Back to GetFilings.com

Table of Contents

UNITED STATES
SECURITIES AND EXCHANGE COMMISSION

Form 10-K

FOR ANNUAL AND TRANSITION REPORTS PURSUANT TO SECTIONS 13 OR
15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

FOR THE FISCAL YEAR ENDED DECEMBER 31, 2003

OR

Commission File No. 000-25120

RSA Security Inc.

174 Middlesex Turnpike
Bedford, Massachusetts 01730
(Address of Principal Executive Offices)

Registrant’s telephone number, including area code: (781) 515-5000

Securities Registered Pursuant to Section 12(b) of the Act: None

Securities Registered Pursuant to Section 12(g) of the Act:
Common Stock, $.01 Par Value
Common Stock Purchase Rights
(Title of class)

Table of Contents

Indicate by check mark whether the registrant: (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes [X] No [  ]

Indicate by check mark if disclosure of delinquent filers pursuant to Item 405 of Regulation S-K is not contained herein, and will not be contained, to the best of the registrant’s knowledge, in definitive proxy or information statements incorporated by reference in Part III of this Form 10-K or any amendment to this Form 10-K. [  ]

Indicate by check mark whether the registrant is an accelerated filer (as defined in Exchange Act Rule 12b-2). Yes [X] No [  ]

As of February 23, 2004, the approximate aggregate market value of the common stock held by non-affiliates of the registrant was $979,539,894 based on the last reported sale price of the registrant’s common stock on The NASDAQ National Market as of the close of business on that date. There were 61,405,366 shares of common stock outstanding as of February 23, 2004.

As of June 30, 2003, the approximate aggregate market value of the common stock held by non-affiliates of the registrant was $623,321,300 based on the last reported sale price of the registrant’s common stock on The NASDAQ National Market as of the close of business on that date.

DOCUMENTS INCORPORATED BY REFERENCE

We make statements in this Report that are forward looking, that is, statements that are not historical facts but convey projections about the future. For example, statements containing the words “believes,” “anticipates,” “plans,” “expects,” “estimates,” “intends,” “may,” “projects,” “will,” “would,” and similar expressions may be forward-looking statements. However, we caution investors not to place undue reliance on any forward-looking statements in this Report because these statements speak only as of the date when made. We undertake no obligation to publicly update any forward-looking statements, whether as a result of new information, future events or otherwise. There are a number of factors that could cause our actual results to differ materially from those indicated by these forward-looking statements, including without limitation, the factors set forth in this report under the caption “Certain Factors That May Affect Future Results.”

RSA Security, RSA, Keon, ClearTrust, SecurID, BSAFE, ACE/Server, RC2, RC4, RC5, The Most Trusted Name in e-Security and RSA Secured are either registered trademarks or trademarks of RSA Security Inc. in the United States and/or other countries. All other trademarks or trade names referred to in this Report are the property of their respective owners.

2

Table of Contents

PART I

ITEM 1.  BUSINESS

COMPANY OVERVIEW

With more than 13,000 customers around the globe, RSA Security Inc. and its consolidated subsidiaries help organizations protect their information and manage the identities of the people and applications accessing and exchanging that information. Built to work seamlessly in complex environments, our portfolio of e-security solutions – including Identity and Access Management, Secure Mobile and Remote Access, Secure Enterprise Access and Secure Transactions – is designed to inspire customers to confidently realize new technologies and exploit the full power of the Internet.

We maintain a website at www.rsasecurity.com. We are not including the information contained in our website as part of this Report, nor are we incorporating the information on our website into this Report by this reference. As soon as reasonably practicable after we electronically file them with or furnish them to the Securities and Exchange Commission, we make available through our website, free of charge, our annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K and amendments to these reports.

COMPANY HISTORY

Since our inception in 1986 as Security Dynamics Technologies, Inc., we have focused on the fundamental need for user identification and authentication, with an initial emphasis on solutions for secure remote access to enterprise networks (RSA SecurID^® technology). In July 1996, to further our strategy and extend our product line, we acquired RSA Data Security, Inc., a privately held company that developed and delivered cryptographic solutions that address the need for data privacy and integrity (RSA BSAFE^® technology).

In January 1999, we introduced the RSA Keon^® product line, a family of public key infrastructure products designed to provide organizations with application security and flexible electronic commerce solutions. In September 1999, we introduced the next-generation, standards-based implementation of the RSA Keon solution and changed our name from Security Dynamics Technologies, Inc. to RSA Security Inc.

In September 2001, we introduced RSA ClearTrust^® Web access management solutions, which we obtained through our purchase of Securant Technologies, Inc.

Throughout our history, we have made a number of corporate acquisitions, in addition to the RSA Data Security and Securant acquisitions described above. Xcert International’s Sentry CA line of products became part of our RSA Keon digital certificate management product family following our February 2001 acquisition of Xcert International, Inc., a privately held company that developed and delivered digital certificate-based products for securing e-business transactions. We introduced a new smart card authentication solution called RSA SecurID Passage, which is part of our authentication product line, as a result of our May 2001 acquisition of 3-G International, Inc., a privately held company that developed and delivered smart card and biometric authentication products.

BACKGROUND

We believe that more and more businesses and government entities are finding that they need to exchange electronic information both internally, among their employees and departments, and externally, with their customers, vendors, business partners, suppliers and others. We have observed an increase in requirements for access to electronic information, characterized by a growing number and type of users, applications, transactions and access methods. Extending information access both inside and outside the organization’s walls – to customers, partners and remote and mobile workers – has become critical to many organizations. This has, in turn, driven advances in technology, resulting in improvements in the speed of exchange and ease of access to information. Some of these technology advancements include faster networks as well as intranets, extranets, portals, wireless access, and VPNs facilitating productive anytime, anywhere access to critical resources.

Increased access to critical information can lead to greater risk of exposure of that information to unauthorized users. Information can be intercepted by hackers, cyber-terrorists, identity thieves, disgruntled employees and even competitors. Losses that result from any serious breach can include large direct and indirect costs, a loss of confidence in the enterprise and regulatory fines. As a result, many organizations have traditionally viewed security as a necessary expense. However, we believe that many organizations are now beginning to see security as a strategic imperative.

3

Table of Contents

Many e-security technologies have emerged to address the information access challenges that organizations face. Some organizations need authentication solutions to help positively identify users (from within as well as outside the enterprise) before granting access to critical applications and resources. Others require comprehensive identity management solutions to help manage user identities, user lifecycles and their access privileges. RSA Security believes that as information access continues to expand in complexity, these distinct e-security requirements will merge to address the larger need for integrated identity and access management.

THE RSA SECURITY STRATEGY

Secure Information Access

Our portfolio of solutions, including Identity and Access Management, Secure Mobile and Remote Access, Secure Enterprise Access and Secure Transactions, is designed to help organizations realize the benefits of e-business, while helping to protect critical resources and applications from unauthorized access and other forms of electronic malice.

Lead e-Security

With over one billion RSA Security-enabled software units shipped, we are a trusted, experienced partner to our customers. We participate actively in the development of industry standards, such as the Liberty Alliance Project, Security Assertion Markup Language (SAML), OASIS and Public Key Cryptography Standards (PKCS). Our efforts are designed to ensure that our current and prospective customers get the right solution for their heterogeneous computing environments and growing business.

Provide Seamless Solutions

We have strategic partnerships with industry-leading companies, including global integrators like Accenture and platform vendors such as Microsoft and Cisco Systems. The RSA Secured^® technology partner program, a key part of this initiative, focuses on product integration and interoperability certification activities, as well as joint support strategies for our mutual customers. Our RSA BSAFE developer solutions are engineered to enable developers to quickly and effectively integrate encryption, protocols and electronic signatures into their applications. Our current products support a number of standards, including PKCS, RADIUS and OASIS SAML 1.0 specification.

THE RSA SECURITY SOLUTION: SECURE INFORMATION EXCHANGE AND IDENTITY MANAGEMENT

Our authentication, identity management and encryption solutions, coupled with professional services and third-party strategic partnerships, are designed to help businesses and government entities securely put critical information into the hands of the people who need it, while protecting it against unauthorized access.

Secure Mobile and Remote Access

Organizations need to secure access to the network from outside the firewall, including from a remote or branch office, partner or customer site, and mobile workforce. To address this challenge, we offer a broad range of authentication options:

	•		RSA SecurID® hardware and software authenticators and RSA ACE/Server software are more secure alternatives to passwords, providing ease of use and the added protection of two-factor authentication.
	•		RSA® Mobile software, which can be used in both enterprise and consumer applications, generates a one-time passcode that is immediately sent to the user’s cell phone or PDA for authentication to protected resources.

Identity and Access Management

We provide identity management capabilities through our RSA ClearTrust^® solution – including access management, authentication, provisioning and user management.

	•		RSA ClearTrust web access management solution is designed to facilitate secure single sign-on (SSO), while protecting access to mission-critical web-based applications and resources through the management of user identities and their access rights.
	•		We work with technology partners to address customer requirements for provisioning across the enterprise. We recently entered into a reseller agreement with Thor Technologies, which permits us to bundle with our RSA ClearTrust product and resell separately Thor’s Xcellerate provisioning software.

Secure Enterprise Access

In order to help organizations effectively manage and control secure access to business-critical information resources within the enterprise, we offer the following solutions:

4

Table of Contents

	•		RSA SecurID® Smart Card and USB solutions are designed to allow an organization to store credentials and combine multiple security functions – such as employee badging, building access and network access – on one portable device.
	•		RSA Keon® Certificate Management solutions enable an organization to issue, validate and manage credentials that are based on x.509 digital certificates.

Secure Transactions

In order to ensure secure transactions, organizations need reliable, trusted, cross-platform technology that verifies: who or where the business data and logic are coming from; who or where it is going to; and that it is protected along the way. We address the need for secure transactions through the following offerings:

	•		RSA BSAFE® encryption and digital signing software is engineered to provide security, performance and support for industry standards. The RSA BSAFE line of software development kits (SDKs) provides components to secure e-business applications, enterprise software, mobile phones, pocket PCs, PDAs, Web browsers, complex networking equipment, and cable TV boxes.
	•		RSA Keon® Certificate Management solutions help enable an organization to issue, validate and manage credentials that are based on x.509 digital certificates.

Path to the Future

We offer our customers a migration path to a system that will be designed to address all of the core requirements outlined above with a single platform:

•

We are working on a new identity and access management architecture, codenamed “NEXUS,” that will be designed to integrate our solutions into a single common administrative and system services platform and to deliver common administration and integration across our products.

STRATEGIC PARTNERS

Through the RSA Secured^® partner program, RSA Security works with leading platform, network and application vendors to ensure that many widely used infrastructure products and applications interoperate with our authentication and identity management solutions. Partners in our RSA Secured SecurID-Ready, Keon-Ready and ClearTrust-Ready programs participate in a rigorous testing and certification process and are periodically required to re-certify their offerings. RSA Secured products include directories and databases, provisioning solutions, enterprise applications, platforms, portals, and web servers. Collectively, through all of the RSA Secured partner programs, we have relationships with leading vendors, representing more than 1,000 products that incorporate our technologies or are interoperable with our products.

In addition, we collaborate with business integration partners in order to assist customers in identifying opportunities where secure information access and identity management can help to achieve strategic business goals. Our partners bring experience to the task of developing, integrating and deploying solutions for complex enterprise business and technology environments. In providing complete lifecycle solutions, from planning and architecture design to deployment, project management and ongoing support, we offer integration expertise gained from thousands of customer implementations.

SALES AND MARKETING

We have established a multi-channel distribution and sales network to serve the e-security market. We sell and license our products directly to end users through our worldwide sales force and through our RSA SecurWorld™ network of original equipment manufacturers, or OEMs, value-added resellers, or VARs, and distributors. In addition, we support our sales efforts through strategic marketing relationships with other vendors. We are currently in the process of changing our sales force strategy to dedicate a portion of our direct sales force to selling our emerging products, such as our RSA ClearTrust and RSA Keon products. For our more mature products, such as our RSA SecurID and RSA ACE/Server products, our strategy is to sell these products primarily through our RSA SecurWorld network of OEMs, VARs and distributors.

In support of our sales efforts, we conduct sales training courses and targeted marketing programs, including direct mail, advertising, seminars, trade shows, interactive marketing, telemarketing and ongoing customer and third-party communications programs. We also seek to stimulate interest in e-security through our public relations program, speaking engagements, white papers, technical notes and other publications, as well as the RSA Conferences held around the world.

5

Table of Contents

To enhance demand for our products, we have participated in the development of various industry-specific protocols that incorporate or complement our security technologies. We also host the industry’s largest annual security conference, the RSA Conference, and participate in other conferences to increase awareness, education and demand for our products.

CUSTOMERS

We have a broad customer base, and no one end user customer accounted for more than 5% of our total revenue in 2003, 2002 or 2001. However, one of our resellers, Tech Data Corporation, accounted for approximately 10% of our total revenue in 2003. During 2003, we sold our products to an average of approximately 4,300 customers per quarter, including both new customers and existing customers to whom we had sold in previous periods. In addition, we increased our customer base during 2003 by 30% to end the year with approximately 13,800 customers.

We sell our products to customers in a number of different vertical markets. We have analyzed approximately 85% of our revenue for the years ended December 31, 2003 and 2002 and determined that the percentage of the analyzed revenue represented by sales to each of our major vertical markets is as follows:

As of December 31, 2003, we have sold more than 16 million RSA SecurID authenticators and licensed our software to thousands of customers worldwide, including approximately 88% of the Fortune 100 and approximately 66% of the Fortune 500. Historically, our customers have sought to secure highly confidential information and have been sophisticated and knowledgeable purchasers of e-security systems.

MAINTENANCE, SUPPORT AND PROFESSIONAL SERVICES

We maintain a customer support help desk, technical support organization and professional services group at our headquarters in Bedford, Massachusetts, and at other locations throughout the world. We offer telephone and Web support for many of our products 24 hours a day, seven days a week. We also have field technical support personnel who work directly with our sales force, distributors and customers. We believe that the quality and the 24 hour, 7 days a week availability of our maintenance and support organization give us a competitive advantage over other companies in our industry.

Our standard practice is to provide a warranty on all RSA SecurID hardware authenticators for the programmed life of the authenticator (generally two to five years) and to replace any defective authenticators (other than authenticators damaged by a user’s abuse or alteration) free of charge. We generally sell each of our other products to customers with a warranty for product defects for specified periods, generally ninety days.

Customers may elect to purchase a maintenance contract, renewable annually or for multiple years. Under these contracts, we agree to provide corrections for identified program errors for supported versions of our software products, version upgrades for both software and, if applicable, firmware, telephone consultation, and Web-based access to solutions, patches and documentation.

Our professional services group helps organizations plan and implement secure e-business solutions. Through this group, we provide our customers with project management, architecture and design, physical deployment, custom development, education and practitioner certification services. Customers typically pay for professional services either at a fixed price or at an hourly or daily rate for the time it takes us to complete the project.

6

Table of Contents

PRODUCT DEVELOPMENT

Our product development efforts are focused on enhancing the functionality, reliability, performance and flexibility of our existing products, as well as developing new products with features and functionality that our current products do not possess. We are developing architectures and technologies to enhance the administrative capabilities and scalability of our RSA ACE/Server, RSA ClearTrust and RSA Keon products and to increase interoperability with additional network operating systems, applications and directory services. We are also developing tools to assist customers, strategic partners and other third-party integrators to integrate our products with custom and other third-party network or system applications.

We continue to work on developing standards-based protocols and solutions that address the needs of specific market segments and build on our RSA BSAFE technology.

In addition to enhancing our existing products, we continue to identify and prioritize various technologies for potential future product offerings. We may develop these products internally or enter into arrangements to license or acquire products or technologies from third parties.

Our product development staff, which works in five development centers worldwide, engages in software and hardware engineering, testing and quality assurance, and technical documentation. We also engage outside contractors where appropriate to supplement our in-house expertise or expedite projects based on customer or market demand. Research and development expenses were $53.6 million, $55.1 million and $66.2 million for 2003, 2002 and 2001, respectively. Our research and development expenses for 2001 include in process research and development expense of $7.9 million, which we wrote off in connection with our acquisitions of Securant, Xcert, 3GI and Transindigo.

MANUFACTURING AND SUPPLIERS

We assemble, program and distribute our products from two locations, Bedford, Massachusetts, and Shannon, Ireland. We distribute to our customers in the Americas and the People’s Republic of China from our facilities in Bedford, Massachusetts, and we distribute to our customers in other parts of the world from our facilities in Shannon, Ireland.

We distribute our software products electronically or on standard magnetic diskettes, compact disks and tapes together with documentation, which are available from many suppliers. We conduct nearly all of our media duplication in-house.

We contract for the manufacture of RSA SecurID^® authenticators with Flextronics, a global electronic manufacturing services supplier, utilizing the supplier’s plant in China. Flextronics contracts with other suppliers for the manufacture of various components, such as the batteries and microcontrollers in the authenticators.

Some components of our hardware authenticators are currently available only from limited sources. For example, Sanyo Electric Co., Ltd. is our only supplier for the microcontroller chips contained in our RSA SecurID products, Flextronics is our only manufacturer for RSA SecurID authenticators, and Schlumberger is our only manufacturer of smart cards. If we were unable to obtain a sufficient supply of these or any other components or RSA SecurID authenticators, then we might be unable to fill customer orders and might have to expend significant resources to find new suppliers or manufacturers. As a result, we attempt to maintain a three-month supply in inventory. We believe that it could take approximately six months to identify and commence production of suitable replacements for the microcontroller chip used in RSA SecurID authenticators.

We monitor warranty claims and address defects through our quality and design processes, which are managed by our product engineering, quality control and technical support organizations. During 2002 and 2003 our quarterly analysis of historical failure and defective return rates indicated that certain authenticators produced between 2000 and 2002 were subject to higher defect and failure rates. During the last several years, we have increased resources and initiated new programs to build an expanded family of high performance authentication solutions. These programs have resulted in the redesign and re-engineering of authenticator products to improve performance and reliability by incorporating new microprocessors, electronics, firmware and batteries with longer life. We will continue to monitor warranty claims and reevaluate our estimate of warranty and defective return obligations in future periods.

COMPETITION

The market for e-security products is competitive and subject to rapid change. We currently experience direct and indirect competition from a number of sources, including:

•

software operating systems suppliers and application software vendors that offer e-security products or features, either as stand-alone products or incorporated into their operating systems or applications;

7

Table of Contents

	•		vendors of hardware authenticators and smart cards competitive with RSA SecurID products;
	•		biometric security device vendors;
	•		vendors of Web access management solutions;
	•		public key infrastructure (PKI) and cryptographic software firms;
	•		application access providers; and
	•		“freeware,” i.e., free or low-cost, unpatented e-security technology.

We believe that the principal competitive factors affecting the market for e-security products include technical features, ease of use, interoperability, quality and reliability, level of security, pricing, customer service and support and distribution channels. We believe that we and our products compare favorably to our competitors and their products with respect to each of these factors.

PROPRIETARY RIGHTS

We rely on a combination of patent, trade secret, copyright and trademark laws, software licenses, nondisclosure agreements and technical measures to protect our proprietary technology. We also generally enter into nondisclosure and assignment of inventions agreements with our employees and confidentiality and/or license agreements with our distributors, strategic partners and customers and potential customers, and we limit access to and distribution of our software, documentation and other proprietary information.

Our 33 issued U.S. patents expire at various dates ranging from 2005 to 2018. Our 46 foreign patents expire at various dates between 2005 and 2020. We have also filed patent applications on inventions embodied in new technologies that we developed and on inventions that may be useful in the field of e-security. There can be no assurance that any of these applications will result in an issued patent.

We have registered, or are seeking to register, our trademarks and service marks in most countries where we are selling our products. We may also seek to purchase or license trademarks from third parties, but there can be no assurance that we will be able to purchase or license trademarks on commercially favorable terms or at all.

GOVERNMENT REGULATION AND EXPORT CONTROLS

All of our products are subject to U.S. export control laws and applicable foreign government import, export and/or use requirements. Minimal U.S. export restrictions apply to all products, whether or not they perform encryption functions.

The Export Administration Regulations of the U.S. Department of Commerce regulate the export of most commercial products with encryption features. Under these regulations, encryption products of any key length, including general purpose encryption toolkits such as our RSA BSAFE products, may be exported, after a one-time technical review, to non-governmental end-users and many governmental end-users around the world, except for embargoed countries and specific prohibited end-users. For some governmental end-users, we are also required to obtain special Encryption Licensing Arrangements or individual export licenses that may be issued at the discretion of the Department of Commerce.

We believe that we have completed the necessary technical reviews of the products and services we currently export, but new products that we acquire or develop may require technical review before we can export them. For the export of some of our products, we are subject to various post-shipment reporting requirements. However, the export regulations may be modified at any time. In light of the ongoing discussions regarding anti-terrorism legislation in the United States Congress, there may be an increased risk that export regulations may be modified in the future. Modifications to the export regulations could reduce or eliminate our ability to export some or all of our products from the United States without a license in the future, which could put us at a disadvantage in competing for international sales compared to companies located outside of the United States that would not be subject to these restrictions.

BACKLOG

We consider backlog to be orders for products or services evidenced by an executed contract which have not been fulfilled as of the end of a fiscal period. Backlog from sale of products and services was $15.7 million at December 31, 2003 and $5.9 million at December 31, 2002. We believe that all backlog orders at December 31, 2003 will be fulfilled during 2004.

EMPLOYEES

At January 31, 2004, we employed 1,049 employees. Of these employees, approximately 392 were involved in sales and marketing, 327 were involved in research and development, 122 in professional services, customer service and support, 99 in administrative,

8

Table of Contents

human resources and finance, 57 in information technology, and 52 in production. None of our employees are covered by collective bargaining agreements. We believe that our relationships with our employees are good.

We believe our compensation plans are competitive with other companies in our industry. We pay our worldwide sales force a base annual salary plus compensation based upon achievement of sales quotas. All employees are paid a base annual salary plus compensation based upon achievement of revenue and earnings targets.

Information on our e-Security Solutions segment and geographical areas may be found in Note 13 of the Notes to Consolidated Financial Statements.

ITEM 2. PROPERTIES

Our principal administrative, sales and marketing, research and development and support headquarter facilities aggregate approximately 328,000 square feet of office space and are located in Bedford, Massachusetts, under non-cancelable fifteen year leases expiring in December 2017. Our former headquarter facilities aggregate approximately 203,000 square feet of office space and are located in Bedford, Massachusetts, under non-cancelable ten year leases expiring in 2009. We lease approximately 58,000 square feet of office space for research and development and sales and marketing in San Mateo, California, under non-cancelable ten-year leases expiring in 2008, and administration and manufacturing facilities in Shannon, Ireland, aggregating approximately 18,750 square feet, which serves as our distribution center for international sales. We also lease facilities for administration, field sales, research and development and customer support throughout the United States, Canada, Asia, Australia and Europe. In addition, we own an approximately 31,000 square foot office building in Bracknell, United Kingdom, which is used for our United Kingdom and European operations.

We are actively looking to sublease our former headquarters and other excess facilities that aggregate approximately 190,000 square feet of office space. During 2002 and 2001, we recorded restructuring charges including approximately $53.7 million representing lease payments due under excess facilities lease agreements, net of estimated sublease income, impaired leasehold improvements and furniture and fixtures, and other associated facilities expense. Based upon current economic and real estate market conditions, we expect to be able to enter into sublease agreements for substantially all of our excess facilities within the next two years. We have existing sublet agreements with third parties for approximately 180,000 square feet of our excess facilities at various locations, which expire at various times through June 2009.

ITEM 3. LEGAL PROCEEDINGS

On or about February 2, 2001, Leon Stambler filed a complaint for patent infringement in U.S. District Court for the District of Delaware against RSA Security, VeriSign, Inc., First Data Corporation, Openwave Systems Inc., and Omnisky Corporation, Case Number 01-0065. In his complaint, Mr. Stambler alleged that certain products marketed by each of the defendants infringed various patents that he owns, and he sought unspecified damages as well as a preliminary and permanent injunction enjoining the defendants from infringing the claims asserted. The trial took place in March 2003, and the jury determined that our products did not infringe Mr. Stambler’s patents. On April 17, 2003, the court entered final judgment in our favor on all claims of non-infringement. In May 2003, Mr. Stambler filed a motion asking the court to set aside the jury’s verdict, and in November 2003, the court denied Mr. Stambler’s motion. On or about December 8, 2003, Mr. Stambler filed a notice of appeal to the United States Court of Appeals. We plan to vigorously defend the appeal. We believe that the final disposition of this matter will not have a material adverse effect on our continuing operations and consolidated financial position.

On or about December 20, 2001, France Telecom and Telediffusion de France (“FT”) filed a Request for Arbitration with the International Court of Arbitration. FT claims that we breached a license agreement with FT and sought unspecified damages, including a payment in excess of $110.0 million plus the legal fees and other costs associated with the arbitration. The arbitration took place in June 2003, and we expect the arbitrator to make a final, binding decision in the first half of 2004. We believe that FT’s claims are without merit. In a related matter, FT has also filed a patent infringement suit in Delaware against Novell, Inc., one of our licensees. In August 2002, we signed a letter agreement with Novell agreeing that if a court requires Novell to pay FT damages, we will reimburse Novell for 50% of the damages, up to a maximum payment of $2.5 million by us. If the damages payable by Novell exceed $5.0 million, then the indemnification provisions of our license agreement with Novell will govern our indemnification obligations. Although we believe that FT’s claims against Novell are without merit, we cannot predict the ultimate outcome of this matter. However, we believe that neither the disposition of our arbitration with FT nor the disposition of the litigation between Novell and FT will have a material adverse effect on our continuing operations and consolidated financial position.

From time to time, we have been named as a defendant in other legal actions arising from our normal business activities, which we believe will not have a material adverse effect on us or our business.

9

Table of Contents

ITEM 4. SUBMISSION OF MATTERS TO A VOTE OF SECURITY HOLDERS

None.

10

Table of Contents

PART II

ITEM 5. MARKET FOR OUR COMMON EQUITY AND RELATED STOCKHOLDER MATTERS

Our common stock has been trading on The NASDAQ National Market under the symbol “RSAS” (formerly “SDTI”) since our initial public offering on December 14, 1994. The following table indicates the high and low sales prices per share of our common stock for each of our fiscal quarters during the last two completed fiscal years, as reported on The NASDAQ National Market.

There were 454 stockholders of record of our common stock as of February 23, 2004. We estimate that we have a total of approximately 68,000 stockholders, including stockholders who hold their shares in “street name.”

We have never declared or paid any cash dividends on our capital stock. We currently intend to retain earnings, if any, to support our growth strategy and do not anticipate paying cash dividends in the foreseeable future. Payment of future dividends, if any, will be at the discretion of our Board of Directors after taking into account various factors, including our financial condition, operating results, current and anticipated cash needs and plans for expansion. In addition, until all of the 7% convertible subordinated debentures that we issued in October and November 2001 have been converted or redeemed, we may not declare or pay cash dividends on our capital stock unless we have the prior consent of the holders of at least 60% of the outstanding principal amount of the debentures.

11

Table of Contents

ITEM 6. SELECTED FINANCIAL DATA

(in thousands, except per share data)

(1)  Total cost of revenue, gross profit and total operating expenses reflect the reclassification of amortization of technology related intangible assets from operating expense to cost of revenue of $6,587 and $3,281 for the years ended December 31, 2002 and 2001,

12

Table of Contents

respectively, and also reflect the reclassification of impairment of technology related intangible assets of $14,333 from operating to cost of revenue expense for the year ended December 31, 2002.

(2)  Per share and share amounts have been adjusted to reflect the three-for-two stock split effected as a dividend in March 2001.

13

Table of Contents

ITEM 7. MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS OF OPERATIONS

We make statements in this Report that are forward looking, that is, statements that are not historical facts but that convey projections about the future. For example, statements containing the words “believes,” “anticipates,” “plans,” “expects,” “estimates,” “intends,” “may,” “projects,” “will,” “would,” and similar expressions may be forward-looking statements. However, we caution investors not to place undue reliance on any forward-looking statements in this Report because these statements speak only as of the date when made. Furthermore, we are not obligated to publicly update any forward-looking statements, whether as a result of new information, future events or otherwise. There are a number of factors that could cause our actual results to differ materially from those indicated by these forward-looking statements, including without limitation the factors described below under the caption “Certain Factors That May Affect Future Results.”

Overview

RSA Security Inc. helps organizations protect their information and manage identities of the people and applications accessing and exchanging information. With thousands of customers around the globe, we provide interoperable solutions for establishing online identities, access rights and privileges for people, applications and devices. We sell our two-factor user authentication, certificate processing, Web access management and encryption products and solutions to corporate enterprise users seeking turnkey security solutions, and to original equipment manufacturers, developers and corporate enterprise users seeking software development components for embedding security in a range of software applications or hardware devices.

We derive our operating revenue primarily from two distinct product groups: Enterprise solutions, which includes RSA SecurID^® authenticators, RSA ACE/Server^® software, RSA ClearTrust^® software, RSA Keon^® software, and maintenance and professional services associated with those products; and Developer solutions, which includes RSA BSAFE^® encryption software and protocol products, RSA Keon components, and maintenance and professional services associated with those products.

We believe sales of our products will be driven by the trend of enterprises permitting remote access to internal resources and Web-enabling of existing applications. Sales of our RSA SecurID authenticator products continue to generate substantial revenue for us, while our less mature Enterprise software products are building revenue and market share. We believe the decrease in the number of technology companies funding development and the availability of free, “open source” products that compete with our RSA BSAFE product line continue to put pressure on our Developer solutions revenue. We believe our product line synergies and strength of our customer base create opportunities to sell additional products to existing customers. However, information technology budgets remain constrained, which has had and could continue to have a direct effect on the sale of our products.

Our Enterprise solutions customers typically place an initial order for a limited number of users, for either our RSA SecurID authenticators or any of our software products, and deploy additional authenticators or software licenses as their need for our products within their enterprise increases. Authenticators have a programmed life of two to five years, and as they expire, our customers typically place additional orders for replacement authenticators. We typically base our RSA ACE/Server, RSA Keon and RSA ClearTrust software license fees on the number of users authorized under each customer’s license. In most cases, customers will also enter into an annual customer support agreement for their software license at the time of initial purchase and renew this support agreement annually. Our support agreement entitles our customers to license software upgrades and telephone support.

Our Developer solutions software licensing terms vary by product and customer. Typical licensing terms may include an initial prepaid license fee and ongoing royalties paid as a percentage of the developer’s product or service revenue, or payment of annual license fees, or a single fully paid-up license fee. Often, our existing developer customers go on to license new software or technology from us or wish to increase the field of use rights for the technology they have already licensed. In such a case, we amend our license agreement with the customer and charge additional licensing fees, thus deriving additional revenue.

Our professional services group provides customers with project management, architecture and design, physical deployment, custom development, education and practitioner certification services. Customers typically pay for professional services either at a fixed price or at hourly or daily rates for the time it takes us to complete the project.

We have contracted with outside manufacturing organizations to produce our RSA SecurID authenticators, and some of our products contain technology that is licensed from third parties. Our cost of revenue consists primarily of costs associated with the manufacture and delivery of RSA SecurID authenticators and royalty fees that we pay for the licensed technology. Cost of revenue also includes warranty obligation expense and labor and overhead costs associated with professional services, customer support, and production activities. Production costs include the programming labor, shipping, inspection and quality control functions associated with the

14

Table of Contents

RSA SecurID authenticators. We are currently working to establish new supplier relationships in order to increase the number of vendors from which we buy our authenticators and authenticator components, in order to reduce our vulnerability to potential supply problems.

We distribute our products through direct sales to end user customers, and through indirect sales, including sales to resellers and distributors that we ship directly to the end user customer and sales to distributors for stocking purposes. For the year ended December 31, 2003, approximately 51% of our revenue was from sales to distributors shipped directly to the end user and resellers, approximately 41% of our revenue was from direct sales to end user customers, and approximately 8% of our revenue was from sales to stocking distributors. Our stocking distributors provide us with inventory level and point of sale reports on a monthly basis. Based upon these reports, we estimate that our stocking distributors typically hold approximately four weeks of inventory on hand in the distribution channel.

Our direct sales to our customers in countries outside of the United States are denominated in U.S. dollars and local currency, with the majority of our sales denominated in U.S. dollars. Our sales through indirect distribution channels are generally denominated in U.S. dollars. For countries outside the United States, we generally pay our operating expenses in local currency. Where we do invoice customers in local currency, we are exposed to foreign exchange rate fluctuations from the time of invoice until collection occurs. We are also exposed to foreign currency fluctuations between the time we collect in U.S. dollars and the time we pay our operating expenses in local currency. Fluctuations in currency exchange rates could affect the profitability and cash flows in U.S. dollars of our products sold in international markets.

Prior to January 1, 2003, we reported two segments, e-Security Solutions and RSA Capital. We have modified our segment disclosure to reflect the divestiture of substantially all of our investments held in RSA Capital and the reduction of resources allocated to RSA Capital. Accordingly, we began reporting one segment, the e-Security Solutions segment, after January 1, 2003. We have revised our segment disclosure to conform to the current period presentation. Information on our segment may be found in Note 13 of the Notes to Consolidated Financial Statements.

Application of Critical Accounting Policies and Estimates

The discussion and analysis of our financial condition and results of operations are based on our consolidated financial statements, which have been prepared in accordance with accounting principles generally accepted in the United States of America. The preparation of these consolidated financial statements requires management to make estimates and assumptions that affect the reported amounts of assets and liabilities and disclosure of contingent assets and liabilities at the date of the consolidated financial statements and the reported amounts of revenue and expense during the reporting period. On an ongoing basis, we evaluate our estimates, including those related to revenue recognition, sales returns, allowance for doubtful accounts, intangible assets, income taxes, financing operations, warranty obligations, restructurings, contingencies and litigation. We base our estimates on historical experience and on various other assumptions that we believe are reasonable under the circumstances. However, our actual results could differ from those estimates.

We believe the following critical accounting policies affect our significant estimates and assumptions used in the preparation of our consolidated financial statements.

Revenue Recognition – We derive our revenue primarily from two sources: sales of products, including hardware and software licenses, and services, including maintenance, support and professional services. Our management must make and use judgments and estimates in connection with the revenue recognized in any reporting period. We recognize revenue from the sale of products when persuasive evidence of an arrangement exists, delivery has occurred, the fee is fixed or determinable, and collection is considered probable. We reduce revenue by provisions for estimated sales returns. The amount and timing of our revenue for any period may materially differ if our management made different judgments or utilized different estimates in establishing our allowance for sales returns. An increase in our allowance for sales returns would reduce our revenue in the period for which the increase is recorded.

For all sales, we use a binding contract, purchase order or another form of documented agreement as evidence of an arrangement with the customer. Sales to our distributors are evidenced by a master agreement governing the relationship, together with binding purchase orders on a transaction-by-transaction basis. We consider delivery to occur when we ship the product, so long as title and risk of loss have passed to the customer.

At the time of a transaction, we assess whether the sale amount is fixed or determinable based upon the terms of the documented agreement. If we determine the fee is not fixed or determinable, we recognize revenue when the fee is fixed. We assess if collection is probable based on a number of factors, including past transaction history with the customer and the creditworthiness of the customer.

15

Table of Contents

If we determine that collection is not probable, we do not record revenue until such time as collection becomes probable, which is generally upon the receipt of cash.

We do not generally include acceptance provisions in arrangements with customers; however, if an arrangement includes an acceptance provision, we recognize revenue upon the customer’s acceptance of the product, which occurs upon the earlier of receipt of a written customer acceptance or expiration of the acceptance period.

In accordance with Statement of Financial Accounting Standards (“SFAS”) No. 48, “Revenue Recognition when Right of Return Exists,” we recognize revenue upon shipment of product to stocking distributors who have only limited return rights, and record a sales return reserve to provide for estimated product returns. We estimate product returns from distributors based upon historical experience.

When arrangements contain multiple elements and vendor specific objective evidence (“VSOE”) of fair value exists for all undelivered elements, we recognize revenue for the delivered elements using the residual method. We base our determination of VSOE of fair value of each of the undelivered elements in multi-element arrangements on either the price we charge when the same element is sold separately or the price established by the members of our management, who have the relevant authority to set prices, for an element not yet sold separately. For arrangements containing multiple elements where VSOE of fair value does not exist for all undelivered elements, we defer revenue for the delivered and undelivered elements until VSOE of fair value exists or all elements have been delivered.

We defer maintenance service revenue, whether sold separately or as part of a multiple element arrangement, and recognize it ratably over the term of the maintenance contract, generally twelve months.

We recognize revenue allocated to professional service elements as the services are performed. When the customization is essential to the functionality of the licensed software, then both the software license and professional services revenue are recognized under the percentage of completion method, which requires revenue to be recognized as a percentage of the project completed. We recognize revenue and gross profit using labor hours as an input measure of progress to completion on these arrangements.

Allowance for Sales Returns – We record allowances for estimated sales returns and allowances on products and maintenance and professional service related revenue in the same period as the related revenue is recorded. We base these estimates on historical sales returns, analysis of credit memo data, current economic trends, product line and customer industry data and other known factors. Our historical experience with sales returns varies by product line depending on the customer, industry and market. We must make judgments and estimates in connection with establishing the allowances for estimated sales returns in any reporting period. The amount and timing of our revenue for any reporting period may materially differ if actual sales returns and allowances differ from our estimates.

Allowance for Doubtful Accounts – We maintain allowances for doubtful accounts for estimated losses resulting from the inability of our customers to make required payments. We analyze accounts receivable and the composition of the accounts receivable aging, historical bad debts, and current economic trends, regional factors and other known factors when evaluating the adequacy of the allowance for doubtful accounts. Based upon the analysis and estimates of the uncollectibility of our accounts receivable, we record an increase in the allowance for doubtful accounts when the prospect of collecting a specific account receivable becomes doubtful. Actual results could differ from the allowances for doubtful accounts recorded, and this difference may have a material effect on our financial position and results of operations. We record recoveries of accounts previously written off as uncollectible as increases to the allowance for doubtful accounts.

Allowance for Warranty Obligations – Our standard practice is to provide a warranty on all RSA SecurID hardware authenticators for the customer selected programmed life of the authenticator (generally two to five years) and to replace any defective authenticators (other than authenticators damaged by a user’s abuse or alteration) free of charge. We sell our other products to customers with a warranty for product defects for a specified period, generally ninety days. We provide reserves for warranty obligations based on historical failure and defective return rates, and include these costs as a component of product cost of revenue. We reevaluate the estimate of warranty and defective return obligations, including the assumptions about estimated failure and return rates, each quarter.

During 2002 and 2003, our analysis of historical failure and defective return rates indicated that certain authenticators produced between 2000 and 2002 were subject to higher defect and failure rates than we had previously experienced. Accordingly, we increased our provisions for warranty obligations by $4.6 million and $2.8 million for the years ended December 31, 2003 and 2002, respectively. We will continue to monitor warranty claims and reevaluate our estimate of warranty and defective return obligations in future periods, which may result in our recording additional warranty expense. Actual warranty returns could differ from the allowance for warranty obligations recorded.

16

Table of Contents

We monitor warranty claims and address defects through our quality and design processes, which are managed by our product engineering, quality control and technical support organizations. During the last several years, we have increased programs and initiated new programs to build an expanded family of high performance authentication solutions. These programs have resulted in the redesign and re-engineering of authenticator products to improve performance and reliability by incorporating new microprocessors, electronics, firmware and batteries with longer life.

Income Taxes – The preparation of our consolidated financial statements requires us to estimate our income taxes in each of the jurisdictions in which we operate, including those outside the United States which may be subject to certain risks that ordinarily would not be expected in the United States. A change in our estimate of income by jurisdiction could cause a change in our annual effective tax rate. The income tax accounting process involves our estimating our actual current exposure together with assessing temporary differences resulting from differing treatment of certain items for tax and accounting purposes. These differences result in the recognition of deferred tax assets and liabilities. We must then record a valuation allowance to reduce our deferred tax assets to the amount that is more likely than not to be realized.

Management judgment is required in determining our provision for income taxes, our deferred tax assets and liabilities and any valuation allowance recorded against deferred tax assets. We have recorded a valuation allowance of $25.4 million as of December 31, 2003 due to uncertainties related to our ability to utilize some of our deferred tax assets, primarily consisting of acquisition related net operating losses carried forward. We base the valuation allowance on our estimates of taxable income by jurisdiction in which we operate and the period over which our deferred tax assets will be recoverable. If actual results differ from these estimates or we adjust these estimates in future periods, we may need to adjust our valuation allowance, which could materially impact our consolidated financial position and results of operations.

Valuation of Goodwill and Other Intangible Assets – In assessing the recoverability of our intangible assets, we must make assumptions regarding estimated future cash flows and earnings and other factors used to determine the fair value of the respective assets. We will record an impairment charge in the amount by which the carrying value of the assets exceeds their fair value. We generally determine fair value based on estimated discounted future cash flows. If these estimates or their related assumptions change in the future, we may be required to record impairment charges against these assets in the reporting period in which the impairment is determined. Any such impairment charge could be significant and could have a material adverse effect on our consolidated financial position and results of operations. We perform an annual test for impairment of our goodwill as of November 30 of each year and, if events or circumstances occur that would more likely than not reduce the fair value of the goodwill below its carrying amount, will perform an interim impairment test. We completed the required annual goodwill impairment test as of November 30, 2003, by comparing the carrying amount of the enterprise to the estimated fair value of the enterprise. Estimated fair value of the enterprise was determined based upon the market multiple valuation method, which requires that we utilize estimates of future cash flows, revenue and earnings. As of November 30, 2003, the fair value of the enterprise was greater than the carrying amount of the enterprise. Therefore, our annual goodwill impairment test performed as of November 30, 2003 did not result in an impairment of our goodwill. At December 31, 2003, we had approximately $189.3 million of goodwill, which accounted for approximately 36% of our total assets. Any goodwill impairment test could result in a decrease to the carrying value of goodwill and could have a material effect on our results of operations and consolidated financial position.

Restructurings – During 2002 and 2001, we initiated consolidation of certain operations in order to enhance operational efficiency and reduce expenses, and recorded significant restructuring charges in connection with these actions. Restructuring charges totaled $56.0 million in 2002 and $20.0 million in 2001. These restructuring charges and our continued analysis of our facilities require us to make estimates based upon real estate market conditions, rental rates, future corporate requirements, general economic conditions and future estimated cash flows. Included in the restructuring charges recorded in 2002 are facility exit costs of $44.0 million, which represents estimated shortfalls of sublease rental income compared to lease payments due through 2009 under certain exited facilities lease agreements, impaired leasehold improvements and furniture and fixtures, and other associated facilities expenses. We base estimates related to anticipated sublease market rates for excess facilities on assumptions regarding the time period required to locate and contract with suitable subtenants and base these assumptions on market trend information analysis.

We continue to monitor and assess our facility obligations, real estate markets and our operating expenses. As a result of these ongoing assessments, during 2003 we revised estimates used in previously recorded restructuring charges. These revisions resulted in no net change to our restructuring liability at December 31, 2003. We revised estimates included in facility exit charges based upon the terms of finalized subleases obtained during 2003, due to lower than anticipated operating costs and other direct costs associated with certain exited facilities, and due to revisions in anticipated headcount growth. These revised estimates of excess facility costs resulted in a net increase to facility exit costs of $0.8 million at December 31, 2003. In addition, we reduced our severance restructuring reserve by $0.6 million at December 31, 2003 when we determined our remaining severance and other outplacement costs were lower than originally estimated. We also reduced our restructuring reserve of costs associated with the liquidation of our Swedish development operations and the sale of certain Swedish assets by $0.2 million at December 31, 2003 when we determined we had no legal and consulting costs remaining in connection with this transaction.

17

Table of Contents

We will continue to monitor and asses our facility obligations, real estate markets and our operating expenses. If the assumptions for the estimates used in our restructuring reserve change due to changes in the real estate and sublease markets, or due to the terms of sublease agreements that we have obtained, the ultimate restructuring expenses for these facilities could vary by material amounts, and could cause us to record additional or revise previously recorded restructuring charges in future reporting periods which could have a material effect on our results of operations and consolidated position.

New Accounting Pronouncements - Interpretation No. 46 – In January 2003, the Financial Accounting Standards Board (“FASB”) issued Interpretation No. 46, “Consolidation of Variable Interest Entities,” which was revised by FIN 46R issued in December 2003 (“FIN 46”). This interpretation of Accounting Research Bulletin No. 51, “Consolidated Financial Statements,” addresses consolidation by business enterprises of variable interest entities (“VIE”) that either: do not have sufficient equity investment at risk to permit the entity to finance its activities without additional subordinated financial support, or for which the equity investors lack an essential characteristic of a controlling financial interest. FIN 46 also sets forth certain disclosure requirements regarding interests in VIE that are deemed significant, even if consolidation is not required. FIN 46 applies to interim periods ending after March 15, 2004 We believe the adoption of FIN 46 will not require the consolidation of our investment in Crosby and therefore will not have a significant impact on our consolidated financial position or results of operations.

18

Table of Contents

Results of Operations

The following table sets forth certain consolidated financial data as a percentage of our total revenue:

(1)  Total cost of revenue, gross margin and total operating expenses reflect the reclassification of amortization of technology related intangible assets from operating expense to cost of revenue of $6.6 million and $3.3 million for the years ended December 31, 2002 and 2001, respectively, and also reflects the reclassification of impairment of technology related intangible assets of $14.3 million from operating to cost of revenue expense for the year ended December 31, 2002.

19

Table of Contents

2003 Compared with 2002

Revenue

The following tables set forth the amount, percentage of total revenue and percentage increase (decrease) of our revenue by product group, product type and product line:

The following tables set forth the amount, percentage of total revenue and percentage increase of revenue by regional area:

We believe the increase in total revenue in 2003 as compared to 2002 was primarily attributable to businesses continuing the trend toward permitting remote access to internal resources and Web-enabling existing applications. We believe our identity and access management solutions promote our product synergies and enable us to generate additional revenue by selling additional products to existing customers. We also believe that as new, lower cost remote access technologies become available and as employment rates increase, we will benefit with increased total product revenue. However, information technology budgets continue to be constrained, and the continued uncertainty in the economy may affect revenue generated from the sales of our products in future quarters.

Our RSA SecurID authentication product line generates a substantial portion of our revenue. Authenticator units sold, in thousands of units, were as follows:

20

Table of Contents

The increase in number of units sold, partially offset by a decrease in the average selling price in 2003 as compared to 2002, contributed to the increased revenue from our RSA SecurID authentication product line. The decrease in the average selling price can be attributed to an increase in the number of larger volume transactions during 2003 as compared to 2002, because we tend to give larger discounts on larger volume transactions. We believe our RSA SecurID authentication products generate and will continue to generate substantial revenue for us.

Our sales to the financial services, technology and telecommunications vertical markets continue to provide increased revenue for us. In addition, we believe the increase in our total revenue can be attributed in part to the continued adoption of our authentication products by an increasing number of small and mid size businesses, combined with existing larger customers expanding their deployments of our products.

We believe the increase in our Web access management revenue is due in part to an increase in the number of companies opening up their information and applications to internal and external users. We believe that our Web access management revenue will continue to grow due to introductions of new enhancements to our products, strong technology and strategic partnerships. In addition, we have made a change to our sales strategy to dedicate a portion of our sales force to focus on selling our emerging products, while selling our more mature products through our resellers and distributors.

The decrease in Developer solutions and encryption revenue during 2003 as compared to 2002 was primarily due to the decrease in the number of technology companies funding development of new information technology products, and the availability of free, “open source” products that compete with our RSA BSAFE product line and which continue to put pressure on our Developer solutions revenue. We believe that our Developer solutions revenue may benefit from companies’ needs to secure their transactions due to regulatory requirements. We currently believe our Developer solutions revenue will represent 8% to 10% of total revenue over the next twelve months.

The increase in service revenue for 2003 as compared to 2002 can primarily be attributed to purchases by new customers coupled with high renewals of annual maintenance contracts from sale of products in prior periods.

We believe that as the United States government proceeds with its agenda of increasing awareness and funding of cyber-security issues and its focus on homeland security, we will benefit with increased revenue. We believe the government sector of our business may increase in the future as government agencies seek e-security partners in order to execute their cyber-security agenda. However, revenue from the government sector of our business was consistent during 2003 as compared to 2002 as the United States government continued to defer its information technology spending. We believe our revenue from the healthcare and financial services markets will continue to increase due to required compliance with industry specific privacy and security laws standards.

Gross Profit

The following tables set forth the gross profit and gross margin for products and maintenance and professional services:

(1)  Total gross profit and gross margin and gross profit - products and gross margin - products reflect the reclassification of amortization of technology related intangible assets of $6.6 million from operating expense to cost of revenue for the year ended December 31, 2002, and also reflects the reclassification of impairment of technology related intangible assets of $14.3 million from operating expense to cost of revenue expense for the year ended December 31, 2002.

Included in the gross profit for products for 2002 is a $2.9 million charge for inventory write down related to discontinued product designs and for product quality warranty obligation expenses. The increase in total gross margin for 2003 as compared to 2002, was primarily attributable to the decrease of $6.6 million in amortization of technology related intangible assets expense and the decrease of $14.3 million in impairment of technology related intangible assets for 2003 as compared to 2002. These decreases were partially offset by a $1.9 million increase in the provision of warranty expense in 2003 as compared to 2002.

We believe the increase in gross margin for products in 2003 as compared to 2002, after excluding the items mentioned above, can be attributed, in part, to the increase in our software revenue. Our software products have higher gross margins than our other product types, and an increase in software revenue would cause our gross margin from products to increase. The increase in total gross margin

21

Table of Contents

in 2003 was also attributable to our efforts to reduce costs and improve operating efficiencies, combined with an increase in total revenue.

The increase in gross profit from maintenance and professional services in 2003 as compared to 2002, was primarily attributable to increased maintenance revenue achieved on decreased customer support costs. Customer support costs decreased due to cost reduction programs implemented over the past two years.

We expect to maintain total gross margins of between 79% and 81% for 2004.

Research and Development

Total research and development expenses decreased 2.6% in 2003 to $53.6 million from $55.1 million in 2002, and represented 20.6% of total revenue for 2003. For 2003 as compared to 2002, the decrease in research and development expenses of $1.5 million was primarily due to the decrease in overhead expenses of approximately $2.8 million offset by the increase in payroll and consulting expenses of approximately $1.3 million associated with our continued allocation of resources towards investing in our future product offerings. We expect total research and development expenditures will be between 19% and 21% of total revenue for 2004.

Marketing and Selling

Total marketing and selling expenses decreased 6.3% in 2003 to $94.3 million from $100.7 million in 2002, and represented 36.3% of total revenue for 2003. Marketing and selling expenses decreased $6.4 million in 2003 as compared to 2002 primarily due to cost reduction measures. For 2003 as compared to 2002, approximately $4.8 million of the decrease in marketing and selling expenses was from decreased overhead costs associated with cost reduction measures, approximately $2.9 million of the decrease was from decreased spending on marketing programs, and approximately $1.6 million of the decrease was from a reduction in bad debt expense. These reductions were partially offset by approximately $2.9 million of increased commission expense due to increased revenue. We believe total marketing and selling expenditures will be between 32% and 35% of total revenue in 2004.

General and Administrative

Total general and administrative expenses increased 11.6% in 2003 to $33.8 million from $30.3 million in 2002, and represented 13.0% of total revenue for 2003. For 2003 as compared to 2002, approximately $2.8 million of the increase was from increased payroll and overhead costs associated with an increased workforce and increased bonus payouts, and approximately $0.7 million of the increase for professional fees incurred in connection with on-going litigation. We believe total general and administrative expenditures will be between 10% and 12% of total revenue in 2004.

Acquisitions

During 2001, we completed four acquisitions, which were accounted for as purchases. Accordingly, the results of operations of the acquired companies have been included in our consolidated statements of operations since their respective dates of acquisition.

In September 2001, we acquired all of the capital stock of Securant, a privately held company that developed the ClearTrust Web access management solution, for an aggregate of $139.1 million in cash including acquisition costs. In May 2001, we acquired all of the capital stock of 3GI, a privately held company that developed smart card and biometric authentication products, and substantially all of the assets of Transindigo, a privately held company that developed real time Web access management software products, for an aggregate of $23.7 million in cash including acquisition costs and litigation expenses. In February 2001, we acquired all of the capital stock of Xcert, a privately held company that developed digital certificate-based products for securing e-business transactions, for $69.7 million in cash, including acquisition costs, plus the assumption of all Xcert stock options.

22

Table of Contents

Allocation of the purchase prices for all four acquisitions completed during 2001 were based on estimates of the fair value of the assets acquired and liabilities assumed based on independent appraisals. These allocations were as follows:

		Estimated Fair Values
										3GI and								Estimated
($ in millions)		Securant				Xcert				Transindigo				Total				Life
Assets and liabilities, including cash		$	(0.6	)		$	4.8			$	6.8			$	11.0
Goodwill			123.6				57.7				13.5				194.8
Intangible assets (1)			19.6				12.9				2.9				35.4			1 to 7 years
Deferred tax liabilities, net (1)			(7.3	)			(5.1	)			(1.1	)			(13.5	)
In process research and development			3.8				2.5				1.6				7.9
Total purchase price			139.1				72.8				23.7				235.6
Less: assumption of stock options			—				(3.1	)			—				(3.1	)
Less: cash acquired			(2.1	)			(0.4	)			(6.9	)			(9.4	)
Net cash paid		$	137.0			$	69.3			$	16.8			$	223.1

(1)

We recorded an impairment charge of $19.1 million during 2002 to reduce the carrying value of these intangible assets to zero at December 31, 2002. Accordingly, we did not record any amortization expense related to these intangible assets after December 31, 2002. As a result of this impairment charge, we reduced the deferred tax liabilities associated with the intangible assets to zero at December 31, 2002.