Back to GetFilings.com

UNITED STATES
SECURITIES AND EXCHANGE COMMISSION
Washington, D.C. 20549

FORM 10-K

For the Fiscal Year Ended December 31, 2001

Commission File Number: 000-26223

TUMBLEWEED COMMUNICATIONS CORP.
(Exact name of registrant as specified in its charter)

700 Saginaw Drive

Redwood City, CA 94063

(Address of principal executive offices, including zip code)

Registrant's telephone number, including area code (650) 216-2000

Securities registered pursuant to Section 12(b) of the Act:
None

Securities registered pursuant to Section 12(g) of the Act:
Common Stock, $0.001 Par Value per Share

        Indicate by check mark whether the Registrant (1) has filed all reports required by Section 13 or 15() of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the Registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days.        Yes  ý        No  o

        Indicate by check mark if disclosure of delinquent filers pursuant to Item 405 of Regulation S-K is not contained herein, and will not be contained, to the best of Registrant's knowledge, in definitive proxy or information statements incorporated by reference in Part III of this Form 10-K or any amendment to this Form 10-K.        o

        The approximate aggregate market value of the Common Stock held by non-affiliates of the Registrant, based upon the last sale price of the Common Stock reported on the Nasdaq National Market on February 15, 2002 was approximately $91,945,732 (based on the closing price for shares of the Registrant's Common Stock as reported on the Nasdaq National Market of $4.09 on that date). Shares held by each officer, director, and holder of 5% or more of the outstanding Common Stock have been excluded in that such persons may be deemed affiliates. This determination of affiliate status is not necessarily a conclusive determination for other purposes.

        The number of shares of common stock outstanding as of February 15, 2002 was 30,631,382.

DOCUMENTS INCORPORATED BY REFERENCE

Certain parts of the Tumbleweed Communications Corp. Proxy Statement relating to the annual meeting of stockholders to be held on May 30, 2002 (the "Proxy Statement") are incorporated by reference into Part III of this Annual Report on Form 10-K.

SPECIAL NOTE ON FORWARD-LOOKING STATEMENTS

        This Annual Report on Form 10-K contains forward-looking statements within the meaning of Section 27A of the Securities Act of 1933 and Section 21E of the Securities Exchange Act of 1934, which are subject to the "safe harbor" created by those sections. The forward-looking statements are based on our current expectations and projections about future events, including, but not limited to, implementing our business strategy; attracting and retaining customers; obtaining and expanding market acceptance of the products and services we offer; forecasts of Internet usage and the size and growth of relevant markets; rapid technological changes in our industry and relevant markets; and competition in our market. Discussions containing such forward-looking statements may be found in "Management's Discussion and Analysis of Financial Condition and Results of Operations." In some cases, forward-looking statements can be identified by terminology such as "may," "will," "should," "could," "predicts," "potential," "continue," "expects," "anticipates," "future," "intends," "plans," "believes," "estimates," and similar expressions. These forward-looking statements are based on current beliefs, expectations and assumptions and involve certain risks and uncertainties that could cause actual results, levels of activity, performance, achievements and events to differ materially from those implied by such forward-looking statements. Factors that could cause or contribute to such differences include those discussed under the caption "Risks and Uncertainties" contained herein, as well as those discussed elsewhere herein. These forward-looking statements are made as of the date of this Annual Report on Form 10-K. We disclaim any obligation to update these forward-looking statements or to explain the reasons why actual results may differ. We reserve the right to update these statements for any reason, including the occurrence of material events.

TUMBLEWEED COMMUNICATIONS CORP.
2001 FORM 10-K ANNUAL REPORT

TABLE OF CONTENTS

TRADEMARKS

        Our registered trademarks include Tumbleweed®, Tumbleweed Communications®, WorldSecure® and Worldtalk®. Additional trademarks belonging to us include Tumbleweed Secure Guardian™, Tumbleweed Secure Policy Gateway™, Tumbleweed Secure Staging Server™, Tumbleweed Staging Server™, Tumbleweed Secure Mail™, Tumbleweed Secure Redirect™, Tumbleweed Secure Public Network™, Tumbleweed SPN™, Tumbleweed Secure Archive™, Tumbleweed Secure Web™, Tumbleweed Secure Inbox™, Tumbleweed Secure Envelope™, Tumbleweed Secure CRM™, Tumbleweed Secure Messenger™, Tumbleweed Secure Statements™, Tumbleweed My Copy™, Tumbleweed L2i™, Tumbleweed IME Developer™, Tumbleweed Integrated Messaging Exchange™, Tumbleweed IME™, Tumbleweed IME Personalize™, WorldSecure/Mail™ and Tumbleweed IME Alert™.

3

PART I

Item 1—Business.

Overview

        We are a leading provider of secure content management solutions for enabling business conducted on the Internet. Tumbleweed Secure Guardian is a leading enterprise-wide policy-based security framework that offers a wide range of solutions to both protect and extend enterprise networks, move business processes online and enable enterprises to communicate safely over the Internet. Tumbleweed solutions empower organizations to safely share and protect critical information, increase customer loyalty and privacy and reduce costs.

        Tumbleweed Secure Guardian augments and extends traditional, network-focused security solutions by adding a critical layer of content-focused security management. Secure Guardian is a server-level software framework that sits between an organization's internal applications and a corporate firewall, and provides centralized security for both incoming and outgoing communications crossing the firewall. Security is provided by intelligently analyzing and managing three critical and interrelated factors: the content that travels over the network; the identities of senders and receivers; and the business processes that direct the proper flow of information across the extended enterprise.

Industry Background

        The use of groupware applications, customer service applications and web services has grown as enterprises are increasingly relying on these applications to communicate with their customers, business partners and suppliers. Enterprises are looking for communications applications that can integrate and migrate business processes and associated data with groupware and web applications and transform how they communicate and conduct business with their partners and customers. The volume of groupware communications and web-based email has grown significantly over the past several years in both the business and consumer markets. According to recent IDC research, worldwide Internet traffic will increase 93-fold from 2000 to 2005.

        To fully leverage the power of communicating using the Internet and email, businesses must first address the issues of security, centralized management, automation, legacy integration and end-user behavior, as well as potential adoption issues. The use of policies and management protocols that were traditionally applied to paper or voice-based processes within a company in many cases can and should be applied to communications conducted over the Internet and email. The adoption of these policies and protocols is critical to establish adherence to regulatory requirements that face each industry and to provide enterprises with the same protection of audit trail and confidentiality that paper processes supply. In addition, recent studies from Gartner Group indicate that consumers are hesitant about doing business online unless they can have confidence that the security and the privacy of their information is protected. End-users are also interested in easily accessible online services and communications from the companies with which they do business.

        With comprehensive security solutions, businesses can deploy policies enterprise-wide, provide critical management of communications, and leverage the investment they have made in their existing systems in order to fully maximize business conducted on the Internet.

Tumbleweed's Security Solutions and Services

        We offer a comprehensive family of communications solutions built on the Tumbleweed Secure Guardian framework that enable enterprises to safely leverage the cost-efficiencies and productivity of Internet communications. In addition, all Tumbleweed solutions are designed to integrate with existing business systems and groupware applications requiring no significant change in existing firewall or system infrastructures. Our application and protocol-specific solutions can be purchased independently

4

or together to create a powerful and complete communications solution for businesses. All of our solutions offer multi-level security using industry standards, universal access, and proven scalability for high volume message traffic.

        All of our solutions are built on the Tumbleweed Secure Guardian framework, an enterprise-wide security framework made up of a platform, the Tumbleweed Secure Policy Gateway, and a multitude of protocol enablers that allow virtually any system to connect to Tumbleweed Secure Guardian. Tumbleweed Secure Guardian offers software solutions and product suites to both protect and extend commercial and governmental enterprise networks.

Tumbleweed Secure Guardian—Solutions to Protect Enterprises

        Our protection solutions enable companies to centrally control, manage and monitor their Internet communications stream. By controlling and monitoring groupware and browser-based communications, as well as employee Internet usage, our customers can better comply with their own internal corporate policies as well as government regulations. Tumbleweed solutions combine not only all of the elements required to establish and manage communications policies but also allow for virus and spam protection, archival of critical communications and regulatory compliance.

        Every day, high volumes of email messages flow in and out of businesses carrying intellectual property assets (such as business plans, technology and engineering specifications, and contracts), personal communications, and harmful content such as viruses and spam. By neglecting to monitor and manage this communications stream, businesses risk:

•

Interception of valuable business data by competitors or hackers;



•

Loss of data and productivity from damage by viruses and malicious content;



•

Clogging of network bandwidth by spam and recreational multimedia files;



•

Liability for accidental exposure of confidential customer or employee information;



•

Liability for the distribution of racist, sexist, or otherwise harmful content; and



•

Liability for violation of industry regulations including various healthcare or other government regulations.

        Businesses need to monitor and manage their communications so that groupware applications can continue to be a tool for fast, cost-effective communications. They need to centrally manage and globally enforce communications policies. They need a solution that complements, rather than replaces, their groupware infrastructure. They also need a solution that enforces communication controls automatically, without relying on the initiative or costly re-training of individual users within their organization.

        By integrating our protection solutions with existing groupware networks, a business can take control of its online communications and set policies to apply content control, filtering, encryption, access control, attachment management, virus scanning and digital signatures to groupware traffic. Because our solutions allow policies to be administered centrally and enforced universally across an enterprise, our server-based protection solutions offer several advantages over desktop solutions, including:

•

Rapid deployment (installed, configured, and tuned within a week);



•

Universal coverage (all groupware and web-based email communications are automatically managed, so no change in existing infrastructure needs to be made);



•

Centralized policy enforcement (identification of sensitive digital information, including the use of industry-specific lexicons);

5

•

Cost-effective centralized administration (no expenses for end user training or distributing, installing, or maintaining new desktop software).

        Our Secure Guardian protection solutions include Tumbleweed Secure Mail, Tumbleweed Secure Archive, and Tumbleweed Secure Web:

•

Tumbleweed Secure Mail allows enterprises to apply policy to inbound and outbound groupware communications. It includes the Secure Policy Gateway for centralized policy enforcement, anti-virus scanning capabilities and a suite of process managers and optional applications that can be quickly configured to define and enforce the policies appropriate to a particular business. The Secure Mail Content Manager scans messages and attachments for specific words or strings of words. When a policy violation is detected, Tumbleweed Secure Mail can take a number of actions, such as block, quarantine, archive, or defer delivery. With Secure Mail Access Manager, companies can set policies that restrict access of groupware-originated communications from certain senders or those sent to certain recipients. For example, policies can block inbound messages from known problem or spam domains, or prevent confidential information from being sent to an unwanted domain. The Secure Mail Virus Manager uses integrated server-based anti-virus software from Network Associates to detect and optionally clean or strip infected attachments in both incoming and outgoing messages.



•

Tumbleweed Secure Archive allows organizations to archive all or selected SMTP messages to an external device, such as an optical jukebox. Messages can be tagged with information such as violation type and retention period prior to archiving. Tumbleweed Secure Archive provides Web-based reviewer tools for performing queries and running reports.



•

Tumbleweed Secure Web provides URL filtering and monitors Internet traffic for inappropriate content, viruses, and malicious mobile content downloaded from the web. Tumbleweed Secure Web can also monitor the content of Web-based e-mail and message board postings.

Tumbleweed Secure Guardian—Solutions to Extend Enterprise Networks

        Our extension solutions allow businesses and organizations to establish secure Internet communications channels with partners, suppliers and customers. All of Tumbleweed's extension solutions are server-based and integrate with existing groupware networks, enterprise systems, or legacy applications in order to secure communications automatically before it crosses the corporate firewall. Without retraining users or changing desktop software, our extension solutions enable businesses to take advantage of moving their business communications online and ensure that those communications are encrypted, auditable and controlled so that access is granted only to appropriate recipients.

        Our extension solutions include Tumbleweed Secure Public Network (SPN), Tumbleweed Secure Redirect, Tumbleweed Secure Messenger, Tumbleweed Secure CRM and Tumbleweed Secure Statements.

•

Tumbleweed SPN, allows businesses to leverage the existing, public infrastructure of the Internet to communicate safely with their partners electronically in a cost-effective manner. A great deal of business critical communications—such as business plans, contracts, product drawings, artwork, legal documents and engineering specifications—take place among branch offices, between branch offices and headquarters or among businesses and their long-standing partners and customers. Until now, businesses have not had a cost-effective solution for securing and automating these communications. Courier services, such as FedEx, are relatively secure, but much slower and more expensive than electronic communications. Virtual Private Networks, or VPNs, typically involve the installation and maintenance of custom hardware and software. Also, VPN access can be difficult to administer for both remote offices and outside partners that need to access only certain information but not the business' entire network environment. Using

6

groupware applications and email is fast and convenient, but typically not secure and can be difficult to manage and track. Using email as a main communications vehicle can also open a company to risks involved with exposing important confidential information to competitors and hackers. Businesses need a way to secure these communications—quickly, easily, and automatically. The solution should:

•

Complement rather than replace existing groupware applications and IT systems at each site;



•

Be based on open standards, so that it works with whatever software and hardware a particular partner is using; and



•

Apply security automatically at the server level, without requiring end users to learn new procedures or replace the client software they are already familiar with.

By deploying our Tumbleweed SPN solution, a business can create secure networks among its offices, partners, suppliers, and customers. Meanwhile, end users within and outside the company can continue using their own client software. Tumbleweed SPN is a server-based solution that can automatically encrypt outgoing messages and sign them with an organization's digital certificate. The solution also monitors, authenticates, and decrypts incoming messages, and delivers them unencrypted to the recipient's desktop within the corporate network environment. Security applied is automatic and transparent to employees within the organizations.

•

Tumbleweed Secure Redirect allows enterprises to communicate securely with individuals at locations outside the secure public network of partners and/or remote offices. Tumbleweed Secure Redirect can scan the content of outgoing messages originating from groupware applications or web-based email applications and then encrypt those communications for delivery depending upon a company's policies. Recipients of messages only need an email program and a Web browser to receive encrypted messages. Recipients can be authenticated by a variety of methods, using known information about the recipient or by tying into an internal authentication database or engine existing within the company (LDAP directory, single sign-on directory, etc.). Tumbleweed Secure Redirect enables businesses to automatically encrypt, deliver, and track communications to any Internet user with a standard email program and web connection. The advantages of Tumbleweed Secure Redirect include:



•

Universal coverage and ubiquitous reach (all groupware communications can be automatically managed and secured, any email client and/or web browser can accept the encrypted messages);



•

Expedited training (end users need not learn new procedures or new software tools); and



•

Cost-effective (no expenses for end user training or distributing, installing, or maintaining new desktop software).




•

Tumbleweed Secure CRM allows enterprises to apply security to emails originating from an internal customer relationship management system.



•

Tumbleweed Secure Messenger supports secure ad hoc online customer service or everyday communications using the Tumbleweed Staging Server and private URL technology. Secure Messenger is an application designed to enable secure, trackable online communication, including secure, browser-based, person-to-person communications. Combining Secure Messenger and Secure CRM, enterprises can tie into existing CRM applications and email response systems to ensure that the confidentiality and security of messages delivered to customers is maintained. Using Tumbleweed Secure Messenger, Internet users can securely compose, send, receive, store and search messages and files. Secure Messenger comes with the Tumbleweed Secure Inbox, an online email inbox that contains all archived messages so

7

customers can download and view messages at any time of the day and track responses of online customer service inquiries. The Tumbleweed Secure Inbox is used to increase levels of customer service, as well as increase internal productivity by allowing customers to self-service using an online vehicle. Tumbleweed Secure Messenger can interoperate with a business's existing web portal applications creating a customized, branded experience for a business' customers and/or partners.

•

Tumbleweed Secure Statements offers businesses a foundation for the automated preparation, secure Internet delivery of, tracking of and managed response to documents. Secure Statements easily integrates with existing systems, and can automatically extract legacy data and convert print stream data (such as PCL, AFP, LCDS, HTML and XML) into Internet-ready files, and deliver such files to the customer or partner. In addition, our solutions can automatically forward important communications to electronic archives. To receive a statement sent via Tumbleweed Secure Statements, an end user only needs an email client and a Web browser. New desktop software, Java applets or desktop plug-ins are not required.

Industry sources estimate that businesses send more than 20 billion paper documents annually. In the United States alone, there are estimated to be more than 350 million financial accounts, each requiring the periodic delivery of statements. Businesses can save time and money and improve service by moving these paper statements online. In most industries, a paper statement costs between $1 and $1.50 to print and mail. Electronic statements delivered by our solutions cost significantly less because we eliminate printing and postage costs.

Tumbleweed's solution also provides a foundation for additional communications services that can promote sales, increase customer loyalty, and streamline customer service. Secure Statements prepares, delivers, and tracks Internet statements. Businesses can provide each statement recipient with a custom Tumbleweed Secure Inbox—a protected online repository for securely receiving, storing, organizing, searching, and forwarding online communications. Using Tumbleweed Secure Messenger, Secure CRM and Secure Statements together, businesses can increase customer retention and service by aggregating all customer communications into one secure location for a customer, organized in folders and by delivery dates and times.

        The advantages of using Tumbleweed Secure Statements versus traditional paper-based delivery and other electronic delivery methods include:

•

Cost reduction (no printing and mailing documents to customers);



•

Existing system integration (extracts statement information from business applications, databases, and mainframe print streams);



•

Universal delivery (reaches any Internet user with a standard email program and a Web browser);



•

Security and authentication (includes passwords, PINs, and digital certificates);



•

Thorough tracking (enables businesses to create an audit trail or otherwise track the transmission and receipt of statements);



•

Payment system integration (integrates with various payment engines with customization); and



•

Cost-effective deployment (no expenses for end user training or distributing, installing, or maintaining new desktop software).

8

Tumbleweed Professional Services

        Our professional services organization provides consulting, integration engineering, custom application development, training and educational services and support used to build online communication systems based on our products.

        The following are examples of the professional services we offer:

        Custom application development, which extends the functionality of our solutions with custom engineering used to create unique online communication solutions that can be deployed to precisely meet a company's business needs.

        Integration consulting, which allows our customers to integrate our solutions with existing technology infrastructure, including legacy systems, customer databases, support systems, and billing systems.

        Data center design and installation, which assists customers in designing communication services based on our products, including determining hardware requirements, backup and redundancy processes, and physically implementing our solution in the customer's data center. Our professional services organization may also provide ongoing support of the customer's data center.

        Technical training, which provides the customer with formal training in the administration and operation of our products and use of Tumbleweed application programming interfaces, or APIs.

        Support, which assists customers in managing Tumbleweed products they have deployed.

        Our products are generally deployed in business-critical environments, where highly responsive customer support is critical to the continuing success of the deployed solution. We maintain a centralized technical support group that is responsible for first-line and second-line customer support as well as distribution of products and documentation updates. This group works closely with our professional services and product development organizations in order to ensure continuity in the areas of problem resolution and priority response.

        We also offer extended customer assistance 24 hours a day, 7 days a week, for those customers requiring around the clock support. Pricing for such support is negotiated separately and is in addition to our standard fees.

        Professional services are performed for an additional fee and are offered in conjunction with the licensing or deployment of our products.

Strategy

        Our objective is to provide a comprehensive family of solutions to leverage the Internet for businesses worldwide. Key elements of our strategy are:

Establish Tumbleweed as a leading provider of Internet security software solutions that offer customers increased productivity, lowered costs and reduced liability.

        We intend to establish Tumbleweed Secure Guardian as the leading foundation upon which to build mission-critical business communications. Our focus is on offering solutions that allow our customers to rapidly recoup their original investment and earn a significant return on that investment. Our customers use our solutions to increase their productivity, efficiency and reduce costs. By moving business processes online and extending online communications to include a number of different applications, our software solutions can eliminate costs associated with traditional paper, fax or voice-based business processes. Our solutions enable our customers to define and implement multi-layer security policies, ensuring the safe and efficient use of corporate email systems and the privacy of confidential information. Through a direct sales force and a reseller channel, we are pursuing

9

customers in the healthcare, pharmaceutical, banking, brokerage, insurance, telecommunications, technology and manufacturing industries.

Focus on providing solutions in markets where we have solid market traction and which represent the largest opportunities for us.

        Our strategy is to offer solutions with a number of key characteristics. We offer solutions that have a horizontal application across a number of vertical industries with market drivers thereby reducing our exposure to any single specific vertical market. We focus on solutions that have a relatively short deployment time, and therefore a lower services load—reducing the cost of running our professional services organization and changing the mix of services revenue in our revenue stream. Our strategy is intended to ultimately help us improve our overall gross margins and serve our customers better. In addition, our strategy is to target geographic markets where Internet usage has matured and where we have reached critical mass in product sales, such as the United States, Japan, Germany, and the United Kingdom.

Cultivate a channel of resellers to augment our direct sales effort and educate the market about Tumbleweed.

        We intend to promote and leverage our channel of resellers, including value-added resellers, to expand the sales of our solutions in strategic vertical and geographic markets. By choosing best-of-breed partners and customers to offer our solutions to the marketplace, we can better capture the opportunity of a growing market and leverage the brand recognition and extensive sales and marketing resources of leading technology providers and consultants. Our Tumbleweed Channel Alliance partners focus on small-to-mid-sized enterprises while our direct sales force focuses on large enterprises.

Provide comprehensive professional and/or outsourcing services through systems integrators or through our in-house team.

        We offer a full suite of professional and consulting services that are end-to-end and designed to help customers implement our solutions as rapidly as possible. The services include business-specific applications consulting, software development, training and complete technical support. In addition, services and outsourcing can also be provided through our best-of-breed systems integrators.

Customers and Target Markets

        Enterprise customers use Tumbleweed solutions to secure online communications and other business delivery processes originating within their own enterprise. These communications and processes reach customers, business partners, suppliers and employees. Examples of Tumbleweed customers include: American Century Services Corp., American Express Travel Related Services Company, Inc., Amgen Inc., Beckman Coulter, Inc., Best Buy Co., Inc., Broadcom Corp., Diners Club International Ltd., the U.S. Food & Drug Administration, Gap Inc., JP Morgan Chase & Co., Merck & Co., Inc., National Semiconductor Corp., Northern Trust Corp., Phoenix Home Life Insurance Co., Salomon Smith Barney Inc., Siebel Systems, Inc., Skandaniska Enskilda Banken AB, Union Miniere Oxyde (UK) Ltd., Verizon Communications, Wachovia Securities, Inc., and Wells Fargo & Co. Over 100 of the Fortune 500 use various Tumbleweed solutions today.

        Tumbleweed solutions and related services are sold directly to enterprises across a number of vertical industries. Our target markets include: healthcare, banking, brokerage, insurance, pharmaceutical, government, manufacturing, technology and telecommunications. In addition, our solutions are offered through the service providers such as those listed above that offer their customers secure, reliable and trackable communication services for a fee. Tumbleweed's distribution strategy

10

addresses the requirements of small companies and large enterprises alike. The primary geographic markets we are focused on are the United States, Japan, Germany and the United Kingdom. We have a Tumbleweed Channel Alliance program to target small and mid-sized business customers and gain market visibility.

Sales

        We maintain a direct sales force that focuses on signing key enterprise customers as well as further penetrating existing accounts by selling them new applications. Our sales force is comprised of domestic and international sales groups consisting of a total of 80 employees as of December 31, 2001. Offices in the U.S. currently include Redwood City, California; Ann Arbor, Michigan; Brentwood, California; Cedar Park, Texas; Charlotte, North Carolina; Chicago, Illinois; Denver, Colorado; Irvine, California; Irving, Texas; New York, New York; Reston, Virginia; and San Ramon, California. Our offices outside the U.S. currently include Germany, Hong Kong, Japan, the Netherlands, Switzerland, and the United Kingdom. Our sales force includes field sales engineers and inside sales personnel who support the account executives. Field sales engineers assist our account executives with technical presentations, customer requirements analysis and initial solution designs. Our inside sales personnel assist the account executives in managing their customer relationships. Our sales effort is augmented by the sales forces of our channel partners. The sales force also works with Tumbleweed Channel Alliance Partners to sell Tumbleweed products. The typical sales cycle can range from several weeks to six months, but may be significantly longer for large sales.

Marketing

        Our marketing efforts are organized around three primary areas: product marketing, product management and corporate marketing. Product marketing identifies target markets and customer opportunities, then develops the positioning, programs and materials to reach customers and support sales activities.

        Product management translates customer and market requirements into product plans and works with engineering to ensure completion. Product management also trains salespeople on product information. Corporate marketing drives lead generation activities to support Tumbleweed sales, as well as overall market awareness of us and our products through media, analyst and investor relations, events, and speaking engagements. Corporate marketing is also responsible for branding, corporate identity, and the Tumbleweed website. Both product marketing and corporate marketing work closely with direct sales and channel sales partners to focus programs more effectively and guide product research and development.

Governmental Regulation

        We are not currently subject to direct regulation by any domestic or foreign governmental agency, other than regulations applicable to businesses generally, and laws or regulations directly applicable to access to online commerce. However, due to the increasing popularity and use of the Internet and other online services, it is possible that a number of laws and regulations may be adopted with respect to the Internet or other online services covering issues such as user privacy, Internet transaction taxation, pricing, content, copyrights, distribution and characteristics and quality of products and services. Furthermore, the growth and development of the market for online commerce may prompt calls for more stringent consumer protection laws that may impose additional burdens on those companies conducting business online. For example, the Federal Communications Commission could determine through one of its ongoing proceedings that the Internet is subject to regulation. Among other possible courses of action, the FCC may determine that Internet service providers are subject to certain access charges or fees for carrying Internet traffic over the public switched telephone network. The adoption of any additional laws or regulations may decrease the growth of the Internet or other

11

online services, which could, in turn, decrease the demand for our products and services and increase our cost of doing business, or otherwise have a material adverse effect on our business, financial condition and results of operations.

        Permits or licenses may be required from federal, state, local or foreign governmental authorities to operate or to sell some products on the Internet. We may not be able to obtain these permits or licenses. We may be required to comply with future national and/or international legislation and statutes regarding conducting commerce on the Internet in all or specific countries throughout the world. It may not be possible to comply with this legislation or these statutes on a commercially reasonable basis, if at all.

        In addition, our products rely on encryption and authentication technology from third parties to provide the security and authentication necessary to achieve secure transmission of confidential information. Exports of software products utilizing encryption technology are generally restricted by the U.S. and various foreign governments. We have obtained approval to export products using up to 255-bit symmetric encryption and 2048-bit public key encryption, including the products formerly known as IME Server, IME Desktop, IME Receive Applet, IME Remote API using OmniORB with SSL, and MMS Worldwide/255. We are not exporting other hardware, software or technology that is subject to export control under U.S. law. However, the list of countries and products for which exports are restricted and the related regulatory policies could be revised in the future, and we may not be able to obtain required government approvals.

Intellectual Property

        To date, the U.S. Patent and Trademark Office has issued us six U.S. patents—five utility patents and one design patent related to the user interface of our products. We have filed an additional twenty-two utility patent applications that are now pending in the U.S. Patent and Trademark Office. We also have twenty-three patent applications now pending in foreign jurisdictions, including three pending applications filed under the Patent Cooperation Treaty. In addition, we currently have nine registered trademarks worldwide, including the mark Tumbleweed, and are pursuing other key trademarks and service marks in the U.S. and internationally.

        We regard our patents, trademarks and other intellectual property as critical to our success. We rely on patent and trademark law together with confidentiality and/or license agreements with our employees, customers, partners and others to protect our proprietary rights. Despite these precautions, we may not be successful in protecting our rights. For example, it may be possible for unauthorized third parties to copy particular portions of our products or reverse engineer or obtain and use information that we regard as proprietary. Some end-user license provisions protecting against unauthorized use, copying transfer and disclosure of the licensed program may be unenforceable under the laws of some jurisdictions and foreign countries. In addition, the laws of some foreign countries do not protect proprietary rights, particularly software based patents, to the same extent as do the laws of the U.S. Our means of protecting our proprietary rights in the U.S. or abroad may not be adequate and competing companies may independently develop similar technology. In particular, we are currently engaged in litigation to enforce our intellectual property rights, which may not be successful and in any event will result in substantial expenditures of resources to pursue.

        The status of U.S. patent protection in the software industry is not well defined and will evolve as the U.S. Patent and Trademark Office grants additional patents and as the Federal Courts further interpret software-based inventions. The status of foreign protection in the software industry is also evolving and not well-defined. Our patent applications may not be issued with the scope of the claims sought by us, if at all. Our products may infringe patents issued to third parties. In addition, because foreign patent applications are not published until 18 months after filing and patent applications in the

12

U.S. are not publicly disclosed until the patent is issued, U.S. and/or foreign applications may have been filed by third parties that relate to our software products.

        Third parties could claim infringement by us with respect to current or future products or services. We may increasingly be subject to claims of intellectual property infringement as the number of our competitors grows and the functionality of their products and services increasingly overlap with ours. We aggressively seek to enforce our patent and other intellectual property rights, which may further increase the risk of adverse claims. Any of these claims, with or without merit, could be time consuming to defend, result in costly litigation, divert management's attention and resources, limit use of our services or require us to enter into royalty or license agreements. A successful claim of product infringement against us could harm our business and prospects.

Competition

        The markets in which we compete are intensely competitive and rapidly changing. We believe there is no single competitor that offers the complete package of secure content management software that Tumbleweed sells. We are aware of competitors that exist for each of our product lines and for combined components of our solution sets.

        Our principal competition for our Tumbleweed Secure Guardian protection solutions are companies that offer various Internet content security, web security, messaging policy management, and enterprise relationship management products. Companies that sell products that compete with some of the features within our products include: Kana Communications, Inc., Clearswift Technologies, Symantec Corp., and Trend Micro Incorporated.

        Our principal competition in the secure document delivery and statement presentment market area comes from other online communication or information security service providers, some of which have services or products that are intended to compete directly with our products or that could be used as alternatives to our products. Examples of some of these providers are Automatic Data Processing, Inc., DST Systems, Inc., New River Systems, and PostX Corporation. Our solutions can be an alternative to traditional mail and courier delivery services such as those offered by Federal Express Corporation, UPS, or the U.S. Postal Service, and to general purpose e-mail applications and services. In addition, companies with which we do not presently directly compete may become competitors in the future, either through the expansion of our products or through their product development in the area of secure online communication services. These companies include International Business Machines Corporation/Lotus Development Corporation and Microsoft Corporation.

        The principal competitive factors in our industry include price, product functionality, product integration, platform coverage and ability to scale, worldwide sales infrastructure and global technical support. Some of our competitors have greater financial, technical, sales, marketing and other resources than we do, as well as greater name recognition and a larger installed customer base. Additionally, some of these competitors have research and development capabilities that may allow them to develop new or improved products that may compete with product lines we market and distribute. We expect that the market for mission-critical messaging software, which has been fragmented historically, will become more consolidated with larger companies being better positioned to compete in such an environment in the long term. As this market continues to develop, a number of companies with greater resources than ours could attempt to increase their presence in this market by acquiring or forming strategic alliances with our competitors or business partners. Our success will depend on our ability to adapt to these competing forces, to develop more advanced products more rapidly and less expensively than our competitors, and to educate potential customers as to the benefits of licensing our products rather than developing their own products. Competitors could introduce products with superior features, scalability and functionality at lower prices than our products and could also bundle existing or new products with other more established products in order to compete with us. In addition,

13

because there are relatively low barriers to entry for the software market, we expect additional competition from other established and emerging companies. Increased competition is likely to result in price reductions, reduced gross margins and loss of market share, any of which could harm our business.

Employees

        As of December 31, 2001, we employed 231 people worldwide, including 60 in engineering, 80 in sales, 50 in professional services, 11 in marketing, and 30 combined in corporate management, finance, human resources, information technology, and other administration. Our employees are not represented by any collective bargaining organization. We have never experienced a work stoppage and consider our relations with our employees to be good.

Item 2—Properties and Facilities.

        We lease approximately 40,000 square feet for our corporate headquarters located in Redwood City, California under a lease with a term of five years commencing June 8, 1999. We also maintain domestic sales offices in Ann Arbor, Michigan; Brentwood, California; Cedar Park, Texas; Charlotte, North Carolina; Chicago, Illinois; Denver, Colorado; Irvine, California; Irving, Texas; New York, New York; Reston, Virginia; and San Ramon, California. Further, we maintain sales offices in various locations overseas, including Germany, Hong Kong, Japan, the Netherlands, Switzerland, and the United Kingdom.

Item 3—Legal Proceedings.

        On March 3, 1999, we sued the docSpace Company, Inc. in the United States District Court for the Northern District of California alleging infringement of our U.S. Patent No. 5,790,790. In its answer, docSpace raised counterclaims alleging, among other things, antitrust violations and unfair competition. On March 9, 2000, Critical Path, Inc. acquired docSpace. On July 31, 2001, we entered into an agreement with Critical Path whereby they acknowledged the validity and enforceability of the two patents at issue, and licensed those patents from us in exchange for a royalty bearing license fee. We have agreed to dismiss both lawsuits.

        On July 7, 2000, three complaints were filed by David H. Zimmer, Congressional Securities, Inc. and other plaintiffs against Interface Systems, Inc., a company we acquired in 2000, and various additional defendants, including Interface's prior president and chief executive officer, Robert A. Nero and Fiserv Correspondent Services, Inc., in the United States District Court for the Southern District of New York. The three cases contain substantially similar allegations of false and misleading representations by various defendants allegedly designed to inflate Interface's stock price. The complaints seek relief under the federal securities laws on behalf of purported classes of persons who purchased, held, or sold shares of Interface stock, and under various other causes of action. On September 27, 2000, we filed (i) a motion to strike or dismiss for failure to meet the certification requirements of the Private Securities Litigation Reform Act, (ii) a motion to dismiss for failure to state a claim, and (iii) a motion to dismiss because of improper venue, or in the alternative, motion to transfer the lawsuits to the Eastern District of Michigan. On July 27, 2001, the Court granted our motion to transfer the lawsuits to the Eastern District of Michigan, and left the decision on the pending motions to dismiss to the transferee Court. The United States District Court for the Eastern District of Michigan held a status conference on the cases on October 23, 2001 without resolving either of our pending motions. On March 8, 2002, the Court ordered the parties to appear for a status and scheduling conference on April 4, 2002. On March 26, 2002, we received from plaintiffs' Michigan counsel a draft amended complaint through which plaintiffs propose to (i) consolidate the separate actions into one action; (ii) add certain new plaintiffs; (iii) add Tumbleweed Communications Corp. as a defendant; (iv) drop the claims under the Federal securities laws; and (v) add claims for breach of

14

fiduciary duty and negligent misrepresentation. Plaintiffs have not yet filed a motion to amend the pending complaints, nor has the court authorized such an amendment. In the meantime, the motion to dismiss and the motion to strike, discussed above, remain before the court with respect to the pending complaints.

        Although we believe these lawsuits are without merit, no assurance can be given about their outcome, and an adverse outcome could significantly harm our business and operating results. Moreover, the costs in defending these complaints could harm future operating results.

Risks and Uncertainties

Because we are in an early stage of development and have a history of losses, it is difficult to evaluate our business and we may face expenses, delays and difficulties.

        We have only a limited operating history upon which an evaluation can be based. Accordingly, our prospects must be considered in light of the risks, expenses, delays and difficulties frequently encountered by companies in a similarly early stage of development, particularly companies engaged in new and rapidly evolving markets like ours. We incurred net losses of $114.2 million, $69.8 million, and $24.2 million in the years ended December 31, 2001, 2000, and 1999, respectively. As of December 31, 2001, we had incurred cumulative net losses of $249.2 million.

We anticipate continued losses.

        Our success may depend in large part upon our ability to generate sufficient revenue to achieve profitability and to effectively maintain existing relationships and develop new relationships with customers and strategic partners. If we do not succeed, our revenue may not increase, and we may not achieve or maintain profitability on a timely basis or at all. In particular, we intend to expend significant financial and management resources on product development, sales and marketing, strategic relationships, technology and operating infrastructure. As a result, we expect to incur additional losses and continued negative cash flow from operations for the foreseeable future.

Our quarterly financial results are subject to significant fluctuations.

        As a result of our limited operating history and the emerging nature of the markets in which we compete, we may not be able to accurately forecast our revenue or expenses. Our success is dependent upon our ability to enter into and maintain profitable relationships with customers and to develop and maintain profitable usage of our products by our customers and their end-users.

        Our revenue has fluctuated and our quarterly operating results will continue to fluctuate based on the timing of the execution and termination of customer agreements in a given quarter. Under the traditional software licensing model, license revenue is comprised of initial license and distribution fees. As a result, we typically recognize initial license fees as revenue in the same quarter an agreement was signed. To the extent that customers purchase our product under the subscription-based pricing model, however, we account for and report our contracted revenue over the life of the agreement.

        Our services revenue historically has been comprised largely of implementation, customization and consulting fees as well as customer support contracts. Our ability to receive revenue from services is subject to multiple risks, including the risk that we may not be able to meet increasing customer demand because of a lack of adequately trained personnel, and the risk that customers may not timely accept the services provided and delay payment for such services.

15

        In addition, we have experienced, and expect to continue to experience, fluctuations in revenue and operating results from quarter to quarter for other reasons, including, but not limited to:

•

the amount and timing of operating costs and capital expenditures relating to our business, operations and infrastructure, including our international operations;



•

our ability to accurately estimate and control costs;



•

our ability to timely collect fees owed by customers;



•

the announcement or introduction of new or enhanced products and services in the secure content management, content security, secure online communications, or document delivery markets; and



•

acquisitions that we complete or propose.

        As a result of these factors we believe that quarter-to-quarter comparisons of our revenue and operating results are not necessarily meaningful, and that these comparisons may not be accurate indicators of future performance. Quarterly financials for 2001 that include revenue accounted for under the both the subscription-based pricing model and the traditional software pricing model will not be comparable with historical quarters that used our previous licensing model. Because our staffing and operating expenses are based on anticipated revenue levels, and because a high percentage of our costs are fixed, small variations in the timing of the recognition of specific revenue could cause significant variations in operating results from quarter to quarter. In addition, many of our customers delay purchases of our products until the end of each quarter. If we are unable to adjust spending in a timely manner to compensate for any unexpected revenue shortfall, any significant revenue shortfall would likely have an immediate negative effect on our operating results. Moreover, we believe the difficulties outlined above with respect to financial forecasts also apply to securities analysts that may publish estimates of our financial results. Our operating results in one or more future quarters may fail to meet the expectations of securities analysts or investors due to any of a wide variety of factors, including fluctuations in financial ratios or other metrics used to measure our performance. If this occurs, we would expect to experience an immediate and significant decline in the trading price of our stock.

        In addition, the terrorist acts of September 11, 2001 in New York City, Washington D.C. and Pennsylvania, as well as the response, military and otherwise, by the United States, have created an uncertain economic environment and we cannot predict the impact of these events, any subsequent terrorist acts or of any related military action, on our customers or business. We believe that, in light of these events, some businesses may curtail spending on information technology, which could also affect our quarterly results or financial condition in the future.

Restructuring of operations and other cost reducing measures we have implemented may not achieve the results we intend and even may harm our business.

        In January 2001, we announced a restructuring of our business, which included a reduction in force and the closure of three international locations. Since that time we have engaged in other ongoing measures to reduce expenses and establish an enterprise that is appropriate for our expected revenue levels. The planning and implementation of this effort has placed, and may continue to place, a significant strain on our managerial, operational, financial and other resources. Additionally, the actions undertaken to restructure the business may negatively affect our employee turnover, recruiting and retention of important employees. If we are unable to implement our restructuring effectively or if we experience difficulties in carrying out the restructuring, our expenses could increase more quickly than we expect. If we find that the actions taken to date did not sufficiently decrease the growth of our expenses, we may find it necessary to implement further streamlining of our expenses, to perform additional reductions in our headcount or to undertake additional restructurings of our business.

16

We may have insufficient cash reserves to see us through to profitability.

        As of December 31, 2001, we had cash and cash equivalents of $43.2 million and incurred cumulative net losses of $249.2 million. Our current cash reserves may be insufficient in the face of either lower than expected revenues or extraordinary or unexpected cash expenses. As a result, we may be required to raise funds through public or private financings, strategic relationships, or other arrangements. Funding, if needed, however, may not be available on acceptable terms or at all. If adequate funds are not available, we may be required to curtail significantly or defer one or more of our operating goals or programs, or take other steps that could harm our business.

A limited number of customers account for a high percentage of our revenue and the failure to maintain or expand these relationships could harm our business.

        The loss of one or more of our major customers, the failure to attract new customers on a timely basis or a reduction in usage and revenue associated with the existing or proposed customers would harm our business and prospects. Five customers comprised approximately 17%, 20%, and 36% of our revenue in 2001, 2000, and 1999, respectively.

If we do not secure key relationships with enterprise customers, our access to broader markets will be limited.

        Our enterprise customers, which use or intend to use our products to intelligently manage the incoming and outgoing online communications of their enterprises, are a significant source of our revenue. A key aspect of our strategy is to access target markets prior to adoption of alternative solutions by the larger participants in these markets. The failure to secure key relationships with new enterprise customers in targeted markets could limit or effectively preclude our entry into these target markets, which would harm our business and prospects.

Customers in a preliminary phase of implementing our product may not proceed on a timely basis or at all.

        Some of our customers are currently in a pre-production or pre-launch stage of implementing our products and may encounter delays or other problems in introducing them. A customer's decision not to do so or a delay in implementation could result in a delay or loss in related revenue or otherwise harm our businesses and prospects. We cannot predict when any customer that is currently in a pilot or preliminary phase will implement broader use of our services.

Our service provider customers may compete with us, fail to promote our product or cease to use our products at all.

        To date, we have generated a significant amount of Tumbleweed Secure Messenger revenue from contracts with a limited number of service provider customers, which use or intend to use our products for the communication of third-party documents and data. If these customers do not effectively promote the use of Secure Messenger to their end-users or cease to offer Secure Messenger to their end-users, the adoption of our services and the recognition of associated revenue could be limited. Because our contracts with our service provider customers are non-exclusive, these customers could elect to offer competing secure online communication services to their customers through our existing or future competitors. The service provider customers also may compete with our secure online communication services through their traditional physical delivery channels.

The markets for enhanced online content management services generally, and for our products specifically, are new and may not develop.

        The market for our products and services is new and evolving rapidly. If the market for our products and services fails to develop and grow, or if our products and services do not gain broad market acceptance, our business and prospects will be harmed. In particular, our success will depend

17

upon the adoption and use by current and potential customers and their end-users of secure content management services. Our success will also depend upon acceptance of our technology as the standard for providing these services. The adoption and use of our products and services will involve changes in the manner in which businesses have traditionally exchanged information. In some cases, our customers have little experience with products, services and technology like those offered by us. Our ability to influence usage of our products and services by customers and end-users is limited. For example, the usage of Secure Messenger by the end-users of our service provider customers has been limited to date. We have spent, and intend to continue to spend, considerable resources educating potential customers and their end-users about the value of our products and services. It is difficult to assess, or to predict with any assurance, the present and future size of the potential market for our products and services, or our growth rate, if any. Moreover, we cannot predict whether our products and services will achieve any market acceptance. Our ability to achieve our goals also depends upon rapid market acceptance of future enhancements of our products and our ability to identify new markets as they emerge. Any enhancement that is not favorably received by customers and end-users may not be profitable and, furthermore, could damage our reputation or brand name. Any failure to identify and address new market opportunities could harm our business and prospects.

We may not find broad acceptance of the Tumbleweed Secure Guardian suite of products.

        In October of 2001 we re-launched our existing product line under the Tumbleweed Secure Guardian suite of products including Tumbleweed Secure Mail (formerly Tumbleweed MMS) and Tumbleweed Secure Messenger, Tumbleweed Secure Statements (formerly IME and IME Statements) and Tumbleweed Secure Redirect (formerly MMS Secure Redirect). If we do not obtain anticipated acceptance and understanding of these re-branded product offerings, our ability to grow our sales may suffer. In addition, if we do not achieve the anticipated growth of the new marketing or even suffer sales decreases as a result of a misperceptions of our products, we may be forced to expend additional resources in new or different marketing directions.

The markets we address are highly competitive and rapidly changing, and we may not be able to compete successfully.

        We may not be able to compete successfully against current and future competitors, and the multiple competitive pressures we face could harm our business and prospects. The markets in which we compete are intensely competitive and rapidly changing.

        Our principal competition for our Tumbleweed Secure Guardian protection solutions are companies that offer various Internet content security, web security, messaging policy management, and enterprise relationship management products. Companies that sell products that compete with some of the features within our products include Kana Communications, Inc., Clearswift Technologies, Symantec Corp., and Trend Micro Incorporated.

        Our principal competition in the secure document delivery and statement presentment market area comes from other online communication or information security service providers, some of which have services or products that are intended to compete directly with our products or that could be used as alternatives to our products. Examples of some of these providers are Automatic Data Processing, Inc., DST Systems, Inc., New River Systems, and PostX Corporation. Our solutions can be an alternative to traditional mail and courier delivery services such as those offered by Federal Express Corporation, UPS, or the U.S. Postal Service, and to general purpose e-mail applications and services. In addition, companies with which we do not presently directly compete may become competitors in the future, either through the expansion of our products or through their product development in the area of secure online communication services. These companies include International Business Machines Corporation/Lotus Development Corporation, and Microsoft Corporation.

        The principal competitive factors in our industry include price, product functionality, product integration, platform coverage and ability to scale, worldwide sales infrastructure and global technical

18

support. Some of our competitors have greater financial, technical, sales, marketing and other resources than we do, as well as greater name recognition and a larger installed customer base. Additionally, some of these competitors have research and development capabilities that may allow them to develop new or improved products that may compete with product lines we market and distribute. We expect that the market for secure content management software will become more consolidated with larger companies being better positioned to compete in such an environment in the long term. As this market continues to develop, a number of companies with greater resources than ours could attempt to increase their presence in this market by acquiring or forming strategic alliances with our competitors or business partners. Our success will depend on our ability to adapt to these competing forces, to develop more advanced products more rapidly and less expensively than our competitors, and to educate potential customers as to the benefits of licensing our products rather than developing their own products. Competitors could introduce products with superior features, scalability and functionality at lower prices than our products and could also bundle existing or new products with other more established products in order to compete with us. In addition, because there are relatively low barriers to entry for the software market, we expect additional competition from other established and emerging companies. Increased competition is likely to result in price reductions, reduced gross margins and loss of market share, any of which could harm our business.

Our recent product releases may not be accepted and our development efforts may be hindered by a variety of factors.

        In October 2001 we released the newest versions of our existing product lines (Secure Mail 5.0 and Secure Messenger 5.0) under the Secure Guardian Framework. These releases may not be scalable, may contain unexpected bugs or problems, may not meet customers' requirements or expectations and may not be accepted as providing added value to our existing customers. In addition, the installation of integrated or complementary software products at customer sites may result in difficulties associated with customer-specific installation processes and may result in new issues arising with respect to our new software releases.

The restructuring of our business has placed a strain on resources.

        We restructured our business in 2001, which has placed, and continues to place, a significant strain on managerial, informational, administrative and operational resources. Our current systems, procedures and controls may not be adequate to achieve the rapid execution necessary to effectively operate within the market for our products and services. We need to continue to enhance and improve our managerial capacity, and improve or replace our existing operational, customer service and financial systems, procedures and controls. Any failure to properly manage these systems and procedural transitions could impair our ability to attract and service customers, and could cause us to incur higher operating costs and delays in the execution of our business plan. Despite our restructuring, we expect that we may need to continue the expansion of our employee base. Our management may not be able to hire, train, retain, motivate and manage required personnel. In addition, our management may not be able to successfully identify, manage and exploit existing and potential market opportunities. If we cannot manage growth effectively, our business and operating results could suffer. Finally, we may have operational, customer service and financial systems that are not appropriate for our current estimated size. Moving to more appropriate office systems may also place a strain on our current systems and require financial expenditures to end the commitments on other systems.

We have a lengthy sales and implementation cycle which could harm our business.

        If we are unable to license our services to new customers on a timely basis or if our existing and proposed customers and their end-users suffer delays in the implementation and adoption of our services, our revenue may be limited and business and prospects may be harmed. Our customers must evaluate our technology and integrate our products and services into the products and services they

19

provide. In addition, our customers may need to adopt a comprehensive sales, marketing and training program in order to effectively implement some of our products. Finally, we must coordinate with our customers using our product for third-party communications in order to assist end-users in the adoption of our products. For these and other reasons, the cycle associated with establishing licenses and implementing our products can be lengthy. This cycle is also subject to a number of significant delays over which we have little or no control. Forecasts about license revenue may be inaccurate as a result of any or all of these factors, and inaccurate forecasts may cause our business, or market valuation, to suffer.

A failure to protect our intellectual property may significantly harm our business.

        We currently rely on a combination of patents, trade secrets, copyrights, trademarks and licenses, together with non-disclosure and confidentiality agreements to establish and protect our proprietary rights in our products. We hold certain patent rights with respect to some of our products. We have filed, and expect in the future to file, additional patent applications. Our existing patents or trademarks, as well as any future patents or trademarks obtained by us, may be challenged, invalidated or circumvented, or our competitors may independently develop or patent technologies that are substantially equivalent or superior to our technology. Further patent or trademark protection may not be obtained, in the United States or elsewhere, for our existing or new products, applications or services. In addition, further protection, if obtained, may not be effective. In some countries, meaningful patent or trademark protection is not available.

        To date, we have not received any material claims of infringement upon the proprietary rights of third parties. However, third parties could assert infringement claims against us in the future, and the cost of responding to such assertions, regardless of their validity, could be significant. We may increasingly be subject to claims of intellectual property infringement as the number of our competitors grows and the functionality of their products and services increasingly overlap with ours. We aggressively seek to enforce our patent and other intellectual property rights, which may further increase the risk of adverse claims. Any of these claims, with or without merit, could be time consuming to defend, result in costly litigation, divert management's attention and resources, limit use of our services or require us to enter into royalty or license agreements. In addition, such claims may be found to be valid and could result in awards against us, which could harm our business.

        We also rely, to some extent, on unpatented trade secrets and other unpatented proprietary information. Our policy is to have employees sign confidentiality agreements, to have selected parties sign non-competition agreements and to have third parties sign non-disclosure agreements. Although we take precautionary measures to maintain our unpatented proprietary information, others may acquire equivalent information or otherwise gain access to or disclose our proprietary information and we may be unable to meaningfully protect our rights to our proprietary information.

Profitable expansion in international markets may be difficult.

        We invested significant financial and managerial resources to expand our sales and marketing operations in international markets and have opened sales offices in Germany, Hong Kong, Japan, the Netherlands, Switzerland, and the United Kingdom. For the years ended December 31, 2001, 2000, and 1999 we derived 24%, 32% and 41%, respectively, of our revenue from international operations. However, to date, we have limited experience in international operations and may not be able to compete effectively in international markets. A key component of our long-term strategy is to further expand into international markets, and we must continue to devote substantial resources to our international operations in order to succeed in these markets. In this regard, we may encounter difficulties such as:

•

unexpected changes in regulatory requirements and trade barriers applicable to the Internet or our business,

20

•

challenges in staffing and managing foreign operations, including employment laws and practices as we expand into continental Europe,

•

seasonal reductions in business activity and economic downturns, in particular, in Europe and Asia,

•

longer payment cycles and problems in collecting accounts receivable,

•

problems associated with the conversion of various European currencies into a single currency, the Euro,

•

legal challenges or regulatory requirements related to the export or import of encryption technologies,

•

differing technology standards, and

•

reduced protection for intellectual property rights in certain countries in which we operate or plan to operate.

        In addition, our expansion into international markets will increasingly subject us to fluctuations in currency exchange rates. In the future, an increasing number of our contracts may be denominated in currencies other than U.S. dollars. We do not presently engage in hedging or similar transactions to protect us from currency fluctuations. Any of the foregoing difficulties of conducting business internationally could harm our international operations and, consequently, our business and prospects.

If we do not provide adequate support services to our customers to implement our products, our business may suffer.

        Our professional services organization assists our customers in implementing our products through software installation, integration with existing customer systems, contract engineering, consulting and training. If the professional services organization does not adequately assess customer requirements or address technical problems, customers may seek to discontinue their relationships with us due to dissatisfaction with the product or our customer support. Furthermore, these customers may realize lower usage than they could have otherwise achieved because they did not fully capitalize on the product in ways that could have been addressed by our professional services organization. Our products must be integrated with existing hardware and complex software products of our customers or other third parties, and our customers may not have significant experience with the implementation of products similar to our own. In addition, profitably providing contract engineering and integration services is an increasingly important aspect of our strategy to strengthen customer loyalty to our product and company. Therefore, our business and future prospects significantly depend on the strength of our professional services organization and our ability to leverage this organization by augmenting our reach through trained and qualified systems integrators. If our professional services organization does not adequately meet these multiple challenges, our business and prospects could suffer.

Product performance problems, system failures, and internet problems could severely damage our business.

        The ability of our customers to use Tumbleweed-based services depends on stable product performance, and the efficient and uninterrupted operation of the computer and communications hardware as well as the software and Internet network systems that they maintain. Although our ability to manage the effects of system failures which occur in computer hardware, software and network systems is limited, the occurrences of these failures could harm our reputation, business and prospects. The Internet has experienced a variety of outages and other delays as a result of damage to portions of our infrastructure, and the Internet could face similar outages and delays in the future. In addition, an increasing number of our customers require us to provide computer and communications hardware, software and Internet networking systems to them as an outsourced data center service. All data

21

centers, whether hosted by us, our customers or by an independent third party to which it outsources this function, are vulnerable to damage or interruption from fire, flood, earthquake, power loss, telecommunications failure or other similar events.

If our software contains errors, we may lose customers or experience reduced market acceptance of our products.

        Our software products are inherently complex and may contain defects and errors that are detected only when the products are in use. In addition, some of our customers require or may require enhanced customization of our software for their specific needs, and these modifications may increase the likelihood of undetected defects or errors. Further, we often render implementation, consulting and other technical services, the performance of which typically involves working with sophisticated software, computing and networking systems, and we could fail to meet customer expectations as a result of any defects or errors. As a result, we may lose customers, customers may fail to implement our products more broadly within their organization and we may experience reduced market acceptance of our products. Some of our products are designed to facilitate the secure transmission of sensitive business information to specified parties outside the business over the Internet. As a result, the reputation of our software products for providing good security is vital to their acceptance by customers. Our products may be vulnerable to break-ins, theft or other improper activity that could jeopardize the security of information for which we are responsible. Problems caused by product defects, failure to meet project milestones for services or security breaches could result in loss of or delay in revenue, loss of market share, failure to achieve market acceptance, diversion of research and development resources, harm to our reputation, or increased insurance, service and warranty costs. To address these problems, we may need to expend significant capital resources that may not have been budgeted.

We may be unable to recruit, retain and motivate qualified personnel, which could harm our business, including product development.

        We must continue to identify, recruit, hire, train, retain and motivate highly skilled technical, managerial, sales, marketing and customer service personnel. Competition for these personnel is intense, and we may not be able to successfully recruit, assimilate or retain sufficiently qualified personnel. In particular, we may encounter difficulties in recruiting a sufficient number of qualified software developers and sales personnel, and we may not be able to retain these employees. The failure to recruit and retain necessary technical, managerial, sales, merchandising, marketing and customer service personnel could harm our business and our ability to obtain new customers and develop new products. Although we have used and continue to use stock options as a retention tool, many of our employees hold stock options that are "underwater" (i.e., the market price of our stock is below their option exercise price) and these options may be ineffective as a retention tool. Our employee turnover may increase if outstanding stock options continue to remain underwater and we do not adjust the option exercise prices. Any adjustment of stock option exercise prices may result in dilution to our stockholders and depress our stock price.

If we lose the services of executive officers or other key employees, our ability to develop our business and secure customer relationships will suffer.

        We are substantially dependent on the continued services and performance of our executive officers and other key personnel. The loss of the services of any of our executive officers or other key employees could significantly delay or prevent the achievement of our development and strategic objectives. We do not have long-term employment agreements with any of our key personnel. The loss of services of any of our executive officers or other key personnel could significantly harm our business and prospects.

22

Our efforts to establish, maintain and strengthen our brands will require significant expenditures and may not be successful.

        If the marketplace does not associate our brands with high quality Internet communication services, it may be more difficult for us to attract new customers or introduce future products and services. The market for our services is new. Therefore, our failure to establish brand recognition at this stage could harm our ability to compete in the future with other companies that successfully establish a brand name for their services. We must succeed in our marketing efforts, provide high quality services and increase our user base in order to build our brand awareness and differentiate our products from those of our competitors. These efforts have required significant expenditures to date. Moreover, we believe that these efforts will require substantial commitments of resources in the future as our brands become increasingly important to our overall strategy and as the market for our services grows.

Because our products utilize the Internet, if use of the Internet does not increase, or the architecture of the Internet is altered, the level of use of our products will suffer.

        If the Internet and other products and services necessary for the utilization of our products are not sufficiently developed, fewer customers and end-users will use our products and our business will be harmed. In particular, the success of our products and services will depend on the development and maintenance of adequate Internet infrastructure, such as a reliable network backbone with the necessary speed, data capacity and other features demanded by users. Moreover, our success will also depend on the timely development of complementary products or services such as high-speed Internet connections for providing reliable access and services and this may not occur. Moreover, changes in the architecture of the Internet may limit the success of our products. Because the online exchange of information is new and evolving, the Internet may not prove to be a viable platform for secure online communication services in the long term. The Internet has experienced, and is expected to continue to experience, significant growth in the numbers of users and amount of traffic. As the Internet continues to experience increased numbers of users and frequency of use, or if its users require increasingly more resources, the Internet infrastructure may not be able to support the demands placed on it. As a result, the performance or reliability of the Internet may be harmed. This in turn could decrease the level of Internet usage and also the level of utilization of our products and services.

Government regulation relating to the Internet may increase costs of doing business or require changes in our business model.

        We are subject to regulations applicable to businesses generally and laws or regulations directly applicable to companies utilizing the Internet. Although at present there are relatively few specific laws and regulations directly applicable to the Internet, it is possible that a number of laws and regulations may be adopted with respect to the Internet. These laws could cover issues like user privacy, pricing, content, intellectual property, distribution, taxation, antitrust, legal liability and characteristics and quality of products and services. The adoption of any additional laws or regulations could decrease the demand for our products and services and increase our cost of doing business or otherwise harm our business or prospects. Delays in the enactment of expected regulations may result in delayed software purchasing by our customers who are subject to such regulations, which in turn may harm our business.

        Moreover, the applicability to the Internet of existing laws in various jurisdictions governing issues like property ownership, sales and other taxes, libel and personal privacy is uncertain and may take years to resolve. For example, tax authorities in a number of states are currently reviewing the appropriate tax treatment of companies engaged in online commerce. New state tax regulations may subject us to additional state sales and income taxes. Any new legislation or regulation, the application of laws and regulations from jurisdictions whose laws do not currently apply to our business, or the application of existing laws and regulations to the Internet and commercial online services could harm our ability to conduct business and harm operating results.

23

Our products are subject to export controls, and we may be unable to obtain necessary export approvals.

        Exports of software products utilizing encryption technology are generally restricted by the U.S. and various foreign governments. All cryptographic products require export licenses from certain U.S. government agencies. We have obtained approval to export products using up to 128-bit symmetric encryption and 1024-bit public key encryption, including the products formerly named IME Server, IME Desktop, IME Receive Applet, IME Remote API using OmniORB with SSL, MMS WorldWide/56 and MMS Strong WorldWide/128. We are not exporting other products and services that are subject to export control under U.S. law. However, the list of products and countries for which export approval is required, and the related regulatory policies, could be revised, and we may not be able to obtain necessary approval for the export of future products. The inability to obtain required approvals under these regulations could limit our ability to make international sales. Furthermore, competitors may also seek to obtain approvals to export products that could increase the amount of competition we face. Additionally, countries outside of the U.S. could impose regulatory restrictions impairing our ability to import our products into those countries.

Costs of communicating via the Internet could increase if access fees are imposed.

        Certain local telephone carriers have asserted that the increasing popularity and use of the Internet has burdened the existing telecommunications infrastructure, and that many areas with high Internet use have begun to experience interruptions in telephone service. These carriers have petitioned the Federal Communications Commission to impose access fees on Internet service providers and online service providers. If these access fees are imposed, the costs of communicating on the Internet could increase substantially, potentially slowing the increasing use of the Internet. This could in turn decrease demand for our services or increase the costs of doing business.

We may have liability for Internet content.

        As a provider of Internet communication products and services, we face potential liability for defamation, negligence, copyright, patent or trademark infringement and other claims based on the nature and content of the materials transmitted online. Any imposition of liability, particularly liability that is not covered by insurance or is in excess of insurance coverage, could be costly and could require us to implement measures to reduce exposure to this liability. This may require us to expend substantial resources or to discontinue selected service or product offerings.

        We do not and cannot screen all of the content generated by users of our product but may be exposed to liability with respect to this content. Furthermore, certain foreign governments, such as Germany, have enforced laws and regulations related to content distributed over the Internet that are more strict than those currently in place in the U.S. Other countries, such as China, regulate or prohibit the transport of telephonic data in their territories. Failure to comply with regulations in a particular jurisdiction could result in fines or criminal penalties or the termination of service in one or more jurisdictions. Moreover, the increased attention focused on liability issues as a result of lawsuits and legislative proposals could impact the growth of Internet use. Liability insurance may not cover claims of these types, or may not be adequate to indemnify against all liability that may be imposed.

Interface Systems, Inc., a Tumbleweed subsidiary, is a defendant in several purported securities class action lawsuits.

        On July 7, 2000, three complaints were filed by David H. Zimmer, Congressional Securities, Inc. and other plaintiffs against Interface and various additional defendants, including Interface's President and Chief Executive Officer, Robert A. Nero and Fiserv Correspondent Services, Inc., in the United States District Court for the Southern District of New York. The three cases contain substantially similar allegations of false and misleading representations by various defendants allegedly designed to inflate Interface's stock price. The complaints seek relief under the federal securities laws on behalf of

24

purported classes of persons who purchased, held, or sold shares of Interface stock, and under various other causes of action. On September 27, 2000, we filed (i) a motion to strike or dismiss for failure to meet the certification requirements of the Private Securities Litigation Reform Act, (ii) a motion to dismiss for failure to state a claim, and (iii) a motion to dismiss because of improper venue, or in the alternative, motion to transfer the lawsuits to the Eastern District of Michigan. On July 27, 2001, the Court granted our motion to transfer the lawsuits to the Eastern District of Michigan, and left the decision on the pending motions to dismiss to the transferee Court. The United States District Court for the Eastern District of Michigan held a status conference on the cases on October 23, 2001 without resolving either of our pending motions. On March 8, 2002, the court ordered the parties to appear for a status and scheduling conference on April 4, 2002. On March 26, 2002, we received from plaintiffs' Michigan counsel a draft amended complaint through which plaintiffs propose to (i) consolidate the separate actions into one action; (ii) add certain new plaintiffs; (iii) add Tumbleweed Communications Corp. as a defendant; (iv) drop the claims under the Federal securities laws; and (v) add claims for breach of fiduciary duty and negligent misrepresentation. Plaintiffs have not yet filed a motion to amend the pending complaints, nor has the court authorized such an amendment. In the meantime, the motion to dismiss and the motion to strike, discussed above, remain before the court with respect to the pending complaints.

        Although we believe these lawsuits are without merit, no assurance can be given about their outcome, and an adverse outcome could significantly harm our business and operating results. Moreover, the costs in defending these complaints could harm future operating results.

Internet related and technology stock prices are especially volatile and this volatility may depress our stock price.

        The stock market has experienced significant price and volume fluctuations and the market prices of securities of technology companies, particularly Internet-related companies, have been highly volatile. In the past, following periods of volatility in the market price of a company's securities, securities class action litigation has often been instituted against companies. The institution of this type of litigation against us could result in substantial costs and a diversion of our management's attention and resources, which could harm our business and prospects.

Our certificate of incorporation and bylaws contain provisions that could discourage or prevent an acquisition of Tumbleweed, which could depress our stock price.

        Our certificate of incorporation and bylaws may inhibit changes of control that are not approved by our Board of Directors. These provisions could limit the price that investors might be willing to pay in the future for shares of our common stock. In particular, our certificate of incorporation provides for a classified Board of Directors and prohibits stockholder action by written consent. These provisions require advance notice for nomination of directors and stockholders' proposals. In addition, as a Delaware corporation, we are subject to Section 203 of the Delaware General Corporation Law. In general, this law prevents a person who becomes the owner of 15% or more of the corporation's outstanding voting stock from engaging in specified business combinations for three years unless specified conditions are satisfied. In addition, our certificate of incorporation allows our Board of Directors to issue preferred stock without further stockholder approval. This could have the effect of delaying, deferring or preventing a change in control. The issuance of preferred stock also could effectively limit the voting power of the holders of Tumbleweed common stock. The provisions of our certificate of incorporation and bylaws, as well as provisions of Delaware law, may discourage or prevent an acquisition or disposition of our business.

Future sales of common stock by our stockholders could depress our stock price.

        We cannot predict if future sales of our common stock, or the availability of our common stock for sale, will depress the market price for our common stock or our ability to raise capital by offering

25

equity securities. Sales of substantial amounts of common stock, or the perception that these sales could occur, may depress prevailing market prices for the common stock

Item 4—Submission of Matters to a Vote of Security Holders.

        No matters were submitted to a vote of our stockholders during the fourth quarter of 2001.

Our Executive Officers

        Listed below are our executive officers as of March 29, 2002. There are no family relationships between any of the executive officers and there is no arrangement or understanding between any executive officer and any other person pursuant to which the executive officer was selected. At the annual meeting of our Board of Directors, which follows the Annual Meeting of Stockholders, executive officers are appointed by the Board to hold office until their earlier resignation or removal.

        Jeffrey C. Smith, Chairman of the Board of Directors and Chief Executive Officer, focusing on strategic planning and partnership development. Before founding Tumbleweed in 1993, Mr. Smith held various senior positions in research and development with the following firms: Frame Technology from 1991 to 1993; Aeon Corp. from 1990 to 1991; Hewlett Packard from 1988 to 1989; and IBM Scientific Research Center in Palo Alto from 1987 to 1988. Mr. Smith served as a lecturer in Software Engineering at Stanford University in 1988 and 1989. Mr. Smith holds a B.S. in Computer Science from Stanford University.

        Douglas A. Sabella, President and Chief Operating Officer, is responsible for worldwide operations, including research and development, sales, professional services, and marketing. Prior to joining Tumbleweed in 2001, Mr. Sabella was the president and chief executive officer of Citadon, previously Bidcom, Inc., from 2000 to 2001. Prior to Bidcom, Mr. Sabella spent 15 years at Lucent Technologies from 1985 to 2000. His most recent position at Lucent was president of Lucent's Communications Applications Group, where he led the messaging, CRM solutions, conferencing and collaboration, and the IP solutions businesses. Mr. Sabella was also COO for Lucent's Octel Messaging division, where he was responsible for the worldwide operations and served as vice president of Lucent's Communications Software business. Prior to Lucent, Mr. Sabella held various senior management positions at AT&T and Paramount Pictures. Mr. Sabella holds a B.B.A. in Business Administration from Hofstra University.

        Elizabeth D. Jordan, Senior Vice President—Finance and Chief Financial Officer, is responsible for finance and administration. Prior to joining Tumbleweed in 2001, Ms. Jordan was Senior Vice President and CFO of Catapulse, Inc., which was sold to Rational Software Corporation in February of 2001, from 2000 to 2001. At Catapulse, Ms. Jordan was responsible for all finance and administration, as well as business plan development. Prior to Catapulse, Ms. Jordan served as Executive Vice President and CFO and other senior finance roles at Sanmina Corporation from 1997 to 2000. Prior to Sanmina, Ms. Jordan held a variety of positions in finance for Network General Corporation from 1992 to 1997. Ms Jordan holds a B.A. in Business Systems from the University of Texas and an M.B.A. in finance from the University of North Texas.

26

PART II

Item 5—Market for Registrant's Common Equity and Related Stockholder Matters.

        Tumbleweed's common stock is traded on the Nasdaq National Market under the symbol "TMWD." The table below sets forth, during the periods indicated, the closing price per share for Tumbleweed's common stock as reported on the Nasdaq National Market.

        As of March 15, 2002, there were approximately 920 holders of record of our common stock. This does not include the number of persons whose stock is in nominee or "street name" accounts through brokers.

Dividend Policy

        We have not declared or paid any cash dividends on our common stock during any period for which financial information is provided in this report. We currently intend to retain future earnings, if any, to fund the development and growth of our business and do not anticipate paying any cash dividends on our common stock in the foreseeable future.

Offerings of Securities

        On August 11, 1999, we completed an initial public offering of our common stock, $0.001 par value, at a price of $12.00 per share. The shares of common stock sold in the offering were registered under the Securities Act of 1933, as amended, on a Registration Statement on Form S-1 (No. 333-79687). The Registration Statement was declared effective by the Securities and Exchange Commission on August 5, 1999. To date, we have used the proceeds for working capital and other general corporate purposes, and we expect to continue to use the proceeds for such purposes. In addition, we may use a portion of the proceeds to acquire complementary products, technologies or businesses.

        On August 1, 2000, we completed a primary and secondary public offering of 3,000,000 shares of our common stock at a price of $56.00 per share. Of the 3,000,000 shares of common stock, 1,500,000 primary shares were sold by us and 1,500,000 secondary shares were sold by our stockholders. Tumbleweed did not receive any of the proceeds from shares sold by its stockholders. Net proceeds of $77.9 million were received by us from the offering of primary shares. To date, we have used the proceeds for working capital and other general corporate purposes, and we expect to continue to use the proceeds for such purposes. In addition, we may use a portion of the proceeds to acquire complementary products, technologies or businesses.

27

Item 6—Selected Financial Data.

Selected Financial Information

        The following selected financial information should be read in conjunction with the consolidated financial statements and the notes to the consolidated financial statements and management's discussion and analysis of financial condition and results of operations included elsewhere in this report. All necessary adjustments, which consisted only of normal recurring adjustments, have been included in the amounts stated below.

(1)

Includes gross profit from product lines we discontinued prior to January 1, 2000.

(2)

Includes stock compensation expense of $317 and $150 for the years ended December 31, 2001, and 2000, respectively

(3)

Includes stock compensation expense of $2,811, $5,821, $3.5 million, $715, and $3,536 for the years ended December 31, 2001, 2000, 1999, 1998, and 1997, respectively.

28

Selected Quarterly Financial Data (Unaudited)

        All necessary adjustments, which consisted only of normal recurring adjustments, have been included in the amounts stated below to present fairly the results of such periods when read in conjunction with the consolidated financial statements and notes to the consolidated financial statements included elsewhere in this report.

(1)

Exclusive of non-cash compensation expense of $56, $97, $85, and $79 for the quarters ended December 31, September 30, June 30, and March 31, 2001, respectively.

(2)

Exclusive of non-cash compensation expense of $74, $90, $129, and $374 for the quarters ended December 31, September 30, June 30, and March 31, 2001, respectively.

(3)

Exclusive of non-cash compensation expense of $342, $366, $355, and $749 for the quarters ended December 31, September 30, June 30, and March 31, 2001, respectively.

29

(4)

Exclusive of non-cash compensation expense of $49, $65, $86, and $468 for the quarters ended December 31, September 30, June 30, and March 31, 2001, respectively.

(5)

Exclusive of non-cash compensation expense of $(336) for the quarter ended March 31, 2001.

(1)

Exclusive of non-cash compensation expense of $(4), $45, $48, and $61 for the quarters ended December 31, September 30, June 30, and March 31, 2000, respectively.

(2)

Exclusive of non-cash compensation expense of $(89), $455, $188, and $274, for the quarters ended December 31, September 30, June 30, and March 31, 2000, respectively.

(3)

Exclusive of non-cash compensation expense of $1,621, $859, $1,098, and $575 for the quarters ended December 31, September 30, June 30, and March 31, 2000, respectively.

(4)

Exclusive of non-cash compensation expense of $(357), $505, $117, and $164 for the quarters ended December 31, September 30, June 30, and March 31, 2000, respectively.

(5)

Exclusive of non-cash compensation expense of $411, for the quarter ended March 31, 2000.

30

Item 7—Management's Discussion and Analysis of Financial Condition and Results of Operations.

        The following discussion should be read in conjunction with the consolidated financial statements and the related notes. The following discussion contains forward-looking statements that reflect our plans, estimates and beliefs. Our actual results could differ materially from those discussed in the forward-looking statements. Factors that could cause or contribute to these differences include, but are not limited to, those discussed below and those listed under "Risks and Uncertainties".

OVERVIEW

        We are a leading provider of secure content management solutions for enabling business conducted on the Internet. Tumbleweed Secure Guardian is a leading enterprise-wide policy-based security framework that offers a wide range of solutions to both protect and extend enterprise networks, move business processes online and enable enterprises to communicate safely over the Internet. Tumbleweed solutions empower organizations to safely share and protect critical information, increase customer loyalty and privacy and reduce costs.

        Secure Guardian provides centralized security for both incoming and outgoing communications and integrates various enterprise applications for safe delivery of all forms of enterprise content. Secure Guardian is based on a platform consisting of the Tumbleweed Secure Policy Gateway™ and a series of protocol enablers that allow virtually any application to connect to it. The Secure Policy Gateway enables the enterprise to apply security to and manage content policies for bi-directional communications traffic, web content and Internet usage. Policies include protection from viruses, malicious mobile code or SPAM attacks, as well as protection from dangerous exposure of company, partner or customer confidential information. Tumbleweed protocol enablers allow a wide range of protocols and enterprise systems to be centrally managed from the Secure Policy Gateway to allow organizations to safely extend communications from enterprise applications, groupware and legacy systems.

        Additionally, Tumbleweed Secure Guardian enables a broad spectrum of network extension solutions that help companies leverage the business efficiencies and benefits of the business Internet, including secure communications between trading partners, moving paper-based processes—such as statement presentment—online, and delivery and storage of aggregated enterprise communications into a single, branded secure inbox. Tumbleweed is trusted by 1,000 blue-chip customers including American Century Services Corp., American Express Travel Related Services Company, Inc., Amgen Inc., Beckman Coulter, Inc., Best Buy Co., Inc., Broadcom Corp., Diners Club International Ltd., the U.S. Food & Drug Administration, Gap, Inc., JP Morgan Chase & Co., Merck, National Semiconductor Corp., Northern Trust, Phoenix Home Life Insurance Co., Salomon Smith Barney Inc., Siebel Systems, Inc., Skandaniska Enskilda Banken AB, Union Minere Oxyde (U.K.) Ltd., Verizon Communications, Wachovia Securities, Inc., and Wells Fargo & Co. Over 100 of the Fortune 500 use various Tumbleweed solutions today.

        Revenue, which consists of both product and intellectual property (IP) revenue and services revenue, results from new contracts and backlog. We define backlog as contractual commitments that are not due and payable as of the balance sheet date and deferred revenue. Product and IP revenue consists of license fees and transaction revenue. We typically offer our software products under a perpetual license. Under a perpetual license our customers pay a one-time license fee for the right to use our software. Perpetual license revenue is typically recognized upon software shipment. We enter into patent license agreements whereby licensees gain access to our patented technology for the duration of the patent in exchange for a licensing fee. We recognize revenue from IP upon execution of the patent license agreement and when billable. Transaction revenue is based on actual volume of transactions or contractual minimum volumes, and the related revenue is recognized based on payment schedules or transaction reports from our customers. Services revenue consists of consulting fees and

31

support and maintenance fees. Consulting fees related to installation or customization are recognized upon client acceptance or percentage of completion. Support and maintenance fees are paid for ongoing customer support and in some instances for the right to receive future upgrades of our products during the term of the maintenance agreement. Revenue from support and maintenance is recognized ratably over the period the support is provided. Revenue from the reseller channel is recognized upon the execution of a distribution agreement and receipt of substantive identification of the end-user customer.

        A portion of our revenue relates to international customers or operations. Most of our international contracts are denominated in foreign currencies. We currently do not have hedging or similar arrangements to protect us against foreign currency fluctuations. Therefore, we increasingly may be subject to currency fluctuations, which could harm our operating results in future periods.

        Our future net income and cash flow may be adversely affected by limitations on our ability to apply net operating losses for federal income tax reporting purposes against taxable income in future periods, including limitations due to ownership changes, as defined in Section 382 of the Internal Revenue Code, arising from issuance of stock.

        On January 31, 2000, we completed the acquisition of Worldtalk Communications Corporation (Worldtalk), a leading provider of Internet security and policy management solutions that enable organizations to define and manage e-mail and web security usage policies to manage the risks and liabilities associated with Internet communications. The business combination has been accounted for as a pooling of interests and, accordingly, our historical financial statements have been restated to include the accounts and results of operations of Worldtalk. Except as otherwise indicated, the terms "Tumbleweed," "we" and "our" refer to Tumbleweed and its subsidiaries, including Worldtalk, in this discussion.

        On May 15, 2000, we repurchased from Hikari Tsushin 5% of the outstanding stock of Tumbleweed KK, or TKK, for a price of approximately $645,000. As a result of this transaction, we own a controlling interest of the Japanese subsidiary and began accounting for the Japanese subsidiary under the consolidation method effective April 1, 2000. On August 29, 2000, we repurchased an additional 25% of the outstanding shares of the jointly owned Japanese subsidiary, increasing our ownership position to 80%.

        On August 1, 2000, we completed a primary and secondary public offering of 3,000,000 shares of our common stock at a price of $56.00 per share. Of the 3,000,000 shares of common stock, 1,500,000 primary shares were sold by us and 1,500,000 secondary shares were sold by our stockholders. Tumbleweed did not receive any of the proceeds from shares sold by its stockholders. Net proceeds of $77.9 million from the offering of primary shares have been and will be used for working capital and other general corporate purposes. In addition, we may use a portion of the net proceeds to acquire complementary products, technologies or businesses.

        On September 1, 2000, we completed the acquisition of Interface Systems, Inc. (Interface). Interface's Legacy to Internet, or L2i, products and services simplify the process of transforming and using data found in legacy computer systems into electronic content that is easy to distribute and use online. The L2i products adapt legacy print streams and other data types to the Internet and intelligently convert them into formats such as Portable Document Format, HyperText Markup Language or eXtensible Markup Language for use online. The combination of L2i with Tumbleweed IME gives our customers a comprehensive, end-to-end solution for secure electronic statement presentment known as Tumbleweed Secure Statements. We divested the Interface businesses other than L2i.

        The acquisition was accounted for using the purchase method of accounting and accordingly, the purchase price was allocated to the assets acquired and liabilities assumed based on their estimated fair

32

values on the acquisition date. Since September 1, 2000, Interface's results of operations have been included in our consolidated statements of operations. The fair value of the intangible assets was determined based upon a valuation using a combination of methods, including a cost approach for the assembled workforce, and an income approach for the core technology.

        The purchase price of approximately $77.1 million consisted of an exchange of 1,249,210 shares of our common stock with a fair value of approximately $64.2 million, assumed stock options with a fair value of approximately $7.9 million, cash paid of $2.0 million, and other acquisition related expenses of approximately $2.9 million consisting primarily of payments for financial advisor and other professional fees.

        During the three months ended March 31, 2001, we performed an impairment assessment of the identifiable intangibles and goodwill recorded in connection with the acquisition of Interface. The assessment was performed primarily due to changes in the economy, the overall decline in the industry growth rates, and our lower actual and projected operating results including that of the business acquired from Interface. Our assessment is supported by the significant sustained decline in our stock price since the valuation date of the shares issued in the Interface acquisition, which resulted in the net book value of our assets prior to the impairment charge significantly exceeding our market capitalization. As a result of our review, we recorded a $51.0 million impairment charge to reduce goodwill and other intangible assets. The charge was determined based upon our estimated discounted cash flows over the remaining estimated useful life of the goodwill using a discount rate of 15%. The assumptions supporting the cash flows including the discount rate were determined using our estimates as of March 31, 2001. The remaining intangible assets were amortized in full over their remaining useful life in 2001.

        In January 2001, our Board of Directors approved a restructuring program. This restructuring program is intended to align our cost structures with our company-wide focus on customer service, sales and research and development. The restructuring involved consolidating our facilities in the U.S. and closing and sales offices in Paris, France; Chatsworth, Australia; and Stockholm, Sweden, realigning our professional services organization, and reducing headcount in most areas of our business. The reduction in force involved approximately 100 employees and total charges incurred as a result of the restructuring were $4.7 million during 2001, which includes charges related to vacating leased facilities domestically and abroad.

Years ended December 31, 2001 and 2000

        Revenue.    Revenue is comprised of product and IP revenue and services revenue. Total revenue decreased to $29.0 million in 2001 from $37.3 million in 2000 due to weaker global macroeconomic conditions in 2001 and the closure of offices in Australia, France, and Sweden associated with our 2001 restructuring.

        Product and IP revenue decreased to $18.4 million in 2001 from $29.2 million in 2000 due to weaker global macroeconomic conditions in 2001, a change in focus to enterprise sales, and the closure of offices in Australia, France, and Sweden associated with our 2001 restructuring. Services revenue increased to $10.7 million in 2001 from $8.2 million in 2000 due to an increase in contract development work by our professional services organization and increases in maintenance fees from our installed customer base.

        Cost of Revenue.    Cost of revenue is comprised of product and IP costs and services costs. Product license cost is primarily comprised of royalties paid to third parties for software licensed by us for inclusion in our products and bandwidth costs associated with hosting servers for those customers who use our hosting services. Services costs are comprised primarily of personnel and overhead costs related to customer support and contract development projects. Total cost of revenue decreased to $12.3 million in 2001 from $13.1 million for 2000. The decrease in total cost of revenue was due to a

33

decrease in service costs and a reduction in product costs that were tied to our revenues, as our revenues decreased.

        Research and Development Expenses.    Research and development expenses are comprised of engineering and related costs associated with the development of our applications, quality assurance and testing. Research and development expenses increased to $15.9 million in 2001 from $15.7 million in 2000. The increase in research and development expenses was due to increased engineering costs resulting from the acquisition of Interface in September 2000.

        Sales and Marketing Expenses.    Sales and marketing expenses are comprised of salaries, commissions, travel expenses and costs associated with trade shows, lead generation, advertising and other marketing efforts. Sales and marketing expenses decreased to $36.4 million in 2001 from $44.8 million in 2000. The decrease in sales and marketing expenses was primarily due to decreased personnel costs as a result of the 2001 restructuring and other cost savings from our closure of offices in Australia, France, and Sweden.

        General and Administrative Expenses.    General and administrative expenses consist primarily of personnel and support costs for our finance, legal, information systems and human resources departments as well as professional fees. General and administrative expenses decreased to $9.3 million in 2001 from $12.0 million in 2000. The decrease in general and administrative expenses was due to decreased personnel costs as a result of the 2001 restructuring and lower legal costs as the prior year included expenses resulting from our patent infringement lawsuit against the docSpace Company, Inc.

        Stock Compensation Expense.    Stock compensation expense was recorded in connection with the amortization of deferred stock compensation recorded as a result of grants of stock options to non-employees and employees at exercise prices less than the deemed fair value on the grant date, the vesting acceleration of stock options approved for certain employees, and warrants granted to non-employees in exchange for services performed, net of a credit related to stock options granted to employees who were later terminated. The credit resulted from the reversal of stock compensation expense previously recorded for options cancelled that had not vested. Stock compensation expense is included in our cost of revenues and operating expenses in our statement of operations. This expense is being amortized over the vesting period of the options, which is generally four years. Stock compensation expense decreased to $3.1 million in 2001 from $6.0 million in 2000. The decrease was the result of the termination of certain employees during the 2001 restructuring whose options had not yet vested.

        Amortization of Goodwill and Intangible Assets.    Amortization of goodwill and intangible assets decreased to $12.2 million in 2001 from $13.8 million in 2000. The decrease in expense in 2001 is due to the $51.0 million impairment charge recorded in the first quarter of 2001. The goodwill and other intangible assets resulted from the Interface purchase and, to a lesser extent, our increase in ownership of Tumbleweed KK from 50% to 80% during 2000. Goodwill and intangible assets are amortized over their respective lives, generally one to five years. In July 2001, the FASB issued SFAS 142, Goodwill and Other Intangible Assets. SFAS 142 will require that goodwill and intangible assets with indefinite useful lives no longer be amortized, but instead tested for impairment at least annually in accordance with the provisions of SFAS 142. SFAS 142 will also require that intangible assets with estimable useful lives be amortized over their respective estimated useful lives to their estimated residual values, and reviewed for impairment whenever events or changes in circumstances indicate that the carrying amount may not be recoverable. We are required to adopt the provisions of SFAS 142 effective January 1, 2002.

        Impairments, Merger-Related, and Restructuring Expenses.    During the first quarter of 2001, our Board of Directors approved a restructuring program. This restructuring program focuses our efforts on aligning our cost structures with our company-wide focus on customer service, sales and research and

34

development. The restructuring involved consolidating facilities in the U.S. and closing international sales office locations in Paris, France; Chatsworth, Australia; and Stockholm, Sweden, realigning our professional services organization, and reducing headcount in most areas of our business. The reduction in work force involved approximately 100 employees and total charges incurred as a result of the restructuring were $4.7 million during 2001, which includes charges related to vacating leased facilities domestically and abroad. Merger related and restructuring expenses of $10.8 for 2000 were recorded in connection with the acquisition of Worldtalk, and were primarily comprised of investment banker's fees, legal fees, severance payments and accounting and printer fees.

        During the three months ended March 31, 2001, we performed an impairment assessment of the identifiable intangibles and goodwill recorded in connection with the acquisition of Interface. The assessment was performed primarily due to changes in the economy, the overall decline in the industry growth rates, and our lower actual and projected operating results including that of the business acquired from Interface. Our assessment is supported by the significant sustained decline in our stock price since the valuation date of the shares issued in the Interface acquisition, which resulted in the net book value of our assets prior to the impairment charge significantly exceeding our market capitalization. As a result of our review, we recorded a $51.0 million impairment charge to reduce goodwill and other intangible assets. The charge was determined based upon our estimated discounted cash flows over the remaining estimated useful life of the goodwill using a discount rate of 15%. The assumptions supporting the cash flows including the discount rate were determined using our estimates as of March 31, 2001. The remaining intangible assets were amortized in full over their remaining useful life in 2001.

        Impairment of Investments.    During 2000, we made investments in two non-public companies of $977,000 and $3.0 million. The investments are carried at cost as we hold less than 20% of the voting equity and do not have the ability to exercise significant influence, and are included in other assets in the accompanying balance sheet. We monitor these investments for impairment and make appropriate reductions in carrying values when necessary. During 2001 we recorded a $3.4 million expense to recognize an other-than-temporary impairment in the value of these investments.

        Other Income, Net.    Other income, net, is primarily comprised of interest income earned on investment securities. Other income, net decreased to $2.1 million in 2001 from $3.4 million in 2000. The decrease in other income, net, is due to the decline in interest rates and a reduction in our cash balances relative to the year-earlier period when we received proceeds from the issuance of securities in August 2000.

Years Ended December 31, 2000 and 1999

        Revenue.    Total revenue increased to $37.3 million in 2000 from $16.8 million in 1999 due to increased acceptance of our solutions in the marketplace. Product and IP revenue increased to $29.2 million in 2000 from $12.3 million in 1999 due to an increase in the number of licenses sold, additional license fees paid by existing customers, minimum transaction fees from customers due to the growth of our installed base, and an increase in the average sales price of the product line formerly known as MMS during 2000. Services revenue increased to $8.2 million in 2000 from $3.0 million in 1999 due to an increase in contract development work by our professional services organization, and, to a lesser extent, increases in maintenance fees. Total revenue excluding discontinued product lines increased to $37.3 million in 2000 from $15.3 million in 1999. There was no revenue from discontinued product lines in 2000.

        Cost of revenue.    Cost of revenue increased to $13.1 million in 2000 from $4.9 million in 1999. The increase in cost of revenues was primarily attributable to increased service costs driven by increased personnel costs supporting our larger customer base and the acquisition of Interface in

35

September 1, 2000. Additionally, product and IP costs increased due to increased sales of products containing software licensed from third parties.

        Research and development expenses.    Research and development costs increased to $15.7 million in 2000 from $10.0 million in 1999. The increase was primarily due to increased head count in part from our Interface acquisition, increases in average salaries for development personnel, and increased facilities-related expenses.

        Sales and marketing expenses.    Sales and marketing expenses increased to $44.8 million in 2000 from $21.9 million in 1999. The increase in sales and marketing expenses was primarily due to increased sales staffing and commissions, and expanded marketing programs.

        General and administrative expenses.    General and administrative expenses increased to $12.0 million in 2000 from $6.1 million in 1999. The increase in general and administrative expenses was due in part to an increase in legal fees corresponding to patent infringement lawsuit we brought against The docSpace Company, Inc., as well as increased staffing expenses and professional fees.

        Stock compensation expense.    Stock compensation expense increased to $6.0 million in 2000 from $3.5 million in 1999. The increase in stock compensation expense resulted from the Interface acquisition in December 2000.

        Merger related and restructuring expenses.    Merger related and restructuring expenses, which were recorded in connection with the acquisition of Worldtalk, are primarily comprised of investment banker's fees, legal fees, severance payments and accounting and printer fees. Merger related and restructuring expenses for 2000 were $10.8 million.

        Amortization of goodwill and intangible assets.    Amortization of goodwill and intangible assets was $13.8 million for 2000. The goodwill and other intangible assets resulted from the Interface purchase and, to a lesser extent, our increase in ownership of Tumbleweed KK from 50% to 80% during 2000.

        Other income, net.    Other income, net increased to $3.4 million in 2000 from $2.1 million in 1999. The increase in other income, net, is due to increased cash balances invested in money market accounts. The increase in cash balances available for investment resulted from proceeds from the issuance of equity securities, including common stock issued in our initial public offering completed in August 1999 and our offering completed in August 2000.

Liquidity and Capital Resources

        Since inception, we have financed our operations primarily through the issuance of equity securities. As of December 31, 2001, we had $43.2 million in cash and cash equivalents.

        Net cash used in operating activities for 2001 was $32.1 million. Cash used in operating activities was primarily the result of a net operating loss and decreases in accounts payable and accrued liabilities, offset by certain non-cash charges, a decrease in accounts receivable and an increase in deferred revenue.

        Net cash used in investing activities for 2001 was $166,000. Net cash used in investing activities was the result of capital expenditures primarily for research and development property and equipment, offset by the sale of our building in Ann Arbor, Michigan.

        Net cash provided by financing activities for 2001 was $444,000. Cash provided by financing activities was attributable to net proceeds from the issuance of equity securities under our stock option and employee stock purchase plans offset by repayments of borrowings.

36

        As of December 31, 2001, our principal commitments consisted of obligations related to outstanding operating and capital leases. Our equipment leases require payment of rental fees to third party leasing providers. In most cases, we have no obligations to purchase the equipment at the end of the lease term. We do not anticipate a substantial increase in capital expenditures in the immediate future. We also do not anticipate an increase in operating lease obligations.

        In June 1999, we entered into an operating lease covering approximately 40,000 square feet of office space in Redwood City, California. The lease is for a term of five years at monthly rent of approximately $96,000. In September 2000, we leased an additional 42,000 square feet in an adjacent building with a term of five years and subleased this space. We terminated this second lease as of December 31, 2001 and made settlement payments on this lease in the first quarter of 2002 as a part of the lease termination agreement.

        In July 1998, we entered into a debt agreement with a bank, which includes a $750,000 equipment loan facility. In June 1999, we obtained a second equipment loan facility in the amount of $1.0 million with the same bank. The first equipment loan in the amount of $750,000 expired in December 2001 and the second equipment loan in the amount of $1.0 million expires in December 2002. Borrowings under both equipment loan facilities bear interest at prime rate plus 0.75%, are due and payable in 36 equal monthly installments and are secured by certain of our assets. As of December 31, 2001, total borrowings under the equipment loan facility was approximately $322,000 in the aggregate and $678,000 remained available under the facilities. The weighted average interest rate for the equipment loans was 8.21%, 10.00%, and 8.45%, for 2001, 2000, and 1999, respectively. The loan has aggregate maturities of approximately $322,000 in 2002.

        Our capital requirements depend on numerous factors, including revenue generated from operations and market acceptance of our products and services, the resources devoted to the development of our products and services and the resources devoted to sales and marketing. We have experienced a substantial increase in capital expenditures and operating expenses since inception consistent with relocation and the growth in operations and staffing; however, we do not anticipate continued increases in capital expenditures in the foreseeable future. We expect to experience a seasonal reduction in sales in Europe during the summer months. In addition, many of our customers delay purchases of our products until the end of each quarter. We believe that our existing capital resources will enable us to maintain our current and planned operations for at least the next 12 months; however, we may need to raise funds prior to that time.

        We will continue to consider future financing alternatives, which may include the incurrence of indebtedness, additional public or private equity offerings or an equity investment by a strategic partner; however, we have no present commitments or arrangements assuring us of any future equity or debt financing. Additionally, equity or debt financing may not be available to us on favorable terms, if at all.

37

Contractual Obligations and Commercial Commitments

        Future cash payments for contractual obligations and commercial commitments as of December 31, 2001, are as follows (in thousands):

Item 7a—Quantitative and Qualitative Disclosures About Market Risk

        We currently do not use financial instruments to hedge operating expenses in Germany, Hong Kong, Japan, the Netherlands, Switzerland, or the United Kingdom denominated in the respective local currency. We assess the need to utilize financial instruments to hedge currency exposures on an ongoing basis.

        We do not use derivative financial instruments for speculative trading purposes, nor do we hedge our foreign currency exposure in a manner that entirely offsets the effects of changes in foreign exchange rates. We regularly review our hedging program and may as part of this review determine at any time to change our hedging program.

Interest Rate Sensitivity

        The primary objective of our investment activities is to preserve principal while at the same time maximizing the income we receive from our investments without significantly increasing risk. Some of the securities that we have invested in may be subject to market risk. This means that a change in prevailing interest rates may cause the fair value of the investment to fluctuate. For example, if we hold a security that was issued with a fixed rate equal to the then-prevailing interest rate and the prevailing interest rate later rises, the fair value of our investment will decline. To minimize this risk, we maintain our portfolio of cash equivalents in commercial paper and money market funds. In general, our investments are not subject to market risk because the interest paid on these funds fluctuates with the prevailing interest rate. As of December 31, 2001, none of our cash equivalents were subject to market risk.

Item 7b—Critical Accounting Policies and Estimates

        Our discussion and analysis of our financial condition and results of operations are based upon our consolidated financial statements, which have been prepared in accordance with accounting principles generally accepted in the United States. The preparation of these financial statements requires us to make estimates and judgments in determining the reported amounts of assets, liabilities, revenues and expenses, and related disclosure of contingent assets and liabilities. We regularly evaluate our estimates, including those related to customer arrangements, bad debts, valuation of assets, and contingencies and litigation. When making estimates, we consider our historical experience, our knowledge of economic and market factors and various other assumptions that we believe to be reasonable under the circumstances. Actual results may differ from these estimates under different assumptions or conditions.

        We believe that the following critical accounting policies represent areas where significant judgments and estimates have been used in the preparation of our consolidated financial statements.

38

Revenue Recognition

        We derive our revenue from two sources (i) product and intellectual property (IP) revenue, which includes license and transaction fees, and patent license agreement fees, and (ii) services revenue, which includes consulting, support, and maintenance fees. As described below, significant management judgments and estimates must be made and used in connection with the revenue recognized in any accounting period. Material differences may result in the amount and timing of our revenue for any period if our management made different judgments or utilized different estimates.

        We typically offer our software products under a perpetual license. Our hosting arrangements require customers to pay a one-time license fee for the right to use our software. We enter into patent license agreements whereby licensees gain access to our patented technology for the duration of the patent in exchange for a licensing fee. Transaction fees are based on the volume of transactions or contractual minimum volumes. Support and maintenance fees are paid, in general, for ongoing customer support during the term of the maintenance agreement.

        We apply the provisions of Statement of Position (SOP) 97-2, "Software Revenue Recognition", and SOP 98-9, "Software Revenue Recognition with Respect to Certain Arrangements", which generally requires revenue recognized from software arrangements to be allocated to each element of the arrangement based on the relative fair values of the elements, such as software products, consulting, training, installation, or post-contract customer support. Fair values are based upon vendor specific objective evidence. If such evidence does not exist for delivered elements, we record revenue using the residual method. If such evidence does not exist for undelivered elements, all revenue from the arrangement is deferred until such time that evidence of fair value does exist, or until all elements of the arrangement are delivered, or revenue is recorded ratably if the only undelivered element is post-contract customer support.

        We recognize revenue from perpetual licenses upon shipment when the following provisions are met: (i) persuasive evidence of an arrangement exists, generally based on an executed contract and non-binding purchase order; (ii) the product has been delivered, generally to a common carrier; (iii) the fee is fixed and determinable, and (iv) collection of the resulting receivable is reasonably assured. We recognize revenue from IP upon execution of the patent license agreement and when billable. Transaction revenue is recognized based on payment schedules or transaction reports from our customers. A number of our contracts include minimum transaction volume requirements. In these cases, the minimum guaranteed revenue is recognized when fees are due and payable during those months where transaction volume does not exceed the designated minimums.

        Consulting fees related to installation or customization is recognized upon client acceptance or percentage of completion. Revenue from support and maintenance is recognized ratably over the period the support is provided.

        We assess collection based on a number of factors, including past transaction history with the customer and the credit-worthiness of the customer. We do not request collateral from our customers. If we determine that collection of a fee is not probable, we defer the fee and recognize revenue at the time collection becomes probable, which is generally upon receipt of cash.

Valuation of Allowance for Doubtful Accounts

        The preparation of financial statements requires us to make estimates and assumptions that affect the reported amount of assets, the disclosure of contingent assets and liabilities at the date of the financial statements, and the reported amounts of revenues and expenses during the reported period. We must make estimates of the collectability of our accounts receivables. We specifically analyze accounts receivable including review of historical bad debts, customer concentrations, customer credit-

39

worthiness, current economic trends, aging of the balance, geographic and industry mix, and changes in our customer payment terms when evaluating the adequacy of the allowance for doubtful accounts.

Valuation of Privately-Held Investments

        Our determination of impairment related to certain equity investments in privately held companies are based on the latest available valuation of such investment, or, if unavailable, our assumptions related to projected operating results of the privately held company and potential effects of declines in market trends. Future events that adversely change the assumptions we use to determine valuation of investments may require us to record charges for impairment of the carrying value of our investments.

Valuation of long-lived and intangible assets and goodwill

        We assess the impairment of identifiable intangibles, long-lived assets and goodwill whenever events or changes in circumstances indicate that the carrying value may not be recoverable. Factors we consider important which could trigger an impairment review include the following:

•

Significant underperformance relative to expected historical or projected future operating results;



•

Significant changes in the manner or our use of the acquired assets or the strategy for our overall business;



•

Significant negative industry or economic trends;



•

Significant decline in our stock price for a sustained period; and



•

Our market capitalization relative to net book value.

        When we determine that the carrying value of intangibles, long-lived assets and goodwill may not be recoverable upon the existence of one or more of the above indicators of impairment, and such carrying value is less than projected undiscounted cash flows attributed to the asset, we measure any impairment based on the amount by which the carrying amount of the assets exceeds the fair value of the assets.

        Statement of Financial Accounting Standards ("SFAS") No. 142, "Goodwill and Other Intangible Assets" became effective on January 1, 2002 and as a result, we will cease to amortize approximately $6.7 million of goodwill. In lieu of amortization, we are required to perform an initial impairment review of our goodwill in 2002 and an annual impairment review thereafter. We expect to complete our initial review during the first half of 2002.

        We currently do not expect to record an impairment charge upon completion of the initial impairment review. However, there can be no assurance that at the time the review is completed, a material impairment charge will not be recorded.

40

Item 8—Financial Statements and Supplementary Data.

TUMBLEWEED COMMUNICATIONS CORP.

INDEX TO CONSOLIDATED FINANCIAL STATEMENTS

41

REPORT OF INDEPENDENT AUDITORS

The Board of Directors and Stockholders
Tumbleweed Communications Corp.:

        We have audited the accompanying consolidated balance sheets of Tumbleweed Communications Corp. and subsidiaries as of December 31, 2001 and 2000, and the related consolidated statements of operations, stockholders' equity, and cash flows for each of the years in the three-year period ended December 31, 2001. These consolidated financial statements are the responsibility of the Company's management. Our responsibility is to express an opinion on these consolidated financial statements based on our audits.

        We conducted our audits in accordance with auditing standards generally accepted in the United States of America. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement. An audit includes examining, on a test basis, evidence supporting the amounts and disclosures in the financial statements. An audit also includes assessing the accounting principles used and significant estimates made by management, as well as evaluating the overall financial statement presentation. We believe that our audits provide a reasonable basis for our opinion.

        In our opinion, the consolidated financial statements referred to above present fairly, in all material respects, the financial position of Tumbleweed Communications Corp. and subsidiaries as of December 31, 2001 and 2000, and the results of their operations and their cash flows for each of the years in the three-year period ended December 31, 2001, in conformity with accounting principles generally accepted in the United States of America.

/s/ KPMG LLP

Mountain View, California
January 24, 2002

42

TUMBLEWEED COMMUNICATIONS CORP. AND SUBSIDIARIES

Consolidated Balance Sheets (in thousands, except share and per share data)

See accompanying notes to consolidated financial statements.

43

TUMBLEWEED COMMUNICATIONS CORP. AND SUBSIDIARIES

Consolidated Statements of Operations (in thousands, except per share data)

See accompanying notes to consolidated financial statements.

44

TUMBLEWEED COMMUNICATIONS CORP. AND SUBSIDIARIES

Consolidated Statements of Stockholders' Equity
Years ended December 31, 2001, 2000 and 1999
(in thousands, except share data)