Table of Contents

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-K

x       ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

FOR THE FISCAL YEAR ENDED DECEMBER 31, 2014

OR

o          TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the transition period from                 to                 .

Commission File Number 001-33197

GUIDANCE SOFTWARE, INC.

(Exact name of registrant as specified in its charter)

Securities registered pursuant to Section 12(b) of the Act:

Securities registered pursuant to Section 12(g) of the Act:  None.

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act.  Yes  o  No  x

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act.  Yes  o  No  x

Indicate by check mark whether the registrant: (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days.  Yes  x  No  o

Indicate by check mark whether the registrant has submitted electronically and posted on its corporate Web site, if any, every Interactive Data File required to be submitted and posted pursuant to Rule 405 of Regulation S-T (232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit and post such files).  Yes  x  No  o

Indicate by check mark if disclosure of delinquent filers pursuant to Item 405 of Regulation of S-K is not contained herein, and will not be contained, to the best of the registrant’s knowledge, in definitive proxy or information statements incorporated by reference in Part III of this Form 10-K or any amendment to this Form 10-K.  x

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer or a smaller reporting company. See the definitions of “large accelerated filer,” “accelerated filer” and “smaller reporting company” in Rule 12b-2 of the Exchange Act.

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act).  Yes  o  No  x

As of June 30, 2014, the aggregate market value of the registrant’s common stock held by non-affiliates of the registrant was approximately $77,058,000* based on the closing sale price as reported on the Global Market tier of The NASDAQ Stock Market LLC. As of February 18, 2015 there were approximately 29,934,000 shares of the registrant’s Common Stock outstanding, net of treasury shares.

* Excludes shares of Common Stock held by executive officers, directors and stockholders whose ownership exceeds 5% of the shares outstanding on that date. This calculation does not reflect a determination that such persons are affiliates for any other purposes.

DOCUMENTS INCORPORATED BY REFERENCE

Portions of the registrant’s definitive proxy statement to be filed with the Commission pursuant to Regulation 14A in connection with the registrant’s 2015 Annual Meeting of Stockholders (the “Proxy Statement”) or portions of the registrant’s 10-K/A, to be filed subsequent to the date hereof, are incorporated by reference into Part III of this Report. Such Proxy Statement or 10-K/A will be filed with the Commission not later than 120 days after the conclusion of the registrant’s fiscal year ended December 31, 2014.

Table of Contents

GUIDANCE SOFTWARE, INC.

FORM 10-K

FOR THE FISCAL YEAR ENDED DECEMBER 31, 2014

Table of Contents

2

Table of Contents

TRADEMARKS

EnCase®, EnScript®, FastBloc®, EnCE®, EnCEP®, Guidance Software™, LinkedReview™, EnPoint™ and Tableau™ are registered trademarks or trademarks owned by Guidance Software in the United States and other jurisdictions and may not be used without prior written permission. All other trademarks and copyrights referenced in this report are the property of their respective owners.  We do not intend our use or display of other companies’ trade names, trademarks or service marks to imply a relationship with, or endorsement or sponsorship of us by, these other companies.

FORWARD-LOOKING STATEMENTS AND FACTORS THAT MAY AFFECT FUTURE RESULTS

This Annual Report, including the section entitled “Management’s Discussion and Analysis of Financial Condition and Results of Operations,” contains forward-looking statements regarding our vision and business strategy, financial condition, results of operations, products and technologies, expectation of competitive pressures and prospects. Such statements are based upon current expectations that involve risks and uncertainties. For example, words such as “may,” “will,” “should,” “expects,” “anticipates,” “intends,” “plans,” “believes,” “seeks,” “estimates” and similar expressions or variations of such words are intended to identify forward-looking statements.  Additionally, any statements contained herein that are not statements of historical facts or that concern future matters such as the development of new products, sales levels, expense levels and other statements regarding similar matters may be deemed to be forward-looking statements.

Although forward-looking statements in this Annual Report reflect the good faith judgment of our management, such statements can only be based on facts and factors currently known by us.  Consequently, forward-looking statements are inherently subject to risks and uncertainties and actual results and outcomes may differ materially from the results and outcomes discussed in or anticipated by the forward-looking statements.  Factors that could cause or contribute to such differences in results and outcomes include, without limitation, those discussed under the heading “Risk Factors” below, as well as those discussed elsewhere in this Annual Report.  Readers are urged not to place undue reliance on these forward-looking statements, which speak only as of the date of this Annual Report. We undertake no obligation to revise or update any forward-looking statements in order to reflect any event or circumstance that may arise after the date of this Annual Report.  Readers are urged to carefully review and consider the various disclosures made in this Annual Report, which attempt to advise interested parties of the risks and factors that may affect our business, financial condition, results of operations and prospects.

PART I

Item  1.                               Business

Overview

Guidance Software, Inc. is the leading global provider of endpoint investigation solutions for cybersecurity analytics, security incident response, e-discovery, and forensic analysis.  Our EnCase® platform provides an investigative infrastructure that enables our customers to search, collect, and analyze electronically stored information in order to address suspicious network activity and rapidly respond to security breaches, litigation, human resources matters, regulatory requests, and allegations of fraud, and to defend their organizations’ data assets in a robust and proactive manner.

EnCase® Enterprise provides organizations with in-depth visibility into data and running processes on laptops, desktops, and file servers in order to enable internal investigations and to quickly determine the root causes of suspicious network activity.  EnCase Enterprise is used in a wide variety of circumstances, including investigations of allegations of fraud or misconduct, intellectual property theft, regulatory compliance reporting, and corporate policy compliance.  In addition, EnCase Enterprise serves as a platform on which our more powerful cybersecurity and electronic discovery (e-discovery) applications, as described below, extend our offering.

EnCase® Cybersecurity provides crucial IT security functionality to enterprises and government agencies through its incident response and sensitive data discovery capabilities.  Integrated with leading security alerting tools from HP, Cisco, Blue Coat Systems, and FireEye, EnCase Cybersecurity helps automate the critical first steps in cybersecurity incident response from the moment of first alert and  rapidly delivers forensic-level visibility of the relevant endpoint data, capturing a snapshot of valuable information from active memory that might otherwise expire and that may serve as potential evidence for criminal prosecution. It also enables the rapid launch of an enterprise-wide search of the enterprise for identical or similar threats.  These capabilities enable a cybersecurity team to remediate any malicious code or processes running on the affected computers and to return the affected endpoints to a trusted state.  As an invaluable proactive planning measure, the sensitive data discovery capabilities enable security teams to rapidly identify IT assets (servers, desktops, laptops, etc.) holding sensitive data (such as credit card numbers, social security numbers, patient health information, and other personally identifiable information) in violation of legally mandated regulations, industry standards, and corporate policies.  Further, they allow an organization to quickly remediate any identified violations and thereby improve and provide evidence of compliance.

3

Table of Contents

EnCase® Analytics is a groundbreaking cybersecurity intelligence product designed to derive insights from the vast amounts of data generated by endpoint activity and to spot signs of unusual or unauthorized behavior on any endpoint.  EnCase Analytics leverages its unique, kernel-level access to provide the industry’s most comprehensive endpoint data collection, providing a repository of the most unimpeachable data for insights into undetected risks and threats.  Through its interactive visual interface, EnCase Analytics compares current activity to regularly updated baselines of “normal” behavior and exposes suspicious patterns, commonalities, and anomalies to proactively identify threats, arrest attempted data breaches earlier in the “kill chain,” and minimize damage.

EnCase® eDiscovery is our enterprise-wide e-discovery solution addressing the end-to-end e-discovery needs of corporations and government agencies.  Following the acquisition of CaseCentral in February 2012, the e-discovery product portfolio spans the entire e-discovery workflow from legal hold to identification, collection, preservation, processing, first-pass review, and early case assessment (ECA) review and production capabilities.  The integrated offering deploys software intelligently, delivering the legal hold, identification, collection, preservation, and processing functions on-premise, at the customer site — close to the sources of data and the data custodians — and the ECA, review, and production functions as subscription-as-a-service (SaaS) in the “cloud,” so that geographically dispersed inside and outside counsel can efficiently collaborate on the review of collected documents without special equipment or software other than a web browser and internet connectivity.

EnCase® eDiscovery Review is a powerful, highly secure, private cloud-hosted, multi-matter review platform with advanced analysis and technology assisted review (TAR) functionality, comprehensive production capabilities, and extensive project management and workflow features to enable efficient, effective, and defensible distributed review.

EnCase® Forensic, the industry-standard digital investigation solution, enables forensic practitioners to conduct efficient, forensically sound digital data collection and investigations.  The EnCase Forensic solution lets examiners acquire data from a wide variety of devices, unearth potential evidence with disk-level forensic analysis, and craft comprehensive reports on their findings, all while maintaining the integrity of the evidence.

EnCase®  Portable  is a triage and collection solution, delivered on a USB device, that allows forensic professionals and non-experts alike to quickly and easily triage and collect digital evidence in a forensically sound and court-proven manner.

EnCase® App Central  is an online marketplace that allows EnScript® developers and investigations professionals the opportunity to share and discover the latest apps that complement the Company’s EnCase products. All apps are reviewed and tested by Guidance Software before being made available in the marketplace.

Our Tableau™ family of forensic hardware products, including forensic duplicators, multiple write blockers and other hardware, complements our industry-leading software to fulfill the needs of the computer forensic community.

The widespread reliance on digital business processes and the explosive growth in the volume of electronic data have resulted in exposure to electronic data-related risks.  They have also created the need to properly conduct digital investigations and to preserve evidence (both data and metadata) in a format that is recognized by courts to prove chain of custody.  The global adoption of local area networks, wide area networks, e-mail, and the Internet have increased communications within and between organizations and have created the ability to generate, store, share, and distribute massive amounts of electronic information instantaneously without regard to physical location.

While the adoption and reliance on these technologies has significantly increased productivity and lowered the cost of doing business for Global 2000 companies, government agencies, and other organizations, it has also exposed organizations to many increasing areas of risk associated with the continued proliferation of electronic data.  The most dramatic escalation of risk is represented by the fact that sensitive data such as intellectual property, financial data, and personally identifiable information (PII) is the direct target of cyber-attacks and breaches initiated by a variety of threat actors, from organized crime groups to nation-states. In addition, organizations are increasingly faced with the need to recover and analyze vast amounts of electronic data quickly and efficiently through processes we refer to as “digital investigations.”  Digital investigations are conducted to address various electronic data-related needs, including:

4

Table of Contents

·                          searching, collecting and processing litigation-related data, or responding to discovery requests for electronic data, or e-discovery requests, where a company must conduct a thorough, yet timely, review of electronic data in order to produce electronic documents or other digital evidence in connection with a particular civil or administrative proceeding;

·                          responding to regulatory data requests, where an organization must efficiently and rapidly produce electronic documents and digital evidence in connection with a project under regulatory review in a manner acceptable to the regulators;

·                          addressing corporate policy violations, such as intellectual property theft, employee fraud, and employee policy violations, all of which must be investigated rapidly; described in a detailed, complete, and comprehensible report of the incident; and mitigated and remedied across an enterprise network as necessary, all while minimizing business interruption; and

·                          responding to IT cyber attacks or attempted breaches, where an organization must expeditiously and unobtrusively determine which systems or files were affected, the nature of the attack, and how to remediate the issue quickly before any further damage occurs.

Traditional digital and cybersecurity investigations involve internal investigators or third-party consultants manually searching through multitudes of electronic data in an attempt to discover traces or “fingerprints” of electronic data-related incidents.  Such investigators or third-party consultants typically use software applications, utilities, or processes, such as taking the affected servers, desktops, and laptops off-line, so that they can remove, image, or copy the hard drives, manually extract the data in question on each affected computer, and save the affected files to another hard drive for processing and analysis by consultants or other third-party experts.  These traditional digital investigations suffer from several distinct problems in that they are costly and time-consuming, they require significant expertise to conduct across complex enterprise network environments, they may not adequately combat attempts to conceal data, they often result in unwanted exposure of sensitive materials and disrupt business, and they are difficult to conduct in a forensically sound manner.  Establishing a comprehensive digital investigative software platform can help organizations address the inadequacies of traditional digital investigations and cost-effectively mitigate the risk of electronic data-related threats.

We complement our product offerings with a comprehensive array of professional and training services, including technical support and maintenance services, to help our customers implement our solutions, conduct investigations, and train their IT and legal professionals to effectively and efficiently use our products.  Our products are used by a wide variety of industries and some of the world’s best known technology, financial and insurance services; defense; energy; pharmaceutical; manufacturing; healthcare; and retail companies.  Our EnCase Enterprise customer base currently includes more than seventy percent of the Fortune 100 and more than forty percent of the Fortune 500, and we have sold our EnCase Forensic software to more than 1,000 enterprises and government and law enforcement agencies worldwide.

As of December 31, 2014, we reported total revenues of $108.7 million, employed approximately 400 employees and conducted business in over 65 countries.  We were incorporated in California in November 1997 and reincorporated in Delaware in December 2006.

Our Internet address is http://www.guidancesoftware.com.  The following filings are posted to our Investor Relations web site, located at http://investors.guidancesoftware.com as soon as reasonably practical after submission to the United States (U.S.) Securities and Exchange Commission (SEC): annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, the proxy statements related to our most recent annual stockholders’ meetings and any amendments to those reports or statements filed or furnished pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of 1934, as amended.  All such filings are available free of charge on our Investor Relations website.  The contents of these websites are not intended to be incorporated by reference into this report or in any other report or document we file, and any reference to these websites is intended to be an inactive textual reference only.

Business Strategy

Our business strategy is to develop and support superior solutions that enable corporate, government, and law-enforcement organizations to conduct thorough and effective computer investigations of any kind, including cybersecurity incident response, intellectual property theft, incident response, compliance auditing, and responding to e-discovery requests, all while maintaining the forensic integrity of the data.  A key driver behind this strategy is the development and introduction of new products and improvements to our existing products.  Our goal is to develop more powerful, user-friendly, and affordable products without compromising on our technological commitment.  We are focused on gaining more EnCase Enterprise customers, and then offering them higher-value products, such as EnCase Cybersecurity, EnCase Analytics, and EnCase eDiscovery, that automate and enhance functionality in the enterprise, cybersecurity, e-discovery, and forensics spheres. In addition, we are focused on continuing our leadership in computer forensics technology with innovative software and hardware for a complete forensic framework.

5

Table of Contents

Our Products and Services

Our products and services give our customers the ability to conduct comprehensive, cost-effective, and precise digital investigations.  Our EnCase Enterprise software provides the foundation to build an enterprise investigation infrastructure.  Furthermore, we believe our EnCase Forensic software is the industry standard for searching, collecting, preserving, analyzing, and authenticating electronic computer forensic data for use in criminal and civil court proceedings.  Our forensic software and hardware products address the complete forensic process.  We also offer a comprehensive array of investigative services and training to help our customers manage their internal digital investigations and learn how to effectively and efficiently use our software.

EnCase® Enterprise

EnCase Enterprise provides an investigative platform that enables an organization to search, collect, preserve, and analyze data on the servers, desktops, and laptops across the network.  EnCase Enterprise enables organizations to respond to electronic discovery requests and conduct internal investigations, including those related to human resources or those focused on compliance or fraud. Companies can also collect and preserve data in response to regulator requests or for civil litigation matters.

EnCase Enterprise serves as the platform for an enterprise investigative infrastructure, to which additional products can be added to enhance and automate the search, collection, preservation, and analysis of data in order to accomplish specific business tasks such as: responding to electronic discovery requests; performing proactive, enterprise-wide data audits for sensitive information, including personally identifiable information, classified data, and intellectual property; and detecting, responding to, and remediating network threats or intrusions.  These products, which can be added to perform the functions above, include, EnCase Cybersecurity, EnCase Analytics, and EnCase eDiscovery.

EnCase® Cybersecurity

EnCase Cybersecurity is a security solution offering incident response and sensitive data discovery software capabilities.  Through its incident response capabilities, it reduces the risk of network breaches by providing the ability to expose, triage, and remediate threats that have escaped detection by layered security solutions and have infiltrated the enterprise; and by providing the ability to enforce data policy compliance on endpoints.  It is designed to determine the root cause and scope of any given event and provides forensic-level visibility and analysis of endpoint data in order to find and remediate threats designed to evade layered security solutions, and return endpoints to a trusted state.

The EnCase Cybersecurity sensitive data discovery capabilities enable organizations to rapidly identify IT assets (servers, desktops, laptops, etc.) holding sensitive data (such as credit card numbers, social security numbers, patient health information, and other personally identifiable information) in violation of legally mandated regulations, industry standards, and corporate policies. Further, they allow an organization to quickly remediate any identified violations and return the network to a compliant state.  With the unique ability to search memory and hard drives at the disk level, EnCase Cybersecurity can target and locate sensitive data no matter where, or in what manner, it is stored, and even if it has been deleted, resides in unallocated space, or is “in use.”

EnCase® Analytics

EnCase Analytics is an endpoint security intelligence product designed to deliver the next level of security intelligence by exposing undetected risks and threats using insights derived from data generated by endpoint activity.  EnCase Analytics leverages kernel-level access for endpoint data collection instead of trusting a compromised operating system, providing a repository of the most reliable data for insights into undetected risks and threats.

EnCase Analytics provides the ability to quickly visualize enterprise-wide endpoint data from multiple dimensions, regardless of how large or disparate the data sets may be.  Through its interactive visual interface, EnCase Analytics exposes suspicious patterns, commonalities, and anomalies, regardless of how large or disparate the data set.  This allows for quick adjustments to proactively identify threats and minimize damage.

6

Table of Contents

EnCase® eDiscovery

EnCase eDiscovery is our enterprise-wide e-discovery solution addressing the end-to-end e-discovery needs of corporations and government agencies.  Following the acquisition of CaseCentral in February 2012, the e-discovery product portfolio spans the entire e-discovery process from legal hold to identification, collection, preservation, processing, first-pass review, and early case assessment (ECA), review, and production capabilities.  Using a distributed, enterprise-wide scalable architecture, it collects and processes only potentially relevant data, and it preserves evidence and metadata in the court-validated EnCase® Logical Evidence File format to ensure complete chain of custody from the moment the legal hold is issued until documents are produced to the opposing party.  EnCase eDiscovery tracks activity at every step of the e-discovery process so that the status of projects can be viewed, audited, and communicated to others.  The ECA, review, and production capabilities are available in the cloud, so that geographically dispersed inside and outside counsel can efficiently review collected documents without needing any special equipment or software other than a web browser and internet connectivity.

Once the initial search has been conducted and the information has been collected, EnCase eDiscovery culls and processes the data to further reduce the volume of irrelevant or duplicate information.  The solution distributes processing in an organized fashion so that several dozen machines can process terabytes of data without disrupting business and degrading network performance.  The collected and processed data can then seamlessly be uploaded onto the available attorney review and production platform to complete the e-discovery process.

The integrated review and production platform is designed to overcome the disadvantages of traditional approaches to e-discovery review and production by:

·         Providing real-time visibility and management oversight of the end-to-end e-discovery process;

·         Leveraging a unique multi-matter architecture that eliminates duplication of effort across cases and enables e-discovery teams to re-use previous work product, such as document coding and tagging or collected ESI; and

·         Delivering a comprehensive e-discovery product that seamlessly uploads document sets and their associated metadata and attorney work product to a centralized legal repository.

EnCase eDiscovery offers:

·         A comprehensive, integrated e-discovery solution that exceeds corporate requirements for security, oversight, risk management, and compliance;

·         The fastest and most comprehensive collection and processing e-discovery product;

·         Both early and continuous case assessment, enabling legal teams to quickly obtain necessary facts at any time from pre- through post-collection phases;

·         The ability to use secure, scalable, cloud review and production capabilities while keeping collection and preservation close to data and its custodians;

·         Unparalleled search and identification capabilities for electronically stored information (ESI) across multiple digital platforms and devices; and

·         De-duplication across cases and comparison of current cases to previous matters to ensure that documents withheld in one matter are never produced in another.

The e-discovery market has been fragmented, lacking a fully integrated solution, and relying on multiple point solutions, which breeds inefficiencies, causes delays, and increases risk and, ultimately, cost.  Typically, in any given technology market, the introduction of integrated offerings drives broader technology adoption, and the e-discovery market should be no different. EnCase eDiscovery is the industry’s first fully integrated e-discovery solution.  EnCase eDiscovery provides customers’ legal and IT teams with one integrated, unified software solution that delivers all of the functionality that organizations desire for in-house electronic discovery, including:

·                          Legal hold;

·                          Pre-collection analytics;

·                          Identification, preservation and collection;

·                          Processing and analysis;

7

Table of Contents

·                          Early and continuous case assessment; and

·                          Cloud-based review and production.

EnCase® Forensic

EnCase Forensic software is the industry-leading tool for searching, collecting, preserving, and analyzing computer forensic data and authenticating such data in court.  EnCase Forensic enables an investigator to conduct the full array of forensic functions on a single machine while preserving the integrity of the evidence for future use in court.  Used by investigators and consultants in law enforcement, government agencies, small businesses, consulting firms, and corporations, EnCase Forensic software provides a robust way to authenticate, search and recover computer evidence rapidly and thoroughly.

EnCase® Portable

EnCase Portable is a triage and collection solution delivered on a USB device that allows forensic professionals and non-experts to quickly and easily triage and collect digital evidence in a forensically sound and court-proven manner.  It enables personnel not trained in computer forensics to forensically acquire documents, internet history and artifacts, images, and other digital evidence, including entire hard drives, by connecting a USB device rather than a laptop.  Also, law enforcement, government agencies, law firms, and corporate customers can cost-effectively, without a laptop, target systems that are not on the network or cannot be transported.  EnCase Portable leverages the powerful search and acquisition capabilities of EnCase software.

EnCase® App Central

EnCase App Central is an online marketplace that allows developers and investigation professionals the opportunity to share and discover the latest apps that complement the Company’s EnCase solutions.  The online store includes apps written by Company employees as well as third-party software developers.  Since the store opened in spring 2013, downloads have exceeded 50,000.

Tableau™ Hardware

Tableau hardware includes write blockers, forensic duplicators and storage devices.  Write blockers and forensic duplicators are used to acquire forensically sound copies of digital storage devices such as hard disks and solid state drives.  Users will typically analyze this data with forensic software such as EnCase Forensic.  Tableau storage products, which were only sold during the first and second quarters of 2013, are used in conjunction with write blockers or forensic duplicators, and provide high-performance, high-availability storage for data acquired and produced during forensic examinations.

Professional Services and Training

Professional Services provides various consulting services to our clients, including e-discovery, network security incident response, civil/criminal digital investigation, implementation services, and a software advisory program.  In addition, we offer certain packaged services based on the specific needs of our customers, including our government customers.

E-Discovery Services.  We offer complete, end-to-end e-discovery consulting and project management services, from litigation hold to the production of files for attorney review.  Leveraging our industry-leading EnCase® eDiscovery solution, our cost-effective e-discovery services teams automate operations that other service providers perform manually, and are able to conduct large scale e-discovery search, collection, and preservation from a central location, producing fast, accurate results with minimal business disruption.

Incident Response Services.  Using EnCase® Cybersecurity, consultants investigate and remediate security breaches in an organization’s network infrastructure.  Consultants determine which methods of entry were used to break into the system, the extent and duration of the intrusion, and exactly which data were compromised.  They can also “kill” malware and/or rogue processes.  In the event a breach draws the attention of regulatory agencies, results and reports can be processed into a court-approved, forensically sound file format to help an organization provide accurate, defensible evidence and information to regulators.

8

Table of Contents

Implementation Services.  We provide implementation and consulting services in connection with the deployment of our EnCase® Enterprise, EnCase Cybersecurity, EnCase eDiscovery, and related software.  Our implementation typically takes one to two weeks, during which we conduct performance tests to ensure full functionality and integration with existing systems in the organization, and provide on-site training to ensure our customers can maximize the use of the technology.

Guidance Software Advisory Program (GAP). GAP provides a comprehensive review of current policies and procedures, including a gap analysis, which identifies risk areas that could impact the customer.  Dedicated advisory consultants work with the customer to build and implement a customized plan to help automate procedures and eliminate wasted resources; establish a documented, defensible and repeatable e-discovery, investigation, or incident response workflow; and align procedures with industry best practices.

Cloud Review Services.  We provide expertise and project management for single or multiple case reviews for our EnCase eDiscovery Review  cloud-based hosting platform.  We have industry-leading experience in managing large cases with hundreds of reviewers, as well as managing clients with thousands of cases through data targeting, initial review, production, and trial preparation.

Training.  Training educates thousands of students per year in computer forensics principles and the use of our EnCase® software products and methodology.  We provide an array of training courses on topics such as computer forensics, incident response, endpoint security, digital investigations and the proper use of our software products, We operate two training classrooms in Pasadena, California; two near Washington, D.C.; one in Orlando, Florida; one near Chicago, Illinois; and two near London, England.  In addition, through our training staff, our authorized training partners and our OnDemand training program, certain courses are offered at off-site locations throughout North, Central, and South America; Europe; Africa; the Middle East; and Asia/the Pacific Rim (as permitted by U.S. Export Regulations).

Customer Service and Technical Support

Customers typically purchase software maintenance services with each new product license for on-premise products.  Software maintenance services include software updates and upgrades, telephone and e-mail support, on a 24-hours-per-day, five-days-per-week basis, as well as customer self-service on our website.  Customers are given an option to renew their maintenance agreements at expiration of their contract which can be for a term of one, two or three years.  Our technical support organization provides support for our on-premise products to our current customers with multi-tiered offerings and includes support availability 24 hours per day, five days per week, in English, and is also available during normal business hours in several other languages, including German and Spanish. Customers utilizing the eDiscovery Review product offering receive support services on a 24x7 basis, in English. Our customer service organization is available 7am-5pm PST, Monday through Friday.

Sales and Distribution

We currently market our software and services through a direct sales organization complemented by an inside sales organization and an indirect sales channel.  In 2014, we increased the size of the inside sales organization relative to the direct sales organization, which helped result in a higher volume of customers of our EnCase Enterprise platform.  Our direct sales force is located throughout the Americas, Europe, the Middle East, Africa, and Asia/the Pacific Rim.

Our revenue consists of product, subscription, and service and maintenance fees from our customers and distributors.  Product revenue represented approximately 32%, 31% and 43% of our total revenue in fiscal years 2014, 2013 and 2012, respectively. Subscription revenue represented approximately 7% of our total revenue in fiscal year 2014, as compared to 9% in 2013, and 7% in 2012.  Revenues from service and maintenance represented approximately 62%, 60%, and 50% of our total revenue in fiscal years 2014, 2013, and 2012, respectively.

Sales to customers outside the United States totaled $25.2 million, representing 23% of our total revenue in fiscal year 2014. For a geographic breakdown of our revenue and property and equipment, see Note 15 to our Consolidated Financial Statements included in this Annual Report on Form 10-K.

Marketing

We use a mix of market research, analyst updates, seminars, direct mail, print advertising, trade shows, speaking engagements, public relations, customer newsletters, and web marketing in order to achieve our marketing goals.  Our marketing department also produces collateral material for distribution to potential customers, including presentation materials, white papers, brochures, magazines, and fact sheets.  We also host user events for our customers and provide support to our channel partners with a variety of programs, training, and product marketing support materials.

9

Table of Contents

In addition to our regional and vertical marketing initiatives, we also host the industry’s largest conference dedicated solely to the subject of digital investigations.  The Computer and Enterprise Investigations Conference (CEIC®) serves as our annual user conference and draws attendees from global law enforcement, government agencies, corporations, law firms, and judges.  This event also draws industry analysts and experts and provides a valuable forum for users to connect, share information, and learn about important topics in the industry.  It enables us to efficiently connect with a broad range of customers, communicate our whole product offerings (products, services, training, etc.), and launch new products in a captive environment while simultaneously driving additional add-on sales to customers who have implemented one or more of the core platform products.

Customers

Our customers include government agencies and global corporations in a wide variety of industries, such as financial and insurance services, technology, defense contracting, telecom, pharmaceutical, healthcare, manufacturing and retail.  Our EnCase® Enterprise customer base currently includes more than half of the Fortune 100 and more than 200 of the Fortune 500 and many federal and international government agencies, and we have deployed our EnCase Forensic software to more than 1,000 government and law enforcement agencies and other customers worldwide.  Our EnCase Enterprise customers are primarily in North America, and also extend to Europe, Africa, the Middle East (as permitted by U.S. Export Regulations) and Asia/the Pacific Rim.  Sales to customers outside of the United States accounted for 23%, 21%, and 19% of our revenues for the fiscal years ended December 31, 2014, 2013, and 2012, respectively.

Research and Development

Our research and development effort is focused on the advancement of our core products and the development of new products, as well as the quality assurance of both core and new products.  We conduct research on existing or new computer hardware or software technology to develop solutions for our law-enforcement, government, or corporate markets.  We conduct research on file-system support, search and analysis algorithms, hardware engineering and design, industry standards, technology integrations, and user productivity and performance features.  Our research and development efforts are often aimed at creating new standards in our industry and streamlining current processes.  Under our customer contracts, we typically obtain the rights to use any improvements to our technology developed or discovered on customer deployments.  Our research and development expenses were $23.0 million, $27.7 million, and $24.5 million in 2014, 2013, and 2012, respectively.

Competition

The market for our products is highly competitive, quickly evolving, and subject to rapidly changing technology.  The market for software for electronic discovery is highly fragmented, and our EnCase® eDiscovery product competes against enterprise search and content management vendors such as HP and EMC, as well as e-discovery point solutions such as StoredIQ, Clearwell, and Nuix; information and content management vendors including HP, (which acquired Autonomy); Symantec (which acquired Clearwell); EMC (which acquired Kazeon); as well as other privately held companies.  Our e-discovery solutions also compete against outsourced e-discovery alternatives, whether e-discovery service providers or consulting companies, such as the large consulting/accounting firms and others, that offer services for traditional digital investigations and e-discovery in place of implementing a packaged software solution.  More generally, our EnCase® eDiscovery software competes against providers of outsourced electronic discovery services, such as FTI or Navigant.

In the IT security market, we believe our EnCase® Cybersecurity and EnCase® Analytics products provide certain unique capabilities, but we nevertheless compete for budget dollars against established IT security vendors such as Checkpoint and McAfee. A new crop of competitors has begun to emerge that classify themselves as “endpoint security” vendors, but which represent a variety of different and sometimes complementary approaches, and none of which offers the depth of visibility into endpoint data provided by EnCase products. Gartner Research recently published a Competitive Landscape report for what it has named the Endpoint Detection and Response (EDR) market. It offers profiles of competitors such as Bit9 (which merged with Carbon Black), Cisco AMP for Endpoints, Crowdstrike, Hexis Cyber, Tanium, and Mandiant (acquired by FireEye). Noting the depth and breadth of data visibility as a competitive advantage, along with our key integrations with complementary technologies such as Cisco ThreatGRID, the Blue Coat Security Analytics Platform, FireEye MPS, and ThreatTrack Threat Analyzer, Gartner named Guidance Software the estimated market share leader for EDR tools.

10

Table of Contents

In the computer forensics market we compete against a series of smaller, privately held companies, such as AccessData, X-Ways Software, and Paraben.  Additionally, in the broader enterprise market we compete with forensic vendors including Access Data and security software solution vendors including McAfee and Symantec.

We currently compete on the basis of the breadth and depth of our products’ functionality as well as on the basis of price. Additionally, we compete on the basis of certain other factors, including forensic technology, forensic soundness and acceptance in court, time required to complete an investigation, ability to scale across large networks, and expertise of consulting personnel.  We believe that we currently compete favorably with respect to these factors.  For further discussion of our competition, see “Risk Factors—We face direct and indirect competition from other software companies, as well as other companies that provide training, consulting, and certification services in computer forensics, which could limit our growth and market share” in Item 1A.

Seasonality

Our business is influenced by seasonal factors, largely due to customer buying patterns.  In recent years, we have generally had weaker demand for our software products and services in the first and second quarters of the year and stronger demand in the third quarter due to the federal government fiscal year end, and in the fourth quarter due to commercial or corporate fiscal year end.  Our consulting and education services have sometimes been negatively impacted in the third and fourth quarters of the year due to the summer and holiday seasons, which result in fewer billable hours for our consultants and fewer education classes.

Intellectual Property and Proprietary Rights

Our intellectual property rights are important to our business.  We rely on a combination of copyrights, trade secrets, trademarks, and patents, as well as confidentiality procedures and contractual provisions to protect our proprietary technology, processes and intellectual property.  We currently have 24 issued patents and 11 patent applications pending in the United States, the European Union or under the Patent Cooperation Treaty (often more than one pending application relates to a single invention).  We own registered copyrights on various versions of our products and associated instructional documentation.  We have registered trademarks or trademarks in the United States and in certain other jurisdictions, including the mark EnCase® in the United States, Japan and the European Union, and in the marks EnCE®, EnScript®, FastBloc®, CEIC®, EnCEP® and logo Guidance Software® in the United States.

Others may develop products that are similar to our technology.  We generally enter into confidentiality and other written agreements with our employees and partners, and through these and other written agreements, we attempt to control access to and distribution of our software, documentation and other proprietary technology and other information.  Despite our efforts to protect our proprietary rights, third parties may, in an unauthorized manner, attempt to use, copy or otherwise obtain and market or distribute our intellectual property rights or technology or otherwise develop a product with the same functionality as our software.  Policing unauthorized use of our software and intellectual property rights is difficult, and nearly impossible on a worldwide basis.  Therefore, we cannot be certain that the steps we have taken or will take in the future will prevent misappropriation of our technology or intellectual property rights, particularly in foreign countries where we do business or where our software is sold or used, where the laws may not protect proprietary rights as fully as do the laws of the United States or where the enforcement of such laws is not common or effective.

Substantial litigation regarding intellectual property rights exists in the software industry.  From time to time, in the ordinary course of business, we may be subject to, or initiate, claims relating to our intellectual property rights or those of others, and we expect that third parties may commence legal proceedings or otherwise assert intellectual property claims against us in the future, particularly as we expand the complexity and scope of our business, the number of similar products increases and the functionality of these products further overlap.  These claims and any resulting litigation could subject us to significant liability for damages. In addition, even if we prevail, litigation could be time-consuming and expensive to defend and could affect our business materially and adversely. Any claims or litigation from third parties may also limit our ability to use various business processes, software and hardware, other systems, technologies or intellectual property subject to these claims or litigation, unless we enter into license agreements with the third parties.  However, these agreements may be unavailable on commercially reasonable terms, or not available at all.  For a discussion of intellectual property claims that have recently been asserted against us, see “Item 3.  Legal Proceedings” and “Note 14 — Contractual Obligations, Commitments and Contingencies” in the notes to the consolidated financial statements included in Item 8.

11

Table of Contents

In addition to our proprietary technology, we rely on technology that we license from third parties.  During 2012, we agreed with Oracle to extend a license for a document viewer technology used in our products until November 2015. (See Risk Factors: “Our success depends in part upon our ability to develop new products and enhance our existing products.  Failure to successfully introduce new or enhanced products to the market may adversely affect our business, financial condition and results of operations” in Item 1A of this Annual Report on Form 10-K).

Employees

As of December 31, 2014, we employed approximately 400 full-time employees.  During 2014, we reduced our headcount by approximately 80 employees.

We have never had any work stoppage and none of our employees are represented by a labor organization or are party to any collective bargaining arrangements.  We consider our employee relations to be good.

Item 1A.                          Risk Factors

You should consider each of the following factors as well as the other information in this Annual Report in evaluating our business and our prospects. The risks and uncertainties are described below are not the only ones we face. Additional risks and uncertainties not presently known to us or that we currently consider immaterial may also impair our business operations.  If any of the following risks actually occurs, our business and financial results could be harmed. In that case, the trading price of our common stock could decline. You should also refer to the other information set forth in this Annual Report, including our financial statements and the related notes.

Global market and economic conditions may adversely affect our business, results of operation and financial condition.

We are subject to the risks arising from adverse changes in global economic conditions, especially those in the US, Europe and the Asia-Pacific region. Economic conditions in the United States and worldwide macroeconomic conditions remained challenging during much of 2012, 2013 and 2014. If this economic weakness continues or worsens, customers may delay, reduce or forego technology purchases, both directly and through our channel partners and resellers.  Delays in customer purchases in the future could lead to reductions in sales of our products, longer sales cycles, slower adoption of new technologies and increased price competition.  Further, deteriorating economic conditions could adversely affect our customers and their ability to pay amounts owed to us. Any of these events would likely harm our business, results of operations and financial condition.

Our operating results may fluctuate from period to period and within each period, which makes our operating results difficult to predict and could cause our revenues, expenses and profitability to fall short of expectations during certain periods.

Our operating results may fluctuate from period to period or within certain periods as a result of a number of factors, many of which are outside of our control. You should not rely on our past results as an indication of future performance, as our operating results in the future may fall below expectations, expenses could increase and revenues could decrease. Each of the risks described in this section, as well as other factors, may affect our operating results. For example, our quarterly revenues and operating results may fluctuate as a result of a variety of factors, including, but not limited to, our lengthy sales cycle, the proportion of revenues attributable to license fees versus services and maintenance revenue, changes in the level of fixed operating expenses, demand for our products and services, the introduction of new products and product enhancements or upgrades by us or our competitors, changes in customer budgets and capital expenditure plans, competitive conditions in the industry and general economic conditions. In addition, many customers make major software acquisitions near the end of their fiscal years, which tends to cause our revenues to be higher in the third and fourth calendar quarters which coincide with the fiscal year ends of many government agencies and corporations, and lower in the first and second calendar quarters. In addition, many customers tend to make software acquisitions or purchases near the end of a particular quarter, which tends to make our revenues for a particular period unpredictable for a significant portion of the period in question until software purchase decisions have been made. Since certain of our software sales are large scale license agreements, a short delay in just one of these software sales from one quarter into a subsequent quarter or a loss of one of these potential sales could cause us to deliver results for a quarter that are below projections of securities analysts that follow our results. There can be no assurance that we will be able to successfully address these risks, and we may not be profitable in any future period.

12

Table of Contents

If the corporate market for digital investigation software does not continue to develop, we will not be able to grow, and our revenues and results of operations will be adversely affected.

The market for digital investigation software continues to evolve largely through our efforts. Our growth is dependent upon, among other things, the size and pace at which the market for such software develops.  Our ability to achieve our anticipated growth rate may be impacted by a contraction in the global economy.  If the market for such digital investigation software decreases, remains constant, or grows more slowly than we anticipate, we will not be able to maintain historical growth rates. Continued growth in the demand for our products is uncertain because of, among other things:

·                          customers and potential customers may decide to use traditional methods of conducting enterprise investigations, such as reliance on in-house professionals or outside consultants to conduct manual investigations;

·                          customers may experience technical difficulty in utilizing digital investigation software or otherwise not achieve their expected return on their investment in such software; and

·                          marketing efforts and publicity related to digital investigation software may not be successful.

Even if digital investigation software gains wide market acceptance, our software may not adequately address market requirements and may not continue to gain market acceptance. If digital investigation software generally, or our software specifically, do not gain wide market acceptance, we may not be able to grow and our revenues and results of operations would be adversely affected.

If we are not able to effectively manage and support our growth or retain and attract highly skilled employees, our business strategy might not succeed.

In the past we have grown rapidly and we will need to continue to grow in all areas of our operations to execute our business strategy.  Managing and sustaining our growth will place significant demands on management as well as on our administrative, operational, technical and financial systems and controls and other resources. We may not be able to expand our product offerings, our customer base and markets, or implement other features of our business strategy at the rate or to the extent presently planned. In addition, our traditionally high level of customer service may suffer as we grow, which could cause our software sales to suffer. If we are unable to successfully manage or support our future growth, we may not be able to maximize revenues or profitability.

In addition, in order to be able to effectively execute our growth plan, we must attract and retain highly qualified personnel. We may need to hire personnel in virtually all operational areas, but primarily in selling and marketing, research and development, professional services, training and customer service. Competition in our industry for experienced and qualified personnel in these areas is extremely intense, especially for software developers with high levels of experience in designing and developing software products and sophisticated technical sales people experienced in selling our complex type of software products and selling into government agencies. In order to expand sales of EnCase® Enterprise, we may need to continue to hire highly qualified commissioned sales personnel to directly target potential EnCase Enterprise customers. These new commissioned sales personnel require several quarters of training and experience before being able to effectively market EnCase Enterprise, and, as a result of these hires, our sales and marketing expense may increase at a greater rate than our revenue, at least in the short term. The expense of hiring and training these commissioned sales personnel may never generate a corresponding increase in revenue. We may not be successful in attracting and retaining the necessary qualified personnel that our growth plan requires. In the past we have experienced, and we expect to continue to experience in the future, difficulty in hiring and retaining highly skilled employees with appropriate qualifications. Many of the companies with which we compete for experienced personnel have greater resources than we have. If we fail to attract new personnel or retain and motivate our current personnel, our business and future growth prospects could be severely harmed.

We also believe that a critical contribution to our successful growth will be our corporate culture which fosters innovation, teamwork and excellence. As our organization grows and we are required to implement more complex organizational structures and institutional programs, we may find it difficult to maintain the beneficial aspects of our corporate culture, which could negatively affect our ability to attract and retain qualified and experienced personnel and therefore our future success in continuing to maintain our rapid growth.

13

Table of Contents

The failure of the legal community to continue to adopt our eDiscovery solution could negatively affect future sales of EnCase® Enterprise, which could have a material adverse effect on our results of operations.

We expect to derive a significant amount of sales of EnCase® Enterprise from continuing demand for our EnCase® eDiscovery solution. However, widespread adoption of e-discovery best practices will require a shift in the way the legal community approaches discovery of electronic documents and other electronically stored data. Currently, most large scale electronic discovery projects are conducted by outsourced service providers that manually retrieve documents from each computer subject to review. These service providers have longstanding and entrenched relationships with the corporations that are subject to large-scale discovery inquiries or security breaches and the large law firms that are typically retained in connection with such discovery projects. Corporations and law firms may continue to prefer to use service providers because of these ongoing established relationships, and because the service providers are widely known and accepted within the legal community, and may resist adoption of our EnCase eDiscovery solution. Moreover, the expense of relying on an outsourced service provider may frequently be covered by the corporation’s insurance policy that is otherwise covering the expense of the litigation, including complying with requests for discovery, while implementation of EnCase Enterprise and our EnCase eDiscovery would require a significant unreimbursed capital expenditure by the corporation. The failure of corporations and law firms to adopt our EnCase eDiscovery solution for e-discovery could have a material adverse effect on our sales and results of operations.

Courts could reject the use of our products, which would harm our reputation and negatively affect future sales of our products and services.

Our software products and services are often used in connection with legal investigations, civil litigation and criminal prosecutions. The admissibility of results generated by our products as evidence in civil and criminal trials is a key component of our customer value proposition. Evidence and the manner used to collect evidence is regularly the subject of challenges in legal investigations and litigation, and our products or personnel may be the direct or indirect subject of such legal challenges. Persons involved in litigation may, for example, challenge the reliability of our products, the admissibility of evidence generated, discovered or collected using our products, and/or the expertise, credibility or reliability of our personnel. Other unpredictable legal challenges may be brought that could reflect upon the reputation of our products or personnel. To date, courts that have addressed challenges to our products or services have ruled against such challenges. If in the future a court were to find that our products are not reliable or that persons representing us or users of our product are not credible, reliable or lack the expertise necessary to serve as a witness or to authenticate evidence, or that our training and certification process does not adequately prepare individuals to conduct competent digital investigations, this could have a material adverse impact on our revenues and results of operations.

We are dependent on our management and research and development teams, and the loss of any key member of either of these teams may prevent us from executing our business strategy.

Our future success depends in a large part upon the continued services of our executive officers and other key personnel.  In particular, Shawn McCreight, our founder, Chairman and Chief Technology Officer, has been significantly responsible for the development of our products.  As announced by the Company on November 5, 2014, Barry Plaga, our Chief Financial Officer, was appointed by our Board as the Company’s Interim Chief Executive Officer and the Board initiated a search for a permanent Chief Executive Officer.  Our ability to attract and retain a qualified Chief Executive Officer may have a material impact on our present and future operating and financial results.  We are also substantially dependent on the continued services of our existing research and development personnel. The loss of one or more of our key employees, and in particular our research and development personnel, could seriously harm our business development, culture and strategic direction. We do not maintain key person life insurance policies on any of our executives. Any key person life insurance policy we maintain now or in the future would not be sufficient to cover the loss of any of our key personnel and any such loss could seriously harm our business and our ability to execute our business strategy. We have agreements that provide severance benefits to each of our Named Executive Officers. Our failure to retain these key employees could negatively impact our ability to execute our business strategy.

Changes or reforms in the law or regulatory landscape could diminish the need for our solutions, and could have a negative impact on our business.

One factor that drives demand for our products and services is the legal and regulatory framework in which our customers operate. Laws and regulations are subject to changes that could either help or hurt the demand for our products. Thus, certain changes in the law and regulatory landscape, such as tort law or legislative reforms that limit the scope and size of electronic discovery requests or the admissibility of evidence generated by such requests, as well as court decisions, could significantly harm our business. Changes in domestic and international privacy laws could also affect the demand and acceptance of our products, and such changes could have a material impact on our revenues.

14

Table of Contents

We face direct and indirect competition from other software companies, as well as other companies that provide training, consulting and certification services in computer forensics, which could limit our growth and market share.

The markets for our software products and services are competitive, highly fragmented and subject to rapidly changing technology, shifting customer needs and frequent introductions of new products and services. We expect the intensity of competition to increase in the future as new companies enter our markets, existing competitors develop stronger capabilities and we expand into other markets. Many of our current competitors have longer operating histories, greater name recognition, access to larger customer bases and substantially more extensive resources than we have. They may be able to devote greater resources to the development, promotion and sale of their products than we can to ours, which could allow them to respond more quickly than we can to new technologies and changes in customer needs and achieve wider market acceptance. Because the barriers to entry into software industry segments are generally low, we expect to continue to face competition from new entrants, particularly as we expand into other segments of the software industry.

Several competing companies provide digital investigation software and applications that directly compete or will compete with our products, or offer solutions our products do not address. In addition, if the market for digital investigation software develops as we anticipate, other companies could enter this market through their own software development or through the acquisition of one of our current competitors. If these companies are more successful in providing similar, better or less expensive digital investigation solutions compared to those that we offer, we could experience a decline in customers and revenue. These companies include computer forensic companies, managed security services companies and consulting companies, such as international consulting/accounting firms, many of which have substantially greater resources and customer bases than we do. If our competitors are more successful than we are at generating professional services engagements, our growth rate or revenues may decline.

We also compete with companies or organizations that have developed or are developing and marketing software and services that diminish the need for our solutions or the budget available to our customers to purchase our solutions. These companies include traditional security companies, data storage infrastructure and data archiving companies, information management, records management and internal IT organizations that develop their own solutions.

Computer hackers may damage our products, services and systems, which could cause interruptions in our service and harm to our business and hackers could gain access to our customers’ personal information which could result in the loss of existing clients, negative publicity and legal liability.

Computer hackers often attempt to access information, including personal information for purposes of identity theft and other criminal activity. In particular, due to the nature of our business, the products and services that we offer and the industry in which we operate, we are more likely to be the target of computer hackers who would like to undermine our ability to offer the products and services that we provide to our customers and possibly retaliate for the results or evidence that our products and services generate.

For example, in December 2005, we became aware of a security breach of our electronic records which contained, among other things, credit card information of approximately 5,000 customers. We promptly notified law enforcement authorities as well as each of the customers whose information may have been compromised. We conducted a forensic examination of the incident and took a number of steps to both remediate the underlying cause and strengthen our internal security system, including enhancing our internal information technology security department and redesigning our network architecture.

In early January 2006, the Federal Trade Commission (the “FTC”) commenced an inquiry into the December 2005 security breach. In September 2006, we executed a consent decree proposed by the FTC that includes no monetary penalties. The consent decree found that we failed to implement proper security measures to protect consumers’ data, and requires us to provide the FTC with initial and biennial third-party assessments of our IT security for a period of 10 years. Additionally, the consent decree requires us to maintain a comprehensive IT security program, retain documentation of such program and provide notice of the consent decree to our executives and employees for a period of 20 years. The FTC formally approved the consent decree on November 15, 2006 and subsequently issued a press release announcing the investigation and its conclusion. In April 2007, we received formal notice and service of the decree from the FTC, effectively ending the inquiry. In 2007, we timely filed the first compliance report required by the consent decree. In 2009, 2011, and 2013, we timely complied with our biennial monitoring and reporting responsibilities required by the consent decree.

Given the incident, any subsequent breach of our security could be especially damaging to our reputation and business and may result in monetary penalties if the FTC were to find that the circumstances that lead to the breach constituted a violation of our obligations under the consent decree.

15

Table of Contents

In addition, from time to time we may be the targets of computer hackers who, among other things, create viruses to sabotage or otherwise attack companies’ networks, products and services. For example, there was recently a spread of viruses, or worms that intentionally deleted anti-virus and firewall software. Our products, networks, websites and systems, may be the target of attacks by hackers. If successful, any of these events could damage our computer systems, force us to incur substantial costs to fix technical problems or result in hackers gaining access to our technical and other proprietary information, which could harm our business and results of operations.

The complexity of accounting regulations and related interpretations and policies, particularly those related to revenue recognition, could materially affect our financial results for a given period.

Although we use standardized sales agreements designed to meet current revenue recognition criteria under accounting principles generally accepted in the United States, we must often negotiate and revise terms and conditions of these standardized agreements, particularly in multi-product license and services transactions. As our transactions have increased in complexity, particularly with the sale of larger, multi-product licenses, negotiation of mutually acceptable terms and conditions may require us to defer recognition of revenue on such licenses. We believe that we are in compliance with Accounting Standards Codification (“ASC”) Software Industry—Revenue Recognition topic (ASC 985-605); however, more complex, multi-product license transactions require additional accounting analysis to account for them accurately. The professional technical guidance available regarding the application of software revenue recognition is very conceptual, and silent to specific implementation matters. As a consequence of this, we have been required to make assumptions and judgments, in certain circumstances, regarding the application of software revenue recognition. Incorrect assumptions or judgments as well as changes in, or clarification to accounting interpretations, could lead to unanticipated changes in our revenue accounting practices and may affect the timing of revenue recognition, which could adversely affect our financial results for any given period. If we discover that we have interpreted and applied revenue recognition rules differently than prescribed by accounting principles generally accepted in the United States, we could be required to devote significant management resources, and incur the expense associated with an audit, restatement or other examination of our financial statements.

In May 2014, the FASB and IASB jointly issued ASU No. 2014-09, Revenue from Contracts with Customers, which supercedes the revenue recognition requirements in ASC 605 Revenue Recognition.  ASU 2014-09 is a comprehensive new revenue recognition standard that will supercede nearly all existing revenue recognition guidance under US GAAP.  The standard’s core principle is that a company will recognize revenue when it transfers promised goods or services to customers in an amount that reflects the consideration to which the company expects to be entitled in exchange for those goods or services.  In doing so, companies will need to use more judgment and make more estimates than under current authoritative guidance.  These may include identifying performance obligations in the contract, estimating the amount of variable consideration to include in the transaction price and allocating the transaction price to each separate performance obligation.  The standard is effective beginning after December 15, 2016, and early adoption is not permitted under US GAAP.  The new revenue recognition requirements may have an impact on the recognition or pattern of recognition of revenue in the future and the Company is still evaluating the potential impact of the new requirements.

Our effective tax rate may fluctuate, which could increase our income tax expense and reduce our net income.

In preparing our quarterly and annual consolidated financial statements, we estimate our income tax liability in each of the foreign and domestic jurisdictions in which we operate by estimating our actual current tax exposure and assessing temporary differences resulting from differing treatment of items for tax and financial statement purposes. Our judgments, assumptions and estimates relative to the current provision for income tax take into account current tax laws and our interpretation of current tax laws. Although we believe our judgments, assumptions and estimates are reasonable, changes in tax laws or our interpretation of tax laws and the resolution of any future tax audits could significantly impact the amounts provided for income taxes in our consolidated financial statements.

We calculate our current and deferred tax provisions based on estimates and assumptions that could differ from the actual results reflected in income tax returns filed during the subsequent year. Adjustments based on filed returns are generally recorded in the period when the tax returns are filed and the global tax implications are known and could significantly impact the amounts provided for income taxes.

Due to uncertainty in the application and interpretation of applicable state sales tax laws, we may be exposed to additional sales tax liability.

The Company’s sales and use tax filings are subject to customary audits by authorities in the jurisdictions where it conducts business in the United States, which may result in assessments of additional taxes.  In March 2011, we determined that additional sales taxes were probable of being assessed by a certain state as a result of the preliminary findings specific to a sales and use tax audit.  The balance for the years in which the statute of limitation has not expired is approximately $1.2 million, including interest of approximately $0.4 million as of December 31, 2014.  The estimated incremental sales and use tax liability was based on a similar model that was being used by the state conducting the sales and use tax audit.

16

Table of Contents

Should other states where we have not imposed sales and use taxes determine that the sale of our products or services are subject to sales and use taxes, we could incur future assessments, which would require charges to operations.

Our operating results and business would be seriously impaired if our revenues from our EnCase® Enterprise product offerings, which include EnCase® Cybersecurity and EnCase® eDiscovery, were to decline.

Historically, we have derived substantially all of our license revenues from sales of our EnCase® Forensic and EnCase Enterprise product offerings. Although we have introduced new software modules, we expect that our EnCase Enterprise product offerings will account for the largest portion of our software product revenue for the foreseeable future.  We believe that the degree of penetration for our EnCase Forensic product in the law enforcement market makes it unlikely that revenue from sales of EnCase Forensic will contribute dramatically to future revenue growth. For this reason, we are dependent on increased sales of our EnCase Enterprise product offerings to drive future growth.

As a result, if for any reason revenue from our EnCase Enterprise product offerings declines further or does not increase as anticipated, our operating results and our prospects for growth will be significantly impaired. Further, if these products fail to meet the needs of our existing and target customers, or if they do not compare favorably in price and performance to competing products, our business will be adversely affected.

We may be limited in our ability to utilize indirect sales channels, such as value-added resellers, corporate resellers, professional services firms and other third-party distributors for the sale and distribution of our products, which may limit our ability to expand our customer base and our revenues.

We may be limited in our ability to market and distribute our products through value-added resellers, corporate resellers, professional services firms and other third-party distributors, which we collectively refer to as third-party resellers, due to various factors. Due to the complex nature of our products, sales professionals generally require a significant amount of time and effort to become sufficiently familiar with our products in order to be able to market them effectively, which makes our products unattractive to third-party resellers. In addition, our competitors include professional services organizations, such as accounting, consulting and law firms, that would otherwise serve as a natural distribution channel for our products and related services.

Moreover, there is significant competition in our industry for qualified third-party resellers. Even if we were to succeed in attracting qualified and capable third-party resellers, agreements with such third-party resellers are generally renewable annually, are not exclusive and contain no minimum purchase commitments. Such agreements may be terminated by either party: (a) for U.S. and Canadian resellers, with 30 days written notice after the initial one-year period; and (b) for non-U.S. or Canadian resellers, within 30 days after the initial six-month period of the agreement, and with 30 days’ notice after the initial one-year period. If we are not able to recruit new qualified third-party resellers, our sales growth may be constrained and our results of operations would suffer.

Our intellectual property rights are valuable, and if we are unable to protect our proprietary technologies and defend infringement claims, we could lose our competitive advantage and our business could be adversely affected.

Our success depends in part on our ability to protect our proprietary products and services and to defend against infringement claims. If we are unable to do so, our business and financial results may be adversely affected. To protect our proprietary technology, we rely upon a combination of copyright, patent, trademark and trade secret law, confidentiality restrictions in contracts with employees, customers and other third parties, software security measures, and registered copyrights, trademarks and patents. If we fail to protect our intellectual property rights adequately, our competitors may gain access to our technology, and our business may be harmed. Any of our patents, trademarks, copyrights or other intellectual property rights may be challenged by others or invalidated through administrative process or litigation proceedings. In addition, we may be unable to obtain patent, copyright or trademark protection on products that we spend significant time and expense to develop in the future. Despite our efforts to protect our proprietary technology, unauthorized persons may be able to copy, reverse engineer or otherwise use some of our proprietary technology. Furthermore, existing patent and copyright laws may afford only limited protection, and the laws of certain countries in which we operate do not protect proprietary technology as well as established law in the United States. For these reasons, we may have difficulty protecting our proprietary technology against unauthorized copying or use. If any of these events happen, there could be a material adverse effect on the value of our proprietary technology and on our business and financial results. In addition, litigation may be necessary to protect our proprietary technology. This type of litigation is often costly and time-consuming, with no assurance of success.

17

Table of Contents

Claims that we misuse the intellectual property of others could subject us to significant legal liability and disrupt our business, which could have a material adverse effect on our financial condition and results of operations.

Because of the nature of our business, we may become subject to material claims of infringement by competitors and other third parties with respect to our current or future software applications, trademarks or other proprietary rights. The legal framework for software patents is rapidly evolving and we expect that software developers will increasingly be subject to infringement claims as the number of software applications and competitors in our industry segment grows. In certain circumstances, the owners of proprietary software could make copyright and/or patent infringement claims against us in connection with such activity. Any such claims, whether meritorious or not, could be time consuming and difficult to defend against, result in costly litigation, cause shipment delays or require us to enter into royalty or licensing agreements with third parties, which may not be available on terms that we deem acceptable, if at all. Any of these claims could disrupt our business, make it difficult to add or retain important features in our products and have a material adverse effect on our financial condition and results of operations.  For a discussion of intellectual property claims that have recently been asserted against us, see “Item 3.  Legal Proceedings” and “Note 14 —  Contractual Obligations, Commitments and Contingencies” in the notes to the consolidated financial statements included in Item 8 of this Annual Report on Form 10-K.

If we are unable to continue to obtain government licenses, approvals or authorizations regarding the export of our products abroad, or if current or future export laws limit or otherwise restrict our business, we could be prohibited from shipping our products to certain countries, which could negatively impact our business, financial condition and results of operations.

We must comply with United States laws regulating the export of our products to other countries. Our products contain encryption and decryption technologies that require us to obtain certain licenses from the United States government in order to export certain of our products abroad. In addition, we are required to obtain licenses from foreign governments in order to import our products into these countries. We cannot guarantee that we will be successful in obtaining such licenses, approvals and other authorizations required from applicable governmental authorities to export our products. The export regimes and the governing policies applicable to our business are subject to change, and we cannot assure you that such export approvals or authorizations will be available to us or for our products in the future. Our failure to receive any required export license, approval or authorization would hinder our ability to sell our products and could negatively impact our business, financial condition and results of operations.

Our software applications may be perceived as, or determined by the courts to be, a violation of privacy rights. Any such perception or determination could adversely affect our revenues and results of operations.

Because of the nature of digital investigations, our potential customers and purchasers of our products or the public in general may perceive that use of our products for these investigations result in violations of individual privacy rights. In addition, certain courts, legislative and regulatory authorities could determine that the use of our software solutions or similar products is a violation of privacy rights, particularly in jurisdictions outside of the United States. Any such determination or perception by potential customers, the general public, government entities or the judicial system could harm our reputation and adversely affect the sales of our products and our results of operations.

Our business depends, in part, on sales to governments and governmental entities and significant changes in the contracting or fiscal policies of governments and governmental entities could have a material adverse effect on our business.

We derive a significant portion of our revenues from contracts with federal, state, local and foreign governments and government agencies, and we believe that the success and growth of our business will continue to depend on our successful procurement of government contracts. For the year ended December 31, 2014, we derived approximately 18.2% of our revenues from the sales of products and services from the U.S. Government.  In 2013 and 2014, our business was adversely affected by government budgeting constraints.  Changes in government contracting policies or additional or continued government budgetary constraints could directly affect our business, financial condition and results of operations. Among the factors that could adversely affect our business, financial condition or results of operations are:

·                          changes in fiscal policies or decreases in available government funding;

18

Table of Contents

·                          changes in government programs or applicable requirements;

·                          the adoption of new laws or regulations or changes to existing laws or regulations;

·                          changes in political or social attitudes with respect to security issues, computer crimes, discovery of computer files and digital investigations;

·                          potential delays or changes in the government appropriations process; and

·                          delays in the payment of our invoices by government payment offices.

These and other factors could cause governments and governmental agencies to refrain from purchasing the products and services that we offer in the future, the result of which could have an adverse effect on our business, financial condition and results of operations. In addition, many of our government customers are subject to stringent budgetary constraints. The award of additional contracts from government agencies could be adversely affected by spending reductions or budget cutbacks at government agencies that currently use or are likely to utilize our products and services.

Because we offer our EnScript® programming language for customization of and the creation of add-ons for EnCase®, customers or third-party programmers may be able to develop products that compete with our products or reduce the marketability or value of our products.

We have developed many of our major products, including EnCase®Cybersecurity and EnCase® eDiscovery,  to function as applications running on the EnCase® Enterprise platform. We created these applications using the EnScript programming language. In order to enhance the attractiveness of EnCase to potential customers and position EnCase as a standard software for digital investigations, we have made available without charge the EnScript programming language, which permits users of EnCase to develop customized add-on features for their own or others’ use, and we have trained our customers on how to write add-on programs using the EnScript programming language, which is similar to Java or C++. As part of this strategy, we have encouraged the development of an active community of EnScript programmers similar to those which have emerged for other software products. While we believe widespread use of our EnScript programming language will ultimately create demand for our products, customers in the past have developed, and may in the future develop, software for use with EnCase using the EnScript programming language, rather than purchasing certain of our product offerings. Losses of sales to potential customers could have a material adverse impact on our revenues and results of operations.

Our success depends in part upon our ability to develop new products and enhance our existing products. Failure to successfully introduce new or enhanced products to the market may adversely affect our business, financial condition and results of operations.

Our future success depends in part on our ability to develop enhancements to our existing products and to introduce new products that keep pace with rapid technological developments and changes in customers’ needs. Although our products are designed to operate on a variety of network hardware and software platforms, we must continue to modify and enhance our products to keep pace with changes in network platforms, operating systems, software technology and changing customer demands. We may not be successful in developing and documenting these modifications and enhancements or in bringing them to market in a timely manner. Any failure of our products to operate effectively with future network platforms and technologies could reduce the demand for our products and result in customer dissatisfaction. In addition, our products incorporate document viewer technology that we license from Oracle USA, Inc. Our license agreement with Oracle expires in November 2015. We may be unable to replace this technology if Oracle terminates this license agreement or it expires, or if the Oracle technology becomes obsolete or incompatible with our products.

Furthermore, any new products that we develop may not be released in a timely manner and may not achieve the market acceptance necessary to generate significant sales revenues. As a result, we may expend significant time and expense towards research and development for new or enhanced products, which may not gain market acceptance or generate sufficient sales to offset the costs of research and development. If we are unable to successfully develop new products or enhance and improve our existing products, or if we fail to position or price our products to meet market demand, our business, financial condition and results of operations will be adversely affected.

19

Table of Contents

Errors in our products could adversely affect our reputation, result in significant costs to us, impair our ability to market our products and expose us to legal liability, any of which may adversely affect our operating results.

Products as complex as ours may contain undetected errors or failures.  Despite extensive testing by us and by our customers, we have in the past discovered errors in our software applications and will likely continue to do so in the future. As a result of past discovered errors, we experienced delays and lost revenues while we corrected the problems in those software applications. In addition, customers in the past have brought to our attention “bugs” in our software exposed by the customers’ unique operating environments. Although we have been able to fix these software bugs in the past, we may not always be able to do so in the future. In addition, our products may also be subject to intentional attacks by viruses that seek to take advantage of these bugs, errors or other weaknesses. Any of these events may result in the loss of, or delay in, market acceptance of our products and services, which would seriously harm our sales, financial condition and results of operations.

Furthermore, we believe that our reputation and name recognition are critical factors in our ability to compete and generate additional sales of our products and services. Promotion and enhancement of our brand name will depend largely on our success in continuing to provide effective software applications and services. The occurrence of errors in our software applications or the detection of bugs by our customers may damage our reputation in the market as well as our relationships with existing customers, which may result in our inability to attract or retain customers.

In addition, because our products are used in security and forensic functions that are often critical to our customers, the licensing and support of our products makes us potentially subject to product liability claims. Any product liability insurance we carry may not be sufficient to cover our losses resulting from any such product liability claims. The successful assertion of one or more large product liability claims against us could have a material adverse effect on our financial condition.

Incorrect or improper use of our products, our failure to properly train customers on how to utilize our software products or our failure to properly provide consulting and implementation services could result in negative publicity and legal liability.

Our products are complex and are deployed in a wide variety of network environments. The proper use of our software requires the end user to undergo extensive training and, if our software products are not used correctly or as intended, inaccurate results may be produced. Our customers or our professional services personnel may incorrectly implement or use our products. Our products may also be intentionally misused or abused by customers or non-customer third parties who obtain access and use of our products. Because our customers rely on our product and service offerings to manage a wide range of sensitive investigations and security functions, the incorrect or improper use of our products, our failure to properly train customers on how to efficiently and effectively use our products or our failure to properly provide consulting and implementation services to our customers may result in negative publicity or legal claims against us.

We cannot predict our future capital needs and we may be unable to obtain additional financing to develop new products, enhance existing products, offer additional services or fund strategic acquisitions, the failure of which could have a material adverse effect on our business, financial condition and results of operations.

We may need to raise additional funds in the future in order to develop new products, enhance existing products, offer additional services or make strategic acquisitions of complementary businesses, technologies, products or services.  Any required additional financing may not be available on terms acceptable to us, or at all.  If we raise additional funds by issuing equity securities, existing security holders will experience dilution of their ownership interest, which could be significant, and the newly-issued securities may have rights senior to those of the holders of our common stock.  If we raise additional funds by obtaining loans from third parties, the terms of those financing arrangements may include negative covenants or other restrictions on our business that could impair our operational and financial flexibility and would also require us to incur additional interest expense.  If additional financing is not available when required or is not available on acceptable terms, we may be unable to successfully develop or enhance our software products and services through internal research and development or acquisitions in order to take advantage of business opportunities or respond to competitive pressures, which could negatively impact our software products and services offerings and sales revenues, the failure of which could have a material adverse effect on our business, financial condition and results of operations.

Acquisitions that we may undertake in the future involve risks that could adversely affect our business, financial condition and results of operations.

We may pursue strategic acquisitions of businesses, technologies, products or services that we believe complement or expand our existing business, products and services. Acquisitions involve numerous risks, including, but not limited to, the following:

·                          diversion of management’s attention during the acquisition and integration process;

20

Table of Contents

·                          the possibility that acquisitions will not be completed successfully, or at all, and our potential exposure to termination fees and/or other costs associated therewith;

·                          the incurrence of substantial legal, accounting, financial advisory and/or other costs;

·                          costs, delays and difficulties of integrating the acquired company’s operations, technologies and personnel into our existing operations and organization;

·                          adverse impact on earnings as a result of amortizing the acquired company’s intangible assets or impairment charges related to write-downs of goodwill related to any acquisition;

·                          issuance of equity securities to pay for acquisitions, which may be dilutive to existing stockholders;

·                          potential loss of customers or key employees of acquired companies;

·                          impact on our financial condition due to the timing of the acquisition or our failure to meet operating or synergy expectations for any acquired business; and

·                          assumption of unknown liabilities of the acquired company.

Any acquisitions of businesses, technologies, products or services that we may undertake in the future may not generate sufficient revenues or cost-saving synergies necessary to offset the associated costs of the acquisitions or may result in other material adverse effects.

Our international sales and operations are subject to factors that could have an adverse effect on our business, financial condition and results of operations.

We have significant sales and services operations outside the United States, and derive a substantial portion of our revenues from these operations. We also continue to expand and diversify our international operations which will increase our global reach.  For the years ended December 31, 2014, 2013 and 2012, we derived approximately 23%, 21%, and 19%, respectively, of our revenues from sales of products and services outside the United States.

Our international operations are subject to risks related to the differing legal, political, social and regulatory requirements and economic conditions of many countries, which risks include, but are not limited to:

·                          difficulties in staffing and managing our international operations;

·                          the fact that foreign countries may impose additional withholding taxes or otherwise tax our foreign income, impose tariffs or adopt other restrictions on foreign trade or investment, including currency exchange controls;

·                          the general economic conditions in the countries in which we operate could have an adverse effect on our earnings from operations in those countries;

·                          the imposition of, or unexpected adverse changes in, foreign laws or regulatory requirements, including those pertaining to export duties and quotas, trade and employment restrictions;

·                          longer payment cycles for sales in foreign countries and difficulties in collecting accounts receivable;

·                          US and foreign import and export laws;

·                          difficulty in monitoring or effectively preventing business practices which may violate US laws including the Foreign Corrupt Practices Act;

·                          fluctuations in currency exchange rates;

·                          compliance with multiple, conflicting and changing governmental laws and regulations, including tax, privacy and data protection laws and regulations;

21

Table of Contents

·                          costs and delays associated with developing software, documentation and training materials in multiple languages; and

·                          political unrest, war or acts of terrorism occurring in the foreign countries in which we currently operate or intend to operate in the future.

We may not continue to succeed in developing and implementing policies and strategies that will be effective in each location where we currently do business or intend to do business in the future. Furthermore, the occurrence of any of the foregoing factors may have a material adverse effect on our business, financial condition and results of operations.

Insiders control a substantial amount of our outstanding stock, and this may delay or prevent a change of control of our company or adversely affect our stock price.

As of February 18, 2015, our executive officers, directors and affiliated entities together beneficially own approximately 36% of our common stock outstanding, including approximately 31% of our outstanding common stock held by our founder, Shawn McCreight, and his wife. As a result, these stockholders may have control over matters that require approval by our stockholders, including the election of directors and approval of significant corporate transactions. Corporate actions favored by these stockholders might be taken even if other stockholders oppose them. This concentration of ownership might also have the effect of delaying or preventing a change of control that other stockholders may view as beneficial.

Our charter documents and Delaware law may deter potential acquirers of our business and may thus depress our stock price.

Our amended and restated certificate of incorporation and our bylaws contain provisions that could delay or prevent a change of control of our company that our stockholders might consider favorable. In addition, we are governed by the provisions of Section 203 of the Delaware General Corporation Law, which may discourage, delay or prevent certain business combinations with stockholders owning 15% or more of our outstanding voting stock. These and other provisions in our charter documents may make it more difficult for stockholders or potential acquirers to initiate actions that are opposed by the then-current board of directors, including delaying or impeding a merger, tender offer, or proxy contest or other change of control transaction involving our company. Any delay or prevention of a change of control transaction could cause stockholders to lose a substantial premium over the then current market price of their shares.

The trading price of our common stock is volatile.

The trading prices of the securities of technology companies have historically been highly volatile. Accordingly, the trading price of our common stock has been subject to wide fluctuations since our initial public offering in December 2006. Factors that may affect the trading price of our common stock include:

·                          variations in our financial results;

·                          announcements of technological innovations, new solutions, pricing models, strategic alliances or significant agreements by us or by our competitors;

·                          recruitment or departure of key personnel;

·                          changes in the estimates of our financial results or changes in the recommendations of any securities analysts that elect to follow our common stock; and

·                          market conditions in our industry, the industries of our customers and the economy as a whole.

In addition, if the market for software or other technology stocks or the stock market in general experiences continued or greater loss of investor confidence, the trading price of our common stock could decline for reasons unrelated to our business or financial results. The trading price of our common stock might also decline in reaction to events that affect other companies in our industry even if these events do not directly affect us.

22

Table of Contents

Future sales of shares by existing stockholders could cause our stock price to decline.

All of our outstanding shares are eligible for sale in the public market, subject in certain cases to volume limitations under Rule 144 of the Securities Act of 1933, as amended. Also, shares subject to outstanding options and rights under our Second Amended and Restated 2004 Equity Incentive Plan are eligible for sale in the public market to the extent permitted by the provisions of various vesting agreements and Rules 144 and 701 under the Securities Act. If these shares are sold, or if it is perceived that they will be sold in the public market, the trading price of our common stock could decline.

In addition, our founder, Shawn McCreight, and his wife, continue to hold a substantial number of shares of our common stock. Sales by Mr. McCreight or his wife of a substantial number of shares, or the expectation that such sales may occur, could significantly reduce the market price of our common stock.

Disruption in component supplies or a breakdown in the manufacturing supply chain could adversely impact hardware revenues.

Tableau™  brand hardware products typically incorporate hundreds or more components from a wide range of manufacturing sources.  In some cases these components are “sole source”, so it is possible for a disruption at a single supplier to constrain or entirely halt production of one of more Tableau brand products, perhaps for an extended period.

Additionally, we use offshore contract manufacturing facilities for most of the assembly work related to Tableau brand hardware products.  A breakdown in international transportation or political or economic upheaval could negatively impact our ability to manufacture or transport products leading to a loss of hardware product revenue.

Our balance sheet contained finite-lived intangible assets and goodwill totaling $22.4 million at December 31, 2014 that are subject to impairment review annually, or whenever events or changes in circumstances indicate that the value may not be recoverable, resulting in write-downs or write-offs. Such write-downs or write-offs could adversely impact our future earnings and stock price, our ability to obtain financing and our customer relationships.

At December 31, 2014, we had $14.6 million in indefinite-lived intangible assets and goodwill on our balance sheet. Accounting Standards Codification Intangibles — Goodwill and Other (ASC 350) requires that goodwill and indefinite-lived intangible assets be tested for impairment annually, or whenever events or changes in circumstances indicate that the value may not be recoverable. Such testing could result in write-downs or write-offs to our goodwill and indefinite-lived intangible assets. Impairment is measured as the excess of the carrying value of the goodwill or intangible assets over the implied fair value of the underlying asset. Accordingly, we may, from time to time, incur impairment charges, which are recorded as operating expenses when they are incurred and would reduce our net income and adversely affect our operating results in the period in which they are incurred.  One customer represents 47% of our subscription revenue for the year ended 2014.  If we were to lose this specific customer, our subscription operations would be adversely affected, and this might result in an impairment of the goodwill and intangible assets in this reporting unit.

As of December 31, 2014, we had $7.8 million of other net intangible assets, consisting of core technology, existing and developed technology, customer relationships and tradenames that we amortize over time. Any material impairment to any of these items could adversely affect our results of operations and could affect the trading price of our common stock in the period in which they are incurred.

Item 1B.                          Unresolved Staff Comments

None.

Item 2.                                  Properties

Our corporate headquarters is located in Pasadena, California.  From January to July of 2013, we leased approximately 70,000 square feet in two locations.  In July 2012, we entered into an Office Lease Agreement (the “Lease”) to lease approximately 90,000 rentable square feet of an office building, also located in Pasadena, California.  The Lease began on August 1, 2013 and has an initial term of ten years and ten months.  The Lease allowed the Company to consolidate its Pasadena operations into a single location.

We also lease approximately 62,000 square feet at facilities in: Houston, Texas; New York City, New York; Waukesha, Wisconsin; San Francisco, California; Dulles, Virginia; Chicago, Illinois; Orlando, Florida, Chandler, Arizona and near London, England.  We also maintain regional facilities in Singapore and Brazil.  These leases expire at various points through 2019.

23

Table of Contents

Item 3.                                  Legal Proceedings

On May 20, 2011, MyKey Technology Inc. (“MyKey”) filed a complaint against us and certain other parties for patent infringement in the United States District Court for the District of Delaware.  With respect to the Company, the complaint alleged that certain of our data acquisition forensic hardware products that we acquired as a result of our acquisition of certain assets of Tableau, LLC (“Tableau”) infringe three of MyKey’s patents relating to write blocking, duplication and data removal technologies, respectively.  The complaint sought a declaration of infringement, a finding of willful infringement, compensatory damages, treble damages, injunctive relief, interest, expenses, costs and attorneys’ fees.

On July 22, 2011, MyKey also filed a complaint with the United States International Trade Commission (the “ITC”), alleging infringement by the Company and certain other parties of the three patents discussed in the preceding paragraph and requesting that the ITC commence an investigation pursuant to Section 337 of the Tariff Act of 1930.  The complaint sought injunctive relief barring the Company from the importation of products that allegedly infringed the three patents of MyKey.  On August 24, 2011, the ITC commenced an investigation of the Company and certain other parties related to the complaint by MyKey.  On August 31, 2011 the proceeding in the District Court was stayed pending the resolution of the ITC matter.  On August 1, 2012, MyKey amended its ITC complaint to remove allegations that its duplication patent had been infringed by the Company and to reduce the number of claims it alleges the Company has infringed related to MyKey’s data removal patent.  In August 2012, the parties completed a trial on the remaining patent claims at issue.

On December 28, 2012, the ITC released a final determination and Order holding that no violation of Section 337 of the Tariff Act of 1930 occurred as a result of the Company’s importation into the United States and sale of the products at issue.  This Order effectively ended the ITC proceeding in the Company’s favor.

On February 20, 2013, the U.S. District Court of Delaware lifted the stay of the proceedings in the MyKey matter.  Effective April 8, 2013, the parties stipulated to a transfer of the matter to the U.S. District Court for the Central District of California.  On April 16, 2013, the Company filed its Answer and Counterclaim.  MyKey filed a petition to consolidate a number of related cases, including the case against the Company in the Central District of California, into a Multi-District Litigation (“MDL”) proceeding.  On August 16, 2013, the MDL panel approved the petition and assigned the MDL consolidated cases to the judge who is also presiding over the individual case against the Company.  The MDL case will dispose of certain issues common to the consolidated cases, such as the validity of patents being asserted against the joint defendants.  On May 23, 2014, the parties completed a Markman hearing related to claim construction of the patents at issue.

On March 26, 2014, MyKey also filed a complaint against the United States of America alleging that the United States has infringed U.S. Patents No. 6,813,682, 7,159,086 and 7,228,379 by or through its acceptance, receipt and/or use of write blocker products, data duplication products and data removal products.  The complaint alleges that such products were supplied to the government by the Company and certain of its co-defendants in the MDL proceeding.  No damages amount is stated in the complaint.  The government could assert a claim for indemnification against the Company but has not done so yet.

On October 16, 2014, MyKey filed a Notice of Status on Claim Construction Issues in which it acknowledged that MyKey will not be able to prove that the Company’s data duplication products infringed U.S. Patent 7,159,086.  In the same filing, MyKey acknowledged that certain claims of United States Patent 6,813,682 are invalid and therefore cannot be infringed by any product.

We intend to defend the remaining MyKey matters vigorously and, at this time, are unable to estimate what, if any, liability we may have in connection with these matters.  Although a financial loss is reasonably possible from currently pending MyKey cases, the Company is unable to estimate a range of reasonably possible financial losses due to various reasons, including, among others, that (1) certain of the proceedings are still at an early stage, (2) there is uncertainty as to the outcome of pending appeals, motions, or settlements, (3) there are significant factual issues to be resolved, (4) there are unresolved negotiations with certain indemnitors or indemnitees of the Company, related to the actions, and (5) we have meritorious defenses that we intend to assert.

From time to time, we may become involved in various other lawsuits and legal proceedings that arise in the ordinary course of business.  Litigation is subject to inherent uncertainties, and an adverse result in these or other matters may arise from time to time that may harm our business.  We are not currently aware of any such other legal proceedings or claims that are likely to have a material impact on our business.

24

Table of Contents

Item 4.                                   Removed & Reserved

(not applicable)

PART II

Item 5.                                  Market for Registrant’s Common Equity, Related Stockholder Matters and Issuer Purchases of Equity Securities

Our common stock is traded on the NASDAQ Global Market under the symbol “GUID”.  The following table sets forth the range of high and low sales prices on the NASDAQ Global Market of the common stock for the periods indicated.

As of January 31, 2015, there were 19 holders of record of our common stock.  On February 18, 2015, the last sale price reported on the NASDAQ Global Market for our common stock was $6.16 per share.

We anticipate that any future earnings will be retained to finance continuing development of our business. Accordingly, we do not anticipate paying dividends on our common stock in the foreseeable future. Any determination to pay dividends in the future will be at the discretion of our Board of Directors and will depend upon our results of operation, financial condition and other factors as the Board of Directors, in its discretion, deems relevant.

Purchases of Equity Securities by the Issuer

In August 2008, our Board of Directors authorized a program to repurchase shares of our common stock having an aggregate value of up to $8.0 million. As of December 31, 2014, we had approximately $3.6 million remaining under this authorization. The authorization allows us to repurchase our common stock from time to time through open market purchases and negotiated transactions, or otherwise. There were no open market purchases during 2014, 2013, or 2012. The timing, nature and amount of such transactions will depend on a variety of factors, including market conditions, and the program may be suspended, discontinued or accelerated at any time. The sources of funds for the purchases under the remaining authorization are our existing cash on hand and cash from operations. Purchases are made in the open market, through block trades and other negotiated transactions. Repurchased shares are held in Treasury Stock and have not been retired.

Employee transactions listed in the table below consist of shares withheld by the Company to satisfy employee personal income tax withholding requirements upon the vesting of share awards issued under our equity compensation plans.  Withholdings are limited to minimum statutory requirements.  As of January 2014, the Company no longer withholds shares to satisfy employee personal income tax withholding requirements upon vesting.

25

Table of Contents

Stock Performance Graph and Cumulative Total Return

The following graph illustrates a comparison of the total cumulative stockholder return on our common stock for each of the last five fiscal years with two indices: (i) the NASDAQ Composite Index (symbol: ^IXIC) and (ii) the NASDAQ Computer Index (symbol: ^IXCO). The graph assumes an initial investment of $100 at the beginning of the five year period and that all dividends have been reinvested.  No cash dividends have been declared on our common stock.  The quotes were obtained from http://finance.yahoo.com. The comparisons in the graph are required by the SEC and are not intended to forecast or be indicative of the possible future performance of our common stock.

COMPARISON OF CUMULATIVE TOTAL RETURN

Item 6.                                  Selected Consolidated Financial Data

The following selected consolidated financial data should be read in conjunction with “Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations” and our consolidated financial statements included in “Item 8. Financial Statements and Supplementary Data.”  The selected consolidated balance sheet data as of December 31, 2014 and 2013 and the selected consolidated statement of operations data for each of the three years in the period ended December 31, 2014, have been derived from our audited consolidated financial statements, which are included in “Item 8. Financial Statements and Supplementary Data” to this Annual Report.  The selected consolidated balance sheet data as of December 31, 2012, 2011 and 2010 and selected consolidated statement of operations data for the year ended December 31, 2011 and 2010 have been derived from our audited consolidated financial statements not included in this Annual Report.  Historical results are not necessarily indicative of the results to be expected in the future.

26

Table of Contents

(1)                  See Note 4 to our consolidated financial statements for an explanation of the determination of the number of shares used to compute basic and diluted per share amounts.

27

Table of Contents

(2)                  Non-cash compensation recorded for each of the last five years five years ended December 31, 2014 relates to stock options and restricted stock granted to employees measured under the fair value method and includes costs related to nonvested share grants.

Item 7.                                 Management’s Discussion and Analysis of Financial Condition and Results of Operations

The following discussion of our financial condition and results of operations should be read together with the financial statements and related notes that are included elsewhere in this Annual Report on Form 10-K. This discussion may contain forward-looking statements based upon current expectations that involve risks and uncertainties.  Our actual results may differ materially from those anticipated in these forward-looking statements as a result of various factors, including those set forth under “Risk Factors” or in other parts of this Annual Report on Form 10-K.

Overview

We develop and provide the leading software and hardware solutions for digital investigations, including EnCase® Enterprise, a network-enabled product primarily for corporations and government agencies, and EnCase® Forensic, a desktop-based product primarily for law enforcement agencies and digital investigators.

We were incorporated and commenced operations in 1997.  From 1997 through 2002, we generated a substantial portion of our revenues from the sale of our EnCase® Forensic products and related services.  We have experienced increases in our revenue as a result of the release of our EnCase® Enterprise product in late 2002, which expanded our customer base into corporate enterprises and federal government agencies.  In addition, the releases of our EnCase® eDiscovery solution in late 2005 and EnCase® Information Assurance solution in late 2006 (which was replaced by our EnCase® Cybersecurity solution in 2009) have increased our revenues.  In May 2010, we added a family of data acquisition forensic hardware products including forensic duplicators, multiple write blockers and other hardware through our acquisition of Tableau, LLC (“Tableau”).  In February 2012, we added cloud-based document review and production software-as-a-service for corporations and law firms through our acquisition of CaseCentral, Inc.  In September 2013, we introduced EnCase®Analytics, a security intelligence solution that exposes threats that evade detection using insights from endpoint data.  We anticipate that sales of our EnCase Enterprise products and related services, in particular our EnCase Cybersecurity and EnCase eDiscovery solutions, sales of our forensic hardware products and sales of subscriptions for cloud-based document review and production SaaS will comprise a substantial portion of our future revenues.

Important Factors Affecting Our Results of Operations

There are a number of trends that may affect our business and our industry.  We have identified factors that we expect to play an important role in our future growth and profitability.  Some of these trends or other factors include:

·                          Legislative and regulatory developments. Our digital investigation solutions allow law enforcement agencies, government organizations and corporations to conduct investigations within the legal and regulatory framework.  Historically, the implementation of new laws and regulations surrounding digital investigations has helped create demand for our products. Future changes in applicable laws or regulations could enhance or detract from the desirability of our products.

·                          Information technology budgets. Deployment of our solutions may require a substantial capital expenditure by our customers.  Budgets for information technology-related capital expenditures at corporations and all levels of government organizations are typically cyclical in nature, with generally higher budgets in times of improving economic conditions and lower budgets in times of economic slowdowns.

·                          Law enforcement agency budgets. We sell our EnCase® Forensic products and training services primarily to law enforcement agencies.  Because of the limited nature of law enforcement budgets, funds are typically initially allocated toward solving issues perceived to be the most pressing.  Sales of our products could be impacted by changes in the budgets of law enforcement agencies or in the relative priority assigned to digital law enforcement investigations.

·                          Prevalence and impact of security breaches, hacking incidents and spread of malicious software. The increasing sophistication of security breaches and hacking attacks on government and private networks and the global spread of malicious software, such as viruses, worms and rootkits, have increased the focus of corporations and large government organizations on digital investigations and other aspects of network security, which has, in turn, increased demand for our products.  Future changes in the number and severity of such breaches, attacks or the spread of malicious software could have an effect on the demand for our products.

28

Table of Contents

·                          Seasonality in revenues. We experience seasonality in our revenues, with the third and fourth quarters typically having the highest revenues for the year.  We believe that this seasonality results primarily from our customers’ budgeting cycles.  The federal government budget year ends in the third calendar quarter of the year and a majority of corporate budget years end in the fourth calendar quarter of the year.  In addition, our customers also tend to make software purchases near the end of a particular quarter, which tends to make our revenues for a particular period unpredictable for a significant portion of that period.  We expect that this seasonality within particular years and unpredictability within particular quarterly periods will continue for the foreseeable future.

·                          Amount of commercial litigation. Because commercial litigation often involves e-discovery, an increase in commercial litigation could increase demand for our products and services, while a decrease in commercial litigation could decrease demand.

Summary of Results of Operations

Our total revenue for the year ended December 31, 2014 was $108.7 million, a decrease of $1.9 million, or 2%, from 2013.  Product revenue was $34.4 million for the year ended December 31, 2014, an increase  of $0.2 million, or 1%, from 2013.  Subscription revenue was $7.4 million for the year ended December 31, 2014, a decrease of $2.9 million, or 28%, from 2013.  Services and maintenance revenues was $66.8 million for the year ended December 31, 2014, an increase of $0.9 million, or 1%, from 2013.  The decrease in our total revenue for the year ended December 31, 2014, compared to 2013 was primarily due to a decrease in subscription revenue, partially offset by small increases in product and services and maintenance revenues.

Our net loss for the year ended December 31, 2014 was $14.7 million, or $0.55 per share, compared to a net loss of $21.5 million, or $0.83 per share, for 2013.  Our future profitability is primarily dependent upon revenue from the sale of our products.  The primary contributors to the decrease in our net loss for 2014 were a decrease in cost of revenues and operating expenses compared with 2013.

Sources of Revenue

Our software product sales transactions typically include the following elements: (i) a software license fee paid for the use of our products under a perpetual license term, or for a specific term; (ii) an arrangement for first-year support and maintenance, which includes unspecified software updates, upgrades and post-contract support; (iii) and professional services for installation, implementation, consulting and training. With our acquisition of CaseCentral in February 2012, we began to generate revenue from cloud-based document review and production software sold as subscription services. We sell our software products and services through our direct sales force, our inside sales force and in some cases we utilize resellers. We sell our hardware products primarily through resellers.

Product Revenue

We generate product revenue principally from two product categories: Enterprise products and Forensic products.  Our Enterprise products include revenue related to licenses of our EnCase® Enterprise, EnCase® Cybersecurity, and EnCase® eDiscovery sales.  Our Forensic products include revenue related to EnCase® Forensic, EnCase® Portable, and forensic hardware sales.  During the first two quarters of each fiscal year, we typically experience our lowest levels of product sales due to the seasonal budgetary cycles of our customers.  The third quarter is typically the strongest quarter for sales to our federal government customers. Typically, sales to our corporate customers are highest in the fourth quarter.

29

Table of Contents

Product revenue for the year ended December 31, 2014 increased $0.2 million, or 1%, to $34.4 million from $34.2 million for the year ended December 31, 2013.  The increase was due to a $1.1 million increase, or 11%, to $10.7 million from $9.6 million for the year ended December 31, 2013,  in hardware revenues due to new versions of our hardware products being released, partially offset by a $0.9 million decrease, or 8%, to $9.9 million from $10.8 million, in forensic products revenues resulting from continued weakness in spending by our government customers.  During the year ended December 31, 2014 we added 568 new EnCase® Enterprise customers, as compared to 278 for the year ended December 31, 2013.

Product revenue for the year ended December 31, 2013 decreased $21.9 million, or 39%, to $34.2 million from $56.1 million for the year ended December 31, 2012.  The decrease was due to a decrease in both Enterprise and Forensic revenues.  Enterprise product revenue for the year ended December 31, 2013 decreased by $16.1 million, or 54%, to $13.8 million from $29.9 million for the year ended December 31, 2012 primarily due to significantly reduced spending by government customers as a result of the federal budget sequestration.  During the year ended December 31, 2013 we added 278 new EnCase® Enterprise customers, as compared to 358 for the year ended December 31, 2012.  During 2013, 66% of Enterprise product revenue was the result of sales to existing customers, compared to 74% in 2012.  Forensic revenue for the year ended December 31, 2013 decreased by $5.8 million, or 22%, to $20.4 million from $26.2 million for the year ended December 31, 2012, primarily due to significantly reduced spending by our government customers impacted by the federal budget sequestration.

Subscription Revenue

Subscription service customers have the right to access our cloud-based document review and production software; however, they may not take possession of the software at any time during the term of their agreement.  We generate subscription revenue principally from two types of customers: corporate or large enterprise customers who typically use our cloud-based software to host multiple legal cases on an ongoing basis, and law firm customers, who typically use our cloud-based software to host single cases.  In general, we recognize revenues for subscriptions on a straight-line basis over the contract period commencing on the date the subscription is made available to the customer.  Usage-based fees, which are determined monthly, are recognized when incurred.

Subscription revenue from our cloud-based document review and production software for the year ended December 31, 2014 decreased $2.9 million, or 28%, to $7.4 million from $10.3 million for the year ended December 31, 2013.  The decrease was primarily due to downward pricing pressure in the eDiscovery sector and reduced revenue as a result of single-use law firm customers transitioning their cases from production to archive status. Our business model focuses on corporate or enterprise customers who typically use our product for multiple legal cases on an ongoing basis.

Subscription revenue for the year ended December 31, 2013 increased $1.1 million, or 12%, to $10.3 million from $9.2 million for the year ended December 31, 2012.  The increase is primarily due to our CaseCentral acquisition in February 2012, when we began to generate revenues from software sold as subscription services.  Subscription revenue for 2013 includes a full year of subscription revenue as compared to a partial year of subscription revenue for 2012, since we started generating subscription revenue in February 2012.

Services and Maintenance Revenues

Services and maintenance revenues for the year ended December 31, 2014 increased $0.8 million, or 1%, to $66.8 million from $66.0 million for the year ended December 31, 2013.  The increase was primarily due to a $2.1 million increase in maintenance revenues as a result of sustained increases in our installed product base and customers desiring to continue maintenance support on our products, partially offset by a $1.3 million decrease in professional services due to a decrease in case work and incident response work for our cloud-based subscriptions due to lower demand for our services from hosting customers. In 2014, our installed product base increased primarily through the addition of 568 new EnCase Enterprise customers, and sales of 137 new EnCase eDiscovery, 157 new EnCase Cybersecurity, and 99 new EnCase Analytics modules to existing EnCase Enterprise customers.

Services and maintenance revenues for the year ended December 31, 2013 increased $1.8 million, or 3%, to $66.0 million from $64.2 million for the year ended December 31, 2012.  Service revenues for the year ended December 31, 2013 increased $0.3 million, or 1%, to $28.2 million from $27.9 million, for the year ended December 31, 2012, primarily due to an increase of $1.3 million in case work, incident response work and implementation work for customers of our EnCase Enterprise products, as well as an increase of approximately $0.8 million in professional services related to the timing of our acquisition of CaseCentral in February 2012, partially offset by a decrease of $1.0 million in training revenue due to reduced

30

Table of Contents

spending by our government customers impacted by the federal budget sequestration.  Maintenance revenue for the year ended December 31, 2013 increased $1.5 million, or 4%, to $37.8 million from $36.3 million for the year ended December 31, 2012 primarily due to sustained increases in our product base and high annual renewal rates by customers desiring maintenance support on our products.  In 2013 our installed product base increased primarily through the addition of 278 new EnCase Enterprise customers, and sales of 35 new EnCase Cybersecurity, 38 new EnCase e-Discovery, and 5 EnCase Analytics modules to existing EnCase Enterprise customers.

Cost of Revenues

Cost of Product Revenue

Cost of product revenue consists principally of the cost of producing our software products, the cost of manufacturing our hardware products and product distribution costs, including the cost of packaging, shipping, customs duties, and compensation and related overhead expenses.  While these costs are primarily variable with respect to sales volumes, they remain low in relation to the revenue generated and result in higher gross margins than our subscription and services and maintenance businesses.  Our gross margins can be affected by product mix, as our enterprise products are generally higher margin products than our forensic products, which include software and hardware.

Costs of product revenue for the year ended December 31, 2014 increased $1.0 million, or 13%, to $8.4 million from $7.5 million for the year ended December 31, 2013.  The increase was primarily due to a $0.8 million increase in hardware costs and a $0.3 million increase in Original Equipment Manufacturer (“OEM”) royalty expense associated with higher sales of hardware.  Product gross margin decreased to 75.5% in 2014 from 78.2% in 2013 primarily due to the increase in hardware sales which have a lower gross margin than our enterprise and forensic software sales.

Cost of product revenue for the year ended December 31, 2013 decreased $0.5 million, or 6%, to $7.5 million from $8.0 million for the year ended December 31, 2012.  The decrease was primarily a result of a decrease in the cost of forensic hardware of approximately $0.9 million, offset by approximately $0.2 million increase in custom duty expense due to increased international sales and a $0.2 million increase in OEM royalty expense.  Product gross margin decreased to 78.2% in 2013 from 85.8% in 2012 primarily due to the decrease in enterprise and forensic software revenues, which have higher gross margins than forensic hardware sales.

31

Table of Contents

Cost of Subscription Revenue

The cost of subscription revenue consists principally of employee compensation costs, including share-based compensation and related overhead, software maintenance paid to third party vendors, and SaaS hosting infrastructure costs.

The cost of subscription revenue for the year ended December 31, 2014 increased $0.3 million, or 6%, to $4.6 million from $4.3 million for the year ended December 31, 2013.  The increase was primarily due to rent expense related to our data center which increased $0.7 million, partially offset by a $0.4 million reduction in employee-related costs due to the reduction in headcount. Subscription gross margin decreased to 38.2% in 2014 from 58.3% in 2013 primarily due to subscription revenues decreasing by 28%, while the cost of subscription revenue increased by 6%.

The cost of subscription revenue for the year ended December 31, 2013 increased $0.6 million, or 16%, to $4.3 million from $3.7 million for the year ended December 31, 2012.  The increase for the year was primarily due to the cloud-based document and production software products not becoming a part of our product mix until the completion of our acquisition of CaseCentral in February 2012.  The year end results for 2013 include a full year of costs of subscription revenue as compared to a partial year of costs of subscription revenue for 2012.

Cost of Services and Maintenance Revenues

The cost of services and maintenance revenues are largely comprised of employee compensation costs, including share-based compensation, and related overhead, travel and facilities costs.  The cost of maintenance revenue is primarily outsourced, but also includes employee compensation costs for customer technical support and related overhead costs.

The cost of services and maintenance revenues for the year ended December 31, 2014 decreased $2.8 million, or 11%, to $23.0 million from $25.8 million for the year ended December 31, 2013.  The decrease was primarily due to a $2.6 million decrease in cost of professional services due to a decrease in compensation and related expenses associated with a reduction in headcount.  Services and maintenance gross margin was 65.6% in 2014, compared to 61.0% in 2013.  The higher gross margin was primarily a result of services revenues decreasing by only 4%, while the cost of services decreased by 12%.

The cost of services and maintenance revenues for the year ended December 31, 2013 increased $1.1 million, or 4%, to $25.8 million from $24.7 million for the year ended December 31, 2012.  The increase in the cost of services and maintenance revenues for the year ended December 31, 2013, from 2012 was primarily due to an increase in costs of professional services.  The increased costs included compensation and related expenses associated with higher revenues and related travel.  Additionally, approximately $0.6 million of the increase in cost of services and maintenance revenues for the year ended December 31, 2013 was due to a full year of costs related to the acquisition of CaseCentral, whereas only a partial year of costs were captured in 2012.  Services and maintenance gross margin was 61.0% in 2013, compared to 61.4% in 2012.  The lower services and maintenance gross margin for the year ended December 31, 2013, from 2012, was primarily a result of training revenue decreasing by 10%, while the cost of training increased slightly.

Operating Expenses

32

Table of Contents

Selling and Marketing Expenses

Selling and marketing expenses consist primarily of personnel costs and costs related to our sales force and marketing staff.  Selling and marketing expenses also include expenses relating to advertising, brand building, marketing promotions and trade show events (net of amounts received from sponsors and participants), product management, travel and allocated overhead.

Selling and marketing expenses for the year ended December 31, 2014 decreased $2.5 million, or 6%, to $39.0 million from $41.5 million for the year ended December 31, 2013.  The decrease was primarily due to a $3.5 million decrease in compensation and other employee-related costs due to lower headcount, partially offset by an increase of $1.0 million in related realignment expense.

Selling and marketing expenses for the year ended December 31, 2013 decreased by $0.8 million, or 2%, to $41.5 million from $42.3 million for the year ended December 31, 2012.  The $0.8 million decrease was attributable to a $4.3 million decrease in commissions expenses, resulting from lower revenues, partially offset by an increase of $2.2 million in compensation and other employee-related expenses due to an increase in headcount as a result of our initiative to expand our international market presence and a $1.3 million increase in expenses for other marketing activities.

Research and Development Expenses

Research and development expenses consist primarily of compensation, including share-based compensation and related overhead expenses.

Research and development expenses for the year ended December 31, 2014 decreased $4.7 million, or 17%, to $23.0 million from $27.7 million for the year ended December 31, 2013.  The decrease is primarily related to a $5.5 million decrease in compensation and other employee-related expenses due to lower headcount, partially offset by an increase of $0.8 million of related realignment expense.

Research and development expenses for the year ended December 31, 2013 increased $3.2 million, or 13%, to $27.7 million from $24.5 million for the year ended December 31, 2012.  The increase was due to higher compensation and other employee-related expenses associated with increased headcount due to the number of products in development, of which $0.6 million was due to an increase in headcount in connection with the acquisition of CaseCentral in February 2012.

General and Administrative Expenses

General and administrative expenses consist of personnel and related costs for accounting, legal, information systems, human resources and other administrative functions.  In addition, general and administrative expenses include professional service fees, bad debt expense, and other corporate expenses and related overhead.

General and administrative expenses for the year ended December 31, 2014 increased $1.0 million, or 5%, to $18.4 million from $17.4 million for the year ended December 31, 2013.  The increase in general and administrative expenses was primarily attributable to $1.6 million in realignment expense associated with our reduction in headcount, partially offset by $0.6 million decrease in compensation costs, rent and other employee-related expenses associated with a lower headcount.

General and administrative expenses for the year ended December 31, 2013 decreased $3.8 million, or 18%, to $17.4 million from $21.2 million for the year ended December 31, 2012.  Approximately $2.0 million of the decrease was due to expenses related to the acquisition of CaseCentral incurred in 2012, $1.9 million of the decrease was due to legal fees incurred in connection with patent infringement complaints filed in 2011that were not filed in 2012 and 2013, partially offset by an increase of $0.6 million in bad debt expense.

Depreciation and Amortization Expenses

Depreciation and amortization expenses consist of depreciation and amortization of our leasehold improvements, furniture, computer hardware and software and intangible assets.  In 2014, 2013 and 2012, we invested $1.9 million, $13.2 million and $4.0 million, respectively, in capital equipment and leasehold improvements.

Depreciation and amortization expense for the year ended December 31, 2014 decreased $0.3 million, or 3%, to $7.4 million from $7.7 million for the year ended December 31, 2013.  The decrease was primarily due to a decrease of $0.3 million in amortization expenses as a result of certain of our acquired intangible assets being fully amortized.

33

Table of Contents

Depreciation and amortization expense for the year ended December 31, 2013 increased $0.8 million, or 12%, to $7.7 million from $6.9 million for the year ended December 31, 2012, primarily as a result of depreciation of purchased property and equipment related to our relocation to our new headquarters in 2013.

Other Income and Expense

Total other income and expense consists of interest earned on cash balances, interest expense paid and other miscellaneous income and expense items.  For the year ended December 31, 2014, we recorded income of $0.7 million as compared with income of $24,000 for the same period in 2013.  The increase was primarily due to a $0.6 million gain related to the sale of a domain name in May 2014.  For the year ended December 31, 2013, we recorded income of $24,000 compared with expense of $8,000 for the same period in 2012.  The change from 2013 to 2012 was primarily due to a decrease in interest expense.

Income Tax Provision

The effective tax rate in years 2014, 2013, and 2012 was 2.0%, 1.0%, and 10.5%, respectively.  In 2014, the effective tax rate differed from the federal statutory rate of 34% primarily due to the tax impact of deferred income tax adjustments, foreign income taxes, and the impact of providing a valuation allowance against Federal and California research and development credits and deferred tax assets.  The effective tax rate in 2013 differed from the federal statutory rate of 34% primarily due to the tax impact of deferred income tax adjustments, certain share-based compensation, and the impact of providing a valuation allowance against California research and development credits and deferred tax assets.  See Note 8 to our Consolidated Financial Statements for additional information.

Liquidity, Capital Resources and Financial Condition

As of December 31, 2014, we had $18.4 million in cash and cash equivalents.  We believe that our cash flow from operations and our cash and cash equivalents are sufficient to fund our working capital and capital expenditure requirements for at least the next 12 months.

Changes in Cash Flow

We generate cash from operating activities primarily from cash collections related to the sale of our products and services.  Net cash used in operating activities was $0.6 million in 2014, compared with $2.9 million of cash provided by operating activities in 2013. The net cash used in operating activities in 2014 included a $14.7 million net loss, an increase of $1.2 million in trade receivables, an increase of $1.5 million in prepaid expenses and other assets and an increase of $3.7 million in deferred revenues in 2014. This compares to cash provided by operating activities of $2.9 million in 2013 which included a $21.5 million net loss, a decrease of $3.9 million in trade receivables, a decrease of $1.8 million in prepaid expenses and other assets, an increase of $2.7 million in accrued liabilities, and a decrease of $1.8 million in deferred revenues in 2013.

Net cash provided by operating activities was $2.9 million in 2013, compared with $9.4 million in 2012.  The decrease in cash provided by operations was primarily a result of a net loss of $21.5 million in 2013 compared to a net loss of 2.0 million in 2012, a decrease in trade receivables of $3.9 million for 2013 compared to an increase of $0.9 million for 2012, an decrease of $2.7 million in accrued liabilities for 2013 compared to an increase of $0.3 million for 2012, an increase of $2.1 million in accounts payable for 2013, compared with a decrease of $0.3 in 2012, and a decrease of $1.8 million in prepaid expenses and other assets for 2013, compared with a decrease of $0.1 million in 2012, offset by a decrease of $1.8 million in deferred revenues for 2013, compared to an increase of $0.6 million in 2012.

Net cash used in investing activities was $1.9 million in 2014 compared to $13.2 million in 2013 and $13.7 million in 2012.  Purchase of property and equipment was $1.9 million in 2014 compared to $13.2 million in 2013.  The decrease was primarily due to the purchase of property and equipment related to our relocation to our new headquarters in 2013.  The decrease in cash used in investing activities in 2013 compared to 2012 was primarily due to a decrease of $9.6 million used in the acquisition of CaseCentral in 2012, partially offset by an increase of $9.2 million in purchases of property and equipment related to our relocation to our new headquarters in 2013.

Net cash provided by financing activities was $1.0 million in 2014 compared to cash used in financing activities of $2.3 million in 2013 and $0.2 million in 2012.  Cash provided by financing activities in 2014 included $1.1 million in proceeds from the exercise of our stock options, partially offset by $0.2 million in principal payments on capital leases and other obligations.  Cash used in financing activities in 2013 included $2.8 million repurchases and withholding of common stock, and $1.2 million of principal payments on capital leases and other obligations, partially offset by $1.7 million of proceeds from the exercise of stock options.  Cash used in financing activities in 2012 included $2.1 million of repurchases and withholding of common stock and $1.5 million of principal payments on capital leases and other obligations, partially offset by $3.4 million in proceeds from stock option exercises.

34

Table of Contents

On July 12, 2012, we entered into a Loan and Security Agreement (as amended or supplemented from time to time, the “Loan Agreement”) with a bank.  On October 31, 2013, we entered into a modification agreement (“Modification Agreement”) of the Loan Agreement with the bank to modify certain financial covenants pertaining to the Loan Agreement.  On September 30, 2014, the Loan Agreement expired.  To secure our remaining letters of credit outstanding, we established a cash collateral account with the bank in the amount of $0.2 million.

On August 29, 2014, we entered into a three year, Senior Secured Revolving Line of Credit (“Revolver”) with another bank.  The maximum principal amount that may be outstanding at any given time under the Revolver, which includes up to $3.0 million of standby letters of credit, is $10.0 million.  Any borrowings under the Revolver would be collateralized by substantially all of our assets, as well as pledges of capital stock.  The Revolver requires that, if we suffer an event of default or have borrowed more than 75% of the maximum principal amount permitted to be outstanding, we maintain an Adjusted Quick Ratio of at least 1.15 to 1.0.  If the Adjusted Quick Ratio falls below 1.5 to 1.0, any collections received by the bank on behalf of the Company will be applied to outstanding loan balances before being remitted to the Company’s operating account.  The Adjusted Quick Ratio is calculated by dividing Quick Assets (cash less restricted cash plus accounts receivable) by current liabilities (current liabilities plus outstanding standby letter of credit less the current portion of deferred revenue).  Borrowings under the Revolver bear interest at a floating rate ranging from 1.25% to 3.25% above the Prime Rate depending on the Company’s Adjusted Quick Ratio.  We are obligated to pay a commitment fee of $0.2 million over the three year term of the Revolver. All principal, interest and any other fees will be due and payable in full on or prior to August 29, 2017.

As of December 31, 2014, we were in compliance with all the covenants of the Revolver.  We had letters of credit outstanding against the Revolver in the amount of $1.3 million, resulting in the maximum available borrowing under the Revolver to be $8.5 million.  Availability is calculated as 80% of eligible accounts receivable, with a maximum of $10.0 million.  To date we have not borrowed under the Revolver.

Contractual Obligations and Commitments

On February 21, 2012, we acquired CaseCentral, a privately-held provider of cloud-based document review and production software for approximately $21.1 million, consisting of $9.6 million in cash (net of $1.4 million in cash acquired), $9.5 million in Company common stock and contingent consideration with an acquisition date fair value of $0.6 million.  Depending on CaseCentral’s SaaS revenues, we may be required to pay up to a maximum of $33.0 million in cash to CaseCentral’s former shareholder over three 12-month periods ending March 31, 2013, 2014 and 2015.  We did not pay any contingent consideration with respect to the first two 12-month periods ending March 31, 2013 and 2014.  At December 31, 2014, the fair value of the contingent consideration for the final 12-month period was estimated to be zero.

At December 31, 2014, our outstanding contractual cash commitments were largely limited to our non-cancelable lease obligations, primarily relating to office facilities, as follows:

Our future capital requirements will depend on many factors, including our rate of revenue growth, the expansion of our selling and marketing activities, the timing and extent of research and development spending to support product development and enhancement efforts, costs associated with expansion into new territories or markets, the timing of the introduction of new products and services, the enhancement of existing products and the continuing market acceptance of our products and services.  To the extent that our existing cash, cash from operations or the availability of cash under our line of credit are insufficient to fund our future activities and planned growth, we may need to raise additional funds through public or private equity or debt financings.  Additional funds may not be available on terms favorable to us or at all.  Furthermore, although we cannot accurately anticipate the effect of inflation or foreign exchange markets on our operations, we do not believe these external economic forces have had, or are likely in the foreseeable future to have, a material impact on our results of operations.  We have omitted unrecognized tax benefits from this table due to the inherent uncertainty regarding the timing and recognition related to these unrecognized tax benefits. See “Note 8—Income Taxes” in the notes to the consolidated financial statements included in Item 8 for further information regarding the unrecognized tax benefits.

35

Table of Contents

On February 29, 2012, the Company entered into a $1.5 million third-party software license agreement authorizing the Company to integrate database software as a component of its products through November 2015.  The agreement also provides for maintenance and support over a two-year period for $0.3 million, which was renewed by the Company at the expiration of the two-year period ending November 2014.  The $1.8 million was payable in eight quarterly installments of $229,000, with the final installment being paid in January 2014.  The license, maintenance and remaining liability have been recorded on the accompanying Consolidated Balance Sheets.

On July 26, 2012, we entered into an Office Lease Agreement (the “Lease”) to lease approximately 90,000 rentable square feet of an office building located in Pasadena, California.  The Lease began on August 1, 2013 and has an initial term of ten years and ten months.  The Lease allows the Company to consolidate its Pasadena, California operations into a single location.  The total annual rent under the Lease ranges from approximately $2.5 million for the first year to approximately $3.4 million for the final year of the Lease.  The Company has two options to extend the Lease, each for a period of five years.

Effective April 1, 2014, we entered into a Colocation Lease Agreement (the “Colocation Lease”) to rent space in a building located in Chandler, Arizona.  The Colocation Lease expires on June 30, 2018.  The Colocation Lease will serve as our new data center, replacing our former San Francisco location obtained in the CaseCentral acquisition.  Rent is based on power allocation and ranges from approximately $236,000 for the first year to approximately $265,000 for the final year.

On July 3, 2014, we entered into an Office Lease Agreement (the “San Francisco Lease”) to lease approximately 6,000 rentable square feet of an office building located in San Francisco, California.  The office building is the new location of our San Francisco office.  The San Francisco Lease commenced on January 1, 2015 and expires in January 2020.  The total annual rent under the San Francisco Lease ranges from approximately $295,000 for the first year to approximately $332,000 for the final year.

On November 13, 2014, the Company entered into a $1.5 million third-party software license agreement authorizing the Company to integrate software as a component of its products through March 2018.  The agreement also provides for maintenance and support over a three-year period, which may be renewed by the Company at the expiration of the three-year period ending March 2018.  The $1.5 million is payable in three annual installments of $492,000, with the final installment being paid in November 2016.  The license, maintenance and remaining liability have been recorded on the accompanying Consolidated Balance Sheets.

Other than the items stated above, we currently have no other material cash commitments, except our normal recurring trade payables, expense accruals, leases and license obligations, all of which are currently expected to be funded through existing working capital and future cash flows from operations.

Off-Balance Sheet Arrangements

As of December 31, 2014, we had no off-balance sheet arrangements as defined in Item 303(a)(4) of the SEC’s Regulation S-K.  We do not have material relationships or transactions with persons or entities that derive benefits from their non-independent relationship with us or our related parties except as disclosed in this report.

Stock Repurchases

In August 2008, our Board of Directors authorized management to repurchase up to $8.0 million of our outstanding common stock.  Under the authorization, the timing and actual number of shares subject to repurchase are at the discretion of management and are contingent on a number of factors, such as levels of cash generation from operations, market conditions and our share price.  Repurchased shares are held in Treasury Stock and have not been retired.  As of December 31, 2014, we had approximately $3.6 million remaining under this authorization.

In addition to the shares we have repurchased on the open market, we withheld zero shares from employees to satisfy their personal income tax withholding requirements upon the vesting of share awards issued under our equity compensation plans during the year ended December 31, 2014.  For years ended December 31, 2013 and 2012, approximately 284,000, and 207,000 common shares, respectively.  Withheld shares are held in Treasury Stock and have not been retired.  The Company may engage in similar transactions from time to time related to future vesting of employee restricted stock awards.

36

Table of Contents

Critical Accounting Policies and Estimates