Item 1. Business.
Overview
Trusted Information Systems, Inc. ("TIS", or the "Company") provides comprehensive security solutions for protection of computer networks, including global Internet-based systems, internal networks and individual workstations and laptops and is a leading provider of firewall products. TIS, which was founded in 1983 to engage in computer security consulting, draws upon the expertise of a senior management team with an average of more than 20 years of experience in computer security and networking issues in industry and government. The Company emphasizes the robustness of its security solutions, its long experience with computer security and cryptography issues and its ability to provide comprehensive solutions to customers. The Company also emphasizes its strong reputation with corporate and government computer security professionals in the United States and abroad as a pioneer in the field of computer network security. The Company's customers include the following or subsidiaries thereof: Chrysler Corporation, E.I. duPont de Nemours and Company (DuPont), Microsoft Corporation, NationsBank Corporation, Royal Dutch Shell Company (Shell International B.V.), and Swiss Bank Corporation.
The Company develops, markets, licenses and supports the Gauntlet(R) family of firewall products. These products allow customers to create "trusted" networks that are protected from access, theft and damage by unauthorized users from "untrusted" networks such as the Internet and also enable the creation of virtual private networks ("VPNs") through the encrypted transmission of information across untrusted networks. The Company's Gauntlet Internet Firewall, introduced in 1994, was derived from the TIS Internet Firewall Toolkit which has been available on the Internet since 1993 and has been downloaded more than 50,000 times to more than 35,000 discrete locations worldwide. Through December 1996, more than 4,000 Gauntlet Internet Firewalls have been licensed to customers. In January 1996, the Company initiated a telemarketing program to upgrade TIS Internet Firewall Toolkit users to the Gauntlet family of firewall products. To build, maintain and enhance customer relationships, TIS also offers a full range of consulting in information security policies and planning to its customers. The Company further provides research and development and consulting to government agencies, including the National Security Agency ("NSA") and Defense Advanced Research Projects Agency ("DARPA"), in areas such as next generation firewalls, distributed trusted operating systems, Internet domain name services, international cryptography and advanced cryptographic key handling and recovery techniques.
Prior to founding the Company in 1983, Stephen T. Walker, Chairman and Chief Executive Officer, spent over 20 years working on computer security issues for the U.S. government at the NSA and the Advanced Research Projects Agency ("ARPA"), the predecessor agency of DARPA.
Industry Background
The Internet
The Internet, derived from ARPA research in the 1970s, is a global web of inter-connected computer networks which enables commercial organizations, educational institutions, government agencies and individuals to freely communicate, access and share information and conduct business remotely. The networks that constitute the Internet are connected in a variety of ways, including by the public switched telephone network and by high speed, dedicated leased lines.
While there has been significant media interest in the consumer potential of the Internet, business and professional organizations also account for a significant percentage of Internet usage. The recent growth in the Internet has been driven primarily by the increasing popularity of two applications: the World Wide Web and e-mail. The emergence of the World Wide Web allows commercial organizations a new medium in which to publish multi-media documents and other information for public access and to advertise or provide products and services to users. Many such commercial enterprises have established a "home page" to enhance these new market opportunities. Customer service, electronic commerce, advertising and market data generation are all being conducted across the World Wide Web. The growth of e-mail usage on the Internet is being driven by ease-of-use and standardization. Today, there are a number of commercially available e-mail programs that an organization or individual may use to facilitate Internet communications.
The Company believes that full commercial utilization of the Internet has been hampered by lack of security and the vulnerability of the Internet and private networks directly connected to the Internet. The very openness of the Internet means that transmitted information and data stored in connected hosts are exposed to other users who are able, in the absence of effective security measures, to gain access to, manipulate and divert the data. This fundamental weakness mandates that organizations and individuals weigh security concerns against the perceived commercial opportunities presented by millions of Internet users.
Private Networks and Intranets
As network technology has advanced, enterprise computing has evolved from mainframe computers supporting a number of terminals toward networks of inter-connected personal computers. Organizations have developed local area networks ("LANs") to share data and applications within work groups. Increasingly, businesses are using the Internet's non-proprietary TCP/IP protocol for internal network communications which facilitates corporate communications using Internet tools and applications. Internal networks that employ TCP/IP as a network protocol are known as "Intranets."
Organizations are increasingly dependent on electronic communications among geographically dispersed internal operations, customers, suppliers and other partners. Many organizations have connected together LANS, including geographically dispersed networks, into wide-area networks ("WANs"), and further connect multiple LANs and WANs, including remote networks and mobile PCs, over dedicated leased lines or other costly telecommunication links. Private networks can support remote access from other private networks to provide customer support bulletin board services, electronic data interchange ("EDI") and database sharing. Organizations can use the Internet as a low-cost, if less secure, communications "backbone" for a WAN, thereby extending internal information systems and enterprise applications to geographically dispersed facilities, remote offices and mobile employees.
The increasing number of authorized users having direct access to expanding networks and the data contained on such networks has increased the need to provide protection for sensitive data on such networks from unauthorized users with general access to a system. Network administrators face the challenge of creating
accessible, shared LANs and Intranets while protecting the integrity and confidentiality of the information being shared.
Network Security
As a result of the increased use of the Internet and Intranets, unauthorized access to organization networks and corporate data is an increasingly costly business problem. Sensitive data that require protection from unauthorized use include financial results, medical records, personnel files, research and development projects, marketing plans, customer lists and other business information. Unauthorized access to this information may go undetected by the computer user or network administrator, especially if the information is read but not altered by the unauthorized party. Organizations are vulnerable not only to unauthorized access to information resources by outsiders, but also to abuse by employees within their own organizations.
TIS believes the requirements for information security in these complex communications systems can be described in terms of three major requirements:
Confidentiality: controlling who gets to read information
Integrity: assuring that information is changed only in a specified and authorized manner, and
Availability: assuring that authorized users have continued access to information and resources.
The relative importance of these requirements differs depending upon the application. For example, funds transfer systems require strong integrity controls, while product design or mineral exploration systems may focus chiefly on confidentiality.
These information security requirements typically are stated in a security policy--a concise statement of information sensitivities, protection responsibilities and organizational commitment. The Company believes that a strong security policy must state specific security needs in terms which balance the system's risk and vulnerabilities with the need to operate. An organization must consider following in establishing a system security policy:
the value of the asset being protected; the vulnerabilities of the system--what damage can insiders/outsiders do to the system; the threats to the system--can adversaries exploit these vulnerabilities; and the risks to the system--what are the costs of recovery if an adversary exploits a system's vulnerability.
These policies then need to be implemented by the organization at a number of levels, for example, (a) between sections or particular groups within a site, (b) for each site, (c) throughout the organization with its many sites and (d) between the organization, its customers and suppliers. Each level of communications requires the implementation of information security technology to carry out these security policies.
Firewalls
Without any firewall protection, a computer on an untrusted network can easily exploit any weaknesses in the software on a computer on a trusted network.
Firewalls have developed as key elements in implementing different security policies at the different levels within networks. The growth in Internet users and Intranets, as well as the growing concerns about network security, are fueling increasing demand for firewalls. A report released in February 1996 by International Data Corporation projects that firewall product licenses will grow from 10,000 units in 1995 to 1,500,000 units in 2000, while revenue from such licenses will grow from approximately $160 million to approximately $980 million over the same period.
Firewalls provide strong points of defense and controlled, audited access to services at all levels of communications -- both from within and without an organization's private network. A firewall is a computer system that is interposed between two networks, generally an organization's internal or private computer network and a more public or untrusted network. The private, or trusted, network can be as large as the internal network of a Fortune 500 company, or as small as a network serving a single department at a single site. The public or untrusted network can be as specific as the enterprise's network or as general and open as the Internet. One "firewalled" private network can exist inside another. A firewall can restrict the access to a trusted network by user, by application and by location. A firewall can also require users to provide authentication based on cryptography that is much less vulnerable than the simple passwords that have been historically used in computer systems. Thus, any organization linking a trusted network to an untrusted network, either internal or external, will generally and increasingly require a firewall to enforce network security and protect the trusted network.
The two major types of firewalls are filtering gateways and application gateways. Both gateway types work to enforce a network security policy without adversely limiting flexibility or affecting performance. However, each design strikes a different balance between these three goals: filtering gateways sacrifice aspects of security in order to be more flexible and generally provide for performance, and application gateways provide higher security at the expense of some flexibility and performance.
Filtering Gateway Firewalls. Filtering gateway firewalls are either "static" or "dynamic" packet filters. Dynamic filtering is sometimes referred to as "Stateful Multi-Layer Inspection." All filtering gateways make routing decisions based on information contained in each network "packet." If a packet's content meets the security policy criteria, it is forwarded to the destination. Otherwise, it is blocked at the gateways. Static filters, which are typically implemented in routers, examine each packet as it arrives at the gateway and make a routing decision based on the packet's header (information such as source and destination address, protocols, and port numbers) and sometimes on portions of the packet's contents. Dynamic filters can make forwarding decisions based on the application protocols contained within the packets, by maintaining the state of the application program. All filtering gateways are limited in the amount of content filtering that may be done for a given session.
Since filtering gateways operate by routing traffic, they provide direct connectivity between untrusted and trusted networks. This direct connection places a large burden for the network's security policy on internal systems because they are directly exposed for all services the firewall lets through. A typical example is electronic mail: if the filtering gateway is configured to permit inbound e-mail, the security of the e-mail server become critical--if it is running an insecure mail service such as the UNIX "sendmail" program, history has shown that the system will be vulnerable to penetration, and could then be used as a starting place to attack the rest of the computers on the network intended to be protected by the firewall.
Application Gateway Firewalls. Application gateways, also known as proxy gateways, control network connections rather than individual packets. At the point where a connection is requested, the proxy for the given protocol will check the firewall's security policy and decide whether the connection is permitted. If it is, the proxy will than mediate all future traffic for that connection and verify that it conforms to the given protocol and security policy. Application gateways permit or deny connections with mediate traffic based on security policy considerations such as user name, addresses, protocols, and protocol-specific functions (e.g., download data but not upload, e-mail scanning, Java filtering).
Virtual Private Networks (VPNs) Once firewalls are in place at multiple sites on a WAN, the ability to establish encrypted communications links over WANs becomes practical. These VPNs provide the most complete protection among networks, whether among a corporation's internal information systems at different locations or among those locations and widely dispersed customers and suppliers. VPNs permit the safe commercial use of the Internet, thereby providing significant cost savings by reducing reliance on more costly dedicated telecommunications alternatives. A report prepared by an industry consultant indicates that for the set of applications covered, such cost savings could provide a full payback of the VPN investment within the first year of its operation.
Export controls imposed by most governments are a significant impediment to the establishment of Global VPNs ("GVPNs"). Recent initiatives and interim regulations by the U.S. and other governments to allow export of
cryptography when combined with some form of key recovery system offer an excellent opportunity to realize the full potential of GVPNs on an international basis. The Company believes that as appropriate government policies are put in place, the combination of application gateway firewalls and key recovery enabled encryption (such as the Company's RecoverKey/KRT technology) will serve to radically alter the landscape of today's private networks, providing reliable, protected communications through public networks such as the Internet. See "-- Commercial Products and Services -- Cryptographic Products/RecoverKey/Key Recovery Technology (KRT) System."
TIS Strategy
The Company's objective is to be the leading provider of comprehensive security products and services for corporate and government information systems. Essential elements of the Company's strategy include:
Provide Comprehensive Security Solutions. The Company's approach is to develop, market and support a broad range of network security software products for the protection of computer networks, including global Internet-based systems, internal networks and individual workstations and laptops. The Company believes that its integrated approach to network security products and services provides a more comprehensive security solution than the single product offerings marketed by many of its competitors. The Gauntlet family of firewall products currently includes the Gauntlet Internet Firewall, the Gauntlet Intranet Firewall, the Gauntlet Net Extender and the Gauntlet PC Extender. Additionally, the Company offers a full range of expert consulting services in information security policies and planning to commercial enterprises and governments. With the support of government-funded and independent research and development, the Company is developing extensions and enhancements to current firewall technology and applications of cryptography to maintain its position as a leader in providing comprehensive security solutions. The Company has developed enhancements to the Gauntlet family of firewall products, including an enhanced graphical user interface ("GUI"), and has shipped initial versions of its Gauntlet products which support Sun Microsystems' Solaris Version 2 and Microsoft's Windows NT Server Version 4.0. The Company intends to extend its leading positions in network firewalls and encryption technology, including RecoverKey(TM), to enable companies to establish GVPNs.
Increase Market Penetration Through Multiple Channels. The Company's marketing strategy for TIS network security products and services focuses on utilizing both a direct sales force and resellers channels to target large corporations and organizations. The Company intends to continue to expand its current direct sales force to both increase its market penetration and to pursue follow-on sales for TIS network security products and services. The Company intends to continue to focus its direct sales efforts on Fortune 500 companies, particularly those which have a strong need for secure communications within workgroups and among geographically dispersed networks through the Internet. For example, the Company has targeted companies in the telecommunications, finance and banking, petrochemicals and pharmaceuticals industries as those most likely to require network security solutions. The Company intends to emphasize the use by such organizations of the Gauntlet family of firewall products and related services together with cryptography, for enhanced security for sensitive communications. The Company has established customer relationships with the following or subsidiaries thereof: Chrysler Corporation, DuPont, Microsoft Corporation, NationsBank Corporation, Royal Dutch Shell Co., and Swiss Bank Corporation.
The Company has established a significant global resellers channel consisting of over 75 Internet service providers, value added resellers and hardware vendors, system integrators and security product vendors. The Company's resellers are primarily located in the United States, Europe and the Pacific Rim. The Company intends to greatly expand these channels for its network security products and for its cryptographic products, particularly in Europe and the Pacific Rim.
A significant portion of the Company's Gauntlet firewall products customers consist of organizations which have sought upgrades to and support for the TIS Internet Firewall Toolkit available on the Internet. The Company has established a program to identify and pursue entities which have installed firewalls based on the TIS Internet Firewall Toolkit for follow-on sales of Gauntlet firewall products and related services.
Expand Consulting Services. The Company intends to focus on expanding its provision of consulting services to large organizations with respect to the establishment of information security policies and of trusted communications systems, including GVPNs. The Company believes these consulting services will assist companies in enhancing security while reducing communication costs through the effective deployment of the Company's products. In building its consulting services, the Company intends to emphasize the reputation and experience of its senior management and technical staff. The Company also intends to utilize the relationships it establishes through its expanding consulting efforts to generate additional customers for TIS network security products and services.
Leverage Government Research and Engineering. The Company believes its extensive U.S. government-funded research activities can yield major short and long-term product concepts as well as enhance current network security product offerings. Government funding contributes to the Company's ability to maintain a research and engineering staff of over 130 scientists and engineers. With the Gauntlet family of firewall products, the Company has demonstrated its ability to create and market commercial products based on government-funded research results and believes that similar efforts will enable it to implement new advanced products in the future.
TIS Solution
TIS offers a comprehensive set of products and services for the protection of computer networks, including global Internet-based systems, internal networks and individual workstations and laptops. As part of this complete solution, TIS provides consulting services to evaluate and design information security policies and firewall and other network security products that address the major requirements of confidentiality, integrity and availability.
The TIS Trusted System Design Principles, derived from decades of computer security experience, include:
Simplicity in mechanisms and services provided.
Simplicity in software design, development and implementation.
A "Crystal Box" approach, in which source code is made available to allow for assurance reviews by the Company's customers, resellers and other experts.
Logging every event that can be logged; the customer can then customize a complete and appropriate security audit trail.
Supporting all forms of user authentication methods and mechanisms.
Enforcing an organization's security policy, instead of imposing one of its own.
Management believes that the integrity of the Company's security solutions, the simplicity and brevity of its Gauntlet code, the transparency of its "Crystal Box" approach and the experience and expertise of its management team and consultants attract customers to purchase the Company's products and services. In addition, the Company believes that the encryption technology of its firewall products, which allows organizations to establish secure communication between geographically dispersed sites through VPNs and GVPNs, further attracts customers due to the potential cost savings which may be achieved by communicating over the Internet rather than over more expensive, private lines.
Commercial Products and Services
Gauntlet Firewall Products
The following table sets forth certain information regarding certain of the current TIS product offerings.
Internet Firewall Toolkit. The Company introduced its Internet Firewall Toolkit on the Internet in 1993, free for use but not for resale. The TIS Internet Firewall Toolkit, which has been downloaded more than 50,000 times to more than 35,000 discrete locations worldwide, is a collection of computer programs from which a skilled programmer can build an application gateway firewall to secure communications over public networks such as the Internet. To build a firewall from the TIS Internet Firewall Toolkit, the toolkit programs must be compiled on the programmer's hardware and operating systems and the user must configure the operating system on which the firewall is housed to be a suitably secure base for the firewall software. A firewall compiled from the TIS Internet Firewall Toolkit provides basic protection for common Internet applications including e-mail and the World Wide Web browsers and supports user authentication. Compared to the Gauntlet family of firewall products, such a firewall will provide limited management features and lacks firewall-to-firewall encryption that allows the construction of a VPN. Additionally, a firewall built from the TIS Internet Firewall Toolkit generally must be maintained and enhanced by the programmer who constructed it. The Company has initiated a program to upgrade TIS Internet Firewall Toolkit users to the Gauntlet family of firewall products.
Gauntlet Internet Firewall. The Gauntlet Internet Firewall is an application gateway firewall which is the corner-stone of the Company's comprehensive security solution. The Gauntlet Internet Firewall functions as a barrier between the user's trusted network and untrusted networks such as the Internet and was initially based on the TIS Internet Firewall Toolkit. The Gauntlet Internet Firewall enables secure communications over public networks such as the Internet, including firewall-to-firewall encryption that allows a firewall owner to construct a VPN. In addition to standard encryption and VPN capabilities, authentication and proxy services, the Gauntlet Internet Firewall includes a secure GUI for management and includes audit and alert capabilities and tools. The Company introduced the GUI for the Gauntlet Internet Firewall in January 1996 and continues to develop additional enhancements for ease of use and administration. The Gauntlet Internet Firewall software operates on a number of popular versions of the UNIX operating system. The Company has developed and packages as part of the Gauntlet Internet Firewall selective modifications to the operating systems to increase the Gauntlet Internet Firewall's usability and to harden the operating systems to make them more resistant to attack. Because of these modifications, the Gauntlet Internet Firewall is "transparent" and supports network services without requiring action by individual end users or modifications to their client software. Also because of these modifications, the Gauntlet Internet Firewall prevents "spoofing" attacks in which a computer on the untrusted network pretends to be on the trusted network, and it detects attempts from either network to probe for unprotected services or points of access. To date, more than 4,000 Gauntlet Internet Firewall products have been installed.
Gauntlet Intranet Firewall. The Gauntlet Intranet Firewall was designed for improving the internal security of a LAN or Intranet. The Gauntlet Intranet Firewall provides protection against unauthorized access to network resources by internal users, and protects communications among individual PCs within and across workgroups. The Gauntlet Intranet Firewall also currently supports Sun, Hewlett-Packard and BSDI operating systems. The Company introduced its Gauntlet Intranet Firewall product supporting Sun Microsystems' Solaris Versions 2.4.1 and 2.5.1 in the fourth quarter of 1996.
Gauntlet Net Extender. Extending the capabilities of the Gauntlet firewall, the Gauntlet Net Extender is a remote Gauntlet Internet Firewall that network administrators can manage from another Gauntlet Internet Firewall. The Gauntlet Net Extender is marketed to customers which are enterprises with multiple divisions and remote locations. Using encryption, the Gauntlet Net Extender works in conjunction with a Gauntlet Internet Firewall to provide remote site network security and remote management and control from a centralized location. The Gauntlet Net Extender also currently supports Sun, Hewlett-Packard and BSDI operating systems. The Company's Gauntlet Net Extender product supporting Sun Microsystem Solaris Versions 2.4.1 and 2.5.1 was made available in the fourth quarter of 1996.
Gauntlet PC Extender. The Gauntlet PC Extender provides multiple levels of security for remote users utilizing a PC running on Microsoft Windows 3.1 or Microsoft Windows for Workgroups 3.11 to connect to an internal network or communicate within an Intranet. The encryption provided by the Gauntlet PC Extender protects passwords, provides user authentication to prevent unauthorized access to internal network resources and provides data encryption to protect the confidentiality and integrity of information transmitted over the Internet or other public or privacy networks. Gauntlet PC Extender product for PCs supporting Microsoft Windows 95 was made available in the first quarter of 1997.
Gauntlet Internet Firewall for Solaris. The Gauntlet Internet Firewall for Sun's Solaris Operating System is a reimplementation of the Gauntlet Internet Firewall for Solaris, including kernel level changes to support the full range of Gauntlet Internet Firewall features and security. The Company introduced its Gauntlet Internet Firewall for Solaris in the fourth quarter of 1996.
Gauntlet Internet Firewall for Windows NT. The Gauntlet Internet Firewall for Microsoft Windows NT is a complete reimplementation of a Gauntlet Firewall whose internal structure and user interface are adapted to the unique functional and performance attributes of the Windows NT operating system environment. The Company introduced Gauntlet Internet Firewall for Windows NT in the fourth quarter of 1996.
Gauntlet ForceField(TM). Gauntlet ForceField is a World Wide Web security product which protects server platforms from unauthorized tampering while allowing performance and web server access. The Company introduced Gauntlet ForceField(TM) in the fourth quarter of 1996.
The specific uses and applications of the Company's network security products vary significantly among market sectors and business organizations. Examples of actual uses by customers of the Company's products include:
o A U.S. company that is a provider of software solutions for electronic commerce has installed multiple Gauntlet Internet Firewalls at the organization's sites in the United States and abroad to create a GVPN utilizing encryption. This enables personnel at the various domestic and overseas sites to share proprietary software product development and business information securely over the Internet.
o A multi-national banking institution has installed multiple Gauntlet Internet Firewalls on corporate Intranets to enforce the bank's security policies that require isolation of different organizations within the bank located throughout the world. Each Gauntlet Internet Firewall is configured to allow only selected applications to pass financial and other important information onto the appropriate internal system. The Company's "Crystal Box" approach and the ability to log all Internet Firewall activities are essential to enforcement of bank security policy.
o A software industry leader uses a number of Gauntlet Internet Firewalls in a parallel configuration which enables responsive Internet access for internal and external users of its major World Wide Web site. The Gauntlet Internet Firewalls enforce the company's security policies and procedures and protect the company's internal systems and networks, which process over 100,000 e-mail messages a day.
The Gauntlet Internet Firewall is offered by the Company at a U.S. list price of approximately $11,500 for software only and approximately $16,500 for a software/hardware bundle. The Company's U.S. list price for the Gauntlet Net Extender is approximately $10,000, for the Gauntlet Intranet Firewall is approximately $7,500, for the Gauntlet PC Extender is approximately $100, and for the Gauntlet ForceField web security product is approximately $500. Volume discounts are generally available. The Company provides initial on-site installation, testing and training and offers a variety of continuing maintenance and support options to customers of the Gauntlet family of firewall products.
The Company plans to extend its firewall products to include new proxies for new services and to defend against new threats. Customer input will be an important part of the Company's continued development of improvements in ease of use and management functions. In addition, the Company is developing products which will be compatible with Microsoft's Internet Security Framework. This framework provides an open, interoperable and cross-platform set of technologies and enables the effective interface of products developed and marketed by a variety of software companies which will allow individuals to exchange information securely, control access to their systems and conduct secure financial transactions across public networks.
Cryptographic Products/RecoverKey/Key Recovery Technology (KRT) System. The Company's cryptographic products are currently under development and the Company is in negotiations with a number of companies regarding licensing of the RecoverKey/KRT toolkit and the Key Recovery Centers ("KRCs"). The Company has signed licenses for its RecoverKey/KRT products and technology with IBM and Atalla.
RecoverKey/KRT Toolkit. The RecoverKey/KRT toolkit consists of software and a license to the Company's RecoverKey/KRT technology to enable companies to incorporate key recovery technology into their products either to enable their cryptographic functions to satisfy U.S. (and possibly other) government requirements for general export to foreign markets (RecoverKey-International, formerly known as Commercial Key Escrow or CKE). This also enables companies to provide emergency access to encrypted data in case an encryption key is lost or unavailable for any reason (RecoverKey, formerly known as Commercial Key Recovery or CKR). Using the
RecoverKey/KRT toolkit, the vendor can encrypt any user secret (e.g., a key used to encrypt a file) using the public key of a KRC and storing it in a Key Recovery Field ("KRF'). This KRF permits future access to that secret for any reason through the designated KRC.
Key Recovery Centers. KRCs are an essential part of the Company's RecoverKey/KRT. A KRC is a system (hardware and software) with a set of public and private keys for the recovery of encrypted data. A KRC receives and records user registrations which include the access information required for future recovery requests. Upon registration, the user's RecoverKey/KRT-enabled application can create a KRF which will be recognized by the KRC. If a user needs to recover an encrypted file or message, the KRF is sent to the KRC, the user's identity is authenticated and the KRC provides the user with a decrypted version of the key located in the KRF to decrypt the file or message.
Microsoft CAPI Compliant Cryptographic Service Provider (CSP). The Company is developing a Microsoft Cryptographic Application Programming Interface (CAPI) compliant CSP with a domestic version, and an exportable version which has been approved for export by the U.S. government. Both versions will be based on RSA's BSAFE version 3.0 toolkit technology. An exportable version will use the Data Encryption Standard ("DES") algorithm (56 bit) at a 112 bit equivalent key length (TRIPLE-qqDES) in conjunction with RecoverKey-International. The domestic version will use triple DES as its standard mode of operation, but will also be able to interoperate with the exportable version. Both versions will use the Company's RecoverKey/KRT technology and will have optional, user selected, key recovery features.
The Company has been a leader in developing a key recovery solution to enable the interests of national security and law enforcement agencies to be addressed while permitting the export of products with strong cryptography. The U.S. government, both in the context of executive branch decision-making and pending legislation in the U.S. Congress, is actively considering a variety of options regarding cryptography export policy. The Clinton administration's current policy on exportable strong cryptography links the relaxation of export controls to systems that include the use of key recovery. However, certain parties, including companies in the computer industry and members of the U.S. Congress, call for removing export controls on products that use the industry standard DES algorithm. Those options could have an adverse impact on the development of a market for the RecoverKey-International products the Company plans to introduce in the future.
In January 1996, the U.S. government granted the Company an export license for a particular transaction involving the Gauntlet Internet Firewall using the DES algorithm. This is the first export license granted because the encryption is combined with a key recovery system. In June 1996, the U.S. government granted the Company several export licenses to sell the Gauntlet Internet Firewall in order to provide GVPN services. In February 1997, the U.S. government granted the Company an export license exception for the general purpose export of the RecoverKey-International(TM) enabled Gauntlet Internet Firewall and in March 1997, the Company received an export license exception for a version of the CSP incorporating multiple modes of operations including TRIPLE-DES and 128 bit RC2/RC4.
On October 2, 1996, the Company, along with ten other companies including IBM, announced the formation of an alliance to develop an exportable, worldwide approach to strong encryption, using key recovery. This alliance now includes over 50 corporations which meet periodically to help establish a worldwide standard for key recovery, which will promote worldwide interoperability while enabling secure international electronic commerce.
On January 24, 1997, the Company and International Business Machines Corporation ("IBM") entered into a patent and software license agreement. Pursuant to the terms and conditions of the agreement, IBM has been granted the right to use, sell, sublicense and distribute the Company's RecoverKey(TM) technology and IBM is permitted to bundle the Company's technology in IBM products for resale. IBM received a license to make, use, sublicense and sell the Company's Toolkits. IBM also received a license to make and sell key recovery centers that incorporate the Company's proprietary technologies and to operate and sublicense the Company's Key Recovery Centers(TM). Generally, the licenses granted under the agreement terminate upon the expiration of the underlying patents.
Under the terms of the license agreement, the Company will receive fees and royalty revenue from IBM based upon IBM's sale of products that incorporate the Company's technology. At IBM's election, the Company
will perform certain ancillary services and provide maintenance and support, for which the Company also receives revenue.
Commercial Consulting
TIS offers a full range of consulting in information security policies and planning. TIS's Commercial Consulting Practice grew out of the Company's original consulting practice founded by Stephen T. Walker. It is currently led by members of senior management and carried out by TIS's staff of experts who average more than 15 years of information security experience in both commercial and government communities. TIS offers the following commercial consulting services: technology research services; consultation on security issues associated with products and services; corporate information security policy development; architectural and diagnostic security analysis and firewall configuration; and training for corporate network and security administration personnel. TIS's consulting customer base includes a wide range of institutions from financial, industrial, regulatory, entertainment, research, information systems and telecommunications organizations.
Management believes that the Commercial Consulting Practice has and will continue to play a key role in generating follow-on sales of the Company's security products. Corporations with the most complete information security needs, such as those in industries targeted the Company, often look to outside consultants to assist them in designing, maintaining and improving network security systems and policies. The Company believes that its reputation in the field of computer security along with its team of experienced consultants attracts customers to engage TIS's services in solving their complex security needs.
The Commercial Consulting Practice continuously evaluates emerging network services and technologies, the security vulnerabilities inherent in new offerings and evolving methods employed by hackers and professional system penetrators to exploit system vulnerabilities. The findings from this effort not only enable more effective consultation and the development of automated analysis tools, but also feed into the ongoing network security product development and enhancement activities of TIS.
Advanced Research and Engineering
The Company engages in research and development of computer and communications security technology under contracts with departments and agencies of the U.S. government. The Company provides security technology analysis and consulting under contracts both directly and indirectly with the U.S. government and the governments of other countries. Prior to 1996, the principal source of the Company's revenues was from government contracts. In 1994 and 1995, approximately 86% and 68% respectively, of the Company's total revenues were derived directly or indirectly from government contracts. In 1996 the percentage of the Company's total revenue derived from government contracts was 42%. These revenues, along with the Company's reputation as a pioneer in the field of computer and network security, have permitted the Company to assemble a group of renowned scientists and engineers.
The government research and development efforts include Trusted Mach technology, a high assurance operating system base that controls access to all system resources and enforces security policies based upon labels associated with the sensitivity of the resources and access privileges of the users. High-Assurance Firewalls, World Wide Web servers and file servers built on the Trusted Mach(R) technology will provide strong protection for data that is to be shared, either within an organization or externally, but which must also be protected from unauthorized reading or writing. Another operating system security technology derived from government-funded research enforces a broad spectrum of security policies, including those tailored to the user's individual role in an organization. This technology can greatly improve the security of existing operating systems by partitioning their capabilities into various domains. The Company has demonstrated significant improvements to UNIX systems security using this technology.
Other government research and development efforts include the development of prototype secure distributed systems, the incorporation of cryptographic services into various applications and the enhancement and broader application of access control techniques. Under government contracts, the Company has incorporated cryptography into e-mail to provide the ability to digitally sign e-mail in addition to protecting the contents from change or perusal. The Company is developing techniques to improve the security of the Internet infrastructure, such as Domain Name Service and routing, by digitally signing communications between cooperating elements. Security services are being incorporated into distributed systems using access control techniques that work with Common Object Request Broker Architecture (CORBA), an emerging international standard.
Government-related consulting has focused primarily upon security assessment and design assistance for security features and attributes of the systems and applications of the U.S. Department of Defense. The Company's consulting has helped to discover approaches that provide both the security and functionality that is needed to support the defense mission. Many of the security issues and architectures have commercial counterparts, and the Company has generally reserved the rights to develop such related technologies for commercial uses.
The Company's backlog for direct and indirect U.S. government contracts as of December 27, 1996 was approximately $11 million. The government-related backlog represents firm orders or contracts for research, development and consulting analysis with performance and delivery schedules that extend up to 30 months. Funded backlog represents the portion of the backlog for which agencies, departments or companies have actually obligated payment. As of December 27, 1996, approximately $4.7 million of the government-related backlog is funded. The Company's U.S. government contracts are subject to audit by the DCAA. The DCAA has audited the Company's cost accounting system through 1993 without material cost disallowances and is currently performing a similar audit of the Company's cost accounting system for 1994.
Most of the Company's government-related contracts require the Company to perform specified services for which the Company is paid its costs incurred and a negotiated fee. Two contracts for the development of the Trusted Mach technology accounted for approximately 33% of the Company's total revenues during 1995. The smaller contract ended in December 1995. The larger contract, with the NSA, accounted for approximately 25% of the Company's total revenues during 1995 and is currently scheduled to complete in early 1997. Security technology research and development contracts with ARPA accounted for approximately 17% and 15% of the Company's 1995 and 1996 revenues, respectively. During 1995 and 1996, 8% and 1% of the Company's total revenues, respectively, came from security technology research and development contracts with the Air Force Rome Laboratories ("RL").
Sales and Marketing
The Company intends to pursue a focused marketing strategy to achieve greater market penetration for TIS network security products and services by utilizing complementary domestic and international distribution channels, including direct sales, resellers and telesales. The Company believes these channels will provide broad customer coverage while maintaining a highly cost-effective effort. The Company has organized its direct sales, resellers and telesales teams, currently consisting of over 30 employees, on a regional basis in order to approach the market in a coordinated manner. The Company has initiated a strategy of directly marketing to its current base of users who have downloaded the TIS Internet Firewall Toolkit and seeks to convert them into users of Gauntlet products. In addition, the Company's Fortune 500 marketing strategy with large organizations is to establish relationships through consulting assistance in the architectural design, installation and operational phases of their major security initiatives. The Company has attended and plans to continue to attend popular Internet and network shows, advertise in trade journals and submit articles that will deliver its message to decision makers and to the people who make information security recommendations.
Direct Sales. The Company's direct sales force markets its products and services to large corporations and organizations with complex information security needs, such as telecommunications companies, finance and banking institutions, petrochemical companies and pharmaceutical companies. The Company's direct sales staff solicits these customers and provides strategy and solutions as well as insights into security architecture alternatives while gathering insight into customers' future requirements.
Resellers. The Company currently maintains a worldwide network of approximately 75 resellers which can be categorized into four areas based on business segmentation and end user focus: Internet service providers, value added resellers and hardware vendors, system integrators and security product vendors. The Company views these reseller partners as an extension of its direct sales force and supports these relationships with on-going training in security planning, installation and maintenance as well as by providing such resellers with updated information, software enhancements and advance notice of announcements of future products through a TIS World Wide Web site designed specifically for that purpose. The following are some of the Company's resellers in each of the designated categories:
o Internet Service Providers: In the United States, these include BBN Internet Service Corp., PSINet, Inc. and UUNet Technologies, Inc. Unipalm Limited is the Company's Internet service provider reseller in Europe. Internet Initiative Japan is one of the Company's Internet service provider resellers in the Pacific Rim.
o Value Added Resellers and Hardware Vendors: In the United States, these include Data General Corporation and Silicon Graphics, Inc. In Europe and the Pacific Rim, these include Bull Enterprise Systems, HITACHI Ltd. and Sumitomo Electric Systems Company, Ltd.
o System Integrators: These include AvantComp Oy, Conjungi Corporation, Fujitsu Systems Business of Canada, Inc. and Media Communications STM AB.
o Security Product Vendors: These include Hanil Telecom Co., Ltd. in the Pacific Rim and Mergent International, Inc. and V-One in the United States.
The Company's agreements with its resellers generally provide the reseller with a limited license to market, distribute and install the Company's Gauntlet family of firewall products in a particular territory and to make such modifications to the Company's Gauntlet family of firewall products as may be required to serve the customer's needs. The agreements obligate the Company to provide its resellers with updates to the licensed Gauntlet family of firewall products and with ongoing maintenance and support. The reseller is required to provide the Company with periodic reports regarding its activities in connection with such products and to pay related license fees to the Company. The agreements also contain confidentiality, indemnification and warranty disclaimer provisions.
Telesales. The TIS Telesales Team maintains frequent and open communications with customers. The TIS Telesales Team is geographically focused to develop, service and transact business. The 1993 decision to make the Company's firewall technology available via the Company's World Wide Web page proved very successful and of strategic importance. It is currently estimated that there have been more than 50,000 downloads of the TIS Internet Firewall Toolkit to more than 35,000 discrete locations worldwide. The Telesales Team targets members of this user community as potential customers for the Gauntlet family of firewall products. TIS also provides these prospects with information through a Firewall Toolkit user group and Birds of a Feather sessions at conferences. Other leads for the Telesales Team are generated through trade shows, an 800 number, e-mail and direct mailings.
For information regarding the Company's revenues from outside North America, see Note 1 of Notes to Consolidated Financial Statements.
Customer Service and Support
The Company offers extensive training to customers and resellers for firewall installation and management. As part of the training program, the Company provides onsite or offsite classroom instruction and related instructional materials which enable customer and reseller personnel to deliver the first level of support and to tailor a support scenario for a client's unique requirements.
The Company offers support services by e-mail and telephone for its Gauntlet family of firewall products. These services encompass diagnosing problems in the network associated with the firewall and answering questions about configuration and operation alternatives. Most customers purchase support services in the form of a support contract covering a single firewall or in the form of a corporate support agreement. The Company offers a variety of support contracts, including one offering support seven days a week, 24 hours per day (7 x 24).
Research and Development
The Company's research and development efforts are focused on core information security technologies, enhancements to existing technologies and products and development of new products. The Company's information security products research and development program has focused primarily on feature and performance enhancements, expansion of the family of scaleable firewall and cryptographic security products and development of applications of cryptography, in particular those associated with cryptographic key recovery. The Company's government research and development program focuses on extensions and enhancements to current firewall technology, access control techniques for operational systems and networks, the application of cryptography within operating systems, network components and network infrastructure and security for distributed systems. See " -- Advanced Research and Engineering." Through a combination of independent and government-funded research and development efforts, the Company is able to maintain a broad base of computer and network security technology expertise and to remain a leader in information security technology development.
As of December 27, 1996, the Company's research and development staff included more than 140 scientists and engineers. Of these, nine have PhDs, 63 have master's degrees and 70 have bachelor's degrees. The Company believes that its ability to attract and retain a highly qualified technical staff will continue to be essential to the success of its research and development programs. The market for such personnel is highly competitive and the Company's research and development activities could be adversely affected if the Company is unable to attract and retain skilled technical personnel.
In addition to amounts directly funded by the U.S. Government, the Company spent approximately $0.6 million, $1.14 million, and $3.9 million on research and development during fiscal years 1994, 1995 and 1996, respectively. The Company expects to continue to fund research and development efforts independently, through internally generated funds. See "Management's Discussion and Analysis of Financial Condition and Results of Operations -- Liquidity and Capital Resources." The Company believes that the continued scope and progressiveness of its security technology research and development are essential in ensuring the Company's future success in the information security field.
Competition
Competition in the information security market is intense and constantly evolving, and the Company expects such competition to increase in the future. The Company believes that significant competitive factors affecting this market are depth of product functionality, product quality and performance, product price, customer support, conformance to protocols and industry standards and breadth of platform support. In addition, the Company believes that the ability to rapidly develop and implement new products and features for the market is critical. There can be no assurance that the Company can maintain or enhance its competitive position against current and future competitors. Significant factors such as the emergence of new products, fundamental changes in computing technology and aggressive pricing and marketing strategies may also affect the Company's competitive position. Many of these factors are out of the Company's control.
The principal competitors for the Company's government-funded research and development are BBN Corporation, The Open Group (formerly known as "Open Software Foundation"), Secure Computing Corporation and SRI International.
The Company's principal current competitors for its network security products include America Online, Inc.'s Advanced Network and Services subsidiary, Bay Networks Inc., Check Point Software Technologies Ltd., Cisco Systems, Inc., Digital Equipment Corporation, Harris Computer Systems Corporation, International Business
Machines Corporation, Microsoft Corporation, Milkyway Networks Corporation, Morningstar Technologies, Inc., Network Systems Corporation, Raptor Systems, Inc., Secure Computing Corporation, Sun Microsystems, Inc. and V-One. Due to the rapid expansion of the network security market, the Company may face competition from new entrants in the network security industry, possibly including the Company's resellers.
The Company and other entities, including IBM, have received approval from the U.S. Department of Commerce to export products using the DES algorithm without key recovery features under the government's current cryptography export regulations. The Company is currently the only entity that has received approval from the U.S. Department of Commerce to export products using cryptography substantially stronger than the 56 bit DES algorithm (eg. TRIPLE-DES and 128 bit RC2/RC4) provided they incorporate RecoverKey-International(TM) features.
Proprietary Information and Intellectual Property
The Company's success is dependent in part on its proprietary technology. TIS relies on a combination of patent, trade secret, copyright and trademark laws, non-disclosure agreements and contractual provisions to establish and protect its proprietary rights. The Company has received three patents and has three pending domestic patent applications and two pending international patent applications pursuant to the Patent Cooperation Treaty (PCT) on its KRT and computer security technology. The Company has filed foreign applications under the European Patent Convention for the countries of Austria, Belgium, Denmark, France, Germany, Greece, Ireland, Italy, Liechtenstein, Luxembourg, Monaco, Netherlands, Portugal, Spain, Sweden, and United Kingdom. Foreign patent applications are also pending in Australia, Brazil, Canada, China, Japan, S. Korea, Mexico, and the Russian Federation. The Company uses a printed "shrink-wrap" license for users of its products in order to protect certain of its copyrights and trade secrets. The Company attempts to protect its trade secrets and other proprietary information through agreements with suppliers and non-disclosure agreements with employees and consultants and other security measures.
Despite the Company's efforts to protect its proprietary rights, unauthorized parties may attempt to copy aspects of the Company's products or to obtain and use information that the Company regards as proprietary. Policing unauthorized use of the Company's products is difficult, and, while the Company is unable to determine the extent to which piracy of its software products exists, such piracy can be expected to be a persistent problem, particularly in international markets and as a result of the growing use of the Internet. Some courts have held that shrink-wrap licenses, because they are not signed by the licensee, are not enforceable. The laws of Maryland, which the shrink-wrap licenses purport to make the governing law, are unclear on this subject. In addition, there can be no assurance that patent applications filed by the Company will result in patents being issued or that its existing patents, and any patents that may be issued to it in the future, will afford protection against competitors with similar technology; nor can there be any assurance that patents issued to the Company will not be infringed upon or designed around by others or that others will not obtain patents that the Company would need to license or design around.
The Company licenses encryption and other portions of the software included in its products from third parties and its success will depend in part on its continued ability to use technology that is important to the functionality of its products licensed from these or other parties. If its licenses were to be terminated and the Company were unable to obtain licenses to similar software from others there could be a material adverse effect on its financial condition or results of operations.
Employees
As of December 27, 1996, the Company employed 235 people on a full-time basis and 28 people on a temporary or part-time basis. Although the Company has no employment agreement with any of its employees, all employees are required to sign agreements containing confidentiality and non-disclosure provisions. Additionally, the Company hires independent contractors and temporary employees on an as-needed basis to assist with specialized assignments in certain areas, including commercial product development, advanced research and engineering, customer support and installations.
None of the Company's employees is represented by a labor union or is subject to a collective bargaining agreement. The Company considers its relations with its employees to be good.
Regulatory Matters
Certain of the Company's information security products are subject to the export restrictions administered by the U.S. Department of State and the U.S. Department of Commerce, which permit the export of encryption products only with the required level of export license. In addition, these U.S. export laws prohibit the export of encryption products to a number of hostile countries. U.S. export regulations regarding the export of encryption technology require either a transactional export license or the granting of Department of Commerce classification determination. To date, the Company has been able to secure all required U.S. export licenses, including the first two export licenses for transactions involving a network security product using the industry standard DES algorithm (56 bits) and the first classification determination permitting the export of a general purpose cryptographic product containing TRIPLE-DES, which were granted because they included a key recovery system. Additionally, the Company has received several export licenses and favorable classification determinations and has a number of export license and classification determination applications pending before the U.S. government with respect to the export of products utilizing RecoverKey/KRT. There can be no assurance that the Company will continue to be able to secure such licenses in a timely manner in the future, or at all. The Company does not expect that such RecoverKey/KRT products will generate significant revenues prior to 1997. See "-- Commercial Products and Services -- Cryptographic Products/RecoverKey/Key Recovery Technology (KRT) System." In certain foreign countries, the Company's distributors are required to secure licenses or formal permission before encryption products can be imported.
Item 2.
Item 2. Properties.
The Company's principal administrative, research, sales, marketing and consulting facility is located in 44,681 square feet of office space in Glenwood, Maryland which is owned by the Company. The Company leases other domestic research, sales, marketing and consulting offices, including approximately 27,000 square feet in Rockville, Maryland and 1,371 square feet in Lisbon, Maryland. The Company has also entered into a lease for 6,271 square feet in McLean, Virginia. Additional domestic offices are located in Mountain View and Los Angeles, California where the Company leases 4,472 and 3,874 square feet, respectively. The Company also maintains a sales, marketing and consulting office located in 2,675 square feet of leased space in the United Kingdom and a similar facility of approximately 1,000 square feet in Germany. The Company also owns a 1,700 square foot building adjacent to its main facility in Glenwood, Maryland which is currently leased to a local small business. The Company believes that its existing facilities are adequate for its needs and the alternative or additional space will be available as needed.
Item 3.
Item 3. Legal Proceedings.
The Company is not currently engaged in any legal proceedings and is not aware of any pending or threatened litigation that could have a material adverse effect on the Company's business, financial condition or results of operations.
Item 4.
Item 4. Submission of Matters to a Vote of Security Holders.
None.
PART II
Item 5.
Item 5. Market for the Company's Common Equity and Related Stockholder Matters.
The Common Stock of Trusted Information Systems, Inc. is traded on the Nasdaq National Market under the symbol "TISX." Prior to October 10, 1996, there was no established public trading market for any of the Company's securities.
The following table sets forth, for the periods indicated, the range of high and low closing sales price for the Common Stock as reported on the Nasdaq National Market.
Fiscal 1996 High Low ---- --- Fourth Quarter (from October 10, 1996) 17 3/4 10
Fiscal 1997 High Low ---- --- First Quarter (through March 14, 1997) 18 3/8 10
On March 14, 1997, the last reported sale price of the Common Stock was $14.75 per share. As of March 14, 1997, the Company had approximately 200 shareholders of record.
The Company has never declared or paid any cash dividends on its common stock. In addition, the agreements relating to certain of the Company's borrowings from Mercantile-Safe Deposit & Trust Company ("Mercantile Bank") restrict the Company's ability to pay cash dividends without Mercantile Bank's consent. The Company intends to retain its earnings to fund development of its business and does not anticipate paying cash dividends in the foreseeable future.
Item 6.
Item 6. Selected Consolidated Financial Data.
The consolidated statement of operations data set forth below for the fiscal years ended December 30, 1994, December 29, 1995 and December 27, 1996 and the consolidated balance sheet data at December 29, 1995 and December 27, 1996 are derived from, and should be read in conjunction with, the audited consolidated financial statements of the Company. The consolidated statements of operations data for the fiscal years ended December 25, 1992 and December 31, 1993, and the consolidated balance sheet data at December 25, 1992, December 31, 1993 and December 30, 1994 are derived from audited or unaudited consolidated financial statement of the Company not included herein. The unaudited consolidated financial statements include all adjustments (consisting only of normal recurring adjustments and accruals) that in the opinion of management are necessary for a fair presentation of the financial information set forth therein. The selected financial data set forth below are qualified in their entirety by, and should be read in conjunction with, the consolidated financial statements, the related notes thereto and "Management's Discussion and Analysis of Financial Condition and Results of Operations."
Item 7.
Item 7. Management's Discussion and Analysis of Financial Condition and Results of Operations.
Management's Discussion and Analysis of Financial Condition and Results of Operations and other parts of this Annual Report contain forward-looking statements which involve risks and uncertainties. The Company's actual results could differ materially from the results discussed in forward-looking statements.
Overview
Trusted Information Systems, Inc. founded in 1983, provides comprehensive security solutions for protection of computer networks, including global Internet-based systems, internal networks and individual workstations and laptops and is a leading provider of firewall products. The Company currently has two operating divisions: the Commercial Division and the Advanced Research and Engineering ("AR&E") Division.
The Commercial Division
The Commercial Division derives revenues from the Company's Gauntlet family of firewall products, its commercial consulting services, and from its RecoverKey(TM) exportable cryptography enabling products. The Commercial Division accounted for 14.2%, 31.9%, and 57.9% of the Company's total revenues in 1994, 1995 and 1996, respectively. The Company expects that the Commercial Division will account for an increased percentage of total revenues in future years.
Prior to 1996, the Company distributed its only revenue producing product, the Gauntlet Internet Firewall which was introduced in 1994, exclusively through resellers and a sales administration staff. The Company presently has more than 100 persons to develop, promote, sell and deliver its network security products and services, including the Gauntlet family of firewall products. Prior to 1996, the Company's Gauntlet Internet Firewall was licensed as software or as software and hardware on one platform, frequently combined (or "bundled") with installation for pricing purposes. Since April 15, 1996, installation for the Gauntlet family of firewall products has been offered as a separate (or "unbundled") optional service provided to customers.
During 1996 the Company began to incur and expects to continue to incur substantial increases in its selling, general and administrative expenses as it builds its marketing and sales efforts to support sales of the Gauntlet Internet Firewall product and of its other products introduced in 1996: the Gauntlet Intranet Firewall, the Gauntlet Net Extender, the Gauntlet PC Extender, the Gauntlet Internet Firewall for Solaris, the Gauntlet Firewall for Windows NT, the Gauntlet ForceField, and certain of its RecoverKey(TM) exportable cryptography products. In addition, the Company expects to further expand its research and development organization, particularly with regards to its RecoverKey(TM) technology, and make additional investment in its general and administrative infrastructure. As a result, the Company expects operating margins to decrease from historical levels. The amount and timing of these additional expenditures are likely to result in fluctuations in operating margins. Any material reduction in gross or operating margins could materially adversely affect the Company's operating results.
The Company offers a full range of consulting in information security planning and product support. The Company's commercial consulting practice offers expert technology research services, consultation on security issues associated with products and services, corporate information security policy development, architectural and diagnostic security analysis services, firewall configuration and maintenance support, and training for corporate network and security administration personnel. These services are carried out by a staff of 20 persons who average more than 15 years of information security experience in both commercial and government organizations.
The Advanced Research and Engineering Division
The Advanced Research and Engineering Division consists primarily of research, development and consulting in computer and related security systems, currently including major contracts with three agencies of the U.S. government: the NSA, Air Force Rome Laboratories ("RL") and Defense Advanced Research Projects Agency ("DARPA"), formerly ARPA. Revenues from the AR&E Division increased consistently through 1995, but
decreased in 1996. The aggregate award value of the Company's nine major active government contracts is approximately $37.1 million. In October 1993, the Company began providing services under the largest of these current contracts, with the NSA, which is valued at $14.8 million and is expected to expire in early 1997. Of the five contracts with DARPA, which range in value from $0.7 million to $9.1 million and have all commenced in the preceding four years, one expires during 1997 and four expire during 1998. While the Company expects to continue to obtain government contracts for its AR&E Division, it does not anticipate that revenues from such contracts will attain the levels realized in 1995.
Most of the Company's government contracts provide for compensation to the Company in the form of reimbursement of costs plus a fee. Gross profit under government contracts generally represents the fee plus recovered operating expenses. Under these government contracts, the Company is entitled to recover associated direct labor costs, overhead and selling, general and administrative expenses, including allowable research and development expenses. Selling, general and administrative expenses allowable under government contracts include salaries and benefits, marketing, bid and proposal costs, management, accounting, legal and contract administration and certain other administrative expenses.
Under its government contracts, the Company bears the risk that recoverable expenses billed by the Company are subject to review and audit by the Defense Contract Audit Agency (the "DCAA"). The DCAA has audited the Company's cost accounting system through 1993 without any significant disallowances and is currently performing a similar audit of the Company's cost accounting system for 1994. Pursuant to their terms, these contracts are also subject to termination at the convenience of the applicable government agency. If the contract is terminated, the Company would typically be reimbursed for its costs to the date of termination plus the cost of any orderly termination and would be paid a portion of the fee.
Results of Operations
Fiscal 1996 Compared to Fiscal 1995
Revenues. The Company's total revenues increased 45.8% to $26,370,081 in 1996 from $18,090,087 in 1995. Commercial product revenues increased 218.4% to $13,597,549 in 1996 from $4,270,294 in 1995, primarily because of increased sales of licenses of Gauntlet Internet Firewalls directly to customers and through the Company's resellers. Commercial consulting services revenues increased 12.4% to $1,677,285 in 1996 from $1,491,661 in 1995, primarily because of the Company's completion of a substantial number of commercial consulting contracts during the third and fourth quarters of 1996. Government contract revenues decreased 10.0% to $11,095,247 in 1996 from $12,327,502 in 1995, primarily because of the Company's reallocation of personnel to its commercial activities.
Gross Profit. Gross profit increased 96.2% to $14,176,628 in 1996 from $7,225,140 in 1995 primarily due to the increase in the Company's commercial product sales. The gross profit associated with commercial products increased 227.8% to $10,256,652 in 1996 from $3,128,642 in 1995, primarily because of increased shipments of Gauntlet firewall products. The gross profit on commercial consulting services increased 12.4% to $689,591 in 1996 from $613,715 in fiscal 1995, primarily because of increased revenues. Gross profit from the Company's government contracts decreased 7.3% to $3,230,385 in 1996 from $3,482,783 in 1995, primarily because of lower related revenues.
As a percentage of related revenues, gross profit on commercial products increased to 75% in 1996 from 73% in 1995, primarily due to increased margins on sales through the Company's resellers. As a percentage of related revenues, gross profit on commercial consulting and government contracts remained virtually unchanged at 41% and 29%, respectively, for fiscal years 1996 and 1995.
Selling, General and Administrative Expenses. Selling, general and administrative expenses increased 271.3% to $13,841,618 in 1996 from $3,727,701 in 1995, due primarily to the substantial increase in personnel and related operating costs associated with the increase in the Company's commercial products sales, as well as the Company's efforts towards developing the infrastructure to support the current and future commercial revenue growth.
Research and Development Expenses. Research and development expenses, which do not include such expenses directly reimbursed under government contracts, increased 243.9% to $3,936,825 in 1996 from $1,144,737 in 1995. This increase primarily resulted from the Company's efforts in developing the new members of the Gauntlet family of firewall products announced in April of 1996. These efforts included developing new members of the Gauntlet family of firewall products, the Microsoft Windows NT and Sun Microsystems' Solaris firewall product versions and its RecoverKey(TM) exportable cryptography enabling products.
Interest and Other Expense. Interest expense increased 161.5% to $415,243 in 1996 from $158,778 in 1995 due to the Company's increased borrowings under its short term lines of credit and its construction credit line. Interest income increased by 807.7% to $456,345 in 1996 from $50,276 in 1995 due to interest earned on cash and marketable securities generated by the proceeds from the Company's initial public offering, which occurred in October, 1996.
Fiscal 1995 Compared to Fiscal 1994
Revenues. The Company's total revenues increased 37.9% to $18,090,087 in 1995 from $13,117,152 in 1994. Commercial product revenues increased 325.6% to $4,270,924 in 1995 from $1,003,498 in 1994, primarily because of increased sales of licenses of Gauntlet Internet Firewalls directly to customers and through the Company's resellers. Commercial consulting services revenues increased 74.3% to $1,491,661 in 1995 from $855,638 in 1994 primarily because of the Company's completion of a substantial number of commercial consulting contracts during 1995. Government contract revenues increased 9.5% to $12,327,502 in 1995 from $11,258,016 in 1994.
Gross Profit. Gross profit increased 47.0% to $7,225,140 in 1995 from $4,914,495 in 1994. This increase was primarily the result of higher gross profit associated with the Gauntlet Internet Firewall, which increased 366.3% to $3,128,642 in 1995 from $670,994 in 1994. The gross profit on commercial products as a percentage of related revenues increased to 73.3% in 1995 from 66.9% in 1994 because of increased margins on the Gauntlet Internet Firewall overall and an increase in the percentage of sales through resellers at higher margins than for direct sales. The gross profit on commercial consulting services decreased slightly to 41.1% in fiscal 1995 from 42.4% in fiscal 1994. Gross profit from the Company's government contracts decreased 10.3% to $3,482,783 in 1995 from $3,881,084 in 1994, primarily because the Company shifted resources to its commercial products. As a percentage of related revenues, the gross profit for government contract revenues decreased to 28.3% in 1995 from 34.5% in 1994 because certain of the Company's government contracts provided for higher fees on the earlier installments under those contracts, generating higher margins in 1994.
Selling, General and Administrative Expenses. Selling, general and administrative expenses increased 24.3% to $3,727,701 in 1995 from $2,997,806 in 1994, primarily due to the Company's overall increase in operations and to the Company's efforts in late 1995 to initiate dedicated commercial marketing and sales efforts.
Research and Development Expenses. Research and development expenses increased 77.2% to $1,144,737 in 1995 from $646,001 in 1994, primarily because the Company increased its budget for funding research and development efforts and began to commit substantial resources to developing its commercial products, including activities in encryption and additional platform applications for the Gauntlet Internet Firewall.
Interest Expense. Interest expense increased 18.3% to $158,778 in 1995 from $134,236 in 1994, due primarily to an increase of approximately $2.2 million during 1995 in the Company's borrowings under its revolving and construction credit lines.
Quarterly Results of Operations
The following tables set forth certain unaudited consolidated statement of operations data for each of the four quarters in 1995 and 1996, as well as the percentage of the Company's revenues represented by each item. The unaudited consolidated financial statements have been prepared on the same basis as the audited consolidated financial statements contained herein and include all adjustments (consisting only of normal recurring adjustments) that the Company considers necessary for a fair presentation of such information when read in conjunction with the Company's Consolidated Financial Statements and accompanying notes. The Company believes that quarter-to-quarter comparisons of its financial results are not necessarily meaningful and should not be relied upon as an indication of future performance.
Liquidity and Capital Resources
Since its inception, the Company has financed its operations and the purchase of property and equipment through the issuance of common stock, borrowings under short-term lines of credit, secured notes payable and stockholder loans and the generation of cash from operations. Cash and cash equivalents were $1,838,787 at December 27, 1996 and $53,859 at December 29, 1995, and marketable securities were $39,127,069 at December 27, 1996, as compared to no marketable securities at December 29, 1995. The Company provided cash from operations of $1,279,505 and $1,237 respectively, for fiscal years 1994 and 1995, but used cash in operations of ($3,265,886) for fiscal year 1996. Net cash provided by or used in operations for the fiscal years 1994 and 1995 consisted primarily of net income, plus growth in the Company's accounts payable, accrued expenses and deferred revenues, offset by growth in the Company's accounts receivable. For the year ended December 27, 1996, the Company used cash to fund its net loss of $2,164,203, which were the primary components of the net cash used in operating activities for the period, and to fund the growth in its accounts receivable and unbilled receivables of $1,843,777, offset by cash provided from increasing various accrued expenses. The decline in cash provided by operations in 1996 as compared to previous years was primarily the result of funds consumed as the Company began to expand its commercial activities and introduce new products.
During fiscal years 1994, 1995 and 1996, the Company used cash in investing activities of $192,165, $2,095,829 and $3,327,988, respectively, to purchase property and equipment. Of these amounts, approximately $1,340,000 and $1,520,000 in 1995 and 1996, respectively, were spent in connection with the purchase or construction of the Company's Glenwood, MD facilities. The Company also used cash in investing activities during the three months ended December 27, 1996 of $36,699,949 to purchase marketable securities.
The Company provided cash in financing activities for fiscal year 1995 of $1,885,931 primarily through net borrowings offset by cash used to repurchase stock from a former officer. The Company generated cash from financing activities for fiscal year 1996 of $45,060,967, primarily from net proceeds from the issuance of 3,910,000 shares of common stock in October, 1996 in an initial public offering.
At December 29, 1995, the Company had various short-term line of credit arrangements with Mercantile Bank aggregating $2 million. During 1996, the Company arranged for additional credit agreements and modified existing credit agreements with Mercantile Bank to provide for additional borrowings to fund the Company prior to its initial public offering. Subsequent to September 27, 1996, in conjunction with the Company's initial public offering, the Company paid off and terminated these line of credit arrangements.
As of December 27, 1996, the Company had no material commitments for capital expenditures.
In 1995, the Company negotiated a construction loan in the amount of $1.8 million to provide for the expansion of its facilities at its Glenwood, Maryland location. At the end of May 1996, the Company had completed its expansion and substantially drawn down the total amount of its construction loan which was converted in December, 1996 into mortgage notes payable to Mercantile Bank with a fixed interest rate. In conjunction with these mortgage notes, the Company is required to meet a minimum liquidity level of $5 million and a minimum tangible net worth of $20 million.
The Company intends from time to time to evaluate potential acquisitions of businesses, products and technologies that could complement or expand the Company's business. At the current time, the Company has no plans, agreements or commitments for any such acquisitions and is not engaged in any negotiations with respect thereto.
The Company has not engaged in any hedging activities to date. Exposure to currency risk is not significant.
While the company may require additional financing to fund development of new products and expansion of its domestic and international operations, it believes that the net proceeds from the Offering, together with existing cash and cash equivalents, cash generated from operations and cash available through its credit and note payable arrangements, will be sufficient to finance its product development and operating needs through December 1997.
Certain Factors that May Affect Future Results of Operations
Except for the historical information contained in this report, the matters discussed and the statements made in this Annual Report concerning the Company's future prospects are "forward-looking statements" under the Federal securities laws that involve risks and uncertainties. There can be no assurance that future results will be achieved, and actual results could differ materially from forecasts and estimates. Important factors that could cause actual results to differ materially include, but are not limited to, the Company's transition to commercial product vendor, its ability to manage growth, the potential significant fluctuations in quarterly operating results and lengthy sales cycle, certain sales and distribution risks, risks associated with information security market, new product introductions, changes in technology, dependence on the Internet, risks of doing business with the U.S. Government, risks of error or failures, risks associated with international sales, the effect of government regulation on technology exports and dependence on key personnel.
The Company is currently devoting significant resources toward the development of versions of Gauntlet Internet firewall products, RecoverKey/KRT products, and enhancements to these families of products. There can be no assurance that the Company will successfully complete the development of these products in a timely fashion, or that the Company's current or future products will achieve market acceptance. Any inability of the Company to develop products on a timely basis that address changing customer requirements may have an adverse effect on the Company's results of operations. In addition, the Company anticipates significant quarterly fluctuations in its operating results in the future. Any shortfall in revenue or earnings from levels expected by securities analysts could have an immediate and significant adverse effect on the trading price of the Company's common stock in any given period. In addition to factors specific to the Company, changes in analysts' earnings estimates for the Company or its industry and factors affecting the securities market in general will often result in significant volatility of the Company's common stock.
Item 8.
Item 8. Financial Statements and Supplementary Data.
The information required by Item 8 of Part II is incorporated herein by reference to the Consolidated Financial Statements filed with this report; see Item 14 of Part IV.
Item 9.
Item 9. Changes in and Disagreements with Accountants on Accounting and Financial Disclosure.
None.
PART III
Item 10.
Item 10. Directors and Executive Officers of the Company.
The information required by Item 10 is hereby incorporated by reference from the Proxy Statement of Trusted Information Systems, Inc.
Item 11.
Item 11. Executive Compensation.
The information required by Item 11 is hereby incorporated by reference from the Proxy Statement of Trusted Information Systems, Inc.
Item 12.
Item 12. Security Ownership of Certain Beneficial Owners and Management.
The information required by Item 12 is hereby incorporated by reference from the Proxy Statement of Trusted Information Systems, Inc.
Item 13.
Item 13. Certain Relationships and Related Transactions.
The information required by Item 13 is hereby incorporated by reference from the Proxy Statement of Trusted Information Systems, Inc.
PART IV
Item 14.
Item 14. Exhibits, Financial Statement Schedules and Reports on Form 8-K.
- ------------------- * Previously filed as an exhibit to the Company's Registration Statement Number 333-5419 on Form S-1 and incorporated herein by reference. ** Filed herewith. + Portions of this Exhibit were omitted and have been filed separately with the Secretary of the Commission pursuant to the Registrant's Application Requesting Confidential Treatment under Rule 24b-2 of the Securities Exchange Act of 1934, as amended, filed on March 27, 1997.
- ---------------------------
(b) Reports on Form 8-K
None.
(c) Exhibits
The exhibits required by this Item are listed under Item 14(a)(3).
(d) Financial Statement Schedule
Financial statement schedules are omitted because they are not required.
- --------------------------------------------------------------------------------
- --------------------------------------------------------------------------------
Trusted Information Systems, Inc.
Report of Independent Auditors Consolidated Balance Sheets at December 29, 1995 and December 27, 1996 Consolidated Statements of Operations for the years ended December 30, 1994, December 29, 1995 and December 27, 1996 Consolidated Statements of Shareholders' Equity for the years ended December 30, 1994, December 29, 1995 and December 27, 1996 Consolidated Statements of Cash Flows for the years ended December 30, 1994, December 29, 1995 and December 27, 1996 Notes to Consolidated Financial Statements
REPORT OF INDEPENDENT AUDITORS
The Board of Directors and Shareholders Trusted Information Systems, Inc.
We have audited the accompanying consolidated balance sheets of Trusted Information Systems, Inc. as of December 29, 1995 and December 27, 1996 and the related consolidated statements of operations, shareholders' equity, and cash flows for each of the three years in the period ended December 27, 1996. These financial statements are the responsibility of the Company's management. Our responsibility is to express an opinion on these financial statements based on our audits.
We conducted our audits in accordance with generally accepted auditing standards. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement. An audit includes examining, on a test basis, evidence supporting the amounts and disclosures in the financial statements. An audit also includes assessing the accounting principles used and significant estimates made by management, as well as evaluating the overall financial statement presentation. We believe that our audits provide a reasonable basis for our opinion.
In our opinion, the consolidated financial statements referred to above present fairly, in all material respects, the financial position of Trusted Information Systems, Inc. at December 29, 1995 and December 27, 1996, and the consolidated results of its operations and its cash flows for the three years in the period ended December 27, 1996, in conformity with generally accepted accounting principles.
/s/ Ernst & Young LLP
Vienna, Virginia February 28, 1996
Trusted Information Systems, Inc.
Consolidated Balance Sheets
December 29, December 27, 1995 1996 ------------ ------------ Assets Current assets: Cash and cash equivalents.................. $ 53,859 $ 1,838,787 Marketable securities...................... -- 39,127,069 Accounts receivable, net of allowance of $44,000 and $174,592 for 1995 and 1996, respectively............................ 4,304,536 5,803,361 Unbilled receivables....................... 1,401,418 1,746,370 Prepaid expenses and other current assets.. 258,438 952,822 Refundable income taxes.................... -- 1,507,121 Deferred income taxes...................... 426,390 -- ------------ ------------ Total current assets......................... 6,444,641 50,975,530 Property and equipment, net.................. 3,715,090 6,695,524 Other assets................................. 62,072 332,539 ------------ ------------ Total assets................................. $ 10,221,803 $ 58,003,593 ============ ============
Liabilities and shareholders' equity Current liabilities: Accounts payable........................... $ 689,537 $ 906,706 Accrued payroll and related expenses....... 1,384,738 2,470,429 Accrued expenses........................... 1,342,421 1,861,648 Income taxes payable....................... 122,174 -- Deferred income taxes...................... -- 403,324 Deferred revenue........................... 1,011,992 2,072,266 Short-term borrowings...................... 1,523,000 -- Notes payable, current portion............. 160,662 150,857 ------------ ------------ Total current liabilities.................... 6,234,524 7,865,230 Notes payable, net of current portion........ 1,580,000 2,424,355 Other non-current liabilities................ -- 47,365 ------------ ------------ Total liabilities............................ 7,814,524 10,336,950 Commitments.................................. -- -- Shareholders' equity: Preferred stock, $.01 par value; 5,000,000 shares authorized; no shares issued or outstanding............................... -- -- Common stock, $.01 par value; 40,000,000 shares authorized; 6,933,611 and 11,489,704 shares issued and outstanding at December 29, 1995 and December 27, 1996, respectively........................ 69,336 114,897 Additional paid-in capital................. -- 46,809,343 Unrealized gains, net of income taxes of $932,838................................... -- 1,495,162 Foreign currency translation adjustment.... (5,121) 12,663 Retained earnings.......................... 2,343,064 178,861 Deferred stock compensation................ -- (944,283) ------------ ------------ Total shareholders' equity................... 2,407,279 47,666,643 ------------ ------------ Total liabilities and shareholders' equity... $ 10,221,803 $ 58,003,593 ============ ============
The accompanying notes are an integral part of these consolidated financial statements.
Trusted Information Systems, Inc.
Consolidated Statements of Operations
Year Ended Year Ended Year Ended December 30, December 29, December 27, 1994 1995 1996 ---- ---- ---- Revenues: Government contracts... $11,258,016 $ 12,327,502 $ 11,095,247 Commercial products.... 1,003,498 4,270,924 13,597,549 Commercial consulting services............. 855,638 1,491,661 1,677,285 ----------- ------------- ---------------- 13,117,152 18,090,087 26,370,081 Cost of revenues: Government contracts... 7,376,932 8,844,719 7,864,862 Commercial products.... 332,504 1,142,282 3,340,897 Commercial consulting services............. 493,221 877,946 987,694 ----------- ------------- ---------------- 8,202,657 10,864,947 12,193,453 ----------- ------------- ---------------- Gross profit............. 4,914,495 7,225,140 14,176,628
Operating expenses: Selling, general and administrative....... 2,997,806 3,727,701 13,841,618 Research and development 646,001 1,144,737 3,936,825 ----------- ------------- --------------- 3,643,807 4,872,438 17,778,443 --------- --------- --------------- Income (loss) from operations............. 1,270,688 2,352,702 (3,601,815) Other income (expense): Interest income........ 44,635 50,276 456,345 Interest expense....... (134,236) (158,778) (415,243) ----------- ------------- ---------------- (89,601) (108,502) 41,102 Income (loss) before income --------- --------- ---------- taxes.................. 1,181,087 2,244,200 (3,560,713)
Income tax provision (benefit).............. 505,646 900,137 (1,396,510) ------- ------- ---------- Net income (loss)........ $ 675,441 $ 1,344,063 $ (2,164,203) =========== ============= =================
Net income (loss) per share.................... $ .08 $ .15 $ (.25) =========== ============= ================= Weighted average shares outstanding............ 8,525,910 8,884,755 8,645,862 ========= ========= =========
The accompanying notes are an integral part of these consolidated financial statements.
Trusted Information Systems, Inc.
Consolidated Statements of Shareholders' Equity
The accompanying notes are an integral part of these consolidated financial statements.
Trusted Information Systems, Inc.
Consolidated Statements of Cash Flows
Year Ended Year Ended Year Ended December 30, December 29, December 27, 1994 1995 1996 ---- ---- ---- Operating activities Net income (loss)............... $ 675,441 $ 1,344,063 $(2,164,203) Adjustments: Depreciation.................. 191,615 261,020 347,552 Deferred income taxes......... (102,456) (136,386) (133,244) Amortization of deferred stock compensation................ -- -- 161,217 Changes in operating assets and liabilities: Accounts receivable and unbilled receivables...... (383,461) (3,131,057) (1,843,777) Prepaid expenses and other current assets............ (53,857) (119,829) (694,384) Other assets................ (52,218) 22,065 (270,467) Accounts payable............ 172,593 219,099 217,156 Accrued payroll and related expenses.................. 272,096 332,770 1,085,691 Other accrued expenses...... 185,500 486,332 519,227 Other non-current liabilities -- -- 47,365 Income taxes payable/refundable........ 378,835 (276,546) (1,598,295) Deferred revenue............ (4,583) 999,706 1,060,274 --------- --------- ---------- Net cash provided by (used in) operating activities.......... 1,279,505 1,237 (3,265,888) Investing activities Purchases of property and equipment..................... (192,165) (2,095,829) (3,327,986) Purchase of marketable securities.................... -- -- (36,699,949) -------- ---------- ----------- Net cash used in investing activities.................... (192,165) (2,095,829) (40,027,935) Financing activities Proceeds from issuance of common stock, net of related costs... -- -- 45,402,650 Proceeds from exercise of stock options....................... 6,380 3,233 346,754 Repurchase of common stock...... -- (407,520) -- Net borrowings (repayments) of short-term borrowings......... (390,000) 1,523,000 (1,523,000) Proceeds from issuance of notes payable....................... -- 1,036,299 1,801,777 Repayments of notes payable..... (471,269) (269,081) (967,214) -------- ---------- ----------- Net cash (used in) provided by financing activities.......... (854,889) 1,885,931 45,060,967 -------- ---------- ----------- Effect of exchange rate changes on cash.......................... (7,805) 982 17,784 -------- ---------- ----------- Net change in cash and cash equivalents................... 224,646 (207,679) 1,784,928 Cash and cash equivalents at beginning of period........... 36,892 261,538 53,859 -------- ---------- ----------- Cash and cash equivalents at end of period........................ $ 261,538 $ 53,859 $ 1,838,787 ========== =========== ============ Supplemental disclosures of cash flow information Interest paid during the period. $ 129,119 $ 162,724 $ 497,398 ========== =========== ============ Income taxes paid during the period........................ $ 126,811 $ 1,176,683 $ 325,537 ========== =========== ============
The accompanying notes are an integral part of these consolidated financial statements.
Trusted Information Systems, Inc.
Notes to Consolidated Financial Statements
(Information as of December 27, 1996 and for the years ended December 30, 1994, December 29, 1995 and December 27, 1996)
1. Basis of Presentation and Significant Accounting Policies
Basis of Presentation of Financial Statements
Description of Business
Trusted Information Systems, Inc. (the "Company" or "TIS") provides comprehensive security solutions for the protection of computer networks, including global Internet-based systems, internal networks and individual workstations and laptops. The Company develops, markets, licenses, and supports the Gauntlet family of firewall products and other network security products as well as TIS' patented RecoverKey(TM) technology which is the first and only key recovery system to meet current U.S. government requirements for exporting of cryptography with key recovery technology. In addition to providing leading edge information security products, TIS performs an array of services in the areas of cryptography, security consulting, training, and advanced research and engineering for commercial and government customers on a worldwide basis.
Fiscal Periods
The Company's fiscal year is based on a 52-53 week year ending on the last Friday in December. The years ended December 30, 1994, December 29, 1995 and December 27, 1996 were 52-week years. Each of the Company's fiscal quarters consists of a 13-week period.
Principles of Consolidation
The accompanying consolidated financial statements include the accounts of the Company and its wholly-owned subsidiaries, Trusted Information Systems (U.K.) Limited ("TIS UK") and Trusted Information Systems GmbH ("TIS GmbH"). The TIS UK subsidiary was established in 1992 to conduct the Company's activities in the United Kingdom and the TIS GmbH subsidiary was established in 1996 to conduct the Company's activities in Germany. All material intercompany accounts and transactions have been eliminated upon consolidation.
Revenues from the Company's European subsidiaries amounted to 3.1% and 4.0% of total revenues for the years ended December 29, 1995 and December 27, 1996, respectively. Translation adjustments from foreign operations are not significant in the current year nor is the risk associated with foreign operations considered to be significant.
Use of Estimates
The preparation of financial statements in conformity with generally accepted accounting principles requires management to make estimates and assumptions that affect the amounts reported in the financial statements and accompanying notes. Actual results could differ from those estimates.
Initial Public Offering and Related Matters
Effective May 31, 1996, the Company consummated a tax-free reorganization for the purposes of becoming a Delaware corporation by issuing 40 shares of a new class of $.01 par value common stock in exchange for each share of the then outstanding no par value Class A (voting) and Class B (non-voting) common stock. The effect of this reorganization is reflected as if it had occurred at the beginning of the earliest period presented.
On August 30, 1996, the Board of Directors approved a 1-for-1.6301 reverse stock split of the Company's common stock, which with stockholder approval became effective on September 28, 1996. All references in the accompanying financial statements to the number of shares of common stock and per share amounts have been restated to reflect the reverse stock split.
In June 1996, the Company filed a registration statement with the SEC permitting the Company to sell 3,910,000 shares of its common stock to the public, including up to 510,000 shares to cover over-allotments. Pursuant to the registration statement, the Company completed its initial public offering (IPO) on October 10, 1996. The initial public offering resulted in proceeds to the Company of approximately $45.4 million, net of approximately $1.9 million in underwriting fees and offering expenses. The Company repaid approximately $4.9 million of its short-term borrowings and notes payable out of the proceeds.
Other Information Regarding Basis of Presentation
The Company performs periodic credit evaluations of the financial condition of its customers and typically does not require collateral from its customers.
Amounts receivable, directly and indirectly, from government agencies approximated 54% and 17% of total accounts receivable at December 29, 1995 and December 27, 1996, respectively. Sales to these agencies accounted for approximately 68% and 42% of total revenues for the years ended December 29, 1995 and December 27, 1996, respectively.
Export sales, primarily to Europe, were 4.8% and 7.6% of total revenues for the years ended December 29, 1995 and December 27, 1996, respectively. Export sales were insignificant in all other periods.
Significant Accounting Policies
Marketable Securities
Marketable securities are classified as available-for-sale and are carried at fair market value with unrealized gains and losses, net of taxes reported in a separate component of shareholders' equity. At December 27, 1996, marketable securities consisted of an investment in 100,000 shares of Cybercash, Inc. and approximately $36.7 million in U.S. Government and U.S. Government-sponsored securities, all with maturities of less than three months. At December 27, 1996, government-sponsored securities are carried at cost, which approximates its fair value.
Realized gains in value judged to be other-than-temporary are included in investment income. Interest and dividends are included in investment income. At December 27, 1996, the common stock of Cybercash, Inc., which the Company purchased in connection with the formation of the company, had a cost basis of approximately $10,000 and an unrealized gain and estimated fair value of approximately $1.5 million (net of taxes of $932,838). The Company may sell such shares subject to the limitations of Rule 144 under the Securities Act of 1933.
Property and Equipment
In 1995, the Company adopted the provisions of Financial Accounting Standards Board Statement No. 121, Accounting for the Impairment of Long-Lived Assets and for Long-Lived Assets and for Long-Lived Assets to Be Disposed Of. Adoption of this Statement did not have a material impact on the reported results of operations of the Company.
Property and equipment is stated at cost. Additions prior to fiscal 1996 were depreciated on an accelerated basis using estimated useful lives of 20-31 years for buildings and improvements and 5-7 years for furniture and equipment, and additions for fiscal year 1996 were depreciated on a straight line basis over similar lives.
Stock Options Granted to Employees
The Company records compensation expense for all stock-based compensation plans using the intrinsic value method prescribed by APB Opinion No. 25, Accounting for Stock Issued to Employees. In October 1995, the Financial Accounting Standards Board issued Statement No. 123, Accounting for Stock-Based Compensation, which encourages companies to recognize expense for stock-based awards based on their estimated fair value on the date of grant. Statement No. 123, effective for 1996, does not require companies to change their existing accounting for stock-based awards, but if the new fair value method is not adopted, pro forma income and earnings per share data should be provided in the footnotes to the financial statements. The Company's 1996 annual financial statements supplementally disclose the required pro forma information as if the fair value method had been adopted for 1996. (See footnote 5.)
Revenue Recognition
Commercial Products and Services -- Revenues from the sale of goods, including software products, are recognized upon shipment, when collection of the receivable is probable and the Company has no significant remaining obligations. In instances where the Company directly installs its products, related installation revenues are recognized upon completion of installation. Commercial consulting services are provided primarily on a time and materials basis. The Company accounts for obligations under customer service, support and maintenance agreements by deferring a pro rata portion of revenue and recognizing it either ratably as the obligations are fulfilled or upon completion of performance.
Government Contracts -- The Company enters into research and development contracts with government agencies under various pricing arrangements. Revenue from "cost-plus-fixed-fee" contracts is recognized on the basis of reimbursable contract costs incurred during the period, plus a percentage of the fixed fee. Revenue from "time and material" contracts is recognized on the basis of hours utilized, plus other reimbursable contract costs incurred during the period. Revenue from "firm-fixed-price" contracts is recognized on the percentage of completion method. Under this method, individual contract revenues are recorded based on the percentage relationship that contract costs incurred bear to management's estimate of total contract costs. Losses, if any, are accrued when their occurrence becomes known and the amount of the loss is reasonably determined.
Under its government contracts, the Company is subject to audit by the Defense Contract Audit Agency (DCAA) which could result in the renegotiation of amounts previously billed. The DCAA has performed audits of the Company's costs through 1993. Management believes that the results of such audits will not have a material adverse effect on the Company's financial position or results of operations.
Revenues recognized in excess of amounts billed to government agencies and retainage related to long-term contracts have been recorded as unbilled receivables in the accompanying balance sheets.
Research and Development
Research and development expenditures are charged to operations as incurred. Statement of Financial Accounting Standard No. 86, Accounting for the Costs of Computer Software to be Sold, Leased or Otherwise Marketed, requires capitalization of certain software development costs subsequent to the establishment of technological feasibility. Based on the Company's product development process, technological feasibility is established upon completion of a working model. Costs incurred by the Company between completion of the working model and the point at which the product is ready for general release have been insignificant. The distribution of products incorporating encryption technology may be subject to U.S. government export restrictions.
Advertising Costs
All advertising costs are expensed when incurred. Costs which are included in expense for the years ended December 30, 1994, December 29, 1995 and December 27, 1996 were approximately $11,800, $28,700 and $105,372, respectively.
Earnings (Loss) Per Share
The Company's net income (loss) per share calculations are based upon the weighted average number of shares of common stock outstanding during each period, adjusted for the dilutive effect of common stock equivalents.
Pursuant to the requirements of the Securities and Exchange Commission, common stock and options to purchase common stock issued at prices below the IPO price during the twelve months immediately preceding the contemplated initial filing of the registration statement in connection with the IPO have been included in the computation of net income per share as if they were outstanding for all periods presented in the Company's registration statement (using the treasury method and assuming repurchase of common stock at the estimated IPO price with the proceeds of assumed exercise of the options), even if antidilutive. For all subsequent periods, such common stock and options have not been included in the computation of net income (loss) per share, as they are considered to be antidilutive.
2. Property and Equipment
Property and equipment consists of: December 29, December 27, 1995 1996 ---- ---- Land...................................... $ 232,926 $ 322,926 Buildings and building improvements....... 1,762,738 4,657,585 Furniture and equipment................... 1,656,097 3,264,082 Leasehold improvements.................... 45,211 116,123 Construction-in-progress.................. 1,335,758 -- ---------- ---------- 5,032,730 8,360,716 Less: accumulated depreciation and amortization.............................. (1,317,640) (1,665,192) ---------- ---------- $3,715,090 $6,695,524 ========== ==========
3. Short-term Borrowings
At December 29, 1995 the Company had various short-term line of credit arrangements with Mercantile-Safe Deposit and Trust Company ("Mercantile Bank") aggregating $2 million. During 1996, the Company arranged for additional credit agreements and modified existing credit agreements with Mercantile Bank that provided for additional borrowings to fund the Company's growth prior to its initial public offering. These credit facilities were paid off in conjunction with the Company's initial public offering.
In 1995 the Company negotiated a construction loan in the amount of $1.8 million to provide for the expansion of its facilities at its Glenwood, Maryland locations. During 1996, the Company had completed its expansion and had substantially drawn down the total amount of its construction loan which was converted in December into a mortgage note which bears interest at a three year fixed rate of 8.46%.
4. Notes Payable
Notes payable to banks and others consist of the following: December 29, December 27, 1995 1996 ---- ---- Small Business Administration mortgage note due in monthly principal and interest (10.1% per annum) installments of approximately $5,000............. $ 420,962 $ 405,052 Notes payable to a bank: Mortgage note; principal due in monthly installments of $10,000 and interest payable monthly at a three year fixed rate of 8.46% ... 684,170 1,750,000 Mortgage note; due in monthly principal and interest (8.46% per annum) installments of $4,128; balance due December 2011 ............. 481,694 420,160 Furniture and equipment notes; principal due in monthly installments of $3,583 in 1995 and $5,667 in 1996 ................................ 153,836 -- ------------ ------------ 1,740,662 2,575,212 Less: current portion.............................. 160,662 150,857 ------------ ------------ $ 1,580,000 $ 2,424,355 ============ ============
All of the notes payable to a bank described above are payable to the same bank and are collateralized by the underlying properties. The furniture and equipment notes were fully paid in 1996.
Other than amounts due under the Small Business Administration note, the Company believes that the carrying amount reported in the balance sheet of its other financial assets and liabilities approximates their fair value. Using discounted cash flow analyses, the fair value of the Small Business Administration note at December 27, 1996 is estimated to be approximately $466,000.
Aggregate maturities of all notes payable at December 27, 1996 are as follows:
1997........... $150,857 1998........... 155,288 1999........... 158,746 2000........... 162,547 2001........... 166,723 Thereafter..... 1,781,051 ----------- Total.......... $ 2,575,212 ===========
5. Stock Options
The Company has adopted the Amended and Restated Employee Stock Option Plan (Employee Option Plan) and the 1996 Stock Option Plan (1996 Option Plan) which provide for the grant of incentive stock options and non-statutory stock options to executives, employees and consultants. The Employee Option Plan authorizes the issuance of options to acquire 6,134,593 shares of common stock and at December 27, 1996, options to acquire 111,391 shares of common stock under the plan were outstanding; no further options will be granted under this plan. The 1996 Option Plan authorizes the issuance of options to acquire 1,625,667 shares of common stock, and, at December 27, 1996, options to acquire 1,152,891 shares of common stock under the plan were outstanding.
The vesting period, contractual life, and the exercise price of each option shall be determined by the respective plan administration committee. However, for incentive stock options, the exercise price shall not be less than the fair market value of the common stock on the date of the grant.
Upon a change in control of the Company, as defined by the plans, 50% of any outstanding unvested options under the 1996 Option Plan or the Director Plan prior to the date of such change in control shall vest and be immediately exercisable.
In connection with the initial public offering, the Company recorded deferred compensation of $1,105,500 as a separate component of shareholders' equity related to the issuance in June 1996 of options for 92,018 shares of the Company's common stock. This deferred compensation is being amortized evenly over the four-year vesting period of the options. At December 27, 1996, none of these options were exercisable.
Option activity under the plans is as follows:
Options Weighted Outstanding Price Average Under the Per Price Per Stock Plans Share Share ----------- ----- ----- Balance at December 31, 1993 907,920 $ .50 $ .50 Options granted.......... 1,091,958 .50-.69 .54 Options exercised........ (11,803) .50 .50 Options canceled......... (870,033) .50-.69 .54 --------- -------- ------ Balance at December 30, 1994 1,118,042 .50-.69 .54 Options granted.......... -- -- -- Options exercised........ (6,453) .50 .50 Options canceled......... (122,693) .50-.69 .54 --------- -------- ------ Balance at December 29, 1995 988,896 .50-.69 .53 Options granted.......... 1,175,316 2.66-7.04 3.21 Options exercised........ (646,093) .50-7.04 .54 Options canceled......... (253,837) .50-7.04 .65 --------- -------- ------ Balance at December 27, 1996 1,264,282 $.69-7.04 $ 3.00 ========= ========= ======
Options exercisable at December 27, 1996 totaled 111,391 at a per share price of $0.69.
The Company has also adopted the 1996 Directors' Stock Option Plan (Director Plan) which provides for the grant of non-statutory stock options to non-employee directors of the Company. The Director Plan authorizes the issuance of options to acquire 200,000 shares of common stock. On August 15, 1996 each of the Company's two existing outside directors were granted options to purchase 9,202 shares of common stock at an exercise price of $7.04 per share, and options to purchase 6,000 shares of common stock will be granted to each future director upon initial election to the board of directors. The options vest ratably over three years. Additionally, commencing in 1997, each director will annually be granted options to purchase 1,250 shares of common stock. Such annual options will vest in full at the earlier of (i) the first anniversary of the date of the grant or (ii) the date of the next annual meeting of stockholders. The exercise price of options granted under the Director Plan will equal the closing price per share of the common stock on the date of grant. As of December 27, 1996, a total of 18,404 options were granted under the Director Plan.
The Company adopted Financial Accounting Standard No. 123 entitled "Accounting for Stock-Based Compensation" ("FAS 123") as of December 27, 1996. The provisions of FAS 123 allow companies to either expense the estimated fair value of stock options or to continue their current practice but disclose the pro forma effects on net income and earnings per share had the fair value of the options been expensed. TIS has elected to continue its practice of recognizing compensation expense for its stock option incentive plans using the intrinsic value based method of accounting (see note 1) and to provide the required pro forma information for stock options granted after December 29, 1995. Accordingly, TIS recognizes compensation expense for its stock option incentive plans using the intrinsic value method of accounting. Under the terms of the intrinsic value method, compensation cost is the excess, if any, of the quoted market price of the stock at the grant date, or other measurement date, over
the amount an employee must pay to acquire the stock.
Pro Forma Disclosure
Had compensation expense for TIS' stock option incentive plans for options granted after December 29, 1995 been determined based on the estimated fair value at the grant dates for awards under those plans, TIS' pro forma net loss and earnings per share for 1996 would have been $2,605,484 and ($.30), respectively, (a decrease of $441,281 and $.05, respectively). Since no options were granted by the Company, there is no pro forma effect for the year ended December 29, 1995. The effects on 1996 pro forma net income and earnings per share of expensing the estimated fair value of stock options are not necessarily representative of the effects on reported net income for future years due to such things as the vesting period of the stock options and the potential for issuance of additional stock options in future years.
The fair value of options granted after December 29, 1995, used as a basis for the above pro forma disclosures, was estimated as of the date of grant using a Black-Scholes option pricing model. The option pricing assumptions include a dividend yield of 0%; an expected volatility of 1.414; a risk-free interest rate of 6.13%; and an expected life of 4 years.
Weighted-average fair value and exercise price per option granted during 1996 was $2.87 and $2.86, respectively for options whose exercise price was equal to the fair value of the options on the date of the grant. For options whose exercise price was less than the fair value on the date of the grant, the weighted average fair value and exercise price per option granted during 1996 was $13.92 and $2.66, respectively. The weighted average contractual life for all options outstanding at December 27, 1996 was 4.0 years.
The following table summarizes information regarding stock options outstanding at December 27, 1996:
Number of Weighted Average Exercise Price Options Outstanding Contractual Life
$0.69 111,391 0.42 $2.66 1,005,660 4.26 $7.04 147,231 4.44
6. Income Taxes
Significant components of the Company's deferred tax assets and liabilities are as follows:
December 29, December 27, 1995 1996 ---- ---- Deferred tax assets: Allowance for doubtful accounts.... $16,905 $ 70,718 Other accrued expenses............. 343,877 69,668 Accrued vacation................... 172,231 208,454 Deferred Revenues.................. -- 342,266 Deferred Compensation.............. -- 65,212 ------- ------- Total deferred tax assets.......... 533,013 756,318 Deferred tax liabilities:.......... Unbilled receivables............... 86,257 49,154 Property and equipment............. 6,929 144,240 Unrealized gain on marketable securities......................... -- 936,728 Other.............................. 13,437 29,520 ------- ------- Total deferred tax liabilities..... 106,623 1,159,642 ------- ------- Net deferred tax asset (liability). $426,390 $(403,324) ======== =========
At December 30, 1994, December 29, 1995 and December 27, 1996, no valuation allowance was required for the deferred tax assets.
The provision (benefit) for income taxes consists of the following:
Year Ended Year Ended Year Ended December 30, December 29, December 27, 1994 1995 1996 ---- ---- ---- Current: Federal............... $ 475,575 $ 855,775 $(1,169,020) State................. 132,526 180,748 (246,909) ------- ------- -------- 608,101 1,036,523 (1,415,929) Deferred: Federal............... (80,026) (125,518) 18,118 State................. (22,429) (10,868) 1,301 ------- ------- ----- (102,455) (136,386) 19,419 -------- -------- ------ Total income tax provision (benefit)..... $ 505,646 $ 900,137 $(1,396,510) =========== =========== ===========
The Company's provision for income taxes resulted in effective tax rates that varied from the statutory federal income tax rate as follows:
Year Ended Year Ended Year Ended December 30, December 29, December 27, 1994 1995 1996 ---- ---- ---- Expected federal income tax provision at 34%.......... $ 401,570 $ 763,028 $(1,210,642) Expenses not deductible for tax purposes............... 14,748 13,336 26,111 State income taxes, net of federal benefit........... 72,664 112,121 (162,101) Other....................... 16,664 11,652 (49,878) --------- --------- ----------- $ 505,646 $ 900,137 $(1,396,510) ========= ========= ===========
7. Profit Sharing Plan
The Company has a 401(k) profit sharing plan covering all permanent U.S. employees who work at least 20 hours per week and similar pension plans for non-U.S. employees. Participants may make voluntary contributions to the plans and the Company matches these contributions, up to 5% of the employee's salary. In addition, the Company may make discretionary contributions to the plans. Participants contributions vest immediately and Company contributions vest over a six-year period. Contributions to the plan charged to operations for the years ended December 30, 1994, December 29, 1995 and December 27, 1996 totaled $410,629, $532,170, and $880,478, respectively.
8. Commitments
The Company leases certain office space in California, Maryland, and Virginia, and sales satellite offices, under non-cancelable operating lease agreements. Certain leases contain escalation clauses and require the Company to pay its share of any increases in operating expenses and real estate taxes. Rent expense was $220,615, $281,381 and $555,019 for the years ended December 30, 1994, December 29, 1995 and December 27, 1996, respectively. Future minimum lease payments under all non-cancelable operating lease arrangements are approximately as follows:
1997.............................. $ 853,013 1998.............................. 794,974 1999.............................. 766,794 2000.............................. 210,937 2001.............................. 94,980 Thereafter........................ -- ---------- Total............................. $2,720,698 ==========
The Company maintains self-insurance programs for health care and short-term disability costs with stop-loss insurance. Expense incurred for group medical claims, program premiums and stop-loss limit charged to operations
for the years ended December 30, 1994, December 29, 1995 and December 27, 1996 totaled $497,090, $621,378 and $780,888, respectively.
9. Related Party Transactions
In 1994, the Company entered into an oral agreement to lease real property located adjacent to the Company's Glenwood, Maryland headquarters from Glenwood Associates Limited Partnership (Glenwood Associates), a limited partnership controlled by certain shareholders of the Company. The lease provided for monthly rent of $3,929 plus payment of operating expenses. The Company purchased the aforementioned property from Glenwood Associates on June 28, 1996 for $360,000 by assuming a mortgage note payable (see Note 4) and the elimination of a receivable. Rent expense under the lease agreement for the years ended December 30, 1994, December 29, 1995, and December 27, 1996 totaled approximately $44,000, $47,000, and $24,000 respectively.
In August 1995, the Company issued a promissory note for the benefit of a shareholder and former officer (Mr. Crocker) in the principal amount of $307,520 representing the balance of monies due to Mr. Crocker in connection with the repurchase by the Company of 588,921 shares of common stock from Mr. Crocker. This promissory note was paid in full in September 1995.
10. Subsequent Events
On January 24, 1997 Trusted Information Systems and International Business Machines (IBM) announced a patent and software license agreement. Under the terms of the agreement, IBM acquired the right to license and distribute TIS' patented RecoverKey(TM) technology within the IBM Secure Way Key Management Framework, as well as in IBM products, which will need key recovery technology, which provides revenues to TIS from IBM sale of products, which include RecoverKey(TM) technology, the operations of recovery key centers and periodic renewals for maintenance and updates.
As of February 28, 1997, the fair value of the Company's shares of Cybercash, Inc. common stock was approximately $2.0 million.
SIGNATURES
Pursuant to the requirements of Section 13 or 15(d) of the Securities Exchange Act of 1934, as amended, the Company has duly caused this Report to be signed on its behalf by the undersigned, thereunto duly authorized, in Glenwood, Maryland, on the 27th of March, 1997.
TRUSTED INFORMATION SYSTEMS, INC.
By: /s/ Stephen T. Walker ----------------------------------- Stephen T. Walker President, Chief Executive Officer, Chairman of the Board and Director
Pursuant to the requirements of the Securities Exchange Act of 1934, as amended, this Report has been signed below by the following persons on behalf of the Company in the capacities and on the date indicated.
Each person whose signature appears below in so signing also makes, constitutes and appoints Stephen T. Walker and Edwin M. Martin, Jr., and each of them acting alone, his true and lawful attorney-in-fact, with full power of substitution, for him in any and all capacities, to execute and cause to be filed with the Securities and Exchange Commission any and all amendments and post-effective amendments to this Report, with exhibits thereto and other documents in connection therewith, and hereby ratifies and confirms all that said attorney-in-fact or his substitute or substitutes may do or cause to be done by virtue hereof.
- ------------------- * Previously filed as an exhibit to the Company's Registration Statement Number 333-5419 on Form S-1 and incorporated herein by reference. ** Filed herewith. + Portions of this Exhibit were omitted and have been filed separately with the Secretary of the Commission pursuant to the Registrant's Application Requesting Confidential Treatment under Rule 24b-2 of the Securities Exchange Act of 1934, as amended, filed on March 27, 1997.
- ---------------------------