---

---

---

•	Protecting users from the advanced attacks that target them via email, social media, and mobile apps;

•	Preventing the theft or inadvertent loss of sensitive information and, in turn, ensuring compliance with regulatory data protection mandates;

•	Collecting, retaining, supervising and discovering sensitive data for compliance and litigation support; and

•	Enabling organizations to respond quickly to security issues, providing both the intelligence and the context to prioritize incidents and orchestrate remediation actions.

---

•

Superior protection against both advanced and targeted threats.  We use a combination of proprietary technologies for big data analytics, machine learning, deep content inspection, dynamic malware analysis, threat correlation, threat intelligence extraction, and virtual execution environments to predictively and actively detect and stop targeted "spear phishing" and other sophisticated advanced and next-generation threat attacks, including APTs, that employ malicious attachments, polymorphic threats, zero-day exploits, user-transparent “drive-by” downloads and other penetration tactics. By processing, analyzing and correlating billions of data points on a daily basis, we can recognize anomalies in order to predictively detect targeted attacks before users are exposed. Our deep content inspection technology enables us to identify malicious message attachments and distinguish between valid messages and "phishing" messages designed to look authentic and trick the end-user into divulging sensitive data or clicking on a malicious web link. Our machine learning technology enables us to detect targeted "zero-hour" attacks in real-time, even if they have not been seen previously at other locations, and quarantine them appropriately. Our dynamic malware analysis and virtual execution environment technologies enable us to examine web site destinations and downloadable files to identify and block potentially hostile code that would otherwise compromise end-user computers, even in cases where the web sites are considered reputable or the attachment’s malicious payload is obfuscated or otherwise disguised. Our threat correlation technologies enable us to rapidly confirm and contain threats, providing rapid, automated protection. In addition, our threat intelligence and response capabilities enable our customers to both prioritize threats that may have compromised them via our Emerging Threat Intelligence and orchestrate or automate protective countermeasures via Proofpoint Threat Response.

•

Comprehensive, integrated email security, advanced threat, information protection and archiving, and digital risk protection product families. We offer a comprehensive solution for email security, composed of our Enterprise Protection, Email Fraud Defense, and Email Continuity offerings. Our advanced threat product family includes solutions to protect organizations across the predominant threat vectors, including email, social media, mobile apps, and SaaS applications. To protect enterprise data from security and compliance risks, our Information Protection product family includes a suite of security solutions (Data Loss Prevention, Encryption, and Data Discover for data at rest) and compliance (Enterprise Archive, eDiscovery Analytics, and Supervision). Finally, our digital risk protection suite enables organizations to look beyond their borders for threats targeting their customers across email phishing, malicious web domains, fraudulent mobile apps, and fraudulent social media accounts.

•

Designed to empower end-users.  Unlike legacy offerings that simply block communication or report audit violations, our solutions actively enable secure business-to-business and business-to-consumer communications. Our easy-to-use policy-based email encryption service automatically encrypts sensitive emails and delivers them to any PC or mobile device. In addition, our secure file-transfer solution makes it easy for end-users to securely share various forms of documents and other content that are typically too large to send through traditional e-mail systems. All of our solutions provide mobile-optimized capabilities to empower the growing number of people who use mobile devices as their primary computing platform.

•

Security optimized cloud architecture.  Our multi-tenant security-as-a-service solution leverages a distributed, scalable architecture deployed in our global data centers for deep content inspection, global threat correlation and analytics, high-speed search, secure storage, encryption key management, software updates, intelligent message routing, and other core functions. Our architecture also enables us to look across hundreds of billions of data points gathered from across our product portfolio and intelligence feeds to better correlate and analyze both targeted and broad-based threat campaigns. Customers can choose to deploy optional physical or virtual points-of-presence behind their firewalls for those who prefer to deploy certain functionality inside their security perimeter. This architecture enables us to leverage the benefits of the cloud to cost-effectively deliver superior security and compliance, while optimizing each deployment for the customer's unique threat environment.

•	Extensible security-as-a-service platform.  The key components of our security-as-a-service platform, including services for secure storage, content inspection, reputation, big data analytics, encryption, key management, and

---

•

Enterprise Protection.  Uses our Proofpoint MLX machine learning technology and reputation data to examine millions of possible attributes in every message to block phishing and spear phishing attacks, spam, viruses, impostor email/business email compromise attacks, and other forms of malicious or objectionable content. This solution also includes sophisticated policy and routing controls designed to ensure security and the effective

---

•	Email Fraud Defense. Enables organizations to understand who is sending email from their domains, and create a policy to both authenticate legitimate email and block fraudulent email.

•	Email Continuity. Allows organizations to maintain email communications if their on-premises or cloud-based email servers experience an outage.

•

Proofpoint Essentials. Our suite of security-as-a-service and compliance solutions specifically designed for distribution across managed service providers and dedicated security resellers. Key capabilities include inbound email filtering to block spam and malware, outbound filtering for compliance with company policies, email continuity to enable email service availability, targeted attack protection, and email archiving.

•	Superior protection from advanced threats, spam and viruses.  Protects against advanced threats, spam and other malware such as viruses, worms and spyware.

•	Comprehensive outbound threat protection.  Analyzes all outbound email traffic to block spam, viruses and other malicious content from leaving the corporate network, and pinpoint the responsible compromised systems.

•	Effective, flexible policy management and administration.  Provides a user-friendly, web-based administration interface and robust reporting capabilities that make it easy to define, enforce and manage an enterprise's messaging policies.

•	Easy-to-use end-user controls.  Gives email users easy, self-service control over their individual email preferences within the parameters of corporate-defined messaging policies.

•	Superior protection from business email compromise. Combining a dynamic classifier on the email gateway with a proactive authentication solution delivers superior protection from these attacks.

•	Business continuity. Provides an always-on insurance policy for crucial business communications via email.

•

Targeted attack protection. Enterprises are protected against both commodity and advanced threats such as phishing and other targeted email attacks by the use of big data analysis, predictive, virtual execution and dynamic malware analysis techniques to identify and apply additional security controls against suspicious messages and any associated links to the web. The same detection techniques are extended to look for malicious content in enterprise social media accounts, malicious links and file sent to users via SaaS applications, and malicious mobile apps that siphon off data or function as remote access Trojans.

•

Threat response. Provides threat information and indicators of compromise ("IoCs") correlation, aggregating across Proofpoint and other third-party security products, to confirm and contain system compromises. By taking advantage of this automated incident response, enterprises can minimize exfiltration windows and leverage staff for breach prevention and mitigation. In addition, it can be leveraged to automatically remove malicious emails that have been delivered to users’ email boxes, reducing the potential risk exposure.

---

•	Superior effectiveness. Proofpoint’s agility in deploying new detection measures and adjusting defenses in response to changes in the threat landscape results is highly effective in stopping threats before they reach enterprise users.

•

Curated threat intelligence. Proofpoint’s threat research team tracks campaigns and actors, providing detailed research in addition to curated IoCs. The high quality of this threat intelligence enables customers to better prioritize their responses to alerts generated by Proofpoint products, as well as leverage the intelligence to hunt for threats that may have compromised their enterprises via other channels.

•

Advanced data loss prevention.  Our advanced data loss prevention solution identifies regulated private content, valuable corporate assets and confidential information before it leaves the organization via email, web-based applications, or our Secure Share solution. Pre-packaged smart identifiers and dictionaries automatically and accurately detect a wide range of regulated content such as social security numbers, health records, credit card numbers, and driver's license numbers. In addition to regulated content, our machine learning technology can identify confidential, organization-specific content and assets. Once identified and classified, sensitive data can be blocked, encrypted and transmitted or re-routed internally based on content and identity-aware policies.

•

Flexible remediation and supervision.  Content, identity and destination-aware policies enable effective remediation of potential data breaches or regulatory violations. Remediation options include stopping the transfer completely, automatically forcing data-encryption, or routing to a compliance supervisor or the end-user for disposition. The solution also provides comprehensive reporting on potential violations and remediation using our analytics capabilities.

•	Policy-based encryption.  Automatically encrypts regulated and other sensitive data before it leaves an organization's security perimeter without requiring cumbersome end-user key management. This enables authorized external recipients, whether or not they are our customers, to quickly and easily decrypt and view content from most devices.

•	Secure share. Cloud-based security-focused solution designed to enable enterprise users to securely exchange large files with ease while staying compliant with enterprise data policies.

•	Data Discover. Automated discovery and remediation solution that identifies sensitive content across the enterprise and enables corrective action, while reducing risk of data breaches and compliance violations.

•

Secure cloud storage.  With our proprietary double blind encryption technology and the associated data storage architecture, all email messages, files and other content are encrypted with keys controlled by the customer before the data enters the Proofpoint Enterprise Archive. This ensures that even our employees and law-enforcement agencies cannot access a readable form of the customer data without authorized access by the customer to the encryption keys stored behind the customer's firewall.

---

•	Search performance.  By employing parallel, big data search techniques, we are able to deliver search performance measured in seconds, even when searching hundreds of terabytes of archived data. Traditional on-premises solutions can take hours or even days to return search results to a complex query.

•	Flexible policy enforcement.  Enables organizations to easily define and automatically enforce data retention and destruction policies necessary to comply with regulatory mandates or internal policies that can vary by user, group, geography or domain.

•	Active legal-hold management.  Enables administrators or legal professionals to easily designate specific individuals or content as subject to legal-hold. Proofpoint Enterprise Archive then provides active management of these holds by suspending normal deletion policies and automatically archiving subsequent messages and files related to the designated matter.

•	End-user supervision.  Leveraging our flexible workflow capabilities, Proofpoint Enterprise Archive analyzes all electronic communications, including email and communications from leading instant messaging and social networking sites, for potential violations of regulations, such as those imposed by Financial Industry Regulatory Authority ("FINRA") and the SEC in the financial services industry.

•

Regulatory compliance.  Data Loss Prevention and Encryption enable outbound messages to comply with national and state government and industry-specific privacy regulations, while Enterprise Archive helps organizations meet regulatory requirements by archiving all messages and content according to compliance retention policies and enabling staff to systematically review messages for compliance supervision.

•	Superior malicious and accidental data loss protection.  Protects against the loss of sensitive data, whether from a cybercriminal attempting to exfiltrate valuable data from a compromised system, or from an employee accidentally distributing a file to the wrong party through email, webmail, social media, file sharing, or other Internet-based mechanisms for publishing content.

•	Easy-to-use secure communication.  Allows corporate end-users to easily share sensitive data without compromising security and privacy, and enables authorized external recipients to transparently decrypt and read the communications from any device. Our mobile-optimized interfaces provide an easy experience for the rapidly growing number of recipients on smartphones and tablets.

•	Reduction in “attack surface”. Enables the automated protection of sensitive data, reducing the amount of critical information potentially exposed to an attacker in a breach scenario.

•	Proactive data governance.  Allows organizations to create, maintain and consistently enforce a clear corporate data retention policy, reducing the risk of data loss and the cost of eDiscovery.

•	Efficient litigation support.  Provides advanced search features that reduce the cost of eDiscovery and allow organizations to more effectively manage the litigation hold process.

•	Reduced storage and management costs.  Helps to simplify mailbox and file system management by automatically moving storage-intensive attachments and files into cost-effective cloud storage.

---

•	Detecting Brand Fraud. Fraudsters imitate companies' brands across digital channels to target customers with phishing scams, malware, phishing, and counterfeit products. Using a native cloud-based platform, customers can quickly find fraudulent social media accounts, web domains, and mobile apps that are affiliated with their brands.

•

Detecting External Threats. External threat management tools enable organizations to quickly identify leaked intellectual property, credentials, and customer data on the web or dark web. Additionally, detection measures can identify cyber criminals using digital tools to plan and execute cyber-attacks that target company’s digital presence and/or physical attacks on its executives, employees, and physical locations.

•

Compliance Monitoring and Protection. Leveraging social media APIs, the platform can monitor and apply content policies to the brand’s owned social media accounts for security, compliance and acceptable use. Using proprietary Deep Social Linguistic Analysis technology, social media and brand managers can aggregate content from across their enterprise and review it for security, risk and compliance violations (including FINRA, Federal Financial Institutions Examination Council, Food and Drug Administration, SEC, Financial Conduct Authority violations), allowing them to safely syndicate content distribution across their social media marketing platforms.

•	Reduction of fraud. Enterprises can reduce both the direct and indirect costs relating to fraud by rapidly and proactively identifying fraudulent web domains, mobile apps, and social media accounts leveraged by cyber criminals in phishing and other forms of attacks.

•	Visibility into external threats. Organizations benefit from early warnings of potentially harmful threats to physical sites, digital presences, and key executives, as well as well as unauthorized posting or resale of their private data.

•	Enhanced compliance. Reduces potential liability from inadvertent posting of sensitive data and demonstrates compliance with more than 35 standards and industry regulations. Automates compliance review processes and social advocate programs through seamless integration with leading social media management suites.

•	Threat detection. Proofpoint deploys an ensemble approach to detect both malware and malware-free attacks. The approach combines multiple forms of detection, including composite reputation correlation, sandboxing for malicious attachments, URLs, and credential phishing, code analysis, network detection, and classifiers for phishing and impostor/BEC attacks.

•	Threat intel extraction. Proofpoint leverages a dedicated environment to learn as much as possible about threats that are detected by any part of the ensemble approach. The extraction environment leverages virtual sandboxes, physical hardware, and human analysts to induce malware to detonate and gather as much forensic detail about it as possible.

•	Nexus threat graph. Proofpoint synthesizes threat intelligence gathered from the vectors and threat feeds in a graph database known as Proofpoint Nexus, which is leveraged by threat researchers to correlate threats into campaigns, analyze new threats for links to known actors, and lend context (e.g. what vertical industries are seeing a given campaign) to all detected threats.

•	Real-time detection. Proofpoint leverages platform services to be in the flow of the movement of potentially sensitive data, including our email gateways, API-based social media integrations, mobile applications store scanning tools, and SaaS application API/proxy connectivity.

•	Information classification. For regulated or otherwise sensitive data, Proofpoint leverages smart identifiers to accurately recognize data types that are relevant from either a security or compliance perspective.

---

•	Intelligent policy. Proofpoint’s information protection and archive products leverage an intelligent policy framework that spans retention, legal hold, smart identifiers, and compliance frameworks, regardless of where the data may be stored or by which channel it is being sent.

•	Big data analytics.  Indexes and analyzes petabytes of information in real-time to discover threats, detect data leaks and enable end-users to quickly and efficiently access information distributed across their organizations.

•	Machine learning.  Builds predictive data models using our proprietary Proofpoint MLX machine learning techniques to rapidly identify and classify threats and sensitive content in real-time.

•	Identity and policy.  Enables the definition and enforcement of sophisticated data protection policies based on a wide set of variables, including type of content, sender, recipient, pending legal matters, time and date, regulatory status and more.

•	Secure storage.  Stores petabytes of data in the cloud cost-effectively using proprietary encryption methods, keeping sensitive data tamper-proof and private, yet fully searchable in real-time.

•	Virtual execution environments.  Exposes suspected malware to a permuted set of instrumented virtual system environments, to assess maliciousness, exploit activity and compromise processes.

•	Intelligent message routing.  Policies can be established by administrators to automatically direct email communications differently through the email network, based on aspects of the messages, for security, compliance, supervisory, system performance, or other reasons.

•	Threat intelligence correlation.  Utilizes inputs from Proofpoint, cloud, and other third-party products to assess IoCs and confirm successful system compromises by malicious actors in near-real-time, then administers network controls to effectively contain the compromised systems.

•

Security.  Security is central to our cloud architecture and is designed into all levels of the system, including physical security, network security, application security, and security at our third-party data centers. Our security measures have met the rigorous standards of SSAE 16 certification. In addition to this commercial certification program, we have also successfully completed the FISMA certification for our cloud-based information protection and archiving solution, enabling us to serve the rigorous security requirements of U.S. federal agencies.

•

Scalability and performance.  By leveraging a distributed, scalable architecture we process billions of requests against our reputation systems and hundreds of millions of messages per day, all in near real-time. Massively-parallel query processing technology is designed to ensure rapid search results over this vast data volume. In addition to this aggregate scalability across all customers, our architecture also scales to effectively meet the needs of several of our largest individual customers, each of which has millions of users and processes tens of millions of messages per day.

---

•	Hybrid Deployment.  Our cloud architecture enables individual customers to deploy entirely in Proofpoint's global data centers or in hybrid configurations with optional points of presence located behind the customer's firewall. This deployment flexibility enables us to deliver security, compliance and performance tailored to the unique threat profile and operating environment of each customer.

•	High availability.  Our services employ a wide range of technologies including redundancy, geographic distribution, real-time data replication and end-to-end service monitoring to provide 24x7 system availability.

•	Network operations control.  We employ a team of skilled professionals who monitor, manage and maintain our global data center infrastructure and its interoperability with the distributed points of presence located behind our customers' firewalls to ensure 24x7 operations.

•	4 of the 5 largest U.S. retailers

•	3 of the 5 largest U.S. aerospace and defense contractors

•	5 of the 5 largest U.S. banks

•	3 of the 5 largest global pharmaceutical companies

•	3 of the 5 largest U.S. petroleum refining companies

•

Direct sales and reseller channel.  We market and sell our solutions to large and mid-sized customers directly through our field and inside sales teams as well as indirectly through a hybrid model, where our sales organization actively assists our network of distributors and resellers. Our sales personnel are primarily located in North America, with additional personnel located in Asia-Pacific, EMEA, Japan and South America. Our reseller partners maintain relationships with their customers throughout the territories in which they operate, providing them with services and third-party solutions to help meet their evolving security requirements. As such, these partners act as a direct conduit through which we can connect with these prospective customers to offer our solutions. Our channel partners include security centric resellers such as

---

•

Strategic relationships.  We also sell our solutions indirectly through key technology companies that offer our solutions in conjunction with one or more of their own products or services. These companies each have their own base of customers, and they distribute our products to augment their own branded products and solutions, sometimes under their own brand and sometimes under the Proofpoint brand.

---

•	Email and Advanced Threat Protection:  Cisco Systems, Inc. (through its acquisitions of IronPort, SourceFire, and ThreatGRID), Microsoft Corporation (through its acquisition of Frontbridge), FireEye, Inc., and Symantec Corporation (through its acquisitions of Brightmail and MessageLabs).

•	Archiving:  Micro Focus International plc and Veritas Technologies LLC (through its acquisitions of KVS and LiveOffice while under the ownership of Symantec Corporation).

•	effectiveness of our protection against advanced threats;

•	comprehensiveness and integration of the solution;

•	flexibility of delivery models;

•	total cost of ownership;

•	scalability and performance;

•	customer support; and

•	extensibility of platform.

---

---

---

---

•	expenditure of significant financial and development resources in efforts to analyze, correct, eliminate or work around errors or defects or to address and eliminate vulnerabilities;

•	loss of existing or potential partners or customers;

•	loss or disclosure of our customers’ confidential information, or the inability to access such information;

•	loss of our proprietary technology;

•	our solutions being susceptible to hacking or electronic break-ins or otherwise failing to secure data;

•	delayed or lost revenue;

•	delay or failure to attain market acceptance;

•	lost market share;

•	negative publicity, which could harm our reputation; or

•	litigation, regulatory inquiries or investigations that would be costly and harm our reputation.

---

---

---

•	fluctuations in currency exchange rates, which may cause our revenues and operating results to differ materially from expectations;

•	our lack of familiarity with commercial and social norms and customs in other countries which may adversely affect our ability to recruit, retain and manage employees in these countries;

•	difficulties and costs associated with staffing and managing foreign operations;

•	the potential diversion of management’s attention to oversee and direct operations that are geographically distant from our U.S. headquarters;

•	compliance with multiple, conflicting and changing governmental laws and regulations, including employment, tax, privacy and data protection laws and regulations;

•	legal systems in which our ability to enforce and protect our rights may be different or less effective than in the United States, including more limited protection for intellectual property rights in some countries;

•	immaturity of compliance regulations in other jurisdictions, which may lower demand for our solutions;

•	greater difficulty with payment collections and longer payment cycles;

•	higher employee costs and difficulty terminating non-performing employees;

•	differences in work place cultures;

•	the need to adapt our solutions for specific countries;

•	our ability to comply with differing technical and certification requirements outside the United States;

•	tariffs, export controls and other non-tariff barriers such as quotas and local content rules;

•	uncertainties related to the United Kingdom's withdrawal from the European Union;

•	adverse tax consequences;

•	restrictions on the transfer of funds;

•	anti-bribery compliance by us or our partners, including under the Foreign Corrupt Practices Act and similar laws of other jurisdictions; and

•	new and different sources of competition.

---

---

---

---

---

---

---

---

•	variations in our revenue, billings, gross margin, operating results, free cash flow, loss per share and how these results compare to analyst expectations;

---

•	forward looking guidance that we may provide regarding financial metrics such as billings, revenue, gross margin, operating results, free cash flow, and loss per share;

•	announcements of technological innovations, new products or services, strategic alliances, acquisitions or significant agreements by us or by our competitors;

•	disruptions in our cloud-based operations or services or disruptions of other prominent cloud-based operations or services;

•	the economy as a whole, market conditions in our industry, and the industries of our customers;

•	trading activity by directors, executive officers and significant stockholders, or the perception in the market that the holders of a large number of shares intend to sell their shares;

•	the size of our market float and significant option exercises;

•	any future issuances of securities;

•	sales and purchases of any common stock issued upon conversion of our convertible notes; and

•	any other factors discussed herein.

•	make it difficult for us to pay other obligations;

•	make it difficult to obtain favorable terms for any necessary future financing for working capital, capital expenditures, debt service requirements or other purposes;

•	require us to dedicate a substantial portion of our cash flow from operations to service the indebtedness, reducing the amount of cash flow available for other purposes; and

•	limit our flexibility in planning for and reacting to changes in our business.

---

•	creating a classified board of directors whose members serve staggered three-year terms;

•	authorizing “blank check” preferred stock, which could be issued by our board without stockholder approval which may contain voting, liquidation, dividend and other rights which are superior to our common stock;

•	limiting the liability of, and providing indemnification to, our directors and officers;

•

limiting the ability of our stockholders to call and bring business before special meetings by providing that any stockholder action must be effected at a duly called meeting of the stockholders and not by a consent in writing, and providing that only our board of directors, the chairman of our board of directors, our Chief Executive Officer or President may call a special meeting of the stockholders; and

•	requiring advance notice of stockholder proposals for business to be conducted at meetings of our stockholders and for nominations of candidates for election to our board of directors.

•	develop or enhance our application and services;

•	continue to expand our product development, sales and marketing organizations;

•	acquire complementary technologies, products or businesses;

•	expand operations, in the United States or internationally;

•	hire, train and retain employees; or

---

•	respond to competitive pressures or unanticipated working capital requirements.

---

---

---

---

(1)	Includes stock-based compensation and amortization of intangible assets as follows:

---

•	protecting users from the advanced attacks that target them via email, social media and mobile applications;

•	preventing the theft or inadvertent loss of sensitive information and, in turn, ensuring compliance with regulatory data protection mandates;

•	collecting, retaining, governing and discovering sensitive data for compliance and litigation support; and

•	enabling organizations to respond quickly to security issues, providing both the intelligence and the context to prioritize incidents and orchestrate remediation actions.

---

---

---

---

•	Billings is not a substitute for revenue, as trends in billings are not directly correlated to trends in revenue;

•

Billings is affected by a combination of factors including the timing of renewals, the sales of our solutions to both new and existing customers, the relative duration of contracts sold, and the relative amount of business derived from strategic partners. As each of these elements has unique characteristics in the relationship between billings and revenue, our billings activity is not closely correlated to revenue except over longer periods of time; and

•	Other companies, including companies in our industry, may not use billings, may calculate billings differently, or may use other financial measures to evaluate their performance ‑ all of which reduce the usefulness of billings as a comparative measure.

---

•	Adjusted EBITDA provides investors and other users of our financial information consistency and comparability with our past financial performance, facilitates period-to-period comparisons of operations and facilitates comparisons with our peer companies, many of which use similar non-GAAP financial measures to supplement their GAAP results; and

•

It is useful to exclude certain non-cash charges, such as depreciation, amortization of intangible assets and stock-based compensation, and acquisition- and litigation-related (income) expenses from adjusted EBITDA because the amount of such expenses in any specific period may not be directly correlated to the underlying performance of our business operations and these expenses can vary significantly between periods as a result of new acquisitions, full depreciation of previously acquired tangible and amortization of intangible assets, the timing of new stock‑based awards or litigation-related (income) expenses, as the case may be.

---

---

---

---

(1)	Includes stock-based compensation and amortization of intangible assets as follows:

---

---

---

(1)	Includes stock-based compensation expense and amortization of intangible assets as follows:

---

---

•	An increase in amortization of intangible assets of $2.2 million due to the acquired businesses, and an increase in depreciation of fixed assets of $4.5 million due to the increase in capital expenditure;

•	Stock-based compensation expense increased $18.6 million due to the increase in headcount and valuation of grants made;

•	Amortization of debt issuance costs and accretion of debt discount increased $5.9 million due to the issuance of our convertible notes in June 2015;

•	a decrease in deferred commissions change of $4.9 million due more deferrals in 2015 and higher deferred commission amortization in 2016 as compared to 2015;

•	An increase in accounts payable change of $1.8 million due to the timing of the payments;

---

•	An increase in deferred revenue change of $28.3 million due to higher billings;

•	An increase in accrued liabilities change of $2.0 million due to the timing of compensation and other payments;

•	The increase was offset by a net loss change of $12.5 million and an increase in accounts receivable change of $5.9 million.

•	An increase in amortization of intangible assets of $3.5 million due to the acquired businesses, and an increase in depreciation of fixed assets of $3.6 million due to the increase in capital expenditure;

•	Stock-based compensation expense increased $29.1 million due to the increase in headcount and valuation of grants made;

•	Amortization of debt issuance costs and accretion of debt discount increased $6.2 million due to the issuance of our convertible notes in June 2015;

•	A decrease in accounts receivable change of $2.7 million due to collections;

•	An increase in accounts payable change of $2.3 million due to the timing of the payments;

•	An increase in deferred revenue change of $20.9 million due to higher billings;

•	An increase in accrued liabilities change of $0.5 million due to the timing of compensation and other payments;

•	The increase was offset by a net loss change of $38.6 million, an increase in deferred commissions change of $3.6 million primarily due to higher deferrals, and a decrease in deferred rent change of $2.5 million as larger lease agreements, including tenant allowances received, were executed in prior periods.

---

(1)	Represents the 0.75% and 1.25% convertible senior notes issued in June 2015 and December 2013, respectively. See Note 8, "Convertible Senior Notes" for further information.

(2)	Represents interest payments on the 0.75% and 1.25% senior convertible notes.

(3)	Consists of capital leases and contractual obligations under operating leases for office space and data centers.

(4)	Consists of minimum purchase commitment of products and services. Obligations under contracts that we can cancel without a significant penalty was not included in the table above.

(5)	As we are unable to reasonably predict the timing of settlement of liabilities related to unrecognized tax benefits, net, the table does not include $0.3 million of such non-current liabilities included in Other long-term liabilities recorded on our consolidated balance sheet as of December 31, 2016.

---

•	Revenue recognition;

•	Deferred commissions;

•	Stock-based compensation expense;

•	Fair value of assets acquired and liabilities assumed in business combinations;

•	Impairment assessment of goodwill, intangible assets and other long-lived assets

•	Loss contingencies; and

•	Recognition and measurement of current and deferred income taxes.

•	Persuasive evidence of an arrangement exists;

•	Delivery has occurred or services have been rendered;

•	Sales price is fixed or determinable; and

•	Collectability is reasonably assured.

---

---

•	future expected cash flows from our revenue streams;

•	cost to build the acquired technology;

•	the acquired company’s brand and competitive position, as well as assumptions about the period of time the acquired brand will continue to be used in the combined company’s product portfolio; and

•	discount rates.

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

•	Persuasive evidence of an arrangement exists;

•	Delivery has occurred or services have been rendered;

•	Sales price is fixed or determinable; and

•	Collectability is reasonably assured.

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

•	Level 1: Quoted (unadjusted) prices in active markets for identical assets or liabilities.

---

•	Level 2: Observable inputs other than quoted prices included in Level 1, such as quoted prices for similar assets or liabilities in active markets; quoted prices for identical or similar assets or liabilities in markets that are not active; or other inputs that are observable or can be corroborated by observable market data for substantially the full term of the asset or liability.

•

Level 3: Unobservable inputs to the valuation methodology that are supported by little or no market activity and that are significant to the measurement of the fair value of the assets or liabilities. Level 3 assets and liabilities include those whose fair value measurements are determined using pricing models, discounted cash flow methodologies or similar valuation techniques, as well as significant management judgment or estimation.

---

---

---

---

•	during the calendar quarter commencing after September 30, 2015, if the last reported sale price of the Company's common stock is greater than or equal to 130% of the applicable conversion price on each such trading day for at least 20 trading days (whether or not consecutive) during the period of 30 consecutive trading days ending on the last trading day of the preceding calendar quarter;

•	during the 5 business day period after any 5 consecutive trading day period in which the trading price, as defined, per $1 principal amount of the 0.75% Notes for each trading day of such measurement period was less than 98% of the product of the last reported sale price of the Company's common stock and the applicable conversion rate on each such trading day;

•	upon a notice of redemption by the Company; or

•	upon the occurrence of specified corporate transactions.

---

•	during the calendar quarter commencing after March 31, 2014, if the last reported sale price of the Company's common stock is greater than or equal to 130% of the applicable conversion price on each such trading day for at least 20 trading days (whether or not consecutive) during the period of 30 consecutive trading days ending on the last trading day of the preceding calendar quarter;

•	during the 5 business day period after any 5 consecutive trading day period in which the trading price, as defined, per $1 principal amount of the 1.25% Notes for each trading day of such measurement period was less than 98% of the product of the last reported sale price of the Company's common stock and the applicable conversion rate on each such trading day;

•	upon a notice of redemption by the Company; or

•	upon the occurrence of specified corporate transactions.

---

---

---

---

---

---

---

---

---

---

---

---