UNITED STATES
SECURITIES AND EXCHANGE COMMISSION

FORM 10-Q

Commission File Number 000-23655

INTERNET SECURITY SYSTEMS, INC.

(Exact name of registrant as specified in its charter)

6303 BARFIELD ROAD, ATLANTA, GEORGIA 30328
(Address of principal executive offices)

Registrant’s telephone number, including area code (404) 236-2600

     Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes [X] No [   ]

     Indicate by check mark whether the registrant is an accelerated filer (as defined in Rule 12b-2 of the Exchange Act). Yes [X] No [   ]

     Indicate the number of shares outstanding of each of the registrant’s classes of common stock, as of the latest practicable date.

2

PART I. FINANCIAL INFORMATION

Item 1. Consolidated Financial Statements

INTERNET SECURITY SYSTEMS, INC.

See accompanying notes

3

INTERNET SECURITY SYSTEMS, INC.

See accompanying notes

4

INTERNET SECURITY SYSTEMS, INC.

See accompanying notes

5

INTERNET SECURITY SYSTEMS, INC.

Note 1. Significant Accounting Policies

Basis of Presentation

     The consolidated financial statements of Internet Security Systems, Inc. (“ISS” or the “Company”) as of June 30, 2004 and for the three months and six months ended June 30, 2004 and 2003 are unaudited and, in the opinion of management, contain all adjustments, consisting of normal recurring items, necessary for the fair presentation of the financial position and results of operations of the Company for the interim periods. The consolidated financial statements include the accounts of the Company and its majority-owned subsidiaries. The consolidated balance sheet at December 31, 2003 has been derived from the audited financial statements at that date but does not include all of the footnotes required by accounting principles generally accepted in the United States for complete financial statements.

     These consolidated financial statements should be read in conjunction with the Consolidated Financial Statements and Notes thereto included in the Company’s Annual Report on Form 10-K for the year ended December 31, 2003. The results of operations for the three months and six months ended June 30, 2004 are not necessarily indicative of the results to be expected for the entire year. All significant intercompany accounts and transactions have been eliminated.

     Certain prior period amounts have been reclassified to conform to current period presentation.

     The preparation of financial statements and related disclosures in conformity with accounting principles generally accepted in the United States requires management to make estimates and assumptions that affect the amounts reported in the financial statements and accompanying notes. Actual results may differ from those estimates, and such differences may be material to the consolidated financial statements.

Goodwill and Intangibles

     Goodwill and intangible assets are comprised of the following, as of the dates indicated (in thousands):

     The changes in the carrying amounts of goodwill and other intangibles from December 31, 2003 to June 30, 2004 were primarily a result of the purchase of Cobion AG (“Cobion”) (see Note 3) and additional consideration related to a 2002 acquisition of TriSecurity Holdings Pte Ltd., resulting in approximately $22.3 million of goodwill and $16.5 million of other intangibles recorded during the first quarter of 2004. The remaining fluctuation is the result of currency translation adjustments.

     The Company amortizes intangible assets over their estimated useful lives of eight years for core technology, five years for developed technology, three to six years for work force and three years for customer relationships. Amortization expense of intangible assets is as follows (in thousands):

6

     The estimated future amortization expense of intangible assets as of June 30, 2004 is as follows (in thousands):

     The Company amortized $375,000 relating to the purchase of a software license used in certain of its products. Those costs are included in research and development expense.

Stock-Based Compensation

     Statement of Financial Accounting Standard 123, “Accounting for Stock-Based Compensation” (“SFAS 123”), as amended by SFAS 148, “Accounting for Stock-Based Compensation - Transition and Disclosure,” establishes accounting and reporting standards for stock-based employee compensation plans. As permitted by SFAS 123, ISS continues to account for stock-based compensation in accordance with Accounting Principles Board Opinion No. 25, “Accounting for Stock Issued to Employees” (“APB 25”), and has elected the pro forma disclosure alternative of SFAS 123.

     Although SFAS 123 allows the Company to continue to follow APB 25 guidelines, the following table shows pro forma net loss and pro forma net loss per share for the periods indicated as if the Company had adopted SFAS 123. The following table illustrates the effect on net income per share if the provisions of SFAS 123 had been applied. The pro forma impact of applying SFAS 123 as illustrated below will not necessarily be representative of the pro forma impact in future years. Pro forma information is as follows (amounts in thousands, except per share amounts):

     In 2004, 295,000 restricted shares were issued to officers and certain key employees of ISS. These shares vest in two installments: 50% vests two years from the grant date, and the remaining 50% vests three years from the grant date. Upon issuance of restricted shares, unearned compensation is recorded in stockholders’ equity as deferred compensation equal to the market value of the restricted shares and is recognized as compensation expense over the vesting period. Total compensation expense for restricted stock awards, including the expense for 13,000 restricted shares issued to directors in 2003, amounted to $539,000 in the second quarter of 2004 and $925,000 in the six months ended June 30, 2004.

Note 2. Income Taxes

     The Company recorded tax provisions of $3.1 million and $3.0 million for the three-month periods ended June 30, 2004 and 2003, respectively, and tax provisions of $6.1 million and $6.3 million for the six-month periods ended June 30, 2004 and 2003, respectively. While income tax expense was recorded on domestic income, the amount of domestic taxes payable was reduced by deductions related to the employee exercise of stock options in current and prior periods. The tax benefit of these deductions was

7

recorded as additional paid-in capital. Taxes paid generally relate to foreign operations and certain state taxes for which net operating loss deductions have been suspended.

     The effective tax rate was approximately 36% for the three and six months ended June 30, 2004 and 38% for the three and six months ended June 30, 2003. The effective rates differ from the statutory rates due primarily to the impact of acquisition-related intangibles that are not deductible for income tax purposes.

     As of June 30, 2004, ISS had a net operating loss carryforward of approximately $7.5 million related to US operations. The tax benefit of this carryforward will be recorded as additional paid-in capital as realized. There are also approximately $8.3 million of research and development tax credit carryforwards that expire between 2011 and 2023 and foreign tax credit carryforwards of $2.9 million that expire between 2006 and 2008.

     In addition, Cobion, which was acquired by ISS in January 2004, has a net operating loss carryforward of approximately $9.1 million. The tax value of this loss has been recorded as a deferred tax asset and the Company will not recognize a provisional benefit as this loss is utilized.

Note 3. Business Acquisition

     In January 2004, ISS acquired Cobion, a privately held company based in Kassel, Germany. Cobion provides content filtering and anti-spam technology that protects individuals and enterprises against unwanted Web content, spam, misuse of information and lost productivity. The Company is continuing to sell the Cobion product on a stand-alone basis as well as including the technology in the Company’s multi-function Proventia appliance.

     Total cash consideration for all of the outstanding shares of Cobion and the acquisition related fees were approximately $33.5 million. The Company adopted a plan to restructure Cobion whereby certain Cobion employees were terminated over a six-month period following the acquisition. As a result, acquisition costs included the accrual of $203,000 of severance costs associated with these terminations. As of June 30, 2004, approximately $95,000 remained in the accrual and will be paid out during the third quarter of 2004.

     The operating results of Cobion are included in the consolidated financial statements of ISS from the date of acquisition. The adjusted aggregate purchase price was allocated based on a valuation report of the Cobion intangibles as follows (in thousands):

     The Company is amortizing these intangible assets over their estimated useful lives of five years for developed technology and three years for customer relationships.

     The tangible assets of Cobion acquired in the merger consisted primarily of cash, accounts receivable and fixed assets. The liabilities of Cobion assumed in the merger consisted primarily of accounts payable, accrued expenses and deferred revenue.

     The following summarizes the unaudited pro forma results of operations of the Company for the three months and six months ended June 30, 2003, assuming the acquisition of Cobion was concluded as of the beginning of 2003: (i) revenues of $59.3 million and $119.0 million, respectively, (ii) net income of $4.1 million and $8.1 million, respectively (iii) basic and diluted net income per share of Common Stock of $.08 and $0.16, respectively. Net income and basic and diluted net income per share of Common Stock have been adjusted to reflect the amortization of intangibles identified above. Unaudited pro forma results are not included for the corresponding period of 2004 as the impact of the acquisition would have been immaterial to the consolidated results of operations. This pro forma information is not necessarily indicative of what combined operations would have been if ISS had control of Cobion from the beginning of 2003.

8

Note 4. Comprehensive Income

     The components of comprehensive income are as follows (in thousands):

Note 5. Income per Share

The following table sets forth the computation of basic and diluted net income per share (amounts in thousands, except per share amounts):

Note 6. Segment and Geographic Information

     ISS conducts business in one operating segment: providing information security management solutions. The Company does, however, prepare operating results for internal use on a geographic basis. These geographical based operating costs consist of direct sales expenses, infrastructure to support its employee and customer and partner base, supporting billing and financial systems and a management team. Corporate expenses that are not charged directly to the other segments include research and development, general and administrative costs that support the global organization, amortization of intangibles, stock-based compensation and goodwill and costs that are one-time in nature, such as acquired in-process research and development.

     The accounting policies of the segments are the same as those described in the summary of significant accounting policies. There are no inter-segment sales. Our chief executive officer and chief financial officer evaluate performance based on operating profit or loss from operations, and trade accounts receivable for each segment. Other than trade accounts receivable, assets and liabilities are not discretely allocated or reviewed by segment.

     In accordance with SFAS No. 131, “Disclosures about Segments of an Enterprise and Related Information,” the Company has included a summary of the segment financial information reported internally. The geographic segments are the Americas, Europe, Middle East and Africa (“EMEA”), and the Asia/Pacific region.

     The following table presents ISS’s revenues, operating expenses and operating income (loss) by reportable geographic segment (in thousands):

9

10

Note 7. Commitments and Contingencies

     The Company and certain of its officers and directors were named as defendants in a consolidated amended complaint that was filed in the United States District Court for the Northern District of Georgia on October 9, 2002. The lawsuit purported to be brought on behalf of a class of investors who purchased the Company’s stock during the period from April 5, 2001 through August 14, 2001. The lawsuit alleged violations of the federal securities laws. On September 3, 2003, the court dismissed, with prejudice, the consolidated amended complaint and all rights to appeal have expired.

Note 8. Exit or Disposal Activities

     In the fourth quarter of 2003, the Company committed to a plan of cost reduction and exit activities through the closing of its engineering operations in Reading, U.K. and Sydney, Australia.

     At December 31, 2003 the Company had accrued the following costs associated with these exit activities: one-time termination benefits of $152,000; contract termination costs of $184,000 and other costs of $31,000. One-time termination benefits consisted of severance and benefits for involuntarily terminated employees. The contract termination costs include costs for remaining lease payments on vacated facilities and costs associated with vacating the facility. Other costs consisted primarily of write-off of abandoned fixed assets and the write-off of leasehold improvements related to the vacated facilities.

     At June 30, 2004 all of the one-time termination benefits had been paid out. The remaining liability at June 30, 2004 of approximately $195,000 consists primarily of contract termination costs associated with the final settlement of the office lease in Reading, U.K. The Company expects to utilize the remaining balance of the exit costs by December 31, 2004.

11

INTERNET SECURITY SYSTEMS, INC.

Item 2. Management’s Discussion and Analysis of Financial Condition and Results of Operations

     The following Management’s Discussion and Analysis of Financial Condition and Results of Operations should be read in conjunction with the Consolidated Financial Statements and related Notes thereto included elsewhere in this Quarterly Report on Form 10-Q, as well as the Management’s Discussion and Analysis of Financial Condition and Results of Operations and the Consolidated Financial Statements and Notes thereto included in our Annual Report on Form 10-K for the year ended December 31, 2003 as filed with the Securities and Exchange Commission (“SEC”).

     Except for the historical financial information, many of the matters discussed in this Item 2 may be considered “forward-looking” statements. Forward-looking statements can be identified by the use of words such as “may,” “will,” “should,” “could,” “continue,” “future,” “potential,” “believe,” “project,” “ forecast,” “plan,” “intend,” “seek,” “estimate,” “predict,” “expect,” “anticipate” and similar expressions, or the negative of such terms, or other comparable terminology. Forward-looking statements also include the assumptions underlying or relating to any of the foregoing statements. Such forward-looking statements are not guarantees of future performance and involve a number of risks and uncertainties. Our actual results could differ materially from those anticipated in these forward-looking statements as a result of various factors, including those set forth below under the caption “Risk Factors” and those otherwise described from time to time in our Securities and Exchange Commission reports filed after this Form 10-Q. All forward-looking statements included in this Form 10-Q are based on information available to ISS on the date hereof. We assume no obligation (except where required by law) to update any forward-looking statements for any events or circumstances occurring after the date of this Form 10-Q.

Overview

     We protect gateways, networks, servers and desktops against an ever-changing spectrum of threats, with a comprehensive line of products and services designed specifically for the enterprise, service provider, risk management, small business and consumer markets. These threat protection solutions go beyond basic access control to deliver multiple layers of defense that detect, prevent and respond to threats prior to those threats causing damage to our customers’ business operations.

     Our family of products is a critical element of an active Internet and networking security program within today’s world of global connectivity, enabling organizations to proactively monitor, detect and respond to risks to enterprise information. Prior to 2003, our products were exclusively software, providing intrusion detection and vulnerability assessment solutions. In 2003, we began to sell a new line of products called Proventia, which includes an appliance pre-loaded and configured with our network-based software solutions for intrusion detection and in-line intrusion prevention. Initial customer response has been positive, with this line representing 49% of product and license sale revenues for the first six months of 2004. We believe this new product line is critical to our product sales growth and the ongoing subscription revenues associated with such sales.

     In the fourth quarter of 2003, our product offerings expanded to include multi-function Proventia appliances that include firewall, virtual private network (“VPN”) and anti-virus protection in addition to intrusion protection. We added content filtering and anti-spam features to this product line in the second quarter of 2004. We believe this expanded product offering significantly increases our market opportunity as well as our risk from broader competition. While there have been increasing levels of sales of this multi-function appliance since it’s introduction in December 2003, our expectations for future revenue growth are dependent on successfully penetrating both our existing intrusion protection market and new network security markets. This product also has a different pricing model than our traditional pricing models, which results in a more significant portion of the sales price being deferred and recognized as subscription revenues over a specified term.

     Our managed services offerings currently provide remote management of our best-of-breed security technology, focusing on security assessment and intrusion protection systems, and include firewalls, VPNs, anti-virus and URL filtering software. We focus on serving as the trusted security provider to our customers by maintaining within our existing products the latest counter-measures to security risks, creating new innovative products based on our customers’ needs and providing professional and managed services.

     Many factors will affect our future financial performance, especially our ability to differentiate our offerings from competitors that include much larger companies with greater marketing capabilities, financial resources and brand recognition. In order to continue to create such differentiation, we expect to continue to expand the reach of our domestic and international sales operations through channel partners; seek acquisition candidates and alliances with partners whose products, technologies or services capabilities are complementary to our solutions; and improve our internal operating and financial infrastructure in support of our strategic goals and

12

objectives. At the same time, we expect to adjust our organization size in light of changing economic conditions and maintain emphasis on controlling current period expenses and capital expenditures. While we believe in the long-term success of our business solutions our prospects should be considered in light of the recent experience, risks and uncertainties that are frequently encountered by companies serving rapidly evolving markets. See “Risk Factors.”

Critical Accounting Policies

     The consolidated financial statements were prepared in conformity with accounting principles generally accepted in the United States. As such, management is required to make certain estimates, judgments and assumptions it believes are reasonable based upon the information available. These estimates and assumptions affect the reported amounts of assets and liabilities at the date of the financial statements and the reported amounts of revenues and expenses during the periods presented. The significant accounting policies which management believes are the most critical to aid in fully understanding and evaluating our reported financial results include the following:

Revenue recognition

We recognize revenue in the following categories:

-

Product licenses and sales, which include revenue from sales of perpetual software licenses and products;

-

Subscription revenues, which include product support and content updates, term licenses, subscription licenses, and managed service arrangements; and

-

Professional services revenues, which includes fee-based service engagements and training.

     We recognize software license revenue under Statement of Position (“SOP”) 97-2, Software Revenue Recognition, as modified by SOP 98-9, Software Revenue Recognition with Respect to Certain Transactions, when the following criteria have been met:

-

persuasive evidence of an arrangement exists;

-

delivery has occurred or services have been rendered;

-

price is fixed or determinable; and

-

collection is probable.

Product licenses and sales

     We recognize perpetual software license revenues, assuming all other revenue recognition criteria are met, upon (1) delivery of the software and (2) issuance of the related license, assuming that no significant vendor obligations or customer acceptance rights exist. Where payment terms are extended over periods greater than 12 months, revenue is recognized as such amounts become due and payable. Revenue is also deferred when payment terms are extended for periods less than twelve months and such sales are deemed either not to be fixed or determinable or collection is not probable based on evaluation of all terms of the transaction.

     Product sales consist primarily of appliances sold in conjunction with ISS licensed software. These sales are recognized upon shipment to the customer provided all other revenue recognition criteria are met.

     Sales of enterprise products are generated both through direct sales to end-users as well as through various partners, including system integrators, value-added resellers and distributors. Revenue from product licenses and sales revenue is recognized when the sale has occurred for an identified end user, provided all other revenue recognition criteria are met. At the point of delivery, the customer has no right of return.

     Our historical rate of returns by customers of our products is negligible. We offer evaluation software available via download from our website and evaluation units for appliance-based products that allow potential customers to see the functionality of the products on their own networks.

Subscription revenues

     Renewable product support and content updates are separate components of product licenses and sales. Term licenses allow customers to use our products and receive product support coverage and content updates for a specified period, generally 12 months. We generally invoice for product support, content updates and term licenses at the beginning of the term and recognize revenue

13

ratably over the subscription term. Security monitoring and management services for information assets and systems are part of managed services and associated revenues are recognized and billed as such services are provided.

     Historically, our appliance and software sales have been accounted for primarily as revenue at the time of sale, with product support and content updates generally representing between 20% and 30% of the license or product amount. With the introduction of our Proventia multi-function appliances, the majority of the initial price paid by the customer may be for content provided for a specified term that will be recorded initially in deferred revenues and recognized over the term as subscription revenue.

Professional services revenues

     Service engagements are typically billed on either a fixed fee or time-and-materials basis and primarily consist of security assessments of customer networks and the development of customers’ security policies. These offerings are intended to support our goal of providing products and managed services. We prefer to have our partners provide these services where practical. We recognize such professional services revenues as the related services are rendered.

Multiple elements arrangements

     Multiple element arrangements can include any combination of our products and services listed above. When some elements are delivered prior to others in an arrangement, all revenue is deferred until the delivery of the last element unless all of the following exist:

-

vendor specific objective evidence (“VSOE”) of fair value of the undelivered elements;

-

the functionality of the delivered elements is not dependent on the undelivered elements; and

-

delivery of the delivered elements represents the culmination of the earnings process.

     When these criteria have been met, we allocate revenue to the delivered software product using the residual method. Under the residual method, we allocate discounts inherent in the arrangement entirely to the product that is initially delivered and recognize the other elements as they are delivered based on the VSOE, which is typically determined by the company selling those elements separately.

Allowance for doubtful accounts

     Our sales are global, with customers located in the Americas, Europe, Middle East and Africa (“EMEA”), and Asia/Pacific regions. We perform periodic credit evaluations of our customer’s financial condition and do not require collateral. We provide for estimated credit losses as such losses become probable. We evaluate specific accounts when we become aware of a situation where a customer may not be able to meet its financial obligations due to deterioration of its liquidity or financial viability, credit ratings or bankruptcy. The allowance for doubtful accounts is established based on the best facts available to us and is reevaluated and adjusted as additional information is received. At June 30, 2004, the allowance for doubtful accounts totaled $3.0 million, or 4.4% of the $69.0 million of total trade receivables. This 4.4% allowance percentage of receivables reflects our practice to leave accounts on our general ledger and provide reserves pending final resolution of collectibility rather than to write-off such accounts. During the second quarter of 2004 and 2003, we incurred bad debt expense of $240,000 and $628,000, respectively, and during the first six months of 2004 and 2003, we incurred bad debt expense of $529,000 and $1.0 million, respectively.

     While actual credit losses have historically been within management’s expectations and the provisions established, we cannot guarantee that we will continue to experience the same credit loss rates we have in the past. If the financial condition of our customers were to deteriorate, resulting in an impairment of their ability to make payments, additional allowances may be required.

Impairment of goodwill and other long-lived and intangible assets

     We review goodwill for impairment on an annual basis or on an interim basis whenever events or changes in circumstances indicate that the carrying amount of an asset may not be recoverable. All other long-lived and intangible assets are reviewed for impairment whenever events or circumstances indicate that the carrying amount of an asset may not be recoverable. Such impairment loss would be measured as the difference between the carrying amount of the asset and its fair value based on the present value of

14

estimated future cash flows. Significant judgment is required in the forecasting of future operating results, which are used in the preparation of projected cash flows. Due to uncertain market conditions and potential changes in our strategy and products, it is possible that forecasts used to support our intangible assets may change in the future, which could result in significant non-cash charges that would adversely affect our results of operations.

     We currently have goodwill and other acquisition related intangibles of approximately $250 million, with $195 million of goodwill related to our June 2001 acquisition of Network ICE Corporation (“Network ICE”) and $22 million of goodwill related to the January 2004 acquisition of Cobion. The determination of whether or not goodwill is impaired involves significant judgments based upon short and long-term projections of future performance. We have concluded that this amount is realizable based on forecasted discounted cash flows through 2007 and on our stock market valuation. Neither method indicated that our goodwill had been impaired and, as a result, we did not record any impairment losses related to goodwill during the three months or six months ended June 30, 2004. Other intangibles of approximately $22 million are principally acquired technology from the Network ICE and Cobion acquisitions that are a primary component in our current product offerings.

Acquisitions

     We believe that our total solutions approach will positively impact our revenue. This includes our products, managed services offerings, and product content and support. While we expect the expansion of these product and service offerings to originate primarily from internal development, our strategy includes acquiring products, technologies and service capabilities that fit within our strategy and could potentially accelerate the timing of the commercial introduction of such products and technologies.

     On January 14, 2004, we acquired Cobion, a privately held company based in Kassel, Germany. Cobion provides content filtering and anti-spam technology that protects individuals and enterprises against unwanted Web content, spam, misuse of information and lost productivity. We are continuing to sell the Cobion product on a stand-alone basis and to OEM partners to incorporate in their products as well as include the technology in our multi-function Proventia appliance in 2004.

     ISS paid cash of approximately $33.5 million for all of the outstanding shares of Cobion and the acquisition related fees. We also adopted a plan to restructure Cobion whereby certain Cobion employees were terminated over a six-month period following the acquisition. As a result, acquisition costs included the accrual of $203,000 of severance costs associated with these terminations. As of June 30, 2004, we had paid out the substantial portion of the severance and will finish paying out the remaining severance of approximately $95,000 against this accrual in the third quarter of 2004.

Results of Operations

     The following table sets forth our consolidated historical operating information, as a percentage of total revenues, for the periods indicated:

15

Revenues

Product licenses and sales

     Product licenses and sales, including perpetual licenses and sales of partner software and hardware appliances, represented 42% of total revenues for both the three-month and six-month periods ended June 30, 2004 as compared with 41% and 43% for the three and six month periods ended June 30, 2003. Although the percentages of total revenue remained comparable, the products making up this revenue component have changed significantly over the last twelve months.

     Since the second quarter of 2003, we have offered the Proventia family of network protection appliances that collectively provides unified, multi-function protection capabilities designed to identify and prevent many forms of attack with minimal user intervention. These products are designed to operate in demanding network environments while being easy to deploy, easy to use and centrally managed, all in an effort to make our solution more cost-effective. In the second quarter of 2004, Proventia represented 50% of our product and license revenues and 49% for the six-month period ended June 30, 2004. We experienced an 18% overall growth in product and license revenues to $28.9 million over the second quarter of 2003 and a 14% overall growth in product and license revenues to $57.6 million over the first half of 2003.

     Our future growth is dependent on a continuation of the positive market response to our Proventia family of products. During 2004, we expect to extend Proventia in software form to our server and desktop solutions. This expected growth is critical as it represents not only product and license revenues, but also subscription revenues from product support and content. This is particularly important with respect to our multi-function Proventia appliances where the majority of the product sale is software blades licensed on a subscription basis and therefore recognized as subscription revenue over the license period.

     Our present product roadmap focuses our development on product offerings and enhancements that will provide broader Proventia appliance offerings and continue to improve central control and manageability, easier deployment and more refined information. We expect that this focus will make our products more cost effective to implement and maintain and will increase the future level of product licenses and sales.

Subscriptions

     Subscriptions revenue represented 49% of total revenues in the three months ended June 30, 2004 increasing from 47% of total revenues in the three months ended June 30, 2003. This was an increase of 23% from $27.9 million in the second quarter of 2003 to $34.3 million in the second quarter of 2004. For the six months ended June 30, 2004, subscriptions revenue increased to 49% of total revenues from 46% of total revenues in the six months ended June 30, 2003. On a year-to-date basis, there was an increase of 22% from $54.8 million for the six months ended June 30, 2003 to $67.1 million for the comparable period of 2004.

Subscriptions revenue consists of product support and content updates, term licenses of products and security-monitoring fees for our managed services offerings. Product content and support revenues, the largest component of subscriptions revenue, remained comparable at 31% and 32% of total revenues in the three months ended June 30, 2004 and 2003, respectively. For the six-month periods ended June 30, 2004 and 2003, product content and support revenues remained at 31%. Product content and support includes hardware support of our Proventia appliances, software updates and software blades, technical support and security content, which are provided through contracts executed with customers for a specified term and billed at the time of contract. Such billings are recorded as deferred revenues on our balance sheet and amortized as subscription revenue over the term of the contract. We expect product content and support revenues to increase in the future as our client base that generates product content and support revenues expands as a result of the pricing model of our multi-function Proventia appliance. The majority of the sale amount of our multi-function Proventia appliances is typically associated with the software blades licensed on a subscription basis and included as subscription revenues. For the three months ended June 30, 2004, software license blade sales exceeded the amortization of blade sales by approximately $200,000. For the six months ended June 30, 2004 sales of software license blades exceeded the amortization of blades by approximately $1,565,000.

     Managed services revenue accounted for 13% of total revenues for both the three months and six months ended June 30, 2004, as compared with 11% in the corresponding periods of 2003. We believe these increases were due to a strong demand in the market for proven, financially sound, managed security service providers. We are marketing managed services both directly to end users and through partners, including a number of new arrangements with integrators and service providers that include managed services as a part of their service offerings to their customers. We also expect sales of managed services to continue to grow steadily as we focus our efforts on marketing offerings to new and existing customers that meet changing needs in today’s environment.

16

Professional services

     Professional services revenue decreased both in absolute dollars and as a percentage of total revenues from 12% in the three months ended June 30, 2003 to 9% in the three months ended June 30, 2004 and from 11% in the six months ended June 30, 2003 to 9% in the six months ended June 30, 2004. This trend is largely the result of our conscious effort to look to our system integration and channel partners to serve as the primary resource to fulfill the services and education needs of our customers.

Geographic regions

     Geographically, we derived the majority of our revenues from sales to customers within the Americas region. Revenues by region represented the following percentages of total revenues for the periods indicated:

     While there have been changes in the proportion of revenues generated by each region, all of the regions experienced growth in revenues when comparing both the three and six-month periods ended June 30, 2004 and 2003. Revenues in EMEA benefited not only from volume growth, but also from a strengthening currency over the last twelve months, since products are primarily sold in the Euro. The financial data for each segment can be found in Note 6 to the Consolidated Financial Statements.

Costs and Expenses

Personnel

     Personnel and related costs represent our largest expense category. We ended the first half of 2004 with 1,220 employees, up from 1,150 at the beginning of the year. This increase occurred primarily from the January 2004 acquisition of Cobion.

     We began to use restricted stock, in addition to stock options, as an equity component of compensation beginning in the first quarter of 2004 and expensed $539,000 in the second quarter of 2004 and $925,000 in the first half of 2004 in the expense category in which the recipients are included.

Cost of product licenses and sales

     Cost of product licenses and sales consists of several components. Costs associated with licensing our software products are minor. The substantial portion of our cost of product licenses and sales represents the hardware cost of our Proventia appliances and payments to partners for their products that we sell or integrate with our managed service offerings. This cost, as a percentage of product licenses and sales revenue, increased from 7% in the quarter ended June 30, 2003 to 17% in the quarter ended June 30, 2004. On a year-to-date basis, cost of product licenses and sales increased from 6% of product licenses and sales revenue in 2003 to 16% in 2004. The increase is due to the introduction of the Proventia appliance line beginning in the second quarter of 2003 and we expect the cost of product licenses and sales to continue to increase in future periods with the continued growth of Proventia appliance sales.

Cost of subscriptions and professional services

     Cost of subscriptions and professional services includes the cost of our technical support personnel who provide assistance to customers under product support agreements, the security operations center costs of providing managed security monitoring services and the costs related to our professional services and training. These costs, as a percentage of subscription and professional services revenues, decreased from 36% and 37% in the three and six months ended June 30, 2003, respectively, to 31% in both the three and six months ended June 30, 2004 as the result of higher subscription revenues from Proventia sales and cost efficiencies.

     Costs associated with our technical support personnel and our security operations centers increased as we added personnel to handle additional customers. We gained efficiencies in our security operations centers and restructured our support groups to be more productive so personnel increased at a much lower rate than revenue growth, contributing to the decrease in those costs as a percentage of total revenues. While we continue to seek increased productivity, we do expect to increase costs with a continued increase in revenues in the future.

17

     Offsetting this increase of costs associated with our technical support personnel and our security operations centers is a decrease in costs commensurate with the decrease in professional services and education services revenues

Research and development

     Research and development expenses consist of salary and related costs of research and development personnel, including costs for employee benefits, and depreciation on computer equipment. These costs include those associated with maintaining and expanding the X-Force, our internal team of security experts. We believe our primary research and product development and managed service offerings are important to retaining our leadership position in the market.

     We continue to add functionality to our product family, providing gateway, network, server and desktop-based solutions, as well as to our security management applications. These improvements, as well as new offerings, are intended to provide our customers with more powerful and easier-to-use solutions for security management across the enterprise.

     In the first half of 2004, we introduced the following:

•

Proventia™ G1200 and G1200-400 Intrusion Prevention Appliances, designed specifically for highly centralized and space-limited network environments.

•

Proventia™ M30 and M10 Multi-Function Protection Appliance, an all-in-one appliance that identifies and blocks known and unknown threats, as well as unwanted traffic, in a single easy-to-use and manage device.

     Research and development expenses increased in absolute dollars from $10.1 million in the three months ended June 30, 2003 to $11.4 million in the three months ended June 30, 2004 and represented 17% and 16% of total revenues, respectively. On a year-to-date basis, these costs increased in absolute dollars from $19.8 million in the first half of 2003 to $22.7 million in the first half of 2004 and represented 17% of total revenues in both periods. The increase in absolute dollars is principally due to the acquisition of Cobion and the amortization of development source code that was licensed in the first quarter of 2004 and is used in our Proventia products. Additionally, we continue to streamline operations as we relocated some engineering functions from our California development facility to Atlanta and offshore with some further streamlining scheduled for the third quarter of 2004.

     While we are committed to continue our investment in X-Force research and development capabilities, which we believe distinguishes ISS from its competitors, we intend to seek leverage in future periods in the research and development area while enhancing current technologies and developing new technologies.

Sales and marketing

     Sales and marketing expenses consist of salaries, travel expenses, commissions, advertising, maintenance of our website, trade show expenses, costs of recruiting sales and marketing personnel and costs of marketing materials. Sales and marketing expenses increased in absolute dollars from $21.0 million in the three months ended June 30, 2003 and $42.2 million in the six months ended June 30, 2003 to $24.1 million and $48.5 million, respectively, in the corresponding periods of 2004. As a percentage of total revenues, sales and marketing expenses decreased from 36% in the three and six months ended June 30, 2003 to 35% in the comparable periods of 2004. This increase in absolute dollars is due to an increase in our overall sales headcount. In addition, the 18% increase in product licenses and sales revenue from the second quarter of 2003 to the comparable period of 2004 resulted in increased commission expense.

     We expect to achieve leverage in our sales efforts by focusing our direct touch sales force on large customers that are served either directly by us or through large systems integrators. Our channel, which includes systems integrators, value-added resellers and distributors, will continue to be of increasing importance to us. We intend to expand the number of partners and use their capabilities to sell to smaller companies and departments of larger companies, as well as extend our reach to larger enterprises through joint selling efforts.

General and administrative

     General and administrative expenses consist of personnel-related costs for executive, administrative, finance and human resources, internal information systems and other support services costs, and legal, accounting and other professional service fees.

18

     General and administrative expenses of $6.3 million in the second quarter of 2004 and $12.6 million in the first half of 2004 and $5.4 million in the second quarter of 2003 and $11.0 million in the first half of 2003 represented 9% of total revenues in all four periods. The increase in absolute dollars is the result of increased costs associated with public company matters such as audit fees and the incremental cost in 2004 of financial control documentation and testing required by Section 404 of the Sarbanes-Oxley Act of 2002.

Amortization

     We incurred amortization expense related to intangible assets and stock-based compensation of $1.8 million in the three months ended June 30, 2004 and $1.3 million in the three months ended June 30, 2003. For the six-month periods, amortization expense was $3.6 million in 2004 and $2.7 million in 2003. These intangible assets and stock-based compensation resulted from acquisitions accounted for under the purchase method of accounting and are amortized over their estimated useful lives and vesting period, respectively. The increase is a result of the amortization of intangibles related to our acquisition of Cobion in the first quarter of 2004.

Interest income

     Interest income decreased from $737,000 in the quarter ended June 30, 2003 to $464,000 in the comparable quarter of 2004 and from $1.4 million in the six months ended June 30, 2003 to $992,000 in the comparable period of 2004. The difference in interest income results from our decrease in yield on investment-quality commercial paper and similar investments from approximately 1.2% in the second quarter of 2003 to approximately .8% during the second quarter of 2004. This decrease results both from the lower average yield on securities purchased during the period as well as from the change in fair market value of marketable securities in anticipation of the increase in the federal funds rate that occurred June 30, 2004.

Provision for income taxes

     Our effective tax rate was approximately 36% for the three and six months ended June 30, 2004 and 38% for the three and six months ended June 30, 2003. The effective rates differ from the statutory rates due primarily to the impact of acquisition-related intangibles that are not deductible for income tax purposes.

Liquidity and Capital Resources

     Our financial position remained strong through the first half of 2004. Our cash and cash equivalents and marketable security investments were $195.3 million at June 30, 2004. Our investments in marketable securities consist solely of highly rated debt obligations with maturities of 12 months or less.

     We continue to meet our working capital needs and capital equipment needs with cash provided by operations. Cash provided by operations in the first six months of 2004 totaled $28.1 million. The major components of cash flows provided by operating activities were net income of $10.7 million, non-cash depreciation and amortization expense charges of $10.4 million, income tax benefit of $4.7 million from employee exercises of stock options, increase in deferred revenues of $4.5 million and a decrease in net accounts receivable of $1.4 million.

     An important element of our liquidity is the collection of our accounts receivable. We measure our accounts receivable management by our day’s sales outstanding (DSO). This is a measurement of accounts receivable divided by billings in the quarter, represented by the sum of revenues plus the change in the deferred revenues liability account balance. This measurement was 87 days at June 30, 2004, slightly higher than our publicly stated target range of 75 to 85 days.

     Our net cash used in investing activities of $63.1 million in the first six months of 2004 resulted primarily from our acquisition of Cobion. The license for development source code used in our Proventia products was the primary component of our capital purchases of $8.2 million. Investing activities also included changes in our marketable securities that have quality characteristics similar to cash equivalents, except their maturities when we acquire them are longer than three months. The cash flow statement included the

19

purchase of $40.9 million of intermediate term marketable securities, primarily interest-bearing government obligations and commercial paper, offset by net proceeds from the maturity of marketable securities of $19.6 million.

     Our financing activities used $27.1 million of cash in the first six months of 2004. This was principally due to the repurchase of 1.9 million shares of our common stock in the open market at an aggregate cost of $29.0 million. Since the inception of this stock repurchase plan, which expired in July 2004, we have purchased 3.2 million shares at an average cost of $14.85 per share for a total cash outlay of approximately $47.4 million. Also, in July 2004, the Board of Directors authorized a new repurchase program to spend up to $50 million over the next year. Also, in the first six months of 2004, the exercise of stock options by our employees and the issuance of common stock through our employee stock purchase plan generated funds of approximately $1.9 million.

     We believe our cash and cash equivalents and marketable securities will be sufficient to meet our working capital needs and capital expenditures for the foreseeable future. Furthermore, we are not aware of any trends, events, or uncertainties that are reasonably likely to result in any significant change to our liquidity. From time to time, we evaluate possible acquisition and investment opportunities in businesses, products or technologies that are complementary to ours. In the event we determine to pursue such opportunities, we may use our available cash and cash equivalents and marketable securities for this purpose.

Off-Balance Sheet Arrangements

     Payments for certain of our operating leases are secured by two collateralized stand-by letters of credit totaling approximately $10.3 million at June 30, 2004. These stand-by letters of credit guarantee our payment obligations on the leases and are renewable annually over the duration of the applicable leases. If we default on the lease payments, the landlords can make a claim against the letters of credit. We, in turn, would be liable to the letter of credit issuers. Our stand-by letters of credit are collateralized by securities worth $12.8 million at June 30, 2004. Other than these non-cancelable operating leases, we have no off-balance sheet financing arrangements, any relationships with “structured finance” or “special purpose” entities, or any contractual obligations with unconsolidated entities that are reasonably likely to impact our liquidity.

Risk Factors

     Forward-looking statements are inherently uncertain as they are based on various expectations and assumptions concerning future events and are subject to known and unknown risks and uncertainties. Our forward-looking statements contained in this Quarterly Report on Form 10-Q and elsewhere should be considered in light of the following important risk factors. Variations from our stated intentions or failure to achieve objectives could cause actual results to differ from those projected in our forward-looking statements. With respect to our Business Outlook published in our earnings press release for the quarter ended June 30, 2004, you may continue to rely on this Business Outlook prior to the start of our quiet period for the quarter ending September 30, 2004 (the “Q3 Quiet Period”), unless we have published a notice stating otherwise. During the Q3 Quiet Period, ISS and its corporate representatives will not comment concerning our previously published Business Outlook. During the Q3 Quiet Period, the Company’s press releases and filings with the SEC on Forms 10-K and 10-Q should be considered historical, speaking as of a date prior to the Q3 Quiet Period only and not subject to update by the Company. The Q3 Quiet Period is expected to run from September 15, 2004 until financial results for the quarter ending September 30, 2004 are expected to be released in October 2004.

     There are many factors that affect ISS’ business and the results of its operations, some of which are beyond ISS’ control. The following is a description of some of the important factors that may cause the actual results of ISS’ operations in future periods to differ materially from those currently expected or desired. We encourage you to read this section carefully.

We Operate in a Rapidly Evolving Market

     We operate in a new and rapidly evolving market and must, among other things:

	•		respond to competitive developments;
	•		continue to upgrade and expand our product and services offerings; and
	•		continue to attract, retain and motivate our employees.

     We cannot be certain that we will successfully address these issues. As a result, we cannot assure our investors that we will be able to continue to operate profitably in the future.

20

     We introduced our new Proventia appliance line, beginning with the A Series, in April 2003. The G Series and M Series were introduced in the fourth quarter of 2003. As a result of our limited history with these products, it may be difficult to plan or project our revenues accurately. The revenue and income potential of these products is unproven and the markets addressed by these products are volatile. While initial reaction to these products have had a positive impact on company results, failure to continue to gain further market acceptance could result in revenues below our expectations and our operating results could be adversely affected.

Our Future Operating Results Will Likely Fluctuate Significantly

     We cannot predict our future revenues and operating results with certainty. However, we do expect our future revenues and operating results to fluctuate due to a combination of factors, including:

	•		the growth in the acceptance of, and activity on, the Internet and the world wide web, particularly by corporate, institutional and government users;
	•		the extent to which the public perceives that unauthorized access to and use of online information are threats to network security;
	•		customer budgets;
	•		the mix of product sales among the various products offered by ISS and whether revenue is recognized upon sale or deferred to subsequent periods;
	•		the volume and timing of orders, including seasonal trends in customer purchasing;
	•		our ability to develop new and enhanced product and managed service offerings and expand our professional services capabilities;
	•		the introduction and acceptance rate of ISS branded appliances, including increased cost of goods sold;
	•		our ability to accurately forecast and produce demanded quantities of our appliance products and models;
	•		availability of component parts of appliance products and reliance on contract manufacturers to produce such products;
	•		our ability to provide scalable managed services offerings through our partners in a cost effective manner;
	•		foreign currency exchange rates that affect our international operations;
	•		product and price competition in our markets; and
	•		general economic conditions, both domestically and in our foreign markets.

     We increasingly focus our efforts on sales of enterprise-wide security solutions, which consist of our entire product suite and related professional services, and managed security services, rather than on the sale of component products. As a result, each sale requires substantial time and effort from our sales and support staff. In addition, the revenues associated with particular sales vary significantly depending on the number of products licensed by a customer, the number of devices used by the customer and the customer’s relative need for our professional services. Large individual sales, or even small delays in customer orders, can cause significant variation in our license revenues and results of operations for a particular period. The timing of large orders is usually difficult to predict and, like many software and services companies, many of our customers typically complete transactions in the last month of a quarter.

     We cannot predict our operating expenses based on our past results. Instead, we establish our spending levels based in large part on our expected future revenues. As a result, if our actual revenues in any future period fall below our expectations, our operating results likely will be adversely affected because very few of our expenses vary with our revenues. Because of the factors listed above, we believe that our quarterly and annual revenues, expenses and operating results likely will vary significantly in the future.

21

     Our ability to provide timely guidance and meet the expectations of investors with respect to our operating and financial results is impacted by the tendency of a majority of our sales to be completed in the last month of a quarter. We may not be able to determine whether we will experience material deviations from guidance or expectations until the end of a quarter.

Dependence on Third Party Suppliers and Manufacturers

     We carry little inventory of our appliance products and we rely on suppliers to deliver necessary components to our contract manufacturers in a timely manner based on the forecasts we provide. We currently purchase some Proventia appliance components and contract manufacturing services from single or limited sources. If shortages occur, supplies are interrupted, or we under estimate demand for models, we may not be able to deliver products to our customers and our revenue and operating results would be adversely affected. Because our supply of hardware is based on short-term forecasts and purchase orders, our contract manufacturers are not obligated to purchase components for greater quantities over longer periods. We provide six-month forecasts of our demand to our contract manufacturers. If we overestimate our requirements, our contract manufacturers may have excess inventory, which could increase our costs. If we underestimate our requirements, our contract manufacturers may have an inadequate component inventory and, based on lead times, this could interrupt manufacturing and result in delays in shipments and revenues.

We Face Intense Competition in Our Market

     The market for network security monitoring, detection, prevention and response solutions is intensely competitive, and we expect competition to increase in the future. We cannot guarantee that we will compete successfully against our current or potential competitors, especially those with significantly greater financial resources or brand name recognition. Our chief competitors generally fall within the following categories:

•

large companies, including Symantec Corp., Cisco Systems, Inc., Juniper Networks, Inc., and McAfee, Inc., that sell competitive products and offerings, as well as other large software companies that have the technical capability and resources to develop competitive products;

•

software or hardware network infrastructure companies like Cisco Systems, Inc. and Juniper Networks, Inc. that could integrate features that are similar to our products into their own products; and

•

relatively smaller software companies offering relatively limited applications for network and Internet security;

•

small and large companies with competitive offerings to components of our managed services offerings.

     Mergers or consolidations among these competitors, or acquisitions of small competitors by larger companies, represent risks. For example, Symantec Corp., Cisco Systems, Inc., McAfee, Inc., and Juniper Networks, Inc. have acquired smaller companies which have intrusion detection or prevention technologies during the past several years. These acquisitions will make these entities potentially more formidable competitors to us if such products and offerings are effectively integrated. Large companies may have advantages over us because of their longer operating histories, greater name recognition, larger customer bases or greater financial, technical and marketing resources. As a result, they may be able to adapt more quickly to new or emerging technologies and changes in customer requirements. They can also devote greater resources to the promotion and sale of their products than we can. In addition, these companies have reduced and could continue to reduce, the price of their security monitoring, detection, prevention and response products and managed security services, which increases pricing pressures within our market.

     Several companies currently sell software products (such as encryption, firewall, operating system security and virus detection software) that our customers and potential customers have broadly adopted. Some of these companies sell products that perform the same functions as some of our products. In addition, the vendors of operating system software or networking hardware may enhance their products to include the same kinds of functions that our products currently provide. The widespread inclusion of comparable features to our software in operating system software or networking hardware could render our products less competitive or obsolete, particularly if such features are of a high quality. Even if security functions integrated into operating system software or networking hardware are more limited than those of our products, a significant number of customers may accept more limited functionality to avoid purchasing additional products.

     In addition, with the introduction of our multi-function M Series Proventia appliance, we have offerings that compete with vendors of firewalls, VPNs, anti-virus systems, and content and spam filtering products. These offerings are competitive with a broader

22

spectrum of network security companies, as well as those that also offer multi-function appliances or broad product suites, like Symantec Corp.

     For the above reasons, we may not be able to compete successfully against our current and future competitors. Increased competition may result in price reductions, reduced gross margins and loss of market share.

We Face Rapid Technological Change in Our Industry and Frequent Introductions of New Products

     Rapid changes in technology pose significant risks to us. We do not control nor can we influence the forces behind these changes, which include:

•

the extent to which businesses and others seek to establish more secure networks;

•

the extent to which hackers and others seek to compromise secure systems;

•

evolving computer hardware and software standards;

•

changing customer requirements; and

•

frequent introductions of new products and product enhancements.

     To remain successful, we must continue to change, adapt and improve our products in response to these and other changes in technology. Our future success hinges on our ability to both continue to enhance our current line of products and professional services and to introduce new products and services that address and respond to innovations in computer hacking, computer technology and customer requirements. We cannot be sure that we will successfully develop and market new products that do this. Any failure by us to timely develop and introduce new products, to enhance our current products or to expand our professional services capabilities in response to these changes could adversely affect our business, operating results and financial condition.

     Our products involve very complex technology and, as a consequence, major new products and product enhancements require a long time to develop and test before going to market. Because this amount of time is difficult to estimate, we have had to delay the scheduled introduction of new and enhanced products in the past and may have to delay the introduction of new and enhanced products in the future.

     The techniques computer hackers use to gain unauthorized access to, or to sabotage, networks and intranets are constantly evolving and increasingly sophisticated. Furthermore, because new hacking techniques are usually not recognized until used against one or more targets, we are unable to anticipate most new hacking techniques. To the extent that new hacking techniques harm our customers’ computer systems or businesses, affected or prospective customers may believe that our products are ineffective, which may cause them or prospective customers to reduce or avoid purchases of our products.

Undetected Product Errors or Defects Could Result in Loss of Revenues, Delayed Market Acceptance and Claims Against Us

     We offer warranties on our products, allowing the end customer to have any defective product repaired, or to receive a replacement product for it during the warranty period, or in certain circumstances return the product for a refund. Our products may contain undetected errors or defects. If there is a broad product failure across our customer base, we may decide to replace all affected products or we may decide to refund the purchase price for defective units. Such defects and actions may adversely affect our ability to record revenue. Some errors are discovered only after a product has been installed and used by end customers. Any errors discovered after commercial release could result in loss of revenues and claims against us.

     We offer warranties on our service levels for managed security services. If we do not meet warranties, the customer generally may obtain credits for service.

     If we are unable to fix errors or other product problems that later are identified after full deployment, or if we fail to meet our service levels for managed security services, in addition to the consequence described above, we could experience:

•

failure to achieve market acceptance;

•

loss of customers;

23

	•		loss of or delay in revenues and loss of market share;
	•		diversion of development resources;
	•		increased service and warranty costs;
	•		legal actions by our customers; and
	•		increased insurance costs.

Our Products are Complex and Are Operated in a Wide Variety of Computer Configurations, Which Could Result in Errors or Product Failures

     Because we offer very complex products, undetected errors, failures or bugs may occur when they are first introduced or when new versions are released. Our products often are installed and used in large-scale computing environments with different operating systems, system management software and equipment and networking configurations, which may cause errors or failures in our products or may expose undetected errors, failures or bugs in our products. We discover software errors, failures and bugs in certain of our product offerings after their introduction and have experienced delays and could experience lost revenues during the period required to correct these errors. Our customers’ computer environments are often characterized by a wide variety of standard and non-standard configurations that make pre-release testing for programming or compatibility errors very difficult and time-consuming. Despite testing, errors, failures or bugs may not be found in new products or releases after commencement of commercial shipments. Errors, failures or bugs in products released by us could result in negative publicity, product returns, loss of or delay in market acceptance of our products or claims by customers or others.

     In addition, if an actual or perceived breach of network security occurs in one of our end customer’s security systems, regardless of whether the breach is attributable to our products, the market perception of the effectiveness of our products could be harmed. Because the techniques used by computer hackers to access or sabotage networks change frequently and generally are not recognized until launched against a target, we may be unable to anticipate these techniques. Alleviating any of these problems could require significant expenditures of our capital and resources and could cause interruptions, delays or cessation of our product licensing, which could cause us to lose existing or potential customers and would adversely affect results of operations.

We Might Have to Defend Lawsuits or Pay Damages in Connection With Any Alleged or Actual Failure of Our Products and Services

     Because our products and services provide and monitor network security and may protect valuable information, we could face claims for product liability, tort or breach of warranty. Anyone who circumvents our security measures could misappropriate the confidential information or other property of end customers using our products, or interrupt their operations. If that happens, affected end customers or others may sue us. In addition, we may face liability for breaches caused by faulty installation of our products by our service and support organizations. Provisions in our contracts relating to warranty disclaimers and liability limitations may be unenforceable. Some courts, for example, have found contractual limitations of liability in standard computer and software contracts to be unenforceable in some circumstances. Defending a lawsuit, regardless of its merit, could be costly and could divert management attention. Our business liability insurance coverage may be inadequate or future coverage may be unavailable on acceptable terms or at all.

Risks Associated with Our Global Operations

     The expansion of our international operations includes our presence in dispersed locations throughout the world, including throughout EMEA and the Asia/Pacific and Latin America regions. Our international presence and expansion exposes us to risks not present in our U.S. operations, such as:

	•		the difficulty in managing an organization spread over various countries located across the world;
	•		compliance with, and unexpected changes in, a wide range of complex regulatory requirements in countries where we do business;
	•		duties and tariffs imposed on importation of our products in other jurisdictions where other manufacturers may not bear those same costs;
	•		increased financial accounting and reporting burdens;
	•		potentially adverse tax consequences;

24

	•		fluctuations in foreign currency exchange rates resulting in losses or gains from transactions and expenses denominated in foreign currencies;
	•		reduced protection for intellectual property rights in some countries;
	•		reduced protection for enforcement of creditor and contractual rights in some countries; and
	•		import and export license requirements and restrictions on the import and export of certain technology, especially encryption technology and trade restrictions.

     Despite these risks, we believe that we must continue to expand our operations in international markets to support our growth. To this end, we intend to establish additional foreign sales operations, expand our existing offices, hire additional personnel, expand our international sales channels and customize our products for local markets. If we fail to execute this strategy, our international sales growth will be limited.

Our Networks, Products and Services May be Targeted by Hackers

     Like other companies, our websites, networks, information systems, products and services may be targets for sabotage, disruption or misappropriation by hackers. As a leading network security solutions company, we are a high profile target. Although we believe we have sufficient controls in place to prevent disruption and misappropriation, and to respond to such situations, we expect these efforts by hackers to continue. If these efforts are successful, our operations, reputation and sales could be adversely affected.

We Must Successfully Integrate Acquisitions

     As part of our growth strategy, we have and may continue to acquire or make investments in companies with products, technologies or professional services capabilities complementary to our solutions. When engaging in acquisitions, we could encounter difficulties in assimilating or completing the development of the technologies, new personnel and operations into our company. These difficulties may disrupt our ongoing business, distract our management and employees, increase our expenses and adversely affect our results of operations. These difficulties could also include accounting requirements, such as impairment charges related to goodwill or other intangible assets or expensing in-process research and development costs. We cannot be certain that we will successfully overcome these risks with respect to any future acquisitions or that we will not encounter other problems in connection with our recent or any future acquisitions. In addition, any future acquisitions may require us to incur debt or issue equity securities. The issuance of equity securities could dilute the investment of our existing stockholders.

Our Proprietary Rights May be Difficult to Enforce

     We rely primarily on copyright, trademark, patent and trade secrets laws, confidentiality procedures and contractual provisions to protect our proprietary rights. We have obtained one United States patent and have a number of patent applications pending, as well as numerous trademarks and trademark applications pending. There can be no assurance that patents will be issued from pending applications, or that claims allowed on any patents will be sufficiently broad to protect our technology. There can be no assurance that any issued patents will not be challenged, invalidated or circumvented, or that any rights granted under these patents will actually provide competitive advantages to us. Despite our efforts to protect our proprietary rights, unauthorized parties may attempt to copy aspects of our products or to obtain and use information that we regard as proprietary. Policing unauthorized use of our products is difficult. While we cannot determine the extent to which piracy of our software products occurs, we expect software piracy to be a persistent problem. In addition, the laws of some foreign countries do not protect our proprietary rights to as great an extent as do the laws of the United States, and many foreign countries do not enforce these laws as diligently as U.S. government agencies and private parties. If we are unable to protect our proprietary rights to the totality of the features in our software and products (including aspects of our software and products protected other than by patent rights), we may find ourselves at a competitive disadvantage to others who need not incur the additional expense, time and effort required to create the innovative products that have enabled us to be successful.

We May Be Found to Infringe the Proprietary Rights of Others

     Third parties may assert claims or initiate litigation related to exclusive patent, copyright, trademark and other intellectual property rights to technologies that are relevant to our business. Because of the large number of patents in the Internet, networking, security and software fields, the secrecy of some pending patents and the rapid rate of issuance of new patents, it is not economically practical (or

25

even possible) to determine in advance whether a product (or any of its components) infringe or will infringe the patent rights of others. Third party asserted claims and/or initiated litigation can include claims against us or our manufacturers, suppliers, or customers, alleging infringement of proprietary rights with respect to our existing or future products (or components of those products). Regardless of the merit of these claims, they can be time-consuming, result in costly litigation and diversion of technical and management personnel, or require us to develop a non-infringing technology or enter into license agreements. There can be no assurance that licenses will be available on acceptable terms and conditions, if at all, in these circumstances, or that any indemnification that might be available to us would be adequate to cover our costs of defense. Furthermore, because of the potential for large judgments, which are not necessarily predictable, it is not unusual to find even arguably unmeritorious claims settled for significant funds. If any infringement or other intellectual property claim made against us by a third party is successful, or if we fail to develop non-infringing technology or license the proprietary rights on commercially reasonable terms and conditions, our business, operating results, financial condition and liquidity could be materially and adversely affected.

We Must Continue to Attract and Retain Personnel in a Competitive Marketplace

     We believe that our future success will depend in part on our ability to recruit and retain highly skilled management, sales, marketing and technical personnel. To accomplish this, we believe that we must provide personnel with a competitive compensation package, including stock options, restricted stock or similar incentive stock awards. Increases in shares available for issuance under our incentive stock plans and new incentive stock plans require stockholder approval in many cases, and institutional stockholders, or stockholders generally, may not approve future plans or increases. Our current incentive stock plan expires in September 2005 and we believe that sufficient shares are available for issuance under that plan to meet our needs until it expires. We currently expect to propose a new incentive stock plan to stockholders at our annual stockholders meeting in 2005. Additionally, the accounting industry has recently determined that corporations will include a compensation expense in their statement of operations relating to the issuance of employee stock options. This may become effective in calendar year 2005. As a result, we may decide to issue fewer stock options and may be impaired in our efforts to attract and retain necessary personnel. Conversely, issuing a comparable number of stock options could adversely impact our results of operations.

Some Provisions in the ISS Certificate of Incorporation and Bylaws Make a Takeover of ISS Difficult

     Our certificate of incorporation and bylaws contain provisions that could have the effect of making it more difficult for a third party to acquire, or of discouraging a third party from attempting to acquire, control of ISS. These provisions:

•

establish a classified board of directors;

•

create preferred stock purchase rights that grant to holders of common stock the right to purchase shares of Series A Junior Preferred Stock in the event that a third party acquires 20% or more of the voting power of our outstanding common stock;

•

prohibit the right of our stockholders to act by written consent;

•

limit calling special meetings of stockholders; and

•

impose a requirement that holders of 66 2/3% of the outstanding shares of common stock are required to amend the provisions relating to he classification of our board of directors and action by written consent of stockholders.

Item 3. Quantitative and Qualitative Disclosures About Market Risk

     We have no material changes to the disclosure on this matter made in our Annual Report on Form 10-K for the year ended December 31, 2003.

Item 4. Controls and Procedures

     Our management, with the participation of the Chief Executive Officer and Chief Financial Officer, evaluated the effectiveness of our disclosure controls and procedures as of the end of the period covered by this quarterly report. Based on such evaluation, these officers have concluded that, as of such date, our disclosure controls and procedures were effective to provide reasonable assurance that information required to be disclosed in the reports the Company files or submits under the Securities Exchange Act of 1934 is recorded, processed, summarized and reported on a timely basis.

26

     There have not been any changes in the Company’s internal control over financial reporting during the quarter ended June 30, 2004 that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

PART II. OTHER INFORMATION

Item 1. Legal Proceedings

     The Company and certain of its officers and directors were named as defendants in a consolidated amended complaint that was filed in the United States District Court for the Northern District of Georgia on October 9, 2002. The lawsuit purported to be brought on behalf of a class of investors who purchased the Company’s stock during the period from April 5, 2001 through August 14, 2001. The lawsuit alleged violations of the federal securities laws. On September 3, 2003, the court dismissed, with prejudice, the consolidated amended complaint and all rights to appeal have expired

Item 2. Changes in Securities, Use of Proceeds and Issuer Purchases of Equity Securities

(e) The following table provides information about purchases by the Company of its common stock during the three months ended June 30, 2004: All such purchases were made in open-market transactions pursuant to a repurchase plan publicly announced on July 18, 2002 under which the Company has been authorized by the Board to purchase up to $50 million. The plan terminated on July 14, 2004 and no further purchases can be made under that plan. Through June 30, 2004, the Company had purchased approximately 3.2 million shares at an aggregate cost of approximately $47.4 million.

Issuer Purchases of Equity Securities

Item 4. Submission of Matters to a Vote of Security Holders

     The Annual Meeting of Stockholders of Internet Security Systems, Inc. was held on Monday, May 24, 2004.

     The following two directors were elected to serve a three-year term ending in the year 2007: (a) Robert E. Davoli, 43,315,528 votes for and 2,312,293 votes withheld, and (b) Christopher W. Klaus, 44,531,928 votes for and 1,095,893 votes withheld.

Item 6. Exhibits and Reports on Form 8-K

27