidated Financial Statements, which are not included in this report. This information should be read in conjunction with "Management's Discussion and Analysis of Financial Condition and Results of Operations" and the audited consolidated financial statements and related notes in Part IV, Item 15(a) of this Annual Report on Form 10-K.

26

Table of Contents