INTERNET SECURITY SYSTEMS INC/GA - 10-Q Quarterly Report

UNITED STATES
SECURITIES AND EXCHANGE COMMISSION
WASHINGTON, D.C. 20549

FORM 10-Q

(Mark One)


x		QUARTERLY REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

		For the quarterly period ended June 30, 2002

OR

o		TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the transition period from __________________________________ to __________________________________

Commission File Number

INTERNET SECURITY SYSTEMS, INC.

(Exact name of registrant as specified in its charter)


DELAWARE		58-2362189

(State or jurisdiction of incorporation or organization)		(I.R.S. Employer Identification No.)

6303 BARFIELD ROAD, ATLANTA, GEORGIA 30328

(Address of principal executive offices)

Registrant’s telephone number, including area code (404) 236-2600

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes x No o

Indicate the number of shares outstanding of each of the registrant’s classes of common stock, as of the latest practicable date.


Title of each class		Number of Shares Outstanding as of August 2, 2002

Common Stock, $0.001 par value		48,397,377

TABLE OF CONTENTS


		CONSOLIDATED BALANCE SHEETS
		CONSOLIDATED STATEMENTS OF OPERATIONS
		CONSOLIDATED STATEMENTS OF CASH FLOWS
		NOTES TO CONSOLIDATED FINANCIAL STATEMENTS
	MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS OF OPERATIONS
	ITEM 3. QUANTITATIVE AND QUALITATIVE DISCLOSURES ABOUT MARKET RISK
PART II OTHER INFORMATION
	ITEM 1. LEGAL PROCEEDINGS
	ITEM 2. CHANGES IN SECURITIES AND USE OF PROCEEDS
	ITEM 4. SUBMISSION OF MATTERS TO A VOTE OF SECURITY HOLDERS
	ITEM 6. EXHIBITS AND REPORTS ON FORM 8-K
Section 906 Certification of the CEO
Section 906 Certification of the CFO


		PAGE
		NUMBER

PART I. FINANCIAL INFORMATION
Item 1 Consolidated Financial Statements:
	Consolidated Balance Sheets at June 30, 2002 and December 31, 2001		3
	Consolidated Statements of Operations for the three months and six months ended June 30, 2002 and June 30, 2001		4
	Consolidated Statements of Cash Flows for the six months ended June 30, 2002 and June 30, 2001		5
	Notes to Consolidated Financial Statements		6
Item 2 Management’s Discussion and Analysis of Financial Condition and Results of Operations			9
Item 3 Quantitative and Qualitative Disclosures about Market Risk			21
PART II. OTHER INFORMATION			21
Item 1 Legal Proceedings			21
Item 2 Changes in Securities and Use of Proceeds			21
Item 4 Submission of Matters to a Vote of Security Holders			21
Item 6 Exhibits and Reports on Form 8-K			22

INTERNET SECURITY SYSTEMS, INC.

CONSOLIDATED BALANCE SHEETS

(Amounts in thousands, except per share amounts)


			June 30,			December 31,
			2002			2001

			(UNAUDITED)
ASSETS
Current assets:
	Cash and cash equivalents		$	141,282		$	108,038
	Marketable securities			32,697			55,129
	Accounts receivable, less allowance for doubtful accounts of $2,485 and $2,563, respectively			55,767			50,259
	Inventory			2,156			1,768
	Prepaid expenses and other current assets			6,885			6,018

		Total current assets		238,787			221,212
Property and equipment:
	Computer equipment			34,874			31,043
	Office furniture and equipment			22,572			20,872
	Leasehold improvements			20,219			17,835

				77,665			69,750
	Less accumulated depreciation			32,399			25,254

				45,266			44,496
Restricted marketable securities				12,500			12,500
Goodwill, less accumulated amortization of $27,381				196,884			197,060
Other intangibles, less accumulated amortization of $6,901 and $4,644, respectively				16,513			19,722
Other assets				8,119			5,994

		Total assets	$	518,069		$	500,984

LIABILITIES AND STOCKHOLDERS’ EQUITY
Current liabilities:
	Accounts payable		$	2,103		$	3,553
	Accrued expenses			19,681			20,440
	Deferred revenues			48,812			48,139

		Total current liabilities		70,596			72,132
Other non-current liabilities				1,809			1,917
Commitments and contingencies
Stockholders’ equity:
	Preferred stock, $.001 par value, 20,000,000 shares authorized, none issued or outstanding			—			—
	Common stock, $.001 par value, 120,000,000 shares authorized, 48,386,000 and 47,871,000 issued and outstanding, respectively			48			48
	Additional paid-in capital			438,338			430,449
	Deferred compensation			(1,048	)		(1,985	)
	Accumulated other comprehensive income (loss)			97			(2,312	)
	Retained earnings			8,229			735

		Total stockholders’ equity		445,664			426,935

		Total liabilities and stockholders’ equity	$	518,069		$	500,984

INTERNET SECURITY SYSTEMS, INC.

CONSOLIDATED STATEMENTS OF OPERATIONS

(Amounts in thousands, except per share amounts)
(Unaudited)


			Three months ended						Six months ended
			June 30,						June 30,

			2002			2001			2002			2001

Revenues:
	Product licenses and sales		$	30,187		$	28,088		$	60,400		$	64,264
	Subscriptions			22,788			15,460			43,110			30,596
	Professional services			7,056			8,162			14,898			18,005

				60,031			51,710			118,408			112,865
Costs and expenses:
	Cost of revenues:
		Product licenses and sales		1,344			3,607			3,671			10,151
		Subscriptions and professional services		13,362			13,457			25,871			25,295

		Total cost of revenues		14,706			17,064			29,542			35,446
	Research and development			8,821			8,940			17,428			17,255
	Sales and marketing			23,902			23,913			46,589			45,547
	General and administrative			6,832			5,085			12,276			9,596
	Charge for in-process research and development			—			2,910			—			2,910
	Write-off of lease obligation			—			—			—			1,072
	Amortization of other intangibles and stock-based compensation			1,464			1,146			2,960			1,314
	Amortization of goodwill			—			3,930			—			4,128

				55,725			62,988			108,795			117,268
Operating income (loss)				4,306			(11,278	)		9,613			(4,403	)
Interest income, net				872			1,792			1,602			3,750
Minority interest				(68	)		—			(207	)		—
Other income				1,873			—			1,836			1,638
Foreign currency exchange loss				(100	)		(31	)		(77	)		(282	)

Income (loss) before income taxes				6,883			(9,517	)		12,767			703
Provision for (benefit from) income taxes				2,758			(3,907	)		5,273			(228	)

Net income (loss)			$	4,125		$	(5,610	)	$	7,494		$	931

Basic net income (loss) per share of Common Stock			$	0.09		$	(0.13	)	$	0.16		$	0.02

Diluted net income (loss) per share of Common Stock			$	0.08		$	(0.13	)	$	0.15		$	0.02

Weighted average shares:
	Basic			48,340			44,392			47,924			43,299

	Diluted			48,927			44,392			48,773			44,922

INTERNET SECURITY SYSTEMS, INC.

CONSOLIDATED STATEMENTS OF CASH FLOWS

(Amounts in thousands)
(Unaudited)


				Six months ended
				June 30,

				2002			2001

OPERATING ACTIVITIES
Net income				$	7,494		$	931
Adjustments to reconcile net income to net cash provided by operating activities:
		Depreciation			7,145			5,205
		Amortization of goodwill			—			4,128
		Amortization of other intangibles and stock-based compensation			2,960			1,314
		Accretion of discount on marketable securities			381			73
		Minority interest			207			—
		Charge for in-process research and development			—			2,910
		Other non-cash items			—			46
		Income tax benefit from exercise of stock options			4,225			2,022
		Gain on sale of subsidiary stock			—			(1,638	)
	Changes in assets and liabilities, excluding the effect of acquisitions:
		Accounts receivable			(5,508	)		5,127
		Inventory			(388	)		858
		Prepaid expenses and other assets			(2,992	)		(4,881	)
		Accounts payable and accrued expenses			(2,523	)		(5,320	)
		Deferred revenues			1,800			4,217

			NET CASH PROVIDED BY OPERATING ACTIVITIES		12,801			14,992
INVESTING ACTIVITIES
Acquisitions, net of cash received					—			2,307
Net proceeds from maturity of marketable securities					64,396			72,531
Purchases of marketable securities					(42,345	)		(70,425	)
Purchases of property and equipment					(7,915	)		(20,193	)
Net proceeds from sale of subsidiary stock					—			1,766

			NET CASH PROVIDED BY (USED IN) INVESTING ACTIVITIES		14,136			(14,014	)
FINANCING ACTIVITIES
Proceeds from exercise of stock options					2,756			12,599
Proceeds from issuance of common stock					1,142			1,228

			NET CASH PROVIDED BY FINANCING ACTIVITIES		3,898			13,827
Foreign currency impact on cash					2,409			(396	)

Net increase in cash and cash equivalents					33,244			14,409
Cash and cash equivalents at beginning of period					108,038			66,210

Cash and cash equivalents at end of period				$	141,282		$	80,619

SUPPLEMENTAL CASH FLOW DISCLOSURE
Income taxes paid				$	2,502		$	—

INTERNET SECURITY SYSTEMS, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS

1. Basis of presentation and significant accounting policies

The consolidated financial statements of Internet Security Systems, Inc. (“ISS”) as of June 30, 2002 and for the three and six months ended June 30, 2002 and 2001 are unaudited and, in the opinion of management, contain all adjustments, consisting of normal recurring items necessary for the fair presentation of the financial position and results of operations for the interim periods. The consolidated financial statements include the accounts of Internet Security Systems, Inc. and its majority-owned subsidiaries. The consolidated balance sheet at December 31, 2001 has been derived from the audited financial statements at that date but does not include all the footnotes required by accounting principles generally accepted in the United States for complete financial statements.

These consolidated financial statements should be read in conjunction with the Consolidated Financial Statements and Notes thereto included in our Annual Report on Form 10-K for the year ended December 31, 2001. The results of operations for the three and six months ended June 30, 2002 are not necessarily indicative of the results to be expected for the entire year. All significant intercompany accounts and transactions have been eliminated. Certain previously reported amounts have been reclassified to conform to the current presentation format.

The preparation of financial statements and related disclosures in conformity with accounting principles generally accepted in the United States requires management to make estimates and assumptions that affect the amounts reported in the financial statements and accompanying notes. Actual results could differ from those estimates.

2. Other income and expense

Other income reported in the quarter ended June 30, 2002 consists of a $1.9 million gain on the sale of an investment in an ISS distributor in Japan. The shares of the publicly traded company were acquired when the distributor was privately held and were subsequently sold on the open market. The gain is substantially offset by expenses included in the general and administrative category resulting from the consolidation of Tokyo-based operations from several different locations to a new centralized headquarters in Tokyo. Costs associated with this move included lease termination costs, including remaining rent payments, write-off of leasehold improvements and moving costs.

Included in pretax income in the six months ended June 30, 2001, is a non-recurring other income item of $1.6 million generated from the sale of approximately 2% of the outstanding shares of our Asia-Pacific subsidiary in March 2001. As part of the planning for an IPO in Japan of a minority interest in our Asia-Pacific subsidiary that was completed in September 2001, options were granted in the subsidiary as a means of key employee retention and approximately 2% of the outstanding shares were sold to employees and key partners. The price was established based on a valuation of the company by an independent appraisal firm. The gain represents the difference between proceeds received and the underlying basis in the stock.

In the six months ended June 30, 2001, the Company recorded a first quarter $1.1 million write-off of the remaining lease obligation on our previous Atlanta office space. This non-recurring expense originated in the quarter as available subleased space in the area grew substantially as the result of layoffs, closures and consolidations, diminishing the prospects of subleasing our old space.

3. Goodwill and intangible assets

The Company adopted Statement of Financial Accounting Standards (“SFAS”) No. 142, “Goodwill and Other Intangible Assets” on January 1, 2002. As a result, goodwill is no longer amortized, but is instead tested for impairment annually or sooner if circumstances indicate that it may no longer be recoverable. Upon adoption, the Company completed the transitional goodwill impairment assessment required by SFAS No. 142 and concluded that goodwill was not impaired at January 1, 2002.

Goodwill and intangible assets are comprised of the following (in thousands):


			June 30, 2002						December 31, 2001
				Gross Carrying		Accumulated			Gross Carrying		Accumulated
				Amount		Amortization			Amount		Amortization

Unamortized intangible assets:
	Goodwill				224,265		(27,381	)		224,441		(27,381	)

Amortized intangible assets:
	Core technology				3,853		(1,797	)		3,853		(1,557	)
	Developed technology				17,808		(4,268	)		17,808		(2,487	)
	Work force				215		(134	)		215		(116	)
	Customer relationships				1,538		(702	)		2,490		(484	)

		Total			23,414		(6,901	)		24,366		(4,644	)

The Company amortizes intangible assets over their estimated useful lives of eight years for core technology, five years for developed technology, six years for work force and three years for customer relationships.

Amortization expense of intangible assets (in thousands):



		Three months ended				Six months ended
		June 30,				June 30,
		2002		2001		2002		2001

Goodwill			—		3,930		—		4,128
Core technology			120		120		241		241
Developed technology			890		323		1,781		361
Work force			9		9		18		18
Customer relationships			110		95		218		95

	Total		1,129		4,477		2,258		4,843

The estimated future amortization expense of intangible assets as of June 30, 2002 is as follows (in thousands):


		Amount

Fiscal year:
	2002 (remaining six months)		2,258
	2003		4,479
	2004		4,100
	2005		3,892
	2006		1,784
	2007 and later		—

			16,513

The following table presents a reconciliation of previously reported net income (loss) and net income (loss) per share to the amounts adjusted for the exclusion of the amortization of goodwill (in thousands):



		Three months ended					Six months ended
		June 30,					June 30,
		2002		2001			2002		2001

Net income (loss), reported		$	4,125	$	(5,610	)	$	7,494	$	931
	Amortization of goodwill		—		3,930			—		4,128

Net income (loss), as adjusted			4,125		(1,680	)		7,494		5,059


Basic net income (loss) per share, as reported		$	0.09	$	(0.13	)	$	0.16	$	0.02
Amortization of goodwill			—		0.09			—		0.10

Basic net income (loss) per share, as adjusted		$	0.09	$	(0.04	)	$	0.16	$	0.12


Diluted net income (loss) per share, as reported		$	0.08	$	(0.13	)	$	0.15	$	0.02
	Amortization of goodwill		—		0.09			—		0.09

Diluted net income (loss) per share, as adjusted		$	0.08	$	(0.04	)	$	0.15	$	0.11

For the quarter ended June 30, 2001 options aggregating 1,654,544 are not included in the above calculation as they are antidilutive.

4. Comprehensive income (loss)

The components of comprehensive income (loss), net of tax, are as follows (in thousands):


	Three months ended					Six months ended
	June 30,					June 30,

	2002		2001			2002		2001

Net income (loss)	$	4,125	$	(5,610	)	$	7,494	$	931
Change in cumulative translation adjustment		3,094		553			2,409		(396	)

Comprehensive income (loss)	$	7,219	$	(5,057	)	$	9,904	$	535

5. Income (loss) per share

The computation of net income (loss) per share is as follows (amounts in thousands, except per share amounts):


		Three months ended					Six months ended
		June 30,					June 30,

		2002		2001			2002		2001

Basic net income (loss) per share:
	Net income (loss)	$	4,125	$	(5,610	)	$	7,494	$	931
	Weighted average number of common shares outstanding during the period		48,340		44,392			47,924		43,299

Basic net income (loss) per share		$	0.09	$	(0.13	)	$	0.16	$	0.02

Diluted net income (loss) per share:
	Net income (loss)	$	4,125	$	(5,610	)	$	7,494	$	931
	Weighted average number of common shares outstanding during the period		48,340		44,392			47,924		43,299
	Dilutive stock options		587		—			849		1,623

	Total shares for purpose of calculating diluted net income (loss) per share		48,927		44,392			48,773		44,922

Diluted net income (loss) per share		$	0.08	$	(0.13	)	$	0.15	$	0.02

Options aggregating 1,654,544 for the three months ended June 30, 2001 are not included in the above calculation as they are antidilutive.

INTERNET SECURITY SYSTEMS, INC.
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS

6. Segment and geographic information

ISS conducts business in one operating segment, providing information security management solutions. The Company does, however, prepare information for internal use on a geographic basis (e.g., Americas, EMEA (Europe, Middle East and Africa) and Asia/Pacific). This information consists of the operating results of each geographic segment. The segment operating costs reported internally generally consist of direct sales expenses, an executive team and infrastructure to support its employee and customer and partner base, and supporting billing and financial systems. Unallocated corporate expenses include research and development, general and administrative costs that support the global organization and amortization of intangibles, stock based compensation and goodwill.

There are no intersegment sales. Our chief executive officer and chief financial officer evaluate performance based on operating profit or loss from operations by segment. Assets and liabilities are not discretely allocated or reviewed by segment.

The following table presents ISS’s revenues, operating expenses and operating income (loss) by geographic segment (amounts in thousands):


			Three months ended June 30, 2002											Three months ended June 30, 2001

			Americas		EMEA		Asia/Pacific		Unallocated			Total		Americas		EMEA		Asia/Pacific		Unallocated			Total

Revenues from external customers:
		Product licenses and sales	$	20,272	$	4,534	$	5,381	$	—		$	30,187	$	18,079	$	4,654	$	5,355	$	—		$	28,088
		Subscriptions		17,642		3,095		2,051		—			22,788		12,962		1,438		1,060		—			15,460
		Professional services		4,750		1,464		842		—			7,056		5,891		1,816		455		—			8,162

Total revenue				42,664		9,093		8,274		—			60,031		36,932		7,908		6,870		—			51,710
Cost of revenues:
	Product licenses and sales			1,344		—		—		—			1,344		3,439		168		—		—			3,607
	Subscriptions and professional services			9,067		2,185		2,110		—			13,362		10,278		2,003		1,176		—			13,457

Total cost of revenues				10,411		2,185		2,110		—			14,706		13,717		2,171		1,176		—			17,064
Operating expenses				16,781		4,734		2,387		17,117			41,019		16,997		5,627		2,487		20,813			45,924

Total expenses				27,192		6,919		4,497		17,117			55,725		30,714		7,798		3,663		20,813			62,988
Segment operating income (loss)			$	15,472	$	2,174	$	3,777	$	(17,117	)	$	4,306	$	6,218	$	110	$	3,207	$	(20,813	)	$	(11,278	)


			Six months ended June 30, 2002											Six months ended June 30, 2001

			Americas		EMEA		Asia/Pacific		Unallocated			Total		Americas		EMEA		Asia/Pacific		Unallocated			Total

Revenues from external customers:
		Product licenses and sales	$	41,122	$	8,864	$	10,414	$	—		$	60,400	$	44,513	$	8,994	$	10,757	$	—		$	64,264
		Subscriptions		33,424		5,682		4,004		—			43,110		24,318		4,139		2,139		—			30,596
		Professional services		9,860		2,801		2,237		—			14,898		12,805		3,688		1,512		—			18,005

Total revenue				84,406		17,347		16,655		—			118,408		81,636		16,821		14,408		—			112,865
Cost of revenues:
	Product licenses and sales			3,629		—		42		—			3,671		9,889		252		10		—			10,151
	Subscriptions and professional services			17,629		4,361		3,881		—			25,871		19,330		3,618		2,347		—			25,295

Total cost of revenues				21,258		4,361		3,923		—			29,542		29,219		3,870		2,357		—			35,446
Operating expenses				33,206		9,162		4,221		32,664			79,253		30,444		10,287		4,816		36,275			81,822

Total expenses				54,464		13,523		8,144		32,664			108,795		59,663		14,157		7,173		36,275			117,268
Segment operating income (loss)			$	29,942	$	3,824	$	8,511	$	(32,664	)	$	9,613	$	21,973	$	2,664	$	7,235	$	(36,275	)	$	(4,403	)

INTERNET SECURITY SYSTEMS, INC.
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS

7. Recent accounting pronouncements

In July 2001, the Financial Accounting Standards Board issued Statement of Financial Accounting Standard No. 142, (“SFAS 142”), “Accounting for Goodwill and Other Intangibles”. Under SFAS 142, goodwill and indefinite lived intangible assets are no longer amortized, but are reviewed annually (or more frequently if impairment indicators arise) for impairment. Separable intangible assets that are not deemed to have an indefinite life will continue to be amortized over their useful lives. Companies were required to immediately adopt the amortization provisions of SFAS 142 as it relates to goodwill and intangible assets acquired after June 30, 2001. With respect to goodwill and intangible assets acquired prior to July 1, 2001, companies were required to adopt SFAS 142 in their fiscal year beginning after December 15, 2001. The Company adopted SFAS 142 effective January 1, 2002. Substantially all of the Company’s goodwill balance of $196.9 million as of June 30, 2002, was recorded in June of 2001, in conjunction with the acquisition of Network ICE. In doing so, the Company determined that goodwill is not impaired, therefore, there was no transitional impairment charge to be recorded. The impact of the adoption as it relates to goodwill, which exists currently, is to eliminate amortization of goodwill expense beginning with the year ending December 31, 2002. In 2001, amortization of goodwill totaled $26.5 million.

On October 3, 2001, the FASB issued the Statement of Financial Accounting Standards No. 144 “Accounting for the Impairment or Disposal of Long-Lived Assets” (“SFAS 144”). SFAS 144 addresses financial accounting and reporting for the disposal of long-lived assets. SFAS 144, becomes effective for financial statements issued for fiscal years beginning after December 15, 2001, and interim periods within those fiscal years. The Company adopted SFAS on January 1, 2002. The adoption did not have a material impact on the Company's consolidated financial position, consolidated results of operations or consolidated cash flows.

8. Contingencies

Beginning on September 28, 2001, the Company and certain of its officers and directors were named as defendants in several lawsuits alleging violations of the federal securities laws, including Sections 10(b) and 20(a) of the Securities Exchange Act of 1934, as amended, and Rule 10b-5 thereunder. As of March 27, 2002, six such actions have been filed in the United States District Court for the Northern District of Georgia. The complaints, which are substantially similar in nature, purport to be brought on behalf of a class of investors who purchased the Company’s stock during the period from April 5, 2001 through August 14, 2001 (the “Class Period”). The complaints generally allege that the Company and the individual defendants violated the anti-fraud provisions of the federal securities laws and caused the Company’s stock to trade at artificially high prices by making misrepresentations relating to the Company’s financial condition and prospects during the Class Period. The complaints seek damages in an unspecified amount. All six actions have been consolidated into a single case and the court has appointed lead plaintiffs and lead plaintiff's counsel. The company expects that the plaintiffs will file a consolidated, amended complaint. No answer or other responsive papers are yet due from the defendants. The Company believes that it has meritorious defenses and intends to defend the actions vigorously.

9. Subsequent events

On July 11, 2002, the Board of Directors of the Company authorized a plan to repurchase up to $50 million of the Company’s stock over the next twelve months. Subject to price and market conditions, purchases may be made from time to time in the open market, block trades or private transactions using the Company’s available cash. The repurchase will be made using existing cash and future cash flows from operations.

Also on July 11, 2002, the Board of Directors adopted a shareholder rights plan and authorized and declared a dividend of one preferred share purchase right (a “Right”) for each outstanding share of common stock, par value $.001 per share, of the Company. The dividend was paid on July 29, 2002 to the stockholders of record on that date. Stock issued subsequent to July 29, 2002 will be issued with an attached Right. Each Right will initially represent the rights, under certain circumstances, to purchase one one-thousandth of a share of Series A Junior Participating Preferred Stock (the “Junior Preferred Stock”) at a purchase price of $80 per one one-thousandth of a share. If a person or group acquires beneficial ownership of 20% or more of the then outstanding shares of the Company's common stock (an “Acquiring Person''), the holder of a Right, upon exercise of the Right, will thereafter have the right to receive, in lieu of shares of Junior Preferred Stock, shares of the Company's common stock (or, in certain circumstances, cash, property or other securities of the Company) having a value equal to twice the purchase price of the Right.

The Rights expire on July 11, 2012. Generally, the Board of Directors may redeem the Rights at a price of $.001 per Right (subject to adjustment) at any time prior to the earlier of (i) the close of business on the tenth business day following the Shares Acquisition Date (as defined in the rights plan) or (ii) the expiration date of the Rights. Prior to any person or group becoming an Acquiring Person, the Company may amend the Rights Agreement at any time.

INTERNET SECURITY SYSTEMS, INC.

MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND
RESULTS OF OPERATIONS

The following discussion should be read in conjunction with the Consolidated Financial Statements and related Notes thereto included elsewhere in this Quarterly Report on Form 10-Q. Except for the historical financial information, the matters discussed in this Quarterly Report on Form 10-Q may be considered “forward-looking” statements. Such statements include declarations regarding our intent, belief or current expectations. Such forward-looking statements are not guarantees of future performance and involve a number of risks and uncertainties. Actual results may differ materially from those indicated by such forward-looking statements. Among the important factors that could cause actual results to differ materially from those indicated by such forward-looking statements are the risk factors in this Quarterly Report on Form 10-Q, as well as the risk factors identified in the Annual Report on Form 10-K for the year ended December 31, 2001 as filed with the Securities and Exchange Commission and available at their Web site at www.sec.gov.

OVERVIEW

We are a global leader in information protection solutions dedicated to protecting online assets. Our proactive line of defense protects networks, servers and desktops against an ever-changing spectrum of threats, with a comprehensive line of products and services designed specifically for the particular needs of enterprise, smaller enterprise, consumer and service provider markets. These threat protection solutions go beyond basic access control to deliver multiple layers of defense that detect, prevent and respond to threats prior to those threats causing damage to our customers’ business operations.

We provide a wide range of proactive protection that spans networks, servers and individual desktops, built around the need for comprehensive, cost-effective detection, prevention and response arising from attacks, misuse and security policy violations, all while ensuring the confidentiality, privacy, integrity and availability of proprietary information.

Our family of products is a critical element of an active Internet and networking security program within today’s world of global connectivity, enabling organizations to proactively monitor, detect and respond to risks to enterprise information. Our line of products is designed specifically for the particular needs of enterprise, smaller enterprise, consumer and service provider markets.

Our managed services offerings currently provide remote management of the industry’s best-of-breed security technology including security assessment and intrusion detection systems, firewalls, VPNs, anti-virus and URL filtering software. We focus on serving as the trusted security provider to our customers by maintaining within our existing products the latest counter-measures to security risks, creating new innovative products based on our customers’ needs and providing professional and managed services.

Many factors affect financial performance, and past performance is no assurance of similar future performance. We expect, in the long-term, to continue to expand our domestic and international sales and marketing operations; increase our investment in product development including our proprietary threat and vulnerability database and managed services capabilities; seek acquisition candidates and alliances with partners and alliances with partners with products, technologies or services capabilities complimentary to our solutions; and improve our internal operating and financial infrastructure in support of our strategic goals and objectives. At the same time, we will adjust our organization size in light of current economic conditions and maintain emphasis on controlling discretionary spending and capital expenditures. While we believe in the long-term success of our business solutions, our prospects must be considered in light of the recent experience, risks and difficulties that are frequently encountered by companies in new and rapidly evolving markets. See “Risk Factors”.

Critical accounting policies

The consolidated financial statements were prepared in conformity with accounting principles generally accepted in the United States. As such, management is required to make certain estimates, judgments and assumptions it believes are reasonable based upon the information available. These estimates and assumptions affect the reported amounts of assets and liabilities at the date of the financial statements and the reported amounts of revenues and expenses during the periods presented. The significant accounting policies which management believes are the most critical to aid in fully understanding and evaluating our reported financial results include the following:

Revenue recognition

Revenue is recognized under Statement of Position (“SOP”) 97-2 as modified by SOP 98-9, when the following criteria have been met:

INTERNET SECURITY SYSTEMS, INC.
MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND
RESULTS OF OPERATIONS

• persuasive evidence of an arrangement exists;

• delivery has occurred or services have been rendered;

• price is fixed and determinable; and

• collection is probable.

We recognize perpetual license revenues from ISS-developed products upon (i) delivery of software or, if the customer has evaluation software, delivery of the software key and (ii) issuance of the related license, assuming that no significant vendor obligations or customer acceptance rights exist. Where payment terms are extended over periods greater than 12 months, revenue is recognized as such amounts become due. Product sales consist of (i) appliances sold in conjunction with ISS licensed software and (ii) software developed by third-party partners, combined in some instances with associated hardware appliances and partner maintenance services. These sales are recognized upon shipment to the customer.

License sales of enterprise and small enterprise products are generated both through a direct sales force and through partners. License sales of small office/home office and consumer products are made through a distributor to retail establishments and are sold directly to customers via the Internet. License revenue for sales made through resellers and distributors are recognized only when the product is delivered to the end user.

Annual renewable maintenance is a separate component of each perpetual license agreement for ISS products with revenue recognized ratably over the maintenance term. Subscription revenues include maintenance, term licenses, and managed service arrangements. Term licenses allow customers to use our products and receive maintenance coverage for a specified period, generally 12 months. We recognize revenues from these term agreements ratably over the subscription term. Security monitoring services of information assets and systems are part of managed services and are recognized as such services are provided.

Professional services revenues include fee-based service engagements and training. Service engagements, typically billed on a time-and-materials basis, primarily focus on security assessments of customer networks and the development of customers’ security policies. We recognize such professional services revenues as the related services are rendered.

Multiple element arrangements can include any combination of hardware, software or services. When some elements are delivered prior to others in an arrangement, revenue is deferred until the delivery of the last element unless there is all of the following:

• vendor specific objective evidence (VSOE) of fair value of the undelivered elements;

• the functionality of the delivered elements is not dependent on the undelivered elements; and

• delivery of the delivered elements represents the culmination of the earnings process.

Our historical rate of return for our software products is negligible. We offer demonstration software available via download from our website that allows potential customers to see the functionality of the products on their own networks. We did not have any transactions in the first half of either 2002 or 2001 involving reciprocal arrangements where goods or services were purchased from an organization at the same time that we licensed software or provided services to that organization.

Allowance for doubtful accounts

Our sales are global, including companies located in the United States, Europe, Latin America and the Asia/Pacific regions. We perform periodic credit evaluations of our customer’s financial condition and do not require collateral. Credit risk with respect to trade accounts receivable are limited due to the large number of entities that comprise the Company’s customer base. We provide for estimated credit losses as such losses become probable and such losses have been within management’s expectations. We evaluate specific accounts when we become aware of a situation where a customer may not be able to meet its financial obligations due to a deterioration of its financial viability, credit ratings or bankruptcy. The allowance for doubtful accounts is established based on the best facts available to us and reevaluated and adjusted as additional information is received.

Our provisions for bad debt during the three months ended June 30, 2002 and for the six months ended June 30, 2002 amounted to $200,000 and $665,000, respectively. At December 31, 2001, our allowance for doubtful accounts included approximately $400,000

INTERNET SECURITY SYSTEMS, INC.
MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND
RESULTS OF OPERATIONS

that had been reserved specifically for two customers, both of which were successfully collected in 2002, and the allowance was decreased accordingly. During the first half of 2002, in response to the difficult current economic conditions, we wrote off approximately $340,000 of receivables that were deemed uncollectible due to the deteriorating condition of certain customers. Our June 30, 2002 allowance for bad debts totals 4.4% of the $55.8 million of trade receivables.

While actual credit losses have historically been within management’s expectations and the provisions established, we cannot guarantee that we will continue to experience the same credit loss rates we have in the past. If the financial condition of our customers were to deteriorate, resulting in an impairment of their ability to make payments, additional allowances may be required.

Impairment of goodwill

We currently have a significant intangible asset related to goodwill of $197 million, with $195 million related to our June 2001 acquisition of Network ICE Corporation. The determination of whether or not this asset is impaired involves significant judgments based upon short and long-term projections of future performance. We have concluded that this amount is realizable based both on forecasted discounted cash flows through 2006 and on our stock market valuation. The forecasted discounted cash flows include positive cash flow for each year through 2006 and a minimum terminal value of approximately $289 million. Neither method indicated that our goodwill had been impaired and as a result, we did not record any impairment losses related to goodwill during the six months ended June 30, 2002 and 2001.

Due to uncertain market conditions and potential changes in our strategy and products, it is possible that forecasts used to support our intangible assets may change in the future which could result in significant non-cash charges that would adversely affect our results of operations and financial condition.

Results of operations

The following table sets forth certain consolidated historical operating information, as a percentage of total revenues, for the periods indicated:


		Three months ended						Six months ended
		June 30,						June 30,

		2002			2001			2002			2001

Product licenses and sales			50	%		54	%		51	%		57	%
Subscriptions			38	%		30	%		36	%		27	%
Professional services			12	%		16	%		13	%		16	%

	Total revenues		100	%		100	%		100	%		100	%

Cost of product revenues			2	%		7	%		3	%		9	%
Cost of subscription and professional service revenues			22	%		26	%		22	%		22	%
Research and development			15	%		17	%		15	%		15	%
Sales and marketing			41	%		46	%		40	%		40	%
General and administrative			11	%		10	%		10	%		9	%
Write-off of lease obligation			—			—			—			1	%
Charge for in-process research and development						6	%					3	%
Amortization of goodwill			—			8	%		—			4	%
Amortization of other intangibles and stock-based compensation			2	%		2	%		2	%		1	%

	Total costs and expenses		93	%		122	%		92	%		104	%

Operating income (loss)			7	%		(22	)%		8	%		(4	)%

Revenues

Product licenses and sales

Product licenses and sales, including perpetual licenses and sales of partner software and hardware appliances, continued to be the primary source of revenue generation at 50% of total revenues for the three-month period ended June 30, 2002 and 54% for the

INTERNET SECURITY SYSTEMS, INC.
MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND
RESULTS OF OPERATIONS

corresponding period in 2001. Product licenses and sales represented 51% of total revenues for the six-month period ended June 30, 2002, as compared to 57% for the same period in 2001. The decrease in product licenses and sales as a percentage of total revenues is due to the decrease in the sales of third-party products.

We have de-emphasized sales of third-party products in order to focus on our own ISS solutions. As such, third-party product revenues decreased from 7% of total revenue in the quarter ended June 30, 2001 to 2% in the corresponding period of 2002, with a similar decrease on a year-to-date basis. Additionally, in 2001, we modified our agreement with Nokia, a maker of appliances that work in conjunction with ISS RealSecure software and certain Checkpoint software. We previously purchased and resold these Nokia appliances with ISS RealSecure software, but now the sale of the Nokia appliances occurs primarily through Nokia resellers, with the sale of ISS RealSecure software directly by us or through our resellers to our customers. This change lowered our sales because the Nokia appliances component of sales is now occurring through Nokia resellers. Although we have de-emphasized sales of third-party products, we continue sales of third-party products as part of our managed security services offerings.

License sales of enterprise and small enterprise products are generated both through a direct sales force and through various partners, including system integrators, value-added resellers and distributors. When our partners generate sales, revenues are recognized when the end user sale has occurred, which is identified through electronic delivery of a software key that is necessary to operate the product.

License sales of small office/home office and consumer products are made through distributors to retail establishments and are sold directly to customers via the Internet. License revenue for sales made through our distributors is recognized only when the product is sold to the end user.

Our product line advanced again in the second quarter of 2002, with enhancements to our desktop, server and network protection solutions. We released RealSecure Desktop Protector 3.5, which added the ability to block outbound network traffic as well as new protection from malicious application execution. We introduced broader platform support for our host products to include several versions of Linux. We shipped a new version of our RealSecure Network Sensor 7.0 with full support for high traffic gigabit networks, as well as advanced detection algorithms, developed by integrating technology from our 2001 acquisition of NetworkICE with our existing technology. Our security management application was updated as well, with a new SiteProtector release in the quarter. SiteProtector remains the industry’s only management application to fully control host and network-based agents, as well as vulnerability products to centralize data and to provide fast, guided analysis of security data.

Subscriptions

Subscription revenues consist of maintenance, term licenses of product usage and security-monitoring fees for managed services offerings. Subscriptions revenue represented 38% of total revenues in the three months ended June 30, 2002 increasing from 30% of total revenues in the three months ended June 30, 2001. Maintenance continues to represent the largest portion of our subscription revenue, accounting for 26% of total revenues in the three months ended June 30, 2002 and 20% of total revenues in the comparable period of 2001. We continue to increase our software client base that generates maintenance revenues, through a combination of maintenance contracts associated with new product licenses and a high renewal rate of existing contracts.

Our monitoring fees grew more than 22% in the second quarter of 2002, and represented 7% of total revenues, a one percentage point increase over the corresponding period of 2001. We continue to focus on our intrusion protection offerings, the area of strongest demand.

On a year-to-date basis, subscriptions revenue represented 36% of total revenues in the six months ended June 30, 2002, as compared to 27% in the six months ended June 30, 2001. The year-to-date increase is primarily the result of increased maintenance. Security-monitoring fees did not increase significantly in the first half of 2002 compared with 2001 because we decreased non-core services during 2001. Specifically, we eliminated a security offering combined with internet service provider services in the fourth quarter of 2001, and eliminated contracts where the partner contracted for capacity, but did not achieve the underlying end-user contracts. We believe that we now have a higher component of business that we perceive as providing long-term value-added services to our customers.

Professional services

Professional services revenue represented 12% of total revenues in the three months ended June 30, 2002, decreasing from 16% in the corresponding period of 2001. For the six months ended June 30, 2002, professional services revenue was 13% of revenue, which

INTERNET SECURITY SYSTEMS, INC.
MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND
RESULTS OF OPERATIONS

was a decrease from 16% in the corresponding period of 2001. During 2002, professional services as a percentage of total revenues decreased due to continued customer reluctance to spend discretionary dollars on professional services. Further contributing to this decline was a narrowing of our consulting offerings to focus on high-value offerings that utilize our X-Force expertise, and choosing to use partners to provide deployment and other offerings where appropriate. We also decreased the number of training classes related to third-party products and increased our emphasis on courses related to ISS solutions.

Geographic regions

Geographically, we derived the majority of our revenues from sales to customers within the Americas region; however, international operations continued to be a significant contributor to revenues. Revenues by region represented the following percentages of total revenues for the periods indicated:


	Three months ended						Six months ended
	June 30,						June 30,

	2002			2001			2002			2001

Americas		71	%		72	%		71	%		72	%
EMEA		15	%		15	%		15	%		15	%
Asia/Pacific Rim		14	%		13	%		14	%		13	%

Revenues in Asia/Pacific Rim increased from 13% of total revenues in the three months ended June 30, 2001 to 14% in the corresponding period of 2002 due to continued strong growth in this region, fueled at least in part by the visibility gained from its IPO in September 2001. The Americas revenue, as a percentage of total revenue, decreased due to the reduction in sales of third party products.

Costs and Expenses

Cost of product licenses and sales

Cost of revenues from product licenses and sales consists of several components. Costs associated with licensing our software products are minor. Substantially all of the cost of product licenses and sales represents payments to partners for their products that we integrate with our products or directly provide to our customers as part of a single solution source. Costs of product revenues as a percentage of total revenues decreased to 2% for the three months ended June 30, 2002 from 7% for the comparable period in 2001 and to 3% for the six months ended June 30, 2002 from 9% for the corresponding period in 2001, as sales of partner software and hardware appliances representing a lower percentage of total revenues. This decrease was the result of a reduction in sales of third party products is consistent with our movement away from the direct sales of third-party products, except where related to ISS managed services.

Cost of subscriptions and services

Cost of subscription and services includes the cost of our technical support personnel who provide assistance to customers under maintenance agreements, the security operations center (“SOC”) costs of providing managed security monitoring services and the costs related to our professional services and training. These costs decreased from 26% of revenues in the three months ended June 30, 2001 to 22% of total revenues in the three months ended June 30, 2002. On a year-to-date basis these costs remained at 22% of total revenue in 2001 and 2002. In these periods, costs associated with professional services decreased, while costs associated with our subscription revenue increased.

As a result of the difficult economic conditions combined with our effort to focus on core professional services, costs associated with our professional services and education services decreased, both in dollars and as a percentage of total revenue. Costs were controlled through a reduction in personnel that began in the third quarter of 2001, a narrowing of our consulting offerings to focus on services that directly contribute to our protection platform strategy, and a decrease in the number of training classes related to third party products. We also continue to emphasize control over discretionary spending and capital expenditures.

Costs associated with our technical support personnel and our security operations centers increased in 2002 to handle our increasing customer base. As our subscription revenue base increased we added personnel around the globe to handle additional

INTERNET SECURITY SYSTEMS, INC.
MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND
RESULTS OF OPERATIONS

customers under maintenance agreements and under managed security monitoring services. We made an increased investment in automated systems and personnel resources for our Asia/Pacific SOC, which began operating in the third quarter of 2001.

Research and development

Research and development expenses consist of salary and related costs of research and development personnel, including costs for employee benefits, and depreciation of computer equipment. These costs include those associated with maintaining and expanding the X-Force, our internal team of security experts.

We believe our primary research and product development and managed service offerings are important to retaining our leadership position in the market. These expenses were 15% of revenue in the three months ended June 30, 2002, compared to 17% in the comparable period of 2001. On a year-to-date basis these costs represented 15% of revenue in 2002 and 2001. We continue to invest in available X-Force research capabilities that we believe to be a differentiator for ISS. We intend to seek more leverage in the research and development area while continuing to invest in the enhancement of current technologies and the development of new technologies.

Sales and marketing

Sales and marketing expenses consist of salaries, travel expenses, commissions, advertising, maintenance of our website, trade show expenses, costs of recruiting sales and marketing personnel and costs of marketing materials.

These expenses were $23.9 million in both the three months ended June 30, 2002 and 2001, but decreased as a percentage of total revenues from 46% in 2001 to 41% in 2002. On a year-to-date basis these expenses remained at 40% of total revenues. While absolute dollars remained consistent in each period expenses associated with our direct sales force decreased as a result of leverage achieved in our sales and marketing efforts by focusing our direct sales force and continued expansion of the channel as a source of product sales. The channel continues to be an important source of global revenue for us as we use its capabilities to reach not just departmental and small companies, but larger customers as well. These decreases were offset by an increase in marketing, specifically advertising costs. Beginning in the first quarter of 2002, and continuing into the second quarter of 2002, we launched our first television and print advertising campaign designed to demonstrate the multitude of threats that can compromise the security of a company’s networks, servers or desktops. This campaign is aimed at increasing awareness of the ISS brand, especially at the mainstream business market.

We intend to continue to expand our channel sales capabilities, focus on controlling discretionary spending and capital expenditures and adjust our organization in light of economic conditions. While we expect to gain leverage in our sales and marketing costs in the future, our ability to do so will be largely dependent on economic and competitive conditions in future periods.

General and administrative

General and administrative expenses of $6.8 million in the second quarter of 2002 and $5.1 million in the second quarter of 2001 represented approximately 11% of total revenues in 2002 and 10% in 2001. For the quarter ended June 30, 2002, general and administrative costs included non-recurring expenses related to a relocation of our Asia/Pacific headquarters in Tokyo. Excluding these non-recurring charges, general and administrative expenses remained at 10% of total revenue in the three months ended June 30, 2002 compared to the same period of 2001.

On a year-to-date basis, general and administrative expenses increased from 9% of total revenues in 2001 to 10% in 2002, primarily due to the non-recurring relocation expenses in Japan and our continued expansion of our general and administrative support staff in the EMEA and Asia/Pacific regions as we focus on growth in those areas. Other general and administrative expenses consist of personnel-related costs for executive, administrative, finance and human resources, information systems and other support services costs, and legal, accounting and other professional service fees. The increase in these expenses is also attributable to our continued efforts, through

INTERNET SECURITY SYSTEMS, INC.
MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND
RESULTS OF OPERATIONS

additional employees and systems, to enhance our management’s ability to obtain and analyze information about our domestic and international operations, and to support a larger employee base, as well as the expansion of our facilities.

Charge for in-process research and development and write-off of lease obligation

Operating expenses for the three-month and six-month periods ended June 30, 2001 included a $2.9 million charge for the write-off of in-process research and development costs associated with the Network ICE acquisition in June 2001. At that time, in-process research and development had not reached technological feasibility based on identifiable technological risk factors which indicated that even though successful completion was expected, it was not assured at the acquisition date and was immediately charged to operations.

In the six months ended June 30, 2001, we recorded a first quarter $1.1 million write-off of the remaining lease obligation on our previous Atlanta headquarters office space. This non-recurring expense originated in the first quarter of 2001 as available subleased space in the area grew substantially in that quarter as the result of layoffs, closures and consolidations by many companies, decreasing the prospects of subleasing our old space.

Amortization

We incurred amortization expense of $1.5 million and $1.1 million in the three months ended June 30, 2002 and 2001, respectively. Amortization expense for the six-month periods ended June 30, 2002 and 2001 was $3.0 million and $1.3 million, respectively. In 2002, amortization relates to intangible assets and stock-based compensation, resulting from acquisitions accounted for under the purchase method. Beginning January 1, 2002, goodwill is no longer amortized, but subject to periodic tests for impairment.

Interest income

Net interest income decreased from $1.8 million in the quarter ended June 30, 2001 to $872,000 in the comparable quarter of 2002, and from $3.8 million in the six-months ended June 30, 2002 to $1.6 million in the corresponding period of 2002, due to lower market rates of interest on interest bearing cash equivalents and marketable securities. The market rate of interest paid on investment-quality commercial paper and similar investments dropped from approximately 4.4% during the second quarter of 2001 to approximately 2.1% in the second quarter of 2002. As a result, interest income decreased despite an increase in total cash and cash equivalents and interest-bearing marketable securities.

Minority interest

Minority interest totaled $68,000 in the three months ended June 30, 2002 and $207,000 in the six months ended June 30, 2002. Minority interest expense for the three months and six months ended June 30, 2001 was not material. Minority interest represents the portion of earnings that would be distributed to shares not held by us if the Asia/Pacific Rim subsidiary declared a dividend equal to its earnings. In March 2001 we sold approximately 2% of the outstanding shares of our Asia/Pacific Rim subsidiary to employees and key partners. In September 2001, our Asia/Pacific Rim subsidiary sold newly issued shares equal to approximately 10% of its previously outstanding shares in its initial public offering on the Japan over-the counter market.

Other income

Other income reported in the three-month period ending June 30, 2002 consisted of a $1.9 million gain on the sale of an investment in an ISS distributor in Japan. The shares of the publicly traded company were acquired when the distributor was privately held and were subsequently sold on the open market. The gain is substantially offset by expenses included in the general and administrative category resulting from the consolidation of Tokyo-based operations from several different locations to a new centralized headquarters in Tokyo.

INTERNET SECURITY SYSTEMS, INC.
MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND
RESULTS OF OPERATIONS

Foreign currency exchange loss

The exchange loss of $100,000 and $77,000 in the three months and six months ended June 30, 2002, respectively, and the exchange loss of $31,000 and $282,000 in the three months and six months ended June 30, 2001, respectively, is a result of fluctuations in currency exchange rates between the U.S. dollar and other currencies, primarily the Japanese Yen and the Euro and changes in value of assets and liabilities that are denominated in foreign currencies.

Provision for (benefit from) income taxes

The effective tax rate was 40% and 41% for the three and six months ended June 30, 2002, respectively. For the comparable periods of 2001 the income tax benefit was approximately 41% of pre-tax net loss for the quarter ended June 30, 2001 and 32% of pre-tax net income for the six months ended June 30, 2001.

Under APB Opinion No. 28, “Interim Financial Reporting”, we are required to estimate the annual effective income tax rate each time an interim report is issued. As of June 30, 2002, we estimated the annual effective income tax rate for the calendar year 2002 to be 40%.

The effective tax rate for 2002 differs from the statutory rate primarily due to the impact of acquisition related intangibles that are not deductible for income tax purposes, primarily attributable to the acquisition of Network ICE during the second quarter of 2001. The income tax calculation for the second quarter of 2001 included the impact of goodwill amortization resulting from the Network ICE acquisition that is no longer amortized, effective January 1, 2002 under Statement of Financial Accounting Standard No. 142.

While we record income tax expense on domestic income, domestic taxes payable are reduced by deductions related to the employee exercise of stock options. The tax benefit of these deductions was recorded as additional paid-in capital. Taxes paid generally relate to our foreign operations.

Liquidity and Capital Resources

Net cash provided by operations in the first six months of 2002 was $12.8 million and included net income of $7.5 million, non-cash depreciation and amortization expense charges of $10.1 million, income tax benefit from employee exercises of stock options of $4.2 million and growth in deferred revenues of $1.8 million and was offset by a reduction in net assets and liabilities, excluding cash, of $11.4 million.

Investing activities in the first six months of 2002 included the purchase of $42.3 million of marketable securities, primarily commercial paper, offset by net proceeds from the maturity of marketable securities of $64.4 million. These assets have quality characteristics similar to cash equivalents, except their maturities when we acquire them are longer than three months. We also invested in equipment totaling $7.9 million as we provided existing and new personnel with improved computer hardware and incurred leasehold improvement costs related primarily to a new Asia/Pacific headquarters in Tokyo.

Our financing activities provided $3.9 million of cash in the six months ended June 30, 2002, which consisted of proceeds from the exercise of stock options by our employees and from the issuance of common stock through our Employee Stock Purchase Plan.

As of June 30, 2002, we had $174.0 million of cash and cash equivalents and marketable securities, consisting primarily of money market accounts and investment grade commercial paper. An additional $12.5 million of commercial paper investments are pledged as collateral for stand-by letters of credit related to the operating leases of our facilities and are shown on the balance sheet as restricted cash. We believe that such cash and cash equivalents and marketable securities will be sufficient to meet our working capital needs and capital expenditures for the foreseeable future.

On July 18, 2002 we announced our plan to repurchase up to $50 million of our stock utilizing cash on hand and cash flow generated from operations over the next twelve months. We anticipate retaining a cash and marketable securities balance of at least $120 million during this period. Other than this stock repurchase, we are not aware of any trends, events or uncertainties that are reasonably likely to result in any significant changes to our liquidity. From time to time we evaluate possible acquisition and investment opportunities in businesses, products or technologies that are complimentary to ours. In the event we determine to pursue such opportunities, we may use our available cash and cash equivalents. Pending such uses, we will continue to invest our available cash in investment grade, interest-bearing investments.

INTERNET SECURITY SYSTEMS, INC.
MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND
RESULTS OF OPERATIONS

We do not have any off-balance sheet financing arrangements or any relationships with “structured finance” or “special purpose” entities. Other than our non-cancelable operating leases for office space, we do not have any contractual obligations that would impact our liquidity. Our payment for operating leases is secured by three stand-by letters of credit totaling approximately $10.6 million. The stand-by letters of credit are annually renewable over the duration of the applicable leases. We do not anticipate utilizing these stand-by letters of credit to provide any liquidity needs.

Risk Factors

Forward-looking statements are inherently uncertain as they are based on various expectations and assumptions concerning future events and are subject to known and unknown risks and uncertainties. Our forward-looking statements contained in this Quarterly Report and elsewhere should be considered in light of the following important risk factors. Variations from our stated intentions or failure to achieve objectives could cause actual results to differ from those projected in our forward-looking statements. We undertake no obligation to update publicly any forward-looking statements for any reason, even if new information becomes available or other events occur in the future.

We Operate in a Rapidly Evolving Market

We began operations in 1994 and achieved profitability in 1999. We operate in a new and rapidly evolving market and must, among other things:

• respond to competitive developments;

• continue to upgrade and expand our product and services offerings; and

• continue to attract, retain and motivate our employees.

We cannot be certain that we will successfully address these issues. As a result, we cannot assure our investors that we will be able to continue to operate profitably in the future.

Our Future Operating Results Will Likely Fluctuate Significantly

As a result of our limited operating history, we cannot predict our future revenues and operating results with certainty. However, we do expect our future revenues and operating results to fluctuate due to a combination of factors, including:

• the growth in the acceptance of, and activity on, the Internet and the World Wide Web, particularly by corporate, institutional and government users;

• the extent to which the public perceives that unauthorized access to and use of online information are threats to network security;

• the volume and timing of orders, including seasonal trends in customer purchasing;

• our ability to develop new and enhanced product and managed service offerings and expand our professional services capabilities;

• our ability to provide scalable managed services offerings through our partners in a cost effective manner;

• foreign currency exchange rates that affect our international operations;

• product and price competition in our markets; and

• general economic conditions, both domestically and in our foreign markets.

We increasingly focus our efforts on sales of enterprise-wide security solutions, which consist of our entire product suite and related professional services, and managed security services, rather than on the sale of component products. As a result, each sale may require additional time and effort from our sales and support staff. In addition, the revenues associated with particular sales vary significantly depending on the number of products licensed by a customer, the number of devices used by the customer and the

INTERNET SECURITY SYSTEMS, INC.
MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND
RESULTS OF OPERATIONS

customer’s relative need for our professional services. Large individual sales, or even small delays in customer orders, can cause significant variation in our license revenues and results of operations for a particular period. The timing of large orders is usually difficult to predict and, like many software and services companies, many of our customers typically complete transactions in the last month of a quarter.

We cannot predict our operating expenses based on our past results. Instead, we establish our spending levels based in large part on our expected future revenues. As a result, if our actual revenues in any future period fall below our expectations, our operating results likely will be adversely affected because very few of our expenses vary with our revenues. Because of the factors listed above, we believe that our quarterly and annual revenues, expenses and operating results likely will vary significantly in the future.

Our ability to provide timely guidance and meet the expectations of investors, industry analysts and brokerage firms with respect to our operating and financial results is impacted by the tendency of a majority of our sales to be completed in the last month of a quarter. We may not be able to determine whether we will experience material deviations from guidance or expectations until the end of a quarter.

We Face Intense Competition in Our Market

The market for network security monitoring, detection and response solutions is intensely competitive, and we expect competition to increase in the future. We cannot guarantee that we will compete successfully against our current or potential competitors, especially those with significantly greater financial resources or brand name recognition. Our chief competitors generally fall within one of five categories:

• internal information technology departments of our customers and the consulting firms that assist them in formulating security systems;

• relatively smaller software companies offering relatively limited applications for network and Internet security;

• large companies, including Symantec Corp., Cisco Systems, Inc. and Enterasys Networks, Inc., that sell competitive products and offerings, as well as other large software companies that have the technical capability and resources to develop competitive products;

• software or hardware companies like Cisco Systems, Inc. that could integrate features that are similar to our products into their own products; and

• small and large companies with competitive offerings to components of our managed services offerings.

Mergers or consolidations among these competitors, or acquisitions of small competitors by larger companies, would make such combined entities potentially more formidable competitors to us if such products and offerings are effectively integrated. Large companies may have advantages over us because of their longer operating histories, greater name recognition, larger customer bases or greater financial, technical and marketing resources. As a result, they may be able to adapt more quickly to new or emerging technologies and changes in customer requirements. They can also devote greater resources to the promotion and sale of their products than we can. In addition, these companies have reduced and could continue to reduce, the price of their security monitoring, detection and response products and managed security services, which increases pricing pressures within our market.

Several companies currently sell software products (such as encryption, firewall, operating system security and virus detection software) that our customers and potential customers have broadly adopted. Some of these companies sell products that perform the same functions as some of our products. In addition, the vendors of operating system software or networking hardware may enhance their products to include the same kinds of functions that our products currently provide. The widespread inclusion of comparable features to our software in operating system software or networking hardware could render our products obsolete, particularly if such features are of a high quality. Even if security functions integrated into operating system software or networking hardware are more limited than those of our software, a significant number of customers may accept more limited functionality to avoid purchasing additional software.

For the above reasons, we may not be able to compete successfully against our current and future competitors. Increased competition may result in price reductions, reduced gross margins and loss of market share.

INTERNET SECURITY SYSTEMS, INC.
MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND
RESULTS OF OPERATIONS

We Must Attract and Retain Personnel While Competition for Personnel in Our Industry is Intense

Competition for talented personnel in the software, network consulting and managed services industries is intense. We believe our future success will depend in part on our ability to recruit and retain highly skilled engineering, technical, consulting, marketing, sales and management personnel. To accomplish this, we believe we must provide competitive compensation.

We Face Rapid Technological Change in Our Industry and Frequent Introductions of New Products

Rapid changes in technology pose significant risks to us. We do not control nor can we influence the forces behind these changes, which include:

• the extent to which businesses and others seek to establish more secure networks;

• the extent to which hackers and others seek to compromise secure systems;

• evolving computer hardware and software standards;

• changing customer requirements; and

• frequent introductions of new products and product enhancements.

To remain successful, we must continue to change, adapt and improve our products in response to these and other changes in technology. Our future success hinges on our ability to both continue to enhance our current line of products and professional services and to introduce new products and services that address and respond to innovations in computer hacking, computer technology and customer requirements. We cannot be sure that we will successfully develop and market new products that do this. Any failure by us to timely develop and introduce new products, to enhance our current products or to expand our professional services capabilities in response to these changes could adversely affect our business, operating results and financial condition.

Our products involve very complex technology, and as a consequence, major new products and product enhancements require a long time to develop and test before going to market. Because this amount of time is difficult to estimate, we have had to delay the scheduled introduction of new and enhanced products in the past and may have to delay the introduction of new and enhanced products enhancements in the future.

The techniques computer hackers use to gain unauthorized access to, or to sabotage, networks and intranets are constantly evolving and increasingly sophisticated. Furthermore, because new hacking techniques are usually not recognized until used against one or more targets, we are unable to anticipate most new hacking techniques. To the extent that new hacking techniques harm our customers’ computer systems or businesses, affected or prospective customers may believe that our products are ineffective, which may cause them or prospective customers to reduce or avoid purchases of our products.

Risks Associated with Our Global Operations

The expansion of our international operations includes our presence in dispersed locations throughout the world, including throughout Europe and the Asia/Pacific and Latin America regions. Our international presence and expansion exposes us to risks not present in our U.S. operations, such as:

• the difficulty in managing an organization spread over various countries located across the world;

• compliance with, and unexpected changes in, a wide range of complex regulatory requirements in countries where we do business;

• increased financial accounting and reporting burdens and complexities and potentially adverse tax consequences;

• excess taxation due to overlapping tax structures;

• fluctuations in foreign currency exchange rates resulting in losses or gains from transactions and expenses denominated in foreign currencies;

• reduced protection for intellectual property rights in some countries; and

• export license requirements and restrictions on the export of certain technology, especially encryption technology and trade restrictions.

INTERNET SECURITY SYSTEMS, INC.
MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND
RESULTS OF OPERATIONS

Despite these risks, we believe that we must continue to expand our operations in international markets to support our growth. To this end, we intend to establish additional foreign sales operations, expand our existing offices, hire additional personnel, expand our international sales channels and customize our products for local markets. If we fail to execute this strategy, our international sales growth will be limited.

Our Networks, Products and Services May be Targeted by Hackers

Like other companies, our websites, networks, information systems, products and services may be targets for sabotage, disruption or misappropriation by hackers. As a leading network security solutions company, we are a high profile target. Although we believe we have sufficient controls in place to prevent disruption and misappropriation, and to respond to situations, we expect these efforts by hackers to continue. If these efforts are successful, our operations, reputation and sales could be adversely affected.

We Must Successfully Integrate Acquisitions

As part of our growth strategy, we have and may continue to acquire or make investments in companies with products, technologies or professional services capabilities complementary to our solutions. When engaging in acquisitions, we could encounter difficulties in assimilating new personnel and operations into our company. These difficulties may disrupt our ongoing business, distract our management and employees, increase our expenses and adversely affect our results of operations. These difficulties could also include accounting requirements, such as impairment charges related to goodwill or expensing in-process research and development costs. We cannot be certain that we will successfully overcome these risks with respect to any future acquisitions or that we will not encounter other problems in connection with our recent or any future acquisitions. In addition, any future acquisitions may require us to incur debt or issue equity securities. The issuance of equity securities could dilute the investment of our existing stockholders.

We Depend on Our Intellectual Property Rights and Use Licensed Technology

We rely primarily on copyright and trademark laws, trade secrets, confidentiality procedures and contractual provisions to protect our proprietary rights. We have obtained one United States patent and have 15 patent applications under review. We also believe that the technological and creative skills of our personnel, new product developments, frequent product enhancements, our name recognition, our professional services capabilities and delivery of reliable product maintenance are essential to establishing and maintaining our technology leadership position. We cannot assure you that our competitors will not independently develop technologies that are similar to ours.

Despite our efforts to protect our proprietary rights, unauthorized parties may attempt to copy aspects of our products or to obtain and use information that we regard as proprietary. Policing unauthorized use of our products is difficult. While we cannot determine the extent to which piracy of our software products occurs, we expect software piracy to be a persistent problem. In addition, the laws of some foreign countries do not protect our proprietary rights to as great an extent as do the laws of the United States and many foreign countries do not enforce these laws as diligently as U.S. government agencies and private parties.

INTERNET SECURITY SYSTEMS, INC.
MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND
RESULTS OF OPERATIONS

ITEM 3. QUANTITATIVE AND QUALITATIVE DISCLOSURES ABOUT MARKET RISK

Item 7a. Quantitative and Qualitative Disclosures About Market Risk

Interest Rate Sensitivity

The primary objective of our investment activities is to preserve principal while at the same time maximize the income we receive from our investments without significantly increasing risk. Some of the securities that we have invested in may be subject to market risk. This means that a change in prevailing interest rates may cause the principal amount of the investment to fluctuate. For example, if we hold a security that was issued with a fixed interest rate at the then-prevailing rate and the prevailing interest rate later rises, the market value of our investment will probably decline. To minimize this risk, we maintain our portfolio of cash equivalents and marketable securities in a variety of relatively short-term investments, including commercial paper and overnight repurchase agreements. Our marketable securities at June 30, 2002 mature as follows: $3.9 million within three months, $22.9 million in three to six months and $5.9 million in more than six months.

Risk Associated with Foreign Exchange Rates

We are subject to foreign exchange risk as a result of exposures to changes in currency exchange rates. Our foreign operations are, for the most part, naturally hedged against exchange rate fluctuations since both revenues and expenses of each foreign affiliate are denominated in the same currency. As a result, an unfavorable change in the exchange rate for any particular foreign subsidiary would result in lower revenues and expenses with regards to operating results, and lower assets and liabilities with regards to the balance sheet. Therefore, we do not engage in formal hedging activities, but we do periodically review the potential impact of this risk to ensure that the risk of significant potential losses remains minimal.

PART II OTHER INFORMATION

ITEM 1. LEGAL PROCEEDINGS

Beginning on September 28, 2001, the Company and certain of its officers and directors were named as defendants in several lawsuits alleging violations of the federal securities laws, including Sections 10(b) and 20(a) of the Securities Exchange Act of 1934, as amended, and Rule 10b-5 thereunder. As of March 27, 2002, six such actions have been filed in the United States District Court for the Northern District of Georgia. The complaints, which are substantially similar in nature, purport to be brought on behalf of a class of investors who purchased the Company’s stock during the period from April 5, 2001 through August 14, 2001 (the “Class Period”). The complaints generally allege that the Company and the individual defendants violated the anti-fraud provisions of the federal securities laws and caused the Company’s stock to trade at artificially high prices by making misrepresentations relating to the Company’s financial condition and prospects during the Class Period. The complaints seek damages in an unspecified amount. All six actions have been consolidated into a single case and the court has appointed lead plaintiffs and lead plaintiffs counsel. The Company expects that the plaintiffs will file a consolidated, amended complaint. No answer or other responsive papers are yet due from the defendants. The Company believes that it has meritorious defenses and intends to defend the actions vigorously.

ITEM 2. CHANGES IN SECURITIES AND USE OF PROCEEDS

On July 11, 2002, the Board of Directors adopted a shareholder rights plan and authorized and declared a dividend of one preferred share purchase right (a “Right”) for each outstanding share of common stock, par value $.001 per share, of the Company. The dividend was paid on July 29, 2002 to the stockholders of record on that date. Stock issued subsequent to July 29, 2002 will be issued with an attached Right. Each Right will initially represent the rights, under certain circumstances, to purchase one one-thousandth of a share of Series A Junior Participating Preferred Stock (the “Junior Preferred Stock”) at a purchase price of $80 per one one-thousandth of a share. If a person or group acquires beneficial ownership of 20% or more of the then outstanding shares of the Company's common stock (an “Acquiring Person''), the holder of a Right, upon exercise of the Right, will thereafter have the right to receive, in lieu of shares of Junior Preferred Stock, shares of the Company's common stock (or, in certain circumstances, cash, property or other securities of the Company) having a value equal to twice the purchase price of the Right.

ITEM 4. SUBMISSION OF MATTERS TO A VOTE OF SECURITY HOLDERS

The Annual Meeting of Stockholders of Internet Security Systems, Inc. was held on Wednesday, May 29, 2002.

The following two directors were elected to serve a three-year term ending in the year 2005: (a) Richard S. Bodman, 42,113,700 votes for and 395,908 votes withheld, and (b) Kevin J. O’Connor, 42,257,284 votes for and 252,324 votes withheld.

Our Restated 1995 Stock Incentive Plan was amended to prohibit certain amendments to the plan without stockholder approval and to change the Automatic Option Grant Program for non-employee directors by reducing the initial grant to non-employee directors to 20,000 options and increasing the annual grant to non-employee directors to 10,000 options. The vote was as follows: (a) Voting For: 25,783,653, (b) Voting Against: 16,712,609, (c) Abstentions: 13,345. There were no broker non-votes for purposes of this proposal.

INTERNET SECURITY SYSTEMS, INC.
MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND
RESULTS OF OPERATIONS

ITEM 6. EXHIBITS AND REPORTS ON FORM 8-K


(a)	Exhibits.

	3.1	—	Restated Certificate of Incorporation (filed as Exhibit 3.1 to the Company’s Quarterly Report on Form 10-Q, dated November 14, 2000 and incorporated by reference herein).

	3.2	—	Bylaws (filed as Exhibit 3.2 to the Company’s Registration Statement on Form S-1, Registration No. 333-44529 and incorporated by reference herein).

	11	—	Computation of Per Share Earnings.*

	99.1	—	Certification Pursuant to 18 U.S.C. Section 1350, as Adopted Pursuant to Section 906 of the Sarbanes-Oxley Act of 2002.

	99.2	—	Certification Pursuant to 18 U.S.C. Section 1350, as Adopted Pursuant to Section 906 of the Sarbanes-Oxley Act of 2002.

(b)	Reports on Form 8-K.

	ISS filed no reports on Form 8-K during this reporting period.

*Data required by SFAS No. 128, “Earnings Per Share,” is provided in note 5 to the consolidated financial statements in this report.

INTERNET SECURITY SYSTEMS, INC.
MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND
RESULTS OF OPERATIONS

INTERNET SECURITY SYSTEMS, INC. SIGNATURES

Pursuant to the requirements of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned thereunto duly authorized.


	INTERNET SECURITY SYSTEMS, INC.



Date: August 13, 2002	By	/s/ Richard Macchia

		Chief Financial Officer Vice President and Chief Financial Officer

		(Duly Authorized Officer and Principal Financial Officer)

	By	/s/ Maureen Richards

		Corporate Controller
		(Chief Accounting Officer)

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

	•		persuasive evidence of an arrangement exists;

	•		delivery has occurred or services have been rendered;

	•		price is fixed and determinable; and

	•		collection is probable.

	•		vendor specific objective evidence (VSOE) of fair value of the undelivered elements;

	•		the functionality of the delivered elements is not dependent on the undelivered elements; and

	•		delivery of the delivered elements represents the culmination of the earnings process.

	•		respond to competitive developments;

	•		continue to upgrade and expand our product and services offerings; and

	•		continue to attract, retain and motivate our employees.

	•		the growth in the acceptance of, and activity on, the Internet and the World Wide Web, particularly by corporate, institutional and government users;

	•		the extent to which the public perceives that unauthorized access to and use of online information are threats to network security;

	•		the volume and timing of orders, including seasonal trends in customer purchasing;

	•		our ability to develop new and enhanced product and managed service offerings and expand our professional services capabilities;

	•		our ability to provide scalable managed services offerings through our partners in a cost effective manner;

	•		foreign currency exchange rates that affect our international operations;

	•		product and price competition in our markets; and

	•		general economic conditions, both domestically and in our foreign markets.

	•		internal information technology departments of our customers and the consulting firms that assist them in formulating security systems;

	•		relatively smaller software companies offering relatively limited applications for network and Internet security;

	•		large companies, including Symantec Corp., Cisco Systems, Inc. and Enterasys Networks, Inc., that sell competitive products and offerings, as well as other large software companies that have the technical capability and resources to develop competitive products;

	•		software or hardware companies like Cisco Systems, Inc. that could integrate features that are similar to our products into their own products; and

	•		small and large companies with competitive offerings to components of our managed services offerings.

	•		the extent to which businesses and others seek to establish more secure networks;

	•		the extent to which hackers and others seek to compromise secure systems;

	•		evolving computer hardware and software standards;

	•		changing customer requirements; and

	•		frequent introductions of new products and product enhancements.

	•		the difficulty in managing an organization spread over various countries located across the world;

	•		compliance with, and unexpected changes in, a wide range of complex regulatory requirements in countries where we do business;

	•		increased financial accounting and reporting burdens and complexities and potentially adverse tax consequences;

	•		excess taxation due to overlapping tax structures;

	•		fluctuations in foreign currency exchange rates resulting in losses or gains from transactions and expenses denominated in foreign currencies;

	•		reduced protection for intellectual property rights in some countries; and

	•		export license requirements and restrictions on the export of certain technology, especially encryption technology and trade restrictions.