Back to GetFilings.com

Table of Contents

UNITED STATES
SECURITIES AND EXCHANGE COMMISSION

Form 10-K

FOR ANNUAL AND TRANSITION REPORTS PURSUANT TO SECTIONS 13 OR
15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

FOR THE FISCAL YEAR ENDED DECEMBER 31, 2002

OR

Commission File No. 000-25120

RSA Security Inc.

174 Middlesex Turnpike
Bedford, Massachusetts 01730
(Address of Principal Executive Offices)

Registrant’s telephone number, including area code: (781) 515-5000

Securities Registered Pursuant to Section 12(b) of the Act: None

Securities Registered Pursuant to Section 12(g) of the Act:
Common Stock, $.01 Par Value
Common Stock Purchase Rights
(Title of class)

Table of Contents

Indicate by check mark whether the registrant: (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days.    Yes [X]    No [  ]

Indicate by check mark if disclosure of delinquent filers pursuant to Item 405 of Regulation S-K is not contained herein, and will not be contained, to the best of the registrant’s knowledge, in definitive proxy or information statements incorporated by reference in Part III of this Form 10-K or any amendment to this Form 10-K.    [X]

Indicate by check mark whether the registrant is an accelerated filer (as defined in Exchange Act Rule 12b-2).    Yes [X]    No [  ]

As of February 14, 2003, the approximate aggregate market value of the common stock held by non-affiliates of the registrant was $335,450,441 based on the last reported sale price of the registrant’s common stock on The NASDAQ National Market as of the close of business on that date. There were 57,477,281 shares of common stock outstanding as of February 14, 2003.

As of June 28, 2002, the approximate aggregate market value of the common stock held by non-affiliates of the registrant was $269,516,638 based on the last reported sale price of the registrant’s common stock on The NASDAQ National Market as of the close of business on that date.

DOCUMENTS INCORPORATED BY REFERENCE

This Report contains forward-looking statements within the meaning of Section 21E of the Securities Exchange Act of 1934, as amended, and Section 27A of the Securities Act of 1933, as amended. For purposes of these Acts, any statement that is not a statement of historical fact may be deemed a forward-looking statement. For example, statements containing the words “believes,” “anticipates,” “plans,” “expects,” and similar expressions may be forward-looking statements. However, we caution investors not to place undue reliance on any forward-looking statements in this Report because these statements speak only as of the date when made. We undertake no obligation to publicly update any forward-looking statements, whether as a result of new information, future events or otherwise. There are a number of factors that could cause our actual results to differ materially from those indicated by these forward-looking statements, including without limitation, the factors set forth under the caption “Certain Factors That May Affect Future Results.”

RSA Security, RSA, Keon, ClearTrust, SecurID, BSAFE, ACE/Server, RC2, RC4, RC5, The Most Trusted Name in e-Security and RSA Secured are either registered trademarks or trademarks of RSA Security Inc. in the United States and/or other countries. All other trademarks or trade names referred to in this Report are the property of their respective owners.

2

Table of Contents

PART I

ITEM 1.     BUSINESS

COMPANY OVERVIEW

With thousands of customers around the globe, RSA Security Inc. (NASDAQ: RSAS) provides interoperable solutions for establishing online identities, access rights and privileges for people, applications and devices. Built to work seamlessly and transparently in the complex environments of our customers, our portfolio of identity and access management solutions – including authentication, Web access management and developer solutions – is designed to allow customers to confidently exploit new technologies for competitive advantage. Our strong reputation is built on our history of ingenuity and leadership, proven technologies and long-standing relationships with more than 1,000 technology partners.

We have two business segments: the e-Security Solutions segment and the RSA Capital segment. Our e-Security Solutions segment sells Enterprise solutions and Developer solutions through our four product lines: RSA SecurID^® authentication, RSA Keon^® digital certificates and smart card solutions, RSA BSAFE^® developer tools, and RSA ClearTrust^® Web access management software. Our RSA Capital segment consists of our investment activities.

We maintain a website at www.rsasecurity.com. We are not including the information contained in our website as part of this Report, nor are we incorporating the information on our website into this Report by this reference. As soon as reasonably practicable after filing with or furnishing to the Securities and Exchange Commission, we make available through our website, free of charge, our annual reports on Form 10-K, quarterly reports on Form 10-Q and current reports on Form 8-K, including all amendments to these reports.

COMPANY HISTORY

Since our inception in 1986 as Security Dynamics Technologies, Inc., we have focused on the fundamental need for user identification and authentication, with an initial emphasis on solutions for secure remote access to enterprise networks (RSA SecurID technology). In July 1996, to further our strategy and extend our product line, we acquired RSA Data Security, Inc., a privately held company that developed and delivered cryptographic solutions that address the need for data privacy and integrity (RSA BSAFE technology).

In January 1999, we introduced the RSA Keon product line, a family of public key infrastructure products designed to provide organizations with application security and flexible electronic commerce solutions. In September 1999, we introduced the next-generation, standards-based implementation of the RSA Keon solution and changed our name from Security Dynamics Technologies, Inc. to RSA Security Inc.

In September 2001, we introduced the RSA ClearTrust Web access management solutions, which we obtained through our purchase of Securant Technologies, Inc.

Throughout our history, we have made a number of important corporate acquisitions and dispositions, in addition to the RSA Data Security and Securant acquisitions described above. We developed our RSA Keon Advanced PKI and RSA Keon Unix Control product families using technologies we acquired through our purchase in July 1997 of DynaSoft AB, a privately held company that developed and delivered platform-independent security solutions for distributed client/server networks. Xcert International’s Sentry CA line of products became part of our RSA Keon digital certificate management product family due to our February 2001 acquisition Xcert International, Inc., a privately held company that developed and delivered digital certificate-based products for securing e-business transactions. We introduced a new smart card authentication solution called RSA SecurID Passage, which is part of our authentication product line, as a result of our May 2001 acquisition of 3-G International, Inc., a privately held company that developed and delivered smart card and biometric authentication products.

In June 2002, we sold to TFS Technology AB all of the technology that we still retained from our 1997 acquisition of DynaSoft, including our RSA Keon Advanced PKI and RSA Keon Unix Control product families. We decided to sell this technology because it no longer fit our strategic objectives, which emphasize Web-enabled security solutions. As of December 31, 2002, we have sold, disposed of or otherwise abandoned all of the technology and other assets that we originally acquired from DynaSoft.

3

Table of Contents

BACKGROUND

Historically, e-security solutions have been deployed primarily to defend corporate networks from malicious intrusion and to detect new forms or incidents of attack. These proven, mature e-security solutions include firewalls, anti-virus software, intrusion detection applications and vulnerability assessment products and services.

As more organizations began to conduct business online to reduce costs and compete more aggressively and more efficiently, a new class of e-security applications was deployed to secure the e-business process. This class of products further enabled e-business, including commerce and communications conducted through corporate intranets, extranets and other Internet-based applications.

During this evolution, we believe that organizations traditionally viewed security as a necessary expense. However, we believe that a fundamental shift is occurring, as those same organizations are beginning to see security as a business enabler – a tool that will help their business succeed. In tomorrow’s security landscape, we believe that identity and access management technology will be a primary tool for organizations looking to gain competitive advantage from their strategic security solutions.

The need for identity and access management technology arises from the business community’s and government’s continued investment in their e-business infrastructures as the primary platform for conducting many aspects of business. This growing investment in e-business has resulted in an increase in access requirements that is characterized by a growing number of users with a proliferation of mobile devices being used for anytime, anywhere access to applications and resources. With the adoption of Web services for application-to-application transactions, online activity has also increased. We believe that these factors have led to a redefined e-security perimeter, moving security checkpoints from a few points at the network level to many points at the application level. This expanding and changing e-business model presents organizations with many daunting challenges – from unproductive user experiences and unmanageable infrastructures to shifting security perimeters.

We believe that identity management is critical in this shifting landscape. When it comes to conducting business online, an organization can only use those identities that are trusted. That is where the real value of identity management lies. An effective identity management solution establishes trust in an organization’s online environment. Organizations that wish to do business online, whether with customers, partners or their own employees, need to know who users are (authentication) and what users can do (access management).

We believe that “Identity and Access Management” will play a critical role in the advancement of e-business as a primary mode of conducting business. We believe that this technology may transform the way the industry categorizes security and that three primary capabilities – Authentication, Authorization and Administration – will evolve over the next few years. We believe that, as customers’ e-business initiatives evolve over time, we are well-positioned to be their strategic security partner in deriving business value from identity and access management technology.

In addition, our history and strength in developer solutions is well recognized, and our solutions are pervasive across the Internet. We believe Web services are the next step in this e-commerce evolution, and that we are positioned to help shape the standards and provide the security components and middleware needed for this stage of transactional security. We believe that the industry is increasingly turning to Web services, and we will continue to focus our knowledge and efforts on securing our customers’ systems, including the applications necessary for Web services.

THE RSA SECURITY STRATEGY

Focus on Identity and Access Management

We are positioned to address organizations’ identity and access management needs – today and in the future. With thousands of customers and a history spanning nearly two decades, we understand the needs of the security market. Our heritage is in authentication, authorization and administration – the foundation of evolving identity and access management technology. We already offer a comprehensive family of solutions to address today’s identity and access management challenges, and we plan to offer a migration path toward an identity and access management framework that will be designed to integrate transparently across heterogeneous e-business infrastructures.

Lead e-Security

With over one billion RSA Security-enabled software units shipped, we are a trusted, experienced partner. We have a track record of innovation centered on solving customer problems. We are a pioneer in strong authentication, encryption and digital certificate management solutions, and we have emerged as an innovator in access management. Our ingenuity has helped us achieve an industry-leading market share in strong two-factor authentication and a population of users under the protection of RSA BSAFE

4

Table of Contents

cryptography that spans the Internet. We participate actively in the development of industry standards, such as the Liberty Alliance Project, Security Assertion Markup Language (SAML) and Public Key Cryptography Standards (PKCS). Our efforts are designed to ensure that customers working with us get the right solution for their heterogeneous environment and growing business.

Advance e-Business

We continue to work with our customers to deliver business value, transforming identity and access management solutions into opportunities for competitive advantage. Our portfolio of e-security solutions are designed to help organizations realize the revenue opportunities, operational improvements and customer service benefits of e-business – while helping protect critical resources and applications from unauthorized access and other forms of electronic malice. As identity and access management increasingly becomes a strategic imperative for many organizations, we will strive to offer our customers competitive advantage through enhanced security.

Achieve Seamless and Transparent Solutions

We have technology partnerships with industry-leading companies that allow us to integrate our solutions into many diverse environments, and our technology is pervasive throughout the Internet. The RSA Secured^® technology partner program, a key part of this initiative, focuses on product integration and interoperability certification activities as well as joint support strategies for our mutual customers. Our RSA BSAFE developer solutions are engineered to enable developers to quickly and effectively integrate encryption, protocols and electronic signatures into their applications. Most importantly, we are committed to implementing standards into our products to achieve optimal integration for our customers. Our current products support a multitude of standards, including PKCS and RADIUS, and in 2002, we announced support for the OASIS SAML 1.0 specification.

THE RSA SECURITY SOLUTION: IDENTITY AND ACCESS MANAGEMENT PRODUCTS

With the proliferation of the Internet and new e-business practices, we believe that there has never been a more critical need for sophisticated security technologies and solutions that add value to an organization’s business. Today, as public and private networks merge to redefine perimeters and organizations increasingly Web-enable their applications, our offerings are addressing the need for trusted e-business processes to help organizations achieve a competitive advantage. Our identity and access management solutions are designed to help customers spend more time exploiting new technologies for business advantage, and less time managing security.

Authentication

With a nearly 20-year history of performance and innovation, our authentication solutions remain an industry standard for organizations looking to protect their mission-critical data assets and enable e-business applications by ensuring the authenticity of people, devices and transactions. We offer organizations a wide range of authentication form factors, including software and hardware tokens, smart cards and digital certificates. These solutions help our customers positively identify users and devices before they interact with mission-critical data and applications through VPNs, email, intranets, extranets, Web servers and other network resources.

We offer a broad range of authentication options that enable enterprises to choose from varying levels of security based on the information they are protecting and the risk threshold they are willing to assume, among other criteria.

		RSA SecurID®. RSA SecurID® products are the leading solution for two-factor user authentication. RSA SecurID software is designed to protect an organization by helping to ensure that only authorized users are granted access to networked resources. The RSA SecurID product family offers a wide range of easy-to-use authenticators – from time-synchronous tokens to smart cards – that help to create a strong barrier against unauthorized access.
		RSA® Mobile. The RSA® Mobile technology is an innovative solution that delivers one-time use access codes to users via their short message service (SMS) or email infrastructure. The solution is designed to leverage mobile devices to enable organizations to more securely extend popular Web applications.
		RSA Smart Badging. RSA Smart Badging technology combines the functionality of smart cards and physical ID badges into a single integrated device as a way to provide a cost-effective, user-friendly way to authenticate users and manage access to corporate resources. The multi-application approach to authentication helps enable proximity-based physical access protection and strong network authentication on a single platform, providing enhanced single sign-on for a positive end user experience.

5

Table of Contents

RSA Keon®. RSA Keon® solutions are a family of interoperable software modules for managing digital certificates and creating an environment for authenticating people, devices and transactions. The RSA Keon product family offers specialized solutions, including SSL Web Server Security, Secure VPN, Secure e-mail and digital signatures. RSA Keon software is designed to be easy to use and interoperable with other standards-based solutions.

Web Access Management

Our standards-based approach to Web access management is designed to enable organizations to improve relationships with their customers, suppliers and partners and reduce costs by providing secure access to multiple Web-based applications and services.

RSA ClearTrust®. The RSA ClearTrust® software is a Web access management solution that is designed to facilitate secure e-business by protecting access to mission-critical Web-based applications and resources that are made available through intranets, extranets, portals, and exchange infrastructures. RSA ClearTrust software is designed to enable enterprises to manage and enforce a centralized authentication policy while enhancing the end-user experience through its Web Single Sign-On (SSO) functionality engineered to allow users to seamlessly navigate across multiple applications and domains. The identity management capabilities inherent in the RSA ClearTrust software establish trust in identity and enforce the organization’s business policy.

Developer Solutions

Our Developer Solutions are designed to enable companies to quickly and cost-effectively build privacy, authentication and digital signing technology into many business applications to secure data and authenticate people, devices and transactions. Our Developer Solutions offer a wide range of e-security software components that are intended to empower developers to secure data in any format on any network – wired or wireless.

		RSA BSAFE®. RSA BSAFE® encryption and digital signing is engineered to provide superior security, performance and support for industry standards. The RSA BSAFE line of software development kits (SDKs) provides components to secure e-business applications, enterprise software, mobile phones, pocket PCs, PDAs, Web browsers, complex networking equipment, and cable TV boxes. Over one billion RSA BSAFE-enabled applications are used to protect business transactions worldwide, helping developers to roll out mission-critical applications quickly and with greater confidence.
		RSA e-Sign. RSA e-Sign is a digital signature solution that is designed to close the electronic transaction loop, enabling organizations to gain speed and efficiencies in their business processes. Engineered for ease of use, RSA e-Sign solution works via a simple downloadable applet that enables users to digitally sign and encrypt any form of Web-delivered data within their Web browser. With RSA e-Sign software, organizations can replace paper-based forms and extend their e-business services to include activities requiring signatures, while maintaining the authenticity, integrity and privacy of the data being exchanged.

Professional Services

Our Professional Services Organization offers depth and breadth of expertise in helping its partners to plan, design, build, integrate, and implement high-quality security solutions. From phase to phase, our consultants and technologists help ensure that customers’ e-security investments are aligned with their business objectives.

STRATEGIC PARTNERS

We believe that ensuring that our products interoperate with other technology vendors’ products makes our products more competitive. Therefore, we have an ongoing program in place to establish interoperability between our products and those of other vendors. To that end, we invest in and support a strategic partnering program under the name of “RSA Secured®.” The RSA Secured partner program helps vendors integrate or establish interoperability between their products and our products, including the RSA SecurID, RSA ClearTrust, RSA Keon and RSA BSAFE product lines. The RSA Secured partner program includes four specific programs:

•

We offer interoperability testing and certification for vendors seeking to ensure interoperability between their products and our RSA SecurID and RSA ACE/Server® products. We have certified more than 250 vendor applications as part of our RSA Secured SecurID Ready program, making this program one of the largest certified strong authentication partner programs in the industry.

6

Table of Contents

	•		We offer interoperability testing and certification for vendors seeking to ensure interoperability between their products and our RSA Keon digital certification management solutions. We have certified more than 160 vendor applications as part of our RSA Secured Keon Ready program, making this program one of the largest certified partner programs in the digital certificate management industry.
	•		Our newest RSA Secured program is our RSA Secured ClearTrust Ready program. Under this program, we offer interoperability testing and certification for vendors seeking to ensure interoperability between their products and our RSA ClearTrust Web access management solutions. To date, we have certified over 50 vendor applications as part of the RSA Secured ClearTrust Ready program.
	•		We offer benefits for licensees of our RSA BSAFE technology who incorporate RSA BSAFE software into their products, including listings in our online RSA Secured Solutions directory, use of the RSA Secured brand on the licensees’ product packaging and advertising and access to joint promotional activities.

We believe that the mandatory certification testing and mutual customer support in our RSA SecurID, RSA ClearTrust and RSA Keon Ready programs set these interoperability programs apart from those of our competitors.

Through the RSA Secured program, we foster the use of the RSA Secured logo on vendor products that incorporate our technologies or are interoperable with our products. The program also includes listings in online directories, use of logos on product packaging and promotional materials, and RSA Secured joint promotional activities, such as tradeshows, advertising, direct mail and joint press releases.

Collectively, through all of the RSA Secured partner programs, we have relationships with leading vendors, including Apple Computer, AT&T, BEA, BMC, Check Point, Cisco Systems, Compaq, Ericsson, IBM, Intel, Microsoft, Nortel Networks, Nokia, Novell, Oracle, PeopleSoft, Siebel, Sun Microsystems and others, representing more than 1,000 vendor products that incorporate our technologies or are interoperable with our products. The end-user customers of the vendors who have joined the RSA Secured partner program can purchase authenticators and license our software directly from us. We believe that these relationships help our customers expand their enterprise network coverage and assist us in increasing our customer base.

SALES AND MARKETING

We have established a multi-channel distribution and sales network to serve the e-security market. We sell and license our products directly to end users through our worldwide sales force, as well as through our RSA SecurWorld™ network of original equipment manufacturers, or OEMs, value-added resellers, or VARs, and distributors. In addition, we support our sales efforts through strategic marketing relationships with other vendors.

In support of our sales efforts, we conduct sales training courses and targeted marketing programs, including direct mail, advertising, seminars, trade shows, interactive marketing, telemarketing and ongoing customer and third-party communications programs. We also seek to stimulate interest in e-security through our public relations program, speaking engagements, white papers, technical notes and other publications, as well as the RSA Conferences held around the world.

To enhance demand for our products, we have participated in the development of various industry-specific protocols that incorporate or complement our security technologies. We also host the industry’s premier annual security conference, the RSA Conference, and participate in other conferences to increase awareness, education and demand for our products. Through our RSA Laboratories group, we maintain a leading role in basic cryptographic research and the development of new encryption technologies. RSA Laboratories also maintains working relations with leading academic centers and customer development teams.

CUSTOMERS

We have a broad customer base, and no one customer accounted for more than 5% of our total revenue in 2002, 2001 or 2000. During 2002, we sold our products to an average of approximately 4,000 customers per quarter, including both new customers and repeat customers to whom we had sold in previous periods.

7

Table of Contents

We sell our products to customers in a number of different vertical markets. We have analyzed approximately 80% of our revenue for the years ended December 31, 2002 and 2001 and determined that the percentage of the analyzed revenue represented by sales to each of our major vertical markets is as follows:

As of December 31, 2002, we have sold more than 13 million RSA SecurID authenticators and licensed our software to thousands of customers worldwide, including 82% of the Fortune 100, 63% of the Fortune 500 and 88% of the world’s top banks. Historically, our customers have sought to secure highly confidential information, and have been sophisticated and knowledgeable purchasers of e-security systems. Our customers understand the need to secure their network applications for employees, partners and customers. We believe that as corporate networks and Web based services proliferate and become more complex, the number of industries concerned with e-security will grow.

MAINTENANCE, SUPPORT AND PROFESSIONAL SERVICES

We maintain a customer support help desk, technical support organization and professional services group at our headquarters in Bedford, Massachusetts, and at other locations throughout the world. We offer telephone and Web support for many of our products 24 hours a day, seven days a week. We also have field technical support personnel who work directly with our sales force, distributors and customers.

Our standard practice is to provide a warranty on all RSA SecurID hardware authenticators for the customer-selected programmed life of the authenticator (generally three to four years) and to replace any defective authenticators (other than authenticators damaged by a user’s abuse or alteration) free of charge. We generally sell each of our other products to customers with a warranty for product defects for specified periods, generally ninety days.

Customers may elect to purchase a maintenance contract, renewable annually or for multiple years. Under these contracts, we agree to provide corrections for documented program errors; version upgrades for both software and, if applicable, firmware; telephone consultation; and Web-based access to solutions, patches and documentation.

Our professional services group helps organizations plan and implement secure e-business solutions. Through this group, we provide our customers with project management, architecture and design, physical deployment, custom development, education and practitioner certification services. Customers typically pay for professional services either at a fixed price or at an hourly or daily rate for the time it takes us to complete the project.

PRODUCT DEVELOPMENT

Our product development efforts are focused on enhancing the functionality, reliability, performance and flexibility of our existing products, as well as developing new products with features and functionality that our current products do not possess. We are developing architectures and technologies to continually enhance the administrative capabilities and scalability of our RSA ACE/Server, RSA ClearTrust and RSA Keon products and to increase interoperability with additional network operating systems, applications and directory services. We are also developing tools to assist customers, strategic partners and other third-party integrators in integrating our products with custom and other third-party network or system applications.

We are working to improve our competitive position by developing standards-based protocols and solutions that address the needs of specific market segments and build on our industry-leading RSA BSAFE technology.

8

Table of Contents

In addition to enhancing our existing products, we continue to identify and prioritize various technologies for potential future product offerings. We may develop these products internally or enter into arrangements to license or acquire products or technologies from third parties.

Our product development staff, which works in six development centers worldwide, engages in software and hardware engineering, testing and quality assurance, and technical documentation. We also engage outside contractors where appropriate to supplement our in-house expertise or expedite projects based on customer or market demand. Research and development expenses were $55.1 million, $66.2 million and $45.0 million for 2002, 2001 and 2000, respectively. Our research and development expenses for 2001 include in process research and development expense of $7.9 million, which we wrote off in connection with the acquisitions of Securant, Xcert, 3GI and Transindigo.

MANUFACTURING AND SUPPLIERS

We perform assembly, programming and distribution of our products from two locations, Bedford, Massachusetts, and Shannon, Ireland. We distribute to our customers in the Americas and the People’s Republic of China from our facilities in Bedford, Massachusetts, and we distribute to our customers in other parts of the world from our facilities in Shannon, Ireland.

We currently contract for the manufacture of RSA SecurID authenticators with two suppliers, one in China and one in Thailand, and for the manufacture of various components, such as the batteries and microchips in the authenticators, from several other suppliers.

RSA ACE/Server, RSA ClearTrust, RSA Keon and RSA BSAFE software products are distributed on standard magnetic diskettes, compact disks and tapes together with documentation. We contract with media duplication subcontractors for the majority of our media duplication. We have the capability to do all media duplication in-house but limit this use to small production runs such as beta programs.

Although we generally use standard parts and components for our products, some components are currently available only from limited sources. For example, Sanyo Electric Co., Ltd. and Epson Electronics are our only suppliers for the microprocessor chips contained in our RSA SecurID products, and Flextronics and CalComp are our only manufacturers for RSA SecurID authenticators. If we were unable to obtain a sufficient supply of these or any other components and/or RSA SecurID authenticators, then we might be unable to fill customer orders and might have to expend significant resources to find new suppliers and/or manufacturers. As a result, we attempt to maintain a three-to-four month supply in inventory. We believe that it could take approximately six months to identify and commence production of suitable replacements for the microprocessor chip used in RSA SecurID authenticators.

We are currently working to establish new vendor relationships in order to increase the number of suppliers from which we buy our authenticators and authenticator components, in order to reduce our vulnerability to potential supply problems. For example, during 2002 we encountered some quality control problems with our battery vendor. As a result, we have redesigned our product to include longer life and better quality batteries. In addition, we have replaced the supplier that shipped us the faulty batteries with two other battery suppliers and no longer buy batteries from the original supplier.

COMPETITION

The market for e-security products is competitive and subject to rapid change. We currently experience direct and indirect competition from a number of sources, including:

	•		software operating systems suppliers and application software vendors that offer e-security products or features, either as stand-alone products or incorporated into their operating systems or applications;
	•		vendors of hardware authenticators and smart cards competitive with RSA SecurID products;
	•		biometric security device vendors;
	•		vendors of Web access management solutions;
	•		PKI and cryptographic software firms;
	•		application access providers; and
	•		“freeware,” i.e., free or low-cost, unpatented e-security technology.

9

Table of Contents

We believe that the principal competitive factors affecting the market for e-security products include technical features, ease of use, interoperability, quality and reliability, level of security, customer service and support and distribution channels. We believe that we and our products compare favorably to our competitors and their products with respect to each of these factors.

PROPRIETARY RIGHTS

We rely on a combination of patent, trade secret, copyright and trademark laws, software licenses, nondisclosure agreements and technical measures to protect our proprietary technology. We also generally enter into nondisclosure and assignment of inventions agreements with our employees and confidentiality and/or license agreements with our distributors, strategic partners and customers and potential customers, and limit access to and distribution of our software, documentation and other proprietary information.

Our 33 issued U.S. patents expire at various dates ranging from 2005 to 2019. Our 32 foreign patents expire at various dates between 2005 and 2014. We have also filed patent applications on inventions embodied in new technologies that we developed and on inventions that may be useful in the field of e-security. There can be no assurance that any of these applications will result in an issued patent.

We have registered, or are seeking to register, our trademarks and service marks in most countries where we are selling our products. We may also seek to purchase or license trademarks from third parties, but there can be no assurance that we will be able to purchase or license trademarks on commercially favorable terms or at all.

GOVERNMENT REGULATION AND EXPORT CONTROLS

All of our products are subject to U.S. export control laws and applicable foreign government import, export and/or use requirements. Minimal U.S. export restrictions apply to all products, whether or not they perform encryption functions.

The Export Administration Regulations of the U.S. Department of Commerce regulate the export of most commercial products with encryption features. Under regulations issued by the Department of Commerce in January 2000, encryption products of any key length, including general purpose encryption toolkits such as our RSA BSAFE products, may be exported, after a one-time technical review, to non-governmental end-users around the world, except for embargoed countries and specific prohibited end-users. Encryption products may be exported to governmental end-users under special Encryption Licensing Arrangements or individual export licenses that may be issued at the discretion of the Department of Commerce. In October 2000, the Department of Commerce further revised the Export Administration Regulations to relax some reporting requirements and to remove the export licensing requirement for shipments to governmental end-users in 23 countries, including most of the United States’ major trading partners. In June 2002, the Department of Commerce amended the encryption regulations again to conform them to the control lists implemented by other countries that are also members of the Wassenaar Arrangement. We believe that we have completed the necessary technical reviews of the products and services we currently export, but new products that we acquire or develop may require technical review before we can export them. For the export of some of our products, we are subject to various post-shipment reporting requirements.

The changes to the export regulations allow our products to be exported more quickly and at stronger strength and, therefore, be more competitive with products from foreign producers. However, the export regulations may be modified at any time. In light of the ongoing discussions regarding anti-terrorism legislation in the United States Congress, there may be an increased risk that export regulations may be modified in the future. Modifications to the export regulations could reduce or eliminate our ability to export some or all of our products from the United States without a license in the future, which could put us at a disadvantage in competing for international sales compared to companies located outside of the United States that would not be subject to these restrictions.

BACKLOG

We consider backlog to be orders for products or services evidenced by an executed contract which have not been fulfilled as of the end of a fiscal period. Backlog from sale of products and services was $5.9 million at December 31, 2002 and $1.2 million at December 31, 2001. We believe that all backlog orders at December 31, 2002 will be fulfilled during 2003.

RSA CAPITAL

In January 2000, we formed our RSA Capital segment to make synergistic investments in both external and internal activities and technologies. During 2002, we reduced our commitment of resources to the RSA Capital segment and recorded impairment charges on our equity investments to reduce their carrying value to their fair value. We are currently considering proposals to sell our investment portfolio. During 2003, we intend to focus our resources on our e-Security Solutions segment.

10

Table of Contents

Our RSA Capital segment consists of our investment activities and, until March 31, 2002, also included our New Emerging Security Technologies group, or NEST. Through our investment activities, we have historically made investments primarily in equity instruments of e-businesses and other technology companies. Also included in our investment activities is RSA Ventures, I, L.P. (“RSA Ventures”), our venture capital fund, in which we have invested $35.3 million as of December 31, 2002. Our subscription to invest in RSA Ventures is $50.3 million, leaving a remainder of $15.0 million that we may invest, at our sole discretion, over the ten year life of RSA Ventures. We currently do not intend to invest this remaining amount. At December 31, 2002, our investments include investments in private companies of $1.4 million held at their estimated realizable value less costs to dispose, and an investment in Crosby Finance, LLC (“Crosby”), a qualified special purpose entity, of $0.2 million, accounted for at fair value, with changes in fair value recorded in the statement of operations.

Crosby was established specifically to own our shares of VeriSign, Inc. (“VeriSign”) common stock, three forward contracts (“Forwards”) and one variable delivery forward (“VDF”) contract, which we contributed to Crosby on November 27, 2000. We have the right to appoint the members of the Board of Directors of Crosby, one of whom is required to be an independent director who is not an employee, director or stockholder of RSA Security or otherwise affiliated with us and who does not receive any direct or indirect benefit from us. The other members of the Crosby Board of Directors are two of our officers. None of the Crosby directors has any ownership or interest in Crosby or its profits or assets, and with the exception of the independent director, none of the directors is compensated for serving as a director of Crosby. The Crosby Board of Directors manages the operations of Crosby, but neither the Crosby Board nor either of the members of Crosby has the power to cause Crosby to engage in any business other than holding shares of VeriSign common stock, the Forwards and the VDF and performing its obligations under the Forwards and the VDF contracts.

At December 31, 2002 Crosby held 2,027,325 shares of VeriSign and the VDF contract. Crosby has no liability or obligation to its members or to the counterparty to the VDF contract other than delivery of shares of VeriSign common stock to the counterparty upon maturity of the VDF contract in 2006, and distribution of cash proceeds, if any, to its members. We are not responsible for any of the financial obligations of Crosby to its creditors. After settlement of the VDF and distribution of cash proceeds, if any, Crosby will dissolve. Additional information on our investment in Crosby Finance, LLC may be found in Note 4 of the Notes to Consolidated Financial Statements.

In the past, our RSA Capital segment competed for investment opportunities with investment companies, venture capital firms, incubators and other investors.

Before the second quarter of 2002 our RSA Capital segment also included NEST. Through NEST, we focused on investigating, developing and nurturing new ideas and technologies into operational businesses. We merged the NEST activities into our e-Security Solutions segment as of March 31, 2002.

Additional information on our industry segments may be found in Note 14 of the Notes to Consolidated Financial Statements.

EMPLOYEES

At January 31, 2003, we employed 993 employees. Of these employees, approximately 383 were involved in sales and marketing, 287 were involved in research and development, 118 in customer service and support, 98 in administrative, human resources and finance, 61 in information technology, and 46 in production. There were no employees devoted to our RSA Capital segment. No employees are covered by any collective bargaining agreements. We believe that our relationships with our employees are good.

We believe our compensation plans are competitive with other companies in our industry. We pay our worldwide sales force a base annual salary plus compensation based upon achievement of sales quotas. All other employees are paid a base annual salary plus compensation based upon achievement of revenue and earnings targets.

ITEM 2.     PROPERTIES

Our principal administrative, sales and marketing, research and development and support headquarter facilities aggregate approximately 328,000 square feet of office space and are located in Bedford, Massachusetts under non-cancelable fifteen year leases expiring in December 2017. We moved into these headquarter facilities in February 2002. Our former headquarter facilities aggregate approximately 203,000 square feet of office space and are located in Bedford, Massachusetts under non-cancelable ten year leases expiring in 2009. We also lease approximately 58,000 square feet of office space for research and development and sales and marketing in San Mateo, California under non-cancelable ten-year leases expiring in 2008, and administration and manufacturing facilities in Shannon, Ireland aggregating approximately 18,750 square feet, which serves as our distribution center for international sales. We also lease facilities for administration, field sales, research and development and customer support throughout the United

11

Table of Contents

States, Canada, Asia, Australia and Europe. In addition, during 2000, we purchased an approximately 31,000 square foot office building in Bracknell, United Kingdom. This building is used for our United Kingdom and European operations.

We are actively looking to sublease our former headquarters and other excess facilities that aggregate approximately 250,000 square feet of office space. During 2002 and 2001, we recorded restructuring charges including approximately $53.4 million representing lease payments due under excess facilities lease agreements, net of estimated sublease income, impaired leasehold improvements and furniture and fixtures, and other associated facilities expense. Based upon current economic and real estate market conditions, we expect to be able to enter into sublease agreements for all of our excess facilities within the next four years. We have existing sublet agreements with third parties for approximately 90,000 square feet of our excess facilities at various locations, which expire at various times through June 2009.

ITEM 3.     LEGAL PROCEEDINGS

By notice dated January 23, 2002, the Securities and Exchange Commission notified us that it is conducting a formal investigation of (1) our disclosure of a change in our method for estimating our distributor revenue, and (2) certain trading in our common stock. On or about July 11, 2002, the SEC staff notified RSA Security and some of its officers that the staff was considering seeking permission from the SEC to commence a civil injunctive proceeding against them, and that RSA Security and the officers could submit a written statement explaining why no such proceeding should be commenced. We and the officers submitted such a statement in August 2002 and are waiting for the SEC’s response. We and the officers are continuing to cooperate with the SEC, but we cannot predict the ultimate outcome of this matter.

On or about February 2, 2001, Leon Stambler filed a complaint for patent infringement in U.S. District Court for the District of Delaware against RSA Security, VeriSign, Inc., First Data Corporation, Openwave Systems Inc., and Omnisky Corporation, Case Number 01-0065. In September 2001, Mr. Stambler amended his complaint to add Certicom Corp. as an additional defendant. The suit was stayed against Omnisky due to Omnisky’s bankruptcy, and Openwave, Certicom and First Data settled with Mr. Stambler; therefore, only RSA Security and VeriSign remained as defendants. In his complaint, Mr. Stambler alleged that certain products marketed by each of the defendants infringed various patents that he owns, and he sought unspecified damages as well as a preliminary and permanent injunction enjoining the defendants from infringing the claims asserted. The trial took place in March 2003, and the jury determined that our products did not infringe Mr. Stambler’s patents. We believe that it is likely that Mr. Stambler will appeal the jury’s decision. Even if Mr. Stambler does appeal, we believe that the final disposition of this matter will not have a material adverse effect on our continuing operations and consolidated financial position.

On or about July 17, 2001, Digital Privacy, Inc. filed a complaint for patent infringement in the U.S. District Court for the Eastern District of Virginia against RSA Security, Case Number 2:01cv529. In its complaint, Digital Privacy alleged that certain products of 3-G International, Inc. (“3GI”), a private company that RSA Security acquired in May 2001, infringed various patents that Digital Privacy owns, and Digital Privacy sought unspecified damages as well as a permanent injunction enjoining us from infringing the claims asserted. On April 5, 2002, the court granted our motion for summary judgment and dismissed the case. In May 2002, Digital Privacy appealed the dismissal. In February 2003, we signed a settlement agreement with Digital Privacy, under which we have no further obligation or liability, and Digital Privacy dismissed its appeal.

On or about December 20, 2001, France Telecom and Telediffusion de France (“FT”) filed a Request for Arbitration with the International Court of Arbitration. FT claims that we breached a license agreement with FT and seeks unspecified damages including payment of a $20.0 million advance plus the legal fees and other costs associated with the arbitration. We believe that FT’s claims are without merit, and we intend to defend the arbitration vigorously. In a related matter, FT has also filed a patent infringement suit in Delaware against Novell, Inc., one of our licensees. In August 2002, we signed a letter agreement with Novell agreeing that if a court requires Novell to pay FT damages, we will reimburse Novell for 50% of the damages, up to a maximum payment of $2.5 million by us. If the damages payable by Novell exceed $5.0 million, then the indemnification provisions of our license agreement with Novell will govern our indemnification obligations. Although we believe that FT’s claims against Novell are without merit, we cannot predict the ultimate outcome of this matter. However, we believe that neither the disposition of our arbitration with FT nor the disposition of the litigation between Novell and FT will have a material adverse effect on our continuing operations and consolidated financial position.

From time to time, we have been named as a defendant in other legal actions arising from our normal business activities, which we believe will not have a material adverse effect on us or our business.

ITEM 4.     SUBMISSION OF MATTERS TO A VOTE OF SECURITY HOLDERS

None.

12

Table of Contents

PART II

ITEM 5.     MARKET FOR OUR COMMON EQUITY AND RELATED STOCKHOLDER MATTERS

The following sales prices have been adjusted to reflect our three-for-two stock split effected as a dividend on our common stock in March 2001. Our common stock has been trading on The NASDAQ National Market under the symbol “RSAS” (formerly “SDTI”) since our initial public offering on December 14, 1994. The following table indicates the high and low sales prices per share of our common stock for each of our fiscal quarters during the last two completed fiscal years, as reported on The NASDAQ National Market.

There were 450 stockholders of record of our common stock as of February 14, 2003. We estimate that we have a total of approximately 80,000 stockholders, including stockholders who hold their shares in “street name.”

We have never declared or paid any cash dividends on our capital stock. We currently intend to retain earnings, if any, to support our growth strategy and do not anticipate paying cash dividends in the foreseeable future. Payment of future dividends, if any, will be at the discretion of our Board of Directors after taking into account various factors, including our financial condition, operating results, current and anticipated cash needs and plans for expansion.

13

Table of Contents

ITEM 6.   SELECTED FINANCIAL DATA
(in thousands, except per share data)

(1)  Per share and share amounts have been adjusted to reflect the three-for-two stock split effected as a dividend in March 2001.

14

Table of Contents

ITEM 7.   MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS OF OPERATIONS

This Report contains forward-looking statements within the meaning of Section 21E of the Securities Exchange Act of 1934, as amended, and Section 27A of the Securities Act of 1933, as amended. For purposes of these Acts, any statement that is not a statement of historical fact may be a forward-looking statement. For example, statements containing the words “believes,” “anticipates,” “plans,” “expects,” and similar expressions may be forward-looking statements. However, we caution investors not to place undue reliance on any forward-looking statements in this Report because these statements speak only as of the date when made. Furthermore, we are not obligated to publicly update any forward-looking statements, whether as a result of new information, future events or otherwise. There are a number of factors that could cause our actual results to differ materially from those indicated by these forward-looking statements, including without limitation the factors described below under the caption “Certain Factors That May Affect Future Results.”

Overview

RSA Security Inc. is a leading provider of electronic security, or e-security, solutions. With thousands of customers around the globe, we provide interoperable solutions for establishing online identities, access rights and privileges for people, applications and devices. Built to work seamlessly and transparently in the complex environments of our customers, our comprehensive portfolio of identity and access management solutions - including authentication, Web access management and developer solutions – are designed to allow customers to confidently exploit new technologies for competitive advantage. We sell our two-factor user authentication, Web access management and encryption products and solutions to corporate enterprise users seeking turnkey security solutions, and to original equipment manufacturers and developers seeking software development components for embedding security in a range of software applications or hardware devices.

We conduct our business in two segments: e-Security Solutions and RSA Capital. Through our e-Security Solutions segment, we derive our operating revenue primarily from two distinct product groups: Enterprise solutions, which includes RSA SecurID^® authenticators, RSA ACE/Server^® software, RSA ClearTrust^® software, RSA Keon^® software, and maintenance and professional services for those products, and Developer solutions, which includes RSA BSAFE^® encryption software and protocol products, RSA Keon components, and maintenance and professional services for those products.

Sales of our RSA SecurID authenticator products continue to be strong, while our less mature Enterprise software products continue to build revenue and market share. Over the last two years, we have seen a decrease in revenue from our Developer solutions, which we believe is primarily attributable to a decrease in the number of technology companies funding development, as well as the availability of free, “open source” products that compete with our RSA BSAFE product line; however, we have seen an emerging trend in developer solutions selling to enterprise customers. Our product line synergies create opportunities to sell additional products to existing customers.

Typically, our Enterprise solutions customers place an initial order for a limited number of users, for either our RSA SecurID authenticators or any of our software products. As the use of our products grows within the enterprise, our customers may place additional orders with us to add more users. As authenticators expire, typically three to four years after their initial purchase, our customers may order additional replacement authenticators. In most cases, the customer will also enter into a customer support agreement with us at the time of initial purchase and renew this support agreement annually. We typically base our RSA ACE/Server, RSA Keon and RSA ClearTrust software license fees on the number of users authorized under each customer’s license.

With respect to Developer solutions, RSA BSAFE software licensing terms vary by product and customer. Typical licensing terms may include an initial prepaid license fee and ongoing royalties paid as a percentage of the developer’s product or service revenue, or payment of annual license fees, or a single fully paid-up license fee. Often, our existing developer customers go on to license new software or technology from us or wish to increase the field of use rights for the technology they have already licensed. In such a case, we amend our license agreement with the customer and charge additional licensing fees, thus deriving additional revenue.

We have contracted with outside manufacturing organizations to produce our RSA SecurID authenticators, and many of our products contain technology that is licensed from third parties. Our cost of revenue consists primarily of costs associated with the manufacture and delivery of RSA SecurID authenticators and royalty fees that we pay for the licensed technology. Cost of revenue also includes professional service, customer support, and production costs. Production costs include the programming labor, shipping, inspection and quality control functions associated with the RSA SecurID authenticators. We are currently working to establish new vendor relationships in order to increase the number of suppliers from which we buy our authenticators and authenticator components, in order to reduce our vulnerability to potential supply problems.

15

Table of Contents

Our direct sales to our customers in countries outside of the United States are denominated in U.S. dollars and local currency, with the majority of our sales denominated in U.S. dollars. Our sales through indirect distribution channels are generally denominated in U.S. dollars. For countries outside the United States, we generally pay our operating expenses in local currency. Where we do invoice customers in local currency, we are exposed to foreign exchange rate fluctuations from the time of invoice until collection occurs. We are also exposed to foreign currency fluctuations between the time we collect in U.S. dollars and the time we pay our operating expenses in local currency. Fluctuations in currency exchange rates could affect the profitability and cash flows in U.S. dollars of our products sold in international markets.

Our RSA Capital segment consists of our investment activities, and was formed to make synergistic investments in both external and internal activities and technologies. Through our investment activities, we have historically made investments primarily in equity instruments of e-businesses and other technology companies. During 2002 we reduced our commitment of resources to the RSA Capital segment and recorded impairment charges on our equity investments to reduce their carrying value to their estimated realizable value, less costs to dispose. We are currently considering proposals to sell our investment portfolio, and we currently do not intend to make any new investments. During 2003, we intend to focus our resources on our e-Security Solutions segment. Expenses incurred in connection with our investment activities are primarily for general and administration and management and professional fees. Also included in our RSA Capital segment is our interest in Crosby Finance, LLC, a qualified special purpose entity, with a carrying value of $0.2 million at December 31, 2002. Information on our investment in Crosby Finance, LLC may be found in Note 4 of the Notes to Consolidated Financial Statements.

Our RSA Capital segment also included our New Emerging Security Technologies group, or NEST, which was merged into our e-Security Solutions segment prior to the second quarter of 2002. Through NEST we focused on investigating, developing and nurturing new ideas and technologies into operational businesses. Expenses incurred in connection with NEST activities included general and administration expenses, as well as the operations of 3-G International, Inc. and Transindigo Inc (“Transindigo”).

Information on our segments may be found in Note 14 of the Notes to Consolidated Financial Statements.

Application of Critical Accounting Policies and Estimates

The discussion and analysis of our financial condition and results of operations are based on our consolidated financial statements, which have been prepared in accordance with accounting principles generally accepted in the United States of America. The preparation of these consolidated financial statements requires management to make estimates and assumptions that affect the reported amounts of assets and liabilities and disclosure of contingent assets and liabilities at the date of the consolidated financial statements and the reported amounts of revenue and expense during the reporting period. On an ongoing basis, we evaluate our estimates, including those related to revenue recognition, sales returns, allowance for doubtful accounts, investments, intangible assets, income taxes, financing operations, warranty obligations, restructurings, contingencies and litigation. We base our estimates on historical experience and on various other assumptions that we believe are reasonable under the circumstances. However, our actual results could differ from those estimates.

We believe the following critical accounting policies affect our more significant judgments and estimates used in the preparation of our consolidated financial statements.

Revenue Recognition – We derive our revenue primarily from two sources: sales of products, including hardware and software licenses, and services, including maintenance, support and professional services. Our management must make and use judgments and estimates in connection with the revenue recognized in any reporting period. The amount and timing of our revenue for any period may materially differ if our management made different judgments or utilized different estimates in establishing our allowance for sales returns.

We recognize revenue from the sale of our products in accordance with American Institute of Certified Public Accountants Statement of Position (“ SOP”) 97-2, “Software Revenue Recognition,” and SOP 98-9, “Modification of SOP 97-2 With Respect to Certain Transactions,” as amended and interpreted. We recognize revenue from the sale of products when persuasive evidence of an arrangement exists, delivery has occurred, the fee is fixed or determinable, and collection is considered probable. Revenue is reduced by provisions for estimated sales returns.

For all sales, we use a binding contract, purchase order or another form of documented agreement as evidence of an arrangement with the customer. Sales to our distributors are evidenced by a master agreement governing the relationship, together with binding purchase orders on a transaction-by-transaction basis.

We consider delivery to occur when we ship the product, so long as title and risk of loss have passed to the customer.

16

Table of Contents

At the time of a transaction, we assess whether the sale amount is fixed or determinable and whether collection is probable. If we determine the fee is not fixed or determinable, we recognize revenue when the fee is determined and payment becomes due. We assess collection based on a number of factors, including past transaction history with the customer and the creditworthiness of the customer. If we determine that collection is not probable, we do not record revenue until such time when collection becomes probable, which is generally upon the receipt of cash.

In our arrangements with our customers, we generally do not include acceptance provisions, which would give the customer the right to accept or reject the product after we ship it. However, if an arrangement includes an acceptance provision, we recognize revenue upon the customer’s acceptance of the product, which occurs upon the earlier of receipt of a written customer acceptance or expiration of the acceptance period. In accordance with Statement of Financial Accounting Standards (“SFAS”) No. 48, “Revenue Recognition when Right of Return Exists,” we recognize revenue upon shipment of product to stocking distributors for sales to distributors who have only limited return rights, and record a sales return reserve to provide for estimated product returns.

When arrangements contain multiple elements and vendor specific objective evidence (“VSOE”) of fair value exists for all undelivered elements, we recognize revenue for the delivered elements using the residual method. Our determination of fair value of each of the undelivered elements in multi-element arrangements is based on VSOE of fair value. VSOE of fair value for each element is either the price we charge when the same element is sold separately or the price established by the members of our management, who have the relevant authority to set prices, for an element not yet sold separately. For arrangements containing multiple elements where VSOE of fair value does not exist for all undelivered elements, revenue for the delivered and undelivered elements is deferred until VSOE of fair value exists or all elements have been delivered.

Maintenance service revenue, whether sold separately or as part of a multiple element arrangement, is deferred and recognized ratably over the term of the maintenance contract, generally twelve months. Revenue allocated to professional service elements is recognized as the services are performed.

Allowance for Sales Returns – We record allowances for estimated sales returns and allowances on products and maintenance and professional service related revenue in the same period as the related revenue is recorded. These estimates are based on historical sales returns, analysis of credit memo data, current economic trends, product line and customer industry and other known factors. Our historical experience with sales returns varies by product line depending on the customer’s industries and markets. We must make judgments and estimates in connection with establishing the allowances for estimated sales returns in any reporting period. The amount and timing of our revenue for any reporting period may materially differ if actual sales returns and allowances differ from our estimates.

Allowance for Doubtful Accounts – We maintain allowances for doubtful accounts for estimated losses resulting from the inability of our customers to make required payments. We analyze accounts receivable and the composition of the accounts receivable aging, historical bad debts, customer creditworthiness, current economic trends, foreign currency exchange rate fluctuations, changes in our customer payment terms, and other known factors when evaluating the adequacy of the allowance for doubtful accounts. Based upon the analysis and estimates of the uncollectibility of our accounts receivable, we record an increase in the allowance for doubtful accounts when the prospect of collecting a specific account receivable becomes doubtful. Actual results could differ from the allowances for doubtful accounts recorded, and this difference may have a material effect on our financial position and results of operations. Recoveries of accounts previously written off as uncollectible are recorded as increases to the allowance for doubtful accounts.

Income taxes – The preparation of our consolidated financial statements requires us to estimate our income taxes in each of the jurisdictions in which we operate, including those outside the United States which may be subject to certain risks that ordinarily would not be expected in the United States. The income tax accounting process involves our estimating our actual current exposure together with assessing temporary differences resulting from differing treatment of items for tax and accounting purposes. These differences result in the recognition of deferred tax assets and liabilities. We must then record a valuation allowance to reduce our deferred tax assets to the amount that is more likely than not to be realized.

Management judgment is required in determining our provision for income taxes, our deferred tax assets and liabilities and any valuation allowance recorded against deferred tax assets. We have recorded a valuation allowance of $25.4 million as of December 31, 2002 due to uncertainties related to our ability to utilize some of our deferred tax assets, primarily consisting of acquisition related net operating losses carried forward. The valuation allowance is based on our estimates of taxable income by jurisdiction in which we operate and the period over which our deferred tax assets will be recoverable. In the event that actual results differ from these estimates or we adjust these estimates in future periods we may need to adjust our valuation allowance, which could materially impact our consolidated financial position and results of operations.

17

Table of Contents

Valuation of Goodwill and Other Intangible Assets – In assessing the recoverability of our goodwill and other intangibles, we must make assumptions regarding estimated future cash flows and earnings and other factors to determine the fair value of the respective assets. If these estimates or their related assumptions change in the future, we may be required to record impairment charges against these assets in the reporting period in which the impairment is determined. We will record an impairment charge in the amount by which the carrying value of the assets exceeds their fair value. Fair value is determined generally based on estimated discounted future cash flows or a market multiple valuation method. Any such impairment charge could be significant and could have a material adverse effect on our consolidated financial position and results of operations. During the fourth quarter of 2002, we determined the fair value of our intangible assets was zero and accordingly, we recorded a $19.1 million impairment charge to reduce the carrying value of our intangible assets, other than goodwill, to their fair value. At December 31, 2002, we had approximately $191.7 million of goodwill which accounted for approximately 40% of our total assets. Any goodwill impairment test could result in a decrease to the carrying value of goodwill and could have a material effect on our results of operations and consolidated financial position.

The adoption of SFAS No. 142, “Goodwill and Other Intangible Assets,” requires us to analyze the carrying value of goodwill and other intangible assets for impairment on an annual basis. We perform this annual test for impairment as of November 30 of each year and, if events or circumstances occur that would more likely than not reduce the fair value of the goodwill below its carrying amount, will perform an interim impairment test. The test for impairment is performed under a two step process. The first step tests for impairment, and the second step (if necessary) measures impairment. Goodwill is included in our e-Security Solutions segment, which contains one reporting unit (“Reporting Unit”). We completed the required annual goodwill impairment test as of November 30, 2002, by comparing the carrying amount of the Reporting Unit to the estimated fair value of the Reporting Unit. Estimated fair value of the Reporting Unit was determined based upon independent appraisal using the market multiple valuation method. As of November 30, 2002 the fair value of the Reporting Unit was greater than the carrying amount of the Reporting Unit. Therefore, the annual goodwill impairment test performed as of November 30, 2002 did not result in an impairment.

Long-Term Investments – Our long-term investments include investments in preferred and common stock of privately held companies and our interest in Crosby Finance, LLC, a qualified special purpose entity. At December 31, 2002, we had approximately $1.6 million of long-term investments which included $1.4 million for investments in preferred and common stock of privately held companies and $0.2 million for our interest in Crosby. We carry our investments in privately held companies at their estimated realizable value less costs to dispose. We regularly consider available evidence in evaluating potential impairment of our privately held investments. Because no public market exists for these investments, we estimate their value based on potential financing valuations and the investees’ forecasted financial performance, as well as the external markets for these types of investments. If the assumptions and estimates used in assessing the value of these investments are not accurate, or adverse changes in market conditions occur, or forecasts are not met, we may have to record additional impairment charges that we have not previously recognized.

During 2002, we recognized impairment charges of $21.9 million related to our long-term investments in privately held companies. During the fourth quarter of 2002 we initiated a process to sell our equity investments, and recorded an impairment charge of $12.0 million to reflect the investments at their estimated realizable value, less costs of disposal. During 2002, three of the companies in which we had invested were in the process of obtaining additional financing or being sold, and based upon valuations and anticipated cash proceeds, we recorded an impairment charge of $9.9 million to reduce the carrying amount of these investments to their estimated fair value.

We account for our investment in Crosby under Emerging Issues Task Force (“EITF”) Issue No. 96-12, “Recognition of Interest Income and Balance Sheet Classification of Structured Notes.” We are carrying our interest in Crosby at fair value with all increases and decreases in fair value reported in income from investing activities in the statement of operations. We determine the fair value based on the fair value of Crosby’s right to potentially receive additional cash proceeds upon maturity of the VDF contract. At December 31, 2002, our interest in Crosby had a fair value of $0.2 million, and is included in investments as a long-term asset. Should the fair value of our investment in Crosby decrease, we would incur a pretax charge of up to $0.2 million, which would be included in income from investing activities in our consolidated statements of operations.

Restructurings – During 2002, 2001 and 1999, we initiated consolidation of certain operations in order to enhance operational efficiency and reduce expenses, and recorded significant restructuring charges in connection with these actions. Restructuring charges were $56.0 million and $20.0 million for 2002 and 2001, respectively. These restructuring charges require us to make estimates based upon real estate market conditions, rental rates, future corporate requirements, general economic conditions and future estimated cash flows. Included in the restructuring charges recorded in 2002 are facility exit costs of $44.0 million, which represents estimated shortfalls of sublease rental income compared to lease payments due through 2009 under certain exited facilities lease agreements, impaired leasehold improvements and furniture and fixtures, and other associated facilities expenses. Estimates related to the length of time to reserve excess facilities are based on assumptions regarding the period required to locate and contract with suitable subtenants and are based on market trend information analysis. Estimates of sublease income are based upon the terms of existing sublease agreements that we have obtained and market trend information analysis. If the assumptions for these estimates change due to changes in the real estate and sublease markets, or due to the terms of sublease agreements that we have obtained, the ultimate restructuring

18

Table of Contents

expenses for these facilities could vary by material amounts, and could cause us to record additional restructuring charges in future reporting periods. Included in the 2002 restructuring charges are facility exit costs of $35.7 million, which arose when we revised the estimates that we had used in previously recorded restructuring charges. These estimates were revised due to higher than anticipated operating costs and changes to estimated length of time we expect it will take to obtain subtenants for certain excess facilities.

New Accounting Pronouncements

SFAS No. 141 and SFAS No. 142 – We adopted SFAS No. 141, “Business Combinations,” and SFAS No. 142, “Goodwill and Other Intangible Assets,” on January 1, 2002, except with respect to the acquisition of Securant Technologies Inc. (“Securant”) to which we applied the provisions of SFAS No. 141 and No. 142 on September 4, 2001 (the date of acquisition). SFAS No. 141 requires the use of the purchase method of accounting for all business combinations initiated after June 30, 2001, and eliminates the pooling of interests method. In addition, SFAS No. 141 further clarifies the criteria for recognition of intangible assets separately from goodwill. SFAS No. 142 requires that amortization of goodwill and indefinite lived intangible assets be discontinued and instead be evaluated at least annually for impairment under a two step process. Intangible assets with finite lives continue to be amortized over their useful lives.

We completed the transitional goodwill impairment test as of January 1, 2002, the date of adoption of SFAS No. 142. Goodwill is included in our e-Security Solutions segment, which contains one Reporting Unit. The goodwill impairment test compared the carrying amount of the Reporting Unit to the estimated fair value of the Reporting Unit. We determined the estimated fair value of the Reporting Unit based upon an independent appraisal using the market multiple valuation method. As of the January 1, 2002 transitional goodwill impairment test, the fair value of our Reporting Unit was greater than the carrying amount of the Reporting Unit. Therefore, the transitional goodwill impairment test performed as of January 1, 2002 did not result in an impairment of our goodwill.

We perform the required annual goodwill impairment test as of November 30 of every year, and, if events or circumstances occur that would more likely than not reduce the fair value of the Reporting Unit below its carrying amount, we will perform an interim impairment test. Accordingly, we completed the required annual goodwill impairment test as of November 30, 2002. The annual goodwill impairment test compared the carrying amount of the Reporting Unit to the estimated fair value of the Reporting Unit. Estimated fair value of the Reporting Unit was determined based upon independent appraisal using the market multiple valuation method. As of the November 30, 2002 annual goodwill impairment test, the fair value of our Reporting Unit was greater than the carrying amount of the Reporting Unit. Therefore, the annual goodwill impairment test performed as of November 30, 2002 did not result in an impairment of our goodwill.

As a result of our adoption of SFAS No. 142 on January 1, 2002, we reclassified in-place workforce related intangible assets into goodwill, resulting in an increase to goodwill and a decrease to intangible assets of $8.3 million. Upon reclassification of in-place workforce related intangible assets to goodwill and the determination of indefinite lived intangible assets, we reversed the deferred tax liabilities related to these intangible assets. The reversal resulted in a decrease to goodwill and deferred tax liabilities of $3.1 million.

We applied the provisions of SFAS No. 141 and No. 142 with respect to the acquisition of Securant on September 4, 2001 (the date of acquisition). As part of the application of SFAS No. 141, we recognized identifiable intangible assets separate from goodwill and have recognized amortization expense on these intangible assets with finite lives from the date of acquisition.

As a result of our adoption of SFAS No. 142, we discontinued amortizing all existing goodwill and indefinite lived intangible assets and did not record any related amortization expense after January 1, 2002. Had the provisions of SFAS No. 141 and No. 142 been applied for the year ended December 31, 2001, our net income and earnings per share would have been as follows:

19

Table of Contents

We had no intangible asset related amortization expense for the year ended December 31, 2000. Amortization expense recorded in 2001 related to intangible assets acquired in connection with acquisitions completed during 2001.

At December 31, 2002, we applied the provisions of SFAS No. 144, “Accounting for the Impairment or Disposal of Long-Lived Assets,” to our technology, customer list, trademark and noncompetition agreement intangible assets due to circumstances that indicated the carrying value of these intangible assets may not be recoverable. We determined that the carrying amount of these assets was not recoverable because the carrying value of these assets exceeded the sum of the estimated undiscounted cash flows expected to be generated from the use of these assets. We determined the amount of the impairment loss by comparing the carrying amount of these assets to their fair value at December 31, 2002. We determined the fair value based on estimated discounted cash flows expected to be generated from the use of these assets. The fair value of the intangible assets was determined to be zero at December 31, 2002, and accordingly, we recorded a $19.1 million impairment charge for the year ended December 31, 2002 to reduce the carrying amount of our intangible assets to their fair value.

SFAS No. 145 – In April 2002, the Financial Accounting Standards Board (“FASB”) issued SFAS No. 145, “Rescission of FASB Statements No. 4, 44 and 62, Amendment of FASB Statement No. 13 and Technical Corrections.” For most companies, SFAS No. 145 will require gains and losses on extinguishments of debt to be classified as income or loss from continuing operations rather than as extraordinary items as previously required under SFAS No. 4. Extraordinary treatment will be required for certain extinguishments as provided in Accounting Principles Board Opinion No. 30. SFAS No. 145 also amends SFAS No. 13 for certain sales-leaseback and sublease accounting. We were required to adopt the provisions of SFAS No. 145 on January 1, 2003. We believe the adoption of SFAS No. 145 will not have a significant impact on our consolidated financial position or results of operations.

SFAS No. 146 – In July 2002, the FASB issued SFAS No. 146, “Accounting for Costs Associated with Exit or Disposal Activities.” SFAS No. 146 requires that a liability for a cost associated with an exit or disposal activity be recognized when the liability is incurred. SFAS No. 146 nullifies EITF No. 94-3 “Liability Recognition for Certain Employee Termination Benefits and Other Costs to Exit an Activity,” which required a liability be recognized at the commitment date to an exit plan. We were required to adopt the provisions of SFAS No. 146 effective for exit or disposal activities initiated after December 31, 2002. All restructuring activities prior to December 31, 2002, including those described in Note 13 of the Notes to Consolidated Financial Statements, are accounted for under EITF No. 94-3.

SFAS No. 148 – In December 2002, the FASB issued SFAS No. 148, “Accounting for Stock-Based Compensation – Transition and Disclosure.” SFAS No. 148 amends SFAS No. 123, “Accounting for Stock Based Compensation,” and provides alternative methods of transition for a voluntary change to the fair value based method of accounting for stock-based employee compensation. In addition, SFAS No. 148 amends the disclosure requirements of SFAS No. 123 to require prominent disclosures in both annual and interim financial statements about the method for accounting for stock based employee compensation and the effect of the method used on reported results. The transition guidance and annual disclosure provisions of SFAS No. 148 are effective for fiscal years ending after December 15, 2002. The interim disclosure provisions are effective for financial reports containing financial statements for interim periods beginning after December 15, 2002. As we did not make a voluntary change to the fair value based method of accounting for stock based employee compensation in 2002, the adoption of SFAS No. 148 did not have a material impact on our consolidated financial position and results of operations.

20

Table of Contents

Interpretation No. 45 – In November 2002, the FASB issued Interpretation No. 45 (“FIN 45”), “Guarantor’s Accounting and Disclosure Requirements for Guarantees, Including Indirect Guarantees of Indebtedness of Others,” which clarifies disclosure and recognition and measurement requirements related to certain guarantees. The disclosure requirements are effective for financial statements issued after December 15, 2002 and the recognition and measurement requirements are effective on a prospective basis for guarantees issued or modified after December 31, 2002. We believe the adoption of FIN 45 will have no impact on our consolidated financial position and results of operations.

Interpretation No. 46 – In January 2003, the FASB issued Interpretation No. 46 (“FIN 46”), “Consolidation of Variable Interest Entities,” which clarifies the application of Accounting Research Bulletin No. 51, “Consolidated Financial Statements,” relating to consolidation of certain entities. First, FIN 46 will require identification of our participation in variable interest entities (“VIE”), which are defined as entities with a level of invested equity that is not sufficient to fund future activities to permit them to operate on a stand alone basis, or whose equity holders lack certain characteristics of a controlling financial interest. For entities identified as VIE, FIN 46 sets forth a model to evaluate potential consolidation based on an assessment of which party to the VIE, if any, bears a majority of the exposure to its expected losses, or stands to gain from a majority of its expected returns. FIN 46 also sets forth certain disclosure regarding interests in VIE that are deemed significant, even if consolidation is not required. We anticipate the adoption of FIN 46 will not have a significant impact on our consolidated financial position or results of operations.

EITF No. 00-21 – In November 2002, the EITF issued EITF No. 00-21, “Revenue Arrangements with Multiple Deliverables,” which provides guidance on the timing and method of revenue recognition for sales arrangements that include the delivery of more than one product or service. EITF 00-21 is effective prospectively for arrangements entered into in fiscal periods beginning after June 15, 2003. The effect of adopting this issue is being evaluated.

21

Table of Contents

Results of Operations

The following table sets forth certain consolidated financial data as a percentage of our total revenue:

22

Table of Contents

2002 Compared with 2001

Revenue

The following tables set forth the amount, percentage of total revenue and percentage increase (decrease) of our revenue by product group, product type and product division:

We have reclassified revenue of $13.0 million for the year ended December 31, 2001 from the authentication products division to the encryption products division in order to conform to current period presentation.

The following tables set forth the amount, percentage of total revenue and percentage decrease of revenue by regional area:

We believe the decrease in total revenue in 2002 as compared to 2001 was primarily due to the continued decline in information technology spending by our existing and prospective customers due to the uncertainty of the economy. We believe that when and if information technology spending increases from the current rates of spending we will benefit with increased revenue. We believe our product revenue will increase if businesses continue the trend toward permitting remote access to internal resources and Web-enabling existing applications. We also believe our identity and access management solutions promote our product synergies and will enable us to generate additional revenue by selling additional products to existing customers.

We believe revenue from sales of RSA SecurID authenticators declined in 2002 as compared to 2001 primarily due to the recent and continued downsizing of businesses. The number of RSA SecurID authenticator units sold decreased 6.9% in 2002 to 2.5 million from 2.7 million in 2001. In addition, the average selling price per authenticator unit decreased 1.8% in 2002 to $42.65 from $43.45 in 2001. The decrease in number of units sold, along with the decrease in the average selling price in 2002 as compared to 2001, contributed to the decreased revenue from our RSA SecurID authentication product line. The decrease in the average selling price can be attributed to an increase in the number of larger volume transactions during 2002 as compared to 2001, because we tend to give larger discounts on larger volume transactions. We believe our RSA SecurID authentication products generate and will continue to generate substantial revenue for us.

23

Table of Contents

Our authentication products revenue includes revenue from our RSA Keon product line for all periods presented. RSA Keon revenue decreased in 2002 as compared to the same period of 2001, which we believe was due primarily to our customers delaying or canceling the implementation of large infrastructure information technology projects. In addition, during 2002 we eliminated several products included in the RSA Keon product line, and this contributed to the decrease in revenue from our RSA Keon product line. However, due to synergies within our product lines, RSA Keon product line has generated and, we expect, will continue to generate strong revenue. We believe that the revenue generated from our authenticator product division will continue to provide steady overall growth for us despite the weakened global economy.

As result of the acquisition of Securant in September 2001, we established the RSA ClearTrust Web access management solution product division, and generated $3.8 million of Web access management revenue in the fourth quarter of 2001. Web access management revenue was $8.1 million and accounted for 3.5% of total revenue for 2002. We believe, despite a highly competitive market, that our Web access management revenue will contribute approximately 5% to 6% of our total revenue during 2003.

We believe that the decrease in Developer solutions and encryption revenue was primarily attributable to a decrease in the number of technology companies funding development and in the development of new information technology products, as well as the availability of free, “open source” products that compete with our RSA BSAFE product line. We believe revenue from sales of encryption products to enterprise customers has contributed, and will continue to contribute, to our Developer solutions revenue, and we therefore expect that our encryption revenue will continue to account for approximately 10% of our total revenue in 2003.

We believe the increase in service revenue in 2002 as compared to 2001 can primarily be attributed to continued purchases by new customers coupled with renewals of annual maintenance contracts from sale of products in prior periods.

We believe that as the United States government proceeds with its agenda of increasing awareness of cyber-security issues, and its focus on homeland security, we will benefit with increased revenue. We believe the government sector of our business may increase in the future as government agencies seek e-security partners in order to execute their cyber-security agenda. In addition, we believe the Health Insurance Portability and Accountability Act of 1996 (HIPAA) privacy and security standards that require security for online healthcare transactions and clinical trials has increased our revenue from the healthcare and pharmaceutical vertical market segment.

Gross Profit

The following tables set forth the gross profit and gross margin for products and maintenance and professional services:

Included in the gross profit for products for 2002 is a $2.9 million charge for inventory write down related to discontinued product designs and for product quality warranty accruals. Included in the gross profit for products for 2001 is a write off of prepaid royalties of $5.2 million. These prepaid royalties were expensed to cost of product revenue when it was determined that they may not have future realizable value as a result of our acquisition of Xcert International, Inc. (“Xcert”) in February 2001. Excluding the inventory write down and warranty accruals, gross margin for products was 80.5% for 2002. Excluding the prepaid royalties, total gross margin for products was 85.2% for 2001. We have included these gross margin measures, which are not in accordance with generally accepted accounting principles (“GAAP”), for year over year comparison purposes.

We believe the decrease in gross margin for products for 2002 as compared to 2001, after excluding the items mentioned above, can be primarily attributed to the decrease in our software revenue. Our software products have higher gross margins than our other product types, and a decrease in software revenue would cause our gross margin for products to decrease.

We believe the increase in gross profit from maintenance and professional services in 2002 as compared to 2001 was primarily attributable to increased maintenance revenue achieved on decreased customer support costs. Customer support costs decreased due to cost reduction programs implemented since the third quarter of 2001.

We expect to maintain total gross margins of between 76% and 78% for 2003.

24

Table of Contents

Research and Development

Total research and development expenses decreased 5.6% in 2002 to $55.1 million from $58.3 million in 2001, and represented 23.7% of total revenue for 2002. For 2002 as compared to 2001, approximately $3.2 million of the decrease in research and development expenses was from decreased payroll, overheard and consulting expenses associated with our reduced workforce. RSA Capital expenses included in total research and development expenses were $0.5 million and $2.5 million for 2002 and 2001, respectively, all of which were attributable to our NEST group, which merged into our e-Security Solutions segment prior to the second quarter of 2002. We expect our 2003 research and development expenditures in absolute dollars to be similar to 2002, and to be between 19% and 21% of total revenue for 2003.

Marketing and Selling

Total marketing and selling expenses decreased 18.1% in 2002 to $100.7 million from $122.9 million in 2001, and represented 43.4% of total revenue for 2002. Marketing and selling expenses decreased in 2002 as compared to 2001 primarily due to cost reduction measures. For 2002 as compared to 2001, approximately $8.7 million of the decrease in marketing and selling expenses was from decreased payroll expenses and overhead costs associated with our reduced workforce, approximately $6.1 million of the decrease was from decreased spending on marketing programs, approximately $4.7 million of the decrease was from a reduction in bad debt expense, and approximately $2.7 million of the decrease was from decreased commission expense due to decreased revenue. RSA Capital expenses included in total marketing and selling expenses were $0.4 million for 2001, all of which were attributable to our NEST group, which merged into our e-Security Solutions segment prior to the second quarter of 2002. We believe marketing and selling expenditures will be 38% to 39% of total revenue in 2003.

General and Administrative

Total general and administrative expenses decreased 22.7% in 2002 to $30.3 million from $39.1 million in 2001, and represented 13.1% of total revenue for 2002. The decrease in total general and administrative expenses in 2002 as compared to 2001 was primarily due to cost reduction measures. Included in total general and administrative expenses for 2002 and 2001 were $0.3 million and $7.3 million, respectively, of general and administrative costs associated with our RSA Capital segment, including its NEST group and investment activities. For 2002 as compared to 2001, approximately $6.9 million of the decrease was from decreased payroll and overhead costs associated with our reduced workforce, and approximately $3.9 million of the decrease was from decreased expenses relating to our investment activities included in our RSA Capital segment. These decreases were partially offset by an increase of approximately $2.0 million for professional fees incurred in connection with on-going litigation. We believe general and administrative expenditures will be 11% to 13% of total revenue in 2003.

Acquisitions

During 2001, we completed four acquisitions, which were accounted for as purchases. Accordingly, the results of operations of the acquired companies have been included in our consolidated statements of operations since their respective dates of acquisition. Costs related to these acquisitions are for investment banking, professional fees and other direct costs, including employee severance and facilities closure. These costs were recorded on the dates of acquisition and have been included in the allocation of the purchase prices.

In September 2001, we acquired all of the capital stock of Securant, a privately held company that developed the ClearTrust Web access management solution, for an aggregate of $142.4 million in cash including acquisition costs. In May 2001, we acquired all of the capital stock of 3GI, a privately held company that developed smart card and biometric authentication products, and substantially all of the assets of Transindigo, a privately held company that developed real time Web access management software products, for an aggregate of $23.8 million in cash including acquisition costs and litigation expenses. In February 2001, we acquired all of the capital stock of Xcert, a privately held company that developed digital certificate-based products for securing e-business transactions, for $69.7 million in cash, including acquisition costs, plus the assumption of all Xcert stock options.

25

Table of Contents

Allocation of the purchase prices for all four acquisitions completed during 2001 were based on estimates of the fair value of the assets acquired and liabilities assumed based on independent appraisals. These allocations were as follows: