Use these links to rapidly review the document
TABLE OF CONTENTS
INDEX TO CONSOLIDATED FINANCIAL STATEMENTS

Table of Contents

As filed with the Securities and Exchange Commission on April 23, 2018.

Registration No. 333-224196

 

UNITED STATES
SECURITIES AND EXCHANGE COMMISSION
Washington, D.C. 20549

AMENDMENT NO. 1
TO

FORM S-1
REGISTRATION STATEMENT
UNDER
THE SECURITIES ACT OF 1933

---

Carbon Black, Inc.
(Exact name of registrant as specified in its charter)

1100 Winter Street
Waltham, Massachusetts 02451
(617) 393-7400
(Address, including zip code, and telephone number, including area code, of registrant's principal executive offices)

Patrick Morley
President and Chief Executive Officer
Carbon Black, Inc.
1100 Winter Street
Waltham, Massachusetts 02451
(617) 393-7400
(Name, address, including zip code, and telephone number, including area code, of agent for service)

---

---

Approximate date of commencement of proposed sale to public:
As soon as practicable after this Registration Statement is declared effective.

          If any of the securities being registered on this Form are to be offered on a delayed or continuous basis pursuant to Rule 415 under the Securities Act of 1933, check the following box.    o

          If this Form is filed to register additional securities for an offering pursuant to Rule 462(b) under the Securities Act, check the following box and list the Securities Act registration statement number of the earlier effective registration statement for the same offering.    o

          If this Form is a post-effective amendment filed pursuant to Rule 462(c) under the Securities Act, check the following box and list the Securities Act registration statement number of the earlier effective registration statement for the same offering.    o

          If this Form is a post-effective amendment filed pursuant to Rule 462(d) under the Securities Act, check the following box and list the Securities Act registration statement number of the earlier effective registration statement for the same offering.    o

          Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company or an emerging growth company. See the definitions of "large accelerated filer," "accelerated filer," "smaller reporting company" and "emerging growth company" in Rule 12b-2 of the Exchange Act.

          If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ý

---

CALCULATION OF REGISTRATION FEE

(1)

Includes shares that the underwriters have the option to purchase to cover over-allotments, if any.

(2)

Estimated solely for the purpose of calculating the registration fee pursuant to Rule 457(a) under the Securities Act of 1933, as amended.

(3)

The Registrant previously paid $12,450.00 of the total registration fee in connection with a previous filing of this Registration Statement.

---

          The Registrant hereby amends this Registration Statement on such date or dates as may be necessary to delay its effective date until the Registrant shall file a further amendment which specifically states that this Registration Statement shall thereafter become effective in accordance with Section 8(a) of the Securities Act of 1933 or until the Registration Statement shall become effective on such date as the Securities and Exchange Commission, acting pursuant to said Section 8(a), may determine.

   

---

Table of Contents

---

Table of Contents

---

Table of Contents

---

Table of Contents

---

Table of Contents

TABLE OF CONTENTS

        Neither we nor the underwriters have authorized anyone to provide any information or to make any representations other than those contained in this prospectus or in any free writing prospectuses we have prepared. Neither we nor the underwriters take responsibility for, and can provide no assurance as to the reliability of, any other information that others may give you. This prospectus is an offer to sell only the shares offered hereby, but only under circumstances and in jurisdictions where it is lawful to do so. The information contained in this prospectus is current only as of the date of this prospectus, regardless of the time of delivery of this prospectus or of any sale of our common stock.

        For investors outside of the United States: Neither we nor any of the underwriters have done anything that would permit this offering or possession or distribution of this prospectus in any jurisdiction where action for that purpose is required other than in the United States. Persons who come into possession of this prospectus and any applicable free writing prospectus in jurisdictions outside the United States are required to inform themselves about and to observe any restrictions as to this offering and the distribution of this prospectus and any such free writing prospectus applicable to that jurisdiction.

i

---

Table of Contents

 

1

---

Table of Contents

2

---

Table of Contents

3

---

Table of Contents

4

---

Table of Contents

5

---

Table of Contents

6

---

Table of Contents

7

---

Table of Contents

8

---

Table of Contents

9

---

Table of Contents

10

---

Table of Contents

11

---

Table of Contents

12

---

Table of Contents

13

---

Table of Contents

14

---

Table of Contents

15

---

Table of Contents

16

---

Table of Contents

17

---

Table of Contents

RISK FACTORS

        Investing in our common stock involves a high degree of risk. You should carefully consider the risks and uncertainties described below, together with all of the other information in this prospectus, including the section titled "Management's Discussion and Analysis of Financial Condition and Results of Operations" and our consolidated financial statements and related notes included elsewhere in this prospectus, before deciding whether to purchase shares of our common stock. The risks and uncertainties described below are not the only ones we face. Additional risks and uncertainties that we are unaware of may also become important factors that adversely affect our business. If any of the following risks actually occur, our business, financial condition, results of operations and future prospects could be adversely affected. In that event, the market price of our stock could decline, and you could lose part or all of your investment.

Risks Related to Our Business and Industry

We are a rapidly growing company, which makes it difficult to evaluate our future prospects.

        We are a rapidly growing company. Our ability to forecast our future operating results is subject to a number of uncertainties, including our ability to plan for and model future growth. We have encountered and will continue to encounter risks and uncertainties frequently experienced by growing companies in rapidly evolving industries. If our assumptions regarding these uncertainties, which we use to plan our business, are incorrect or change in reaction to changes in our markets, or if we do not address these risks successfully, our operating and financial results could differ materially from our expectations, our business could suffer and the trading price of our stock may decline.

We have not been profitable historically and may not achieve or maintain profitability in the future.

        We have incurred net losses in each year since inception, including net losses of $38.7 million in 2015, $44.6 million in 2016 and $55.8 million in 2017. As of December 31, 2017, we had an accumulated deficit of $279.9 million. While we have experienced significant revenue growth in recent periods, we are not certain whether or when we will obtain a high enough volume of sales of our products to sustain or increase our growth or achieve or maintain profitability in the future. We also expect our costs to increase in future periods, which could negatively affect our future operating results if our revenue does not increase. In particular, we expect to continue to expend substantial financial and other resources on:

•

research and development related to our products, including investments in our research and development team;



•

sales and marketing, including a significant expansion of our sales organization, both domestically and internationally;



•

continued international expansion of our business;



•

expansion of our professional services organization; and



•

general administration expenses, including legal and accounting expenses related to being a public company.

        These investments may not result in increased revenue or growth in our business. We expect to continue to devote research and development resources to our on-premise solutions; if our customers and potential customers shift their information technology, or IT, infrastructures to the cloud faster than we anticipate, we may not realize our expected return from the costs we incur. If we are unable to increase our revenue at a rate sufficient to offset the expected increase in our costs, our business, financial position and results of operations will be harmed, and we may not be able to achieve or maintain profitability over the long term. Additionally, we may encounter unforeseen operating expenses, difficulties, complications, delays and other unknown factors that may result in losses in future periods. If our revenue growth does not meet our expectations in future periods, our financial performance may be harmed, and we may not achieve or maintain profitability in the future.

18

---

Table of Contents

If we are unable to sustain our revenue growth rate, we may not achieve or maintain profitability in the future.

        Our revenue grew from $70.6 million in 2015 to $116.2 million in 2016 and $162.0 million in 2017, representing a 51% compound annual growth rate over the same period. Although we have experienced rapid growth historically and currently have high customer retention rates, we may not continue to grow as rapidly in the future and our customer retention rates may decline. Any success that we may experience in the future will depend in large part on our ability to, among other things:

•

maintain and expand our customer base;



•

increase revenues from existing customers through increased or broader use of our products within their organizations;



•

maintain and expand strategic partnerships with our channel partners;



•

improve the performance and capabilities of our products through research and development;



•

continue to develop our cloud-based solutions;



•

maintain the rate at which customers purchase our support services;



•

continue to successfully expand our business domestically and internationally;



•

successfully identify and consummate acquisitions of complementary businesses, technology and assets; and



•

successfully compete with other companies.

        If we are unable to maintain consistent revenue or revenue growth, our stock price could be volatile, and it may be difficult to achieve and maintain profitability. You should not rely on our revenue for any prior quarterly or annual periods as any indication of our future revenue or revenue growth.

Our quarterly financial results, including our billings and deferred revenue, may fluctuate for a variety of reasons, including our failure to close significant sales before the end of a particular quarter.

        A meaningful portion of our revenue is generated by significant sales to new customers and sales of additional products to existing customers. Purchases of our solutions often occur during the last month of each quarter, particularly in the last quarter of the year. In addition, our sales cycle can last several months from proof of concept to contract negotiation, to delivery of our solution to our customers, and this sales cycle can be even longer, less predictable and more resource-intensive for larger sales. Customers may also require additional internal approvals or seek to test our products for a longer trial period before deciding to purchase our solutions. As a result, the timing of individual sales can be difficult to predict. In some cases, sales have occurred in a quarter subsequent to those we anticipated, or have not occurred at all, which can significantly impact our quarterly financial results and make it more difficult to meet market expectations. See "Management's Discussion and Analysis of Financial Condition and Results of Operations—Critical Accounting Policies—Revenue Recognition."

        In addition to the sales cycle-related fluctuations noted above, our financial results, including our billings and deferred revenue, will continue to vary as a result of a number of factors, many of which are outside of our control and may be difficult to predict, including:

•

our ability to attract and retain new customers;



•

our ability to sell additional products to existing customers;



•

our ability to expand into adjacent and complementary markets;



•

changes in customer or channel partner requirements or market needs;



•

changes in the growth rate of the next-generation endpoint security market;

19

---

Table of Contents

•

the timing and success of new product introductions by us or our competitors, or any other change in the competitive landscape of the next-generation endpoint security market, including consolidation among our customers or competitors;



•

a disruption in, or termination of, any of our relationships with channel partners;



•

our ability to successfully expand our business globally;



•

reductions in customer retention rates;



•

changes in our pricing policies or those of our competitors;



•

general economic conditions in our markets;



•

future accounting pronouncements or changes in our accounting policies or practices;



•

the amount and timing of our operating costs, including cost of goods sold;



•

a change in our mix of products and services, including shifts to cloud-based products offered through a software-as-a-service model; and



•

increases or decreases in our revenue and expenses caused by fluctuations in foreign currency exchange rates.

        Any of the above factors, individually or in the aggregate, may result in significant fluctuations in our financial and other operating results from period to period. These fluctuations could result in our failure to meet our operating plan or the expectations of investors or analysts for any period. If we fail to meet such expectations for these or other reasons, the trading price of our common stock could fall substantially, and we could face costly lawsuits, including securities class action suits.

We recognize substantially all of our revenue ratably over the term of our agreements with customers and, as a result, downturns or upturns in sales may not be immediately reflected in our operating results.

        We recognize substantially all of our revenue ratably over the terms of our agreements with customers, which generally occurs over a one- or three-year period. As a result, a substantial portion of the revenue that we report in each period will be derived from the recognition of deferred revenue relating to agreements entered into during previous periods. Consequently, a decline in new sales or renewals in any one period may not be immediately reflected in our revenue results for that period. This decline, however, will negatively affect our revenue in future periods. Accordingly, the effect of significant downturns in sales and market acceptance of our products, and potential changes in our rate of renewals may not be fully reflected in our results of operations until future periods. Our model also makes it difficult for us to rapidly increase our revenue through additional sales in any period, as revenue from new customers generally will be recognized over the term of the applicable agreement.

        We also intend to increase our investment in research and development, sales and marketing and general and administrative functions and other areas to grow our business. These costs are generally expensed as incurred (with the exception of sales commissions), as compared to our revenue, substantially all of which is recognized ratably in future periods. We are likely to recognize the costs associated with these increased investments earlier than some of the anticipated benefits and the return on these investments may be lower, or may develop more slowly, than we expect, which could adversely affect our operating results.

We face intense competition in our market, especially from larger, well-established companies, and we may lack sufficient financial or other resources to maintain or improve our competitive position.

        Our market is large, highly competitive, fragmented and subject to rapidly evolving technology, shifting customer needs and frequent introductions of new solutions. We expect competition to increase in the future from both established competitors and new market entrants. Our current competitors include

20

---

Table of Contents

legacy antivirus solution providers, such as McAfee and Symantec Corporation, established network security providers, such as Palo Alto Networks, Inc., FireEye, Inc. and Cisco Systems, Inc., and privately held companies, such as Crowdstrike and Cylance. New startup companies, as well as established public and private companies, have entered or are currently attempting to enter the next-generation endpoint security market, some of which are or may become significant competitors in the future. Many of our existing competitors have, and some of our potential competitors could have, substantial competitive advantages such as:

•

greater name recognition and longer operating histories;



•

larger sales and marketing budgets and resources;



•

broader distribution and established relationships with distribution partners and customers;



•

greater customer support resources;



•

greater resources to make acquisitions;



•

lower labor and development costs;



•

larger and more mature intellectual property portfolios; and



•

substantially greater financial, technical and other resources.

        In addition, some of our larger competitors have substantially broader and more diverse product offerings and leverage their relationships based on their installed products or incorporate functionality into existing products to gain business in a manner that discourages users from purchasing our products, including by selling their products at zero or negative margins, product bundling or closed technology platforms. Potential customers may also prefer to purchase from their existing suppliers rather than a new supplier regardless of product performance or features. These larger competitors often have broader product lines and market focus and may therefore not be as susceptible to downturns in a particular market. Some of our smaller competitors that specialize in providing point solutions focused on narrow security problems are able to deliver these specialized security solutions to the market on a faster cadence than a typical enterprise class solution. Conditions in our market could change rapidly and significantly as a result of technological advancements, partnering by our competitors or continuing market consolidation. New start-up companies that innovate and large competitors that are making significant investments in research and development may invent similar or superior products and technologies that compete with our products and technology. Our current and potential competitors may also establish cooperative relationships among themselves or with third parties that may further enhance their resources.

        Some of our competitors have made acquisitions of businesses that may allow them to offer more directly competitive and comprehensive solutions than they had previously offered. As a result of such acquisitions, our current or potential competitors might be able to adapt more quickly to new technologies and customer needs, devote greater resources to the promotion or sale of their products and services, initiate or withstand substantial price competition, take advantage of acquisition or other opportunities more readily, or develop and expand their product and service offerings more quickly than we do. For various reasons, organizations may be more willing to incrementally add our competitors' products to their existing security infrastructure instead of incorporating our products. These competitive pressures in our market or our failure to compete effectively may result in price reductions, fewer orders, reduced revenue and gross margins, and loss of market share. Any failure to meet and address these factors could seriously harm our business and operating results.

The next-generation endpoint security market is new and evolving, and may not grow as expected.

        We believe our future success will depend in large part on the growth, if any, in the market for next-generation endpoint security products. This market is new and evolving, and as such, it is difficult to predict important market trends, including its potential growth, if any. To date, enterprise and corporate

21

---

Table of Contents

cyber security budgets have allocated a majority of dollars to prevention-centric threat protection solutions, such as network, endpoint and web security products designed to stop threats from penetrating corporate networks. Organizations that use these security products may be satisfied with such existing security products and, as a result, these organizations may not adopt our solutions in addition to, or in lieu of, security products they currently use.

        Further, sophisticated cyber attackers are skilled at adapting to new technologies and developing new methods of gaining access to organizations' sensitive business data, and changes in the nature of advanced cyber threats could result in a shift in IT budgets away from products such as ours. In addition, while recent high visibility attacks on prominent enterprises and governments have increased market awareness of the problem of cyber attacks, if cyber attacks were to decline, or enterprises or governments perceived that the general level of cyber attacks has declined, our ability to attract new customers and expand our sales to existing customers could be materially and adversely affected. If products such as ours are not viewed by organizations as necessary, or if customers do not recognize the benefit of our products as a critical element of an effective cyber security strategy, our revenue may not grow as quickly as expected, or may decline, and the trading price of our stock could suffer.

        In addition, it is difficult to predict customer adoption and retention rates, customer demand for our products, the size and growth rate of the market for next-generation endpoint security, the entry of competitive products or the success of existing competitive products. Any expansion in our market depends on a number of factors, including the cost, performance and perceived value associated with our products and those of our competitors. If these products do not achieve widespread adoption or there is a reduction in demand for products in our market caused by a lack of customer acceptance, technological challenges, competing technologies, products, decreases in corporate spending, weakening economic conditions or otherwise, it could result in reduced customer orders, early terminations, reduced customer retention rates or decreased revenue, any of which would adversely affect our business operations and financial results. You should consider our business and prospects in light of the risks and difficulties we encounter in this new and evolving market.

Forecasts of our market and market growth may prove to be inaccurate, and even if the markets in which we compete achieve the forecasted growth, there can be no assurance that our business will grow at similar rates, or at all.

        Growth forecasts included in this prospectus relating to our market opportunities, including our primary endpoint security market and adjacent security markets, and the expected growth thereof are subject to significant uncertainty and are based on assumptions and estimates which may prove to be inaccurate. Even if these markets meet our size estimate and experience the forecasted growth, we may not grow our business at a similar rate, or at all. Our growth is subject to many factors, including our success in implementing our business strategy and ability to penetrate adjacent security markets, which is subject to many risks and uncertainties. Accordingly, the forecasts of market growth included in this prospectus should not be taken as indicative of our future growth.

If our products fail or are perceived to fail to detect cyber attacks, or if our products contain undetected errors or defects, our brand and reputation could be harmed, which could have an adverse effect on our business and results of operations.

        If our products fail or are perceived to fail to detect cyber attacks, including advanced attacks that have never been seen before, in our customers' endpoints and cyber security infrastructure, or if our products fail to identify and respond to new and increasingly complex methods of cyber attacks, our business and reputation may suffer. There is no guarantee that our products will detect all cyber attacks, especially in light of the rapidly changing security landscape to which we must respond. For example, in August 2017, a blog post alleged a product defect in our Cb Response product. We issued a press release stating that the allegation was incorrect, but in the course of evaluating the alleged defect, we uncovered and fixed another defect in our product. We cannot guarantee that our products will not contain

22

---

Table of Contents

undetected errors or defects in the future. Additionally, our products may falsely detect cyber attacks or threats that do not actually exist. For example, our products rely on third-party reports of identified security threats and information provided by an active community of security professionals. If the information from these third parties is inaccurate, the potential for false indications of security cyber attacks increases. These false positives, while typical in the industry, may impair the perceived reliability of our products, and may therefore adversely impact market acceptance of our products, and could result in negative publicity, loss of customers and sales and increased costs to remedy any problem.

        Our products, which are complex, may also contain undetected errors or defects when first introduced or as new versions are released. We have experienced these errors or defects in the past in connection with new products and product upgrades. We expect that these errors or defects will be found from time to time in the future in new or enhanced products after commercial release. Defects may cause our products to be vulnerable to attacks, cause them to fail to detect cyber attacks, or temporarily interrupt customers' networking traffic. Any errors, defects, disruptions in service or other performance problems with our products may damage our customers' business and could hurt our reputation. If our products fail to detect cyber attacks for any reason, we may incur significant costs, the attention of our key personnel could be diverted, our customers may delay or withhold payment to us or elect not to renew or other significant customer relations problems may arise.

        We may also be subject to liability claims for damages related to errors or defects in our products. A material liability claim or other occurrence that harms our reputation or decreases market acceptance of our products may harm our business and operating results. Although we have limitation of liability provisions in our terms and conditions of sale, they may not fully or effectively protect us from claims as a result of federal, state, or local laws or ordinances, or unfavorable judicial decisions in the United States or other countries. The sale and support of our also entails the risk of product liability claims. We maintain insurance to protect against certain claims associated with the use of our products, but our insurance coverage may not adequately cover any claim asserted against us. In addition, even claims that ultimately are unsuccessful could result in our expenditure of funds in litigation, divert management's time and other resources, and harm our business and reputation.

We rely on channel partners, such as managed security service providers, incident response firms and security-focused value added resellers, to generate a significant portion of our revenue. If we fail to maintain successful relationships with our channel partners, or if our channel partners fail to perform, our ability to market, sell and distribute our products will be limited, and our business, financial position and results of operations will be harmed.

        In addition to our direct sales force, we rely on our channel partners to sell our products. A majority of our revenue is generated by our channel partners, including managed service security providers, incident response firms and value added resellers. In addition, in the three months ended December 31, 2017, 94% of our new and add-on business was closed in collaboration with our channel partners. We expect to continue to focus on generating sales to new and existing customers through our channel partners as a part of our growth strategy.

        We provide our sales channel partners with specific training and programs to assist them in selling our products, but there can be no assurance that these steps will be effective. In addition, our channel partners may be unsuccessful in marketing, selling and supporting our products. If we are unable to develop and maintain effective sales incentive programs for our third-party channel partners, we may not be able to incentivize these partners to sell our products to customers and, in particular, to large enterprises. Our agreements with our channel partners are generally non-exclusive and these partners may also market, sell and support products that are competitive with ours and may devote more resources to the marketing, sales and support of such competitive products. These partners may have incentives to promote our competitors' products to the detriment of our own or may cease selling our products altogether. Our channel partners may cease or deemphasize the marketing of our products with limited or no notice and with little or no penalty. Our agreements with our channel partners may generally be terminated for any

23

---

Table of Contents

reason by either party with advance notice prior to each annual renewal date. We cannot be certain that we will retain these channel partners or that we will be able to secure additional or replacement channel partners. The loss of one or more of our significant channel partners or a decline in the number or size of orders from them could harm our operating results. In addition, any new sales channel partner requires extensive training and may take several months or more to achieve productivity. Our channel partner sales structure could subject us to lawsuits, potential liability and reputational harm if, for example, any of our channel partners misrepresent the functionality of our products, subscriptions or services to customers or violate laws or our corporate policies.

        If we fail to effectively manage our existing sales channels, or if our channel partners are unsuccessful in fulfilling the orders for our products, or if we are unable to enter into arrangements with, and retain a sufficient number of, high quality channel partners in each of the regions in which we sell products and keep them motivated to sell our products, our ability to sell our products and operating results will be harmed. The termination of our relationship with any significant channel partner may also adversely impact our sales and operating results.

If we are unable to acquire new customers, our future revenues and operating results will be harmed.

        Our success depends on our ability to acquire new customers, including large enterprise customers. If we are unable to attract a sufficient number of new customers, we may be unable to generate revenue growth at desired rates. Many enterprise customers operate in increasingly complex IT environments and require additional features and functionality, as well as higher levels of support than smaller customers. If our solutions are perceived as insufficient to meet the needs of large enterprises, we may be limited in our ability to acquire large enterprise customers. The next-generation endpoint security market is competitive and many of our competitors have substantial financial, personnel and other resources that they utilize to develop solutions and attract customers. As a result, it may be difficult for us to add new customers to our customer base. Competition in the marketplace may also lead us to win fewer new customers or result in us providing discounts and other commercial incentives. Additional factors that impact our ability to acquire new customers include the perceived need for next-generation endpoint security, the size of our prospective customers' IT budgets, the utility and efficacy of our existing and new products, whether proven or perceived, and general economic conditions. These factors may have a meaningful negative impact on future revenues and operating results.

If we are unable to sell additional products to our customers and maintain and grow our customer retention rates, our future revenue and operating results will be harmed.

        Our future success depends, in part, on our ability to expand the deployment of our products with existing customers by selling them additional products. This may require increasingly sophisticated and costly sales efforts and may not result in additional sales. In addition, the rate at which our customers purchase additional products depends on a number of factors, including the perceived need for additional next-generation endpoint security as well as general economic conditions. If our efforts to sell additional products to our customers are not successful, our business may suffer.

        Further, to maintain or improve our operating results, it is important that our customers renew their agreements with us when the existing term expires. Our customers have no obligation to renew their agreements upon expiration of the applicable contract term, and we cannot provide assurance that customers will renew subscriptions or support agreements. We calculate retention rate by comparing the annual recurring subscription and support revenue from our end-use customers at the beginning of a measurement period to the annual recurring subscription and support revenue from those same end-use customers at the end of a measurement period. We divide the ending annual recurring revenue by the beginning annual recurring revenue to arrive at our retention rate metric. We exclude the impact of any add-on purchases from these customers during the measurement period; accordingly, our retention rate cannot exceed 100%. In addition, this metric reflects the loss of customers who elected not to renew

24

---

Table of Contents

contracts expiring during the measurement period. Our retention rate was 93% in 2015, 92% in 2016 and 93% in 2017. The rate of customer retention may decline or fluctuate as a result of a number of factors, including our customers' satisfaction or dissatisfaction with our products, the effectiveness of our customer support services, our pricing, the prices of competing products, subscriptions or services, mergers and acquisitions affecting our customer base, or reductions in our customers' budgets and spending levels. If our end-use customers do not renew their agreements, or renew on less favorable terms, our revenue may decline, our business may suffer, and we may not realize improved operating results from our customer base.

If we do not successfully anticipate market needs and enhance our existing products or develop new products that meet those needs on a timely basis, we may not be able to compete effectively and our ability to generate revenues will suffer.

        Our customers operate in markets characterized by rapidly changing technologies and business plans, which require them to adapt to increasingly complex IT infrastructures that incorporate a variety of hardware, software applications, operating systems and networking protocols. As our customers' technologies and business plans grow more complex, we expect them to face new and increasingly sophisticated methods of attack. We face significant challenges in ensuring that our products effectively identify and respond to these advanced and evolving attacks without disrupting the performance of our customers' IT infrastructures. As a result, we must continually modify and improve our products in response to changes in our customers' IT infrastructures.

        We cannot guarantee that we will be able to anticipate future market needs and opportunities or be able to develop product enhancements or new products to meet such needs or opportunities in a timely manner, if at all. Even if we are able to anticipate, develop and commercially introduce enhancements and new products, there can be no assurance that enhancements or new products will achieve widespread market acceptance.

        New products, as well as enhancements to our existing products, could fail to attain sufficient market acceptance for many reasons, including:

•

delays in releasing new products, or product enhancements;



•

failure to accurately predict market demand and to supply products that meet this demand in a timely fashion;



•

inability to integrate effectively with the existing or newly introduced technologies, systems or applications of our existing and prospective customers;



•

inability to protect against new types of attacks or techniques used by cyber attackers or other data thieves;



•

defects in our products, errors or failures of our products;



•

negative publicity or perceptions about the performance or effectiveness of our products;



•

introduction or anticipated introduction of competing products by our competitors;



•

installation, configuration or usage errors by our customers;



•

easing or changing of regulatory requirements related to security; and



•

reluctance of customers to purchase products incorporating open source software.

        If we fail to anticipate market requirements or fail to develop and introduce product enhancements or new products to meet those needs in a timely manner, it could cause us to lose existing customers and prevent us from gaining new customers, which would significantly harm our business, financial condition and results of operations.

25

---

Table of Contents

        While we continue to invest significant resources in research and development to ensure that our products continue to address the cyber security risks that our customers face, the introduction of products embodying new technologies could also render our existing products or services obsolete or less attractive to customers. If we spend significant time and effort on research and development and are unable to generate an adequate return on our investment, our business and results of operations may be materially and adversely affected.

If our products do not effectively integrate with our customers' IT infrastructure, or if our technology partners no longer support our products or allow us to integrate with their programs, our business could suffer.

        Our products must effectively integrate with our customers' existing or future IT infrastructure, which often has different specifications, utilizes multiple protocol standards, deploys products from multiple vendors and contains multiple generations of products that have been added over time. As a result, when problems occur in a network, it may be difficult to identify the sources of these problems. If we find errors in the existing software or defects in the hardware used in our customers' infrastructure or problematic network configurations or settings, we may have to modify our software or hardware so that our products will integrate with our customers' infrastructure. In such cases, our products may be unable to provide significant performance improvements for applications deployed in our customers' infrastructure. These issues could cause longer installation times for our products and could cause order cancellations, either of which would adversely affect our business, results of operations and financial condition. Additionally, any changes in our customers' IT infrastructure that degrade the functionality of our products or services or give preferential treatment to competitive software could adversely affect the adoption and usage of our products.

        Further, if our technology partners no longer support our products or allow us to integrate with customers' IT infrastructure, or if we do not maintain these integrations, the functionality of our products may be reduced and our products may not be as marketable to certain existing and potential customers.

        If our products are late in achieving or fail to achieve compliance with these certifications and standards, or our competitors achieve compliance with these certifications and standards, we may be disqualified from selling our products to such customers, or may otherwise be at a competitive disadvantage, either of which would harm our business, results of operations and financial condition.

If our products fail to help our customers achieve and maintain compliance with regulations and/or industry standards, our revenue and operating results could be harmed.

        We generate a portion of our revenue from our product offerings that help organizations achieve and maintain compliance with regulations and industry standards both domestically and internationally. For example, many of our customers subscribe to our product offerings to help them comply with the security standards developed and maintained by the Payment Card Industry Security Standards Council, or the PCI Council, which apply to companies that process, transmit or store cardholder data. In addition, our product and service offerings are used by customers in the healthcare industry to help them comply with numerous federal and state laws and regulations related to patient privacy. In particular, the Health Insurance Portability and Accountability Act of 1996, or HIPAA, and the 2009 Health Information Technology for Economic and Clinical Health Act include privacy and data security standards that protect individual privacy by limiting the uses and disclosures of individually identifiable health information and implementing data security standards. The foregoing and other state, federal and international legal and regulatory regimes may affect our customers' requirements for, and demand for, our products and professional services. Governments and industry organizations, such as the PCI Council, may also adopt new laws, regulations or requirements, or make changes to existing laws or regulations, that could impact the demand for, or value of, our products. If we are unable to adapt our products to changing legal and regulatory standards or other requirements in a timely manner, or if our products fail to assist with, or expedite, our customers' cyber security defense and compliance efforts, our customers may lose confidence

26

---

Table of Contents

in our products, and could switch to products offered by our competitors or threaten or bring legal actions against us. In addition, if laws, regulations or standards related to data security, vulnerability management and other IT security and compliance requirements are relaxed or the penalties for non-compliance are changed in a manner that makes them less onerous, our customers may view government and industry regulatory compliance as less critical to their businesses, and our customers may be less willing to purchase our products. In any of these cases, our revenue and operating results could be harmed.

        In addition, government and other customers may require our products to comply with certain privacy and security regulations, or other certifications and standards. If our products are late in achieving or fail to achieve or maintain compliance with these certifications and standards, or our competitors achieve compliance with these certifications and standards, we may be disqualified from selling our products to such customers, or may otherwise be at a competitive disadvantage, either of which would harm our business, results of operations and financial condition.

As a cyber security provider, we have been, and expect to continue to be, a target of cyber attacks that could adversely impact our reputation and operating results.

        We will not succeed unless the marketplace is confident that we provide effective next-generation endpoint security protection. Because we sell next-generation endpoint security solutions, we may be an attractive target for attacks by cyber attackers or other data thieves, since a breach of our system could provide information regarding us or our customers. Accordingly, we have been, and expect to continue to be, a target of cyber attacks designed to interrupt or impede the performance of our products or the security of our cloud platform, penetrate our network security or our internal systems, or those of our customers, or to misappropriate proprietary information. For example, in 2012, we were subject to an unauthorized breach of one of our computer systems that was not protected by our platform. As a result of this attack, which we discovered in January 2013, a malicious third party gained temporary access to one of our digital code-signing certificates. This third party then used this certificate to sign malware that would not be blocked by our Cb Protection security software. That malware was installed on the computers of several of our customers. While we have undertaken substantial remedial efforts to prevent similar incidents from occurring in the future, we cannot guarantee that we will not be the target of additional cyber attacks and that future cyber attacks will not be successful.

        As a result of this offering, we will likely experience increased visibility as a public company, which could have the effect of attracting the attention of more cyber attackers than would otherwise target us. If our systems are breached, attackers could learn critical information about how our products operate to help protect our customers' endpoints, thereby making our customers more vulnerable to cyber attacks. In addition, if actual or perceived breaches of our platform occur, they could adversely affect the market perception of our products, negatively affecting our reputation, and may expose us to the loss of our proprietary information or information belonging to our customers, investigations or litigation and possible liability, including injunctive relief and monetary damages. Such security breaches could also divert the efforts of our technical and management personnel. In addition, such security breaches could impair our ability to operate our business and provide products to our customers. If this happens, our reputation could be harmed, our revenue could decline and our business could suffer.

Our business and operations are experiencing rapid growth, and if we do not appropriately manage our future growth, or are unable to scale our systems and processes, our operating results may be negatively affected.

        We are a rapidly growing company. To manage future growth effectively, and in connection with our transition to being a public company, we will need to continue to improve and expand our internal IT systems, financial infrastructure and operating and administrative systems and controls, which we may not be able to do efficiently, in a timely manner or at all. Any future growth would add complexity to our organization and require effective coordination across our organization. Failure to manage any future

27

---

Table of Contents

growth effectively could result in increased costs, harm our results of operations and lead to investors losing confidence in our internal systems and processes.

If we are not successful in our continued international expansion, our operating results may be negatively affected.

        We have a limited history of marketing, selling and supporting our products internationally. For the year ended December 31, 2017, we generated approximately 13% of our revenue from customers located outside of the United States. Our growth strategy is dependent, in part, on our continued international expansion. We expect to conduct a significant amount of our business with organizations that are located outside the United States, particularly in Europe and Asia. As a result, we must hire and train experienced personnel to staff and manage our foreign operations. To the extent that we experience difficulties in recruiting, training, managing and retaining international employees, particularly managers and other members of our international sales team, we may experience difficulties in sales productivity in, or market penetration of, foreign markets. We also enter into strategic distributor and reseller relationships with companies in certain international markets where we do not have a local presence. If we are not able to maintain successful strategic distributor relationships with our international channel partners or recruit additional channel partners, our future success in these international markets could be limited. Business practices in the international markets that we serve may differ from those in the United States and may require us to include non-standard terms in customer contracts. To the extent that we enter into customer contracts in the future that include non-standard terms related to payment or performance obligations, our results of operations may be adversely impacted.

        Our business, including the sales of our products by us and our channel partners, may be subject to foreign governmental regulations, which vary substantially from country to country and change from time to time. Our failure, or the failure by our channel partners, to comply with these regulations could adversely affect our business. Further, in many foreign countries it is common for others to engage in business practices that are prohibited by our internal policies and procedures or U.S. regulations applicable to us. Although we have implemented policies and procedures designed to comply with these laws and policies, there can be no assurance that our employees, contractors, channel partners and agents have complied, or will comply, with these laws and policies. Violations of laws or key control policies by our employees, contractors, channel partners or agents could result in delays in revenue recognition, financial reporting misstatements, fines, penalties or the prohibition of the importation or exportation of our products, and could have a material adverse effect on our business and results of operations. If we are unable to successfully manage the challenges of international expansion and operations, our business and operating results could be adversely affected.

        Additionally, our international sales and operations are subject to a number of risks, including the following:

•

greater difficulty in enforcing contracts and managing collections, as well as longer collection periods;



•

higher costs of doing business internationally, including costs incurred in establishing and maintaining office space and equipment for our international operations;



•

fluctuations in exchange rates between the U.S. dollar and foreign currencies in markets where we do business;



•

management communication and integration problems resulting from cultural and geographic dispersion;



•

costs associated with language localization of our products;



•

risks associated with trade restrictions and foreign legal requirements, including any importation, certification and localization of our products that may be required in foreign countries;



•

greater risk of unexpected changes in regulatory practices, tariffs and tax laws and treaties;

28

---

Table of Contents

•

costs of compliance with foreign laws and regulations and the risks and costs of non-compliance with such laws and regulations, including, but not limited to data privacy, data protection and data security regulations;



•

compliance with anti-bribery laws, including, without limitation, the U.S. Foreign Corrupt Practices Act of 1977, as amended, the U.S. Travel Act and the UK Bribery Act 2010, violations of which could lead to significant fines, penalties and collateral consequences for our company;



•

heightened risk of unfair or corrupt business practices in certain geographies and of improper or fraudulent sales arrangements that may impact financial results and result in restatements of, or irregularities in, financial statements;



•

the uncertainty of protection for intellectual property rights in some countries;



•

general economic and political conditions in these foreign markets, including political and economic instability in some countries;



•

foreign exchange controls or tax regulations that might prevent us from repatriating cash earned outside the United States; and



•

double taxation of our international earnings and potentially adverse tax consequences due to changes in the tax laws of the United States or the foreign jurisdictions in which we operate.

        These and other factors could harm our ability to generate future international revenue and, consequently, materially impact our business, results of operations and financial condition.

We provide service level commitments for cloud-based delivery of our products and support. Any future service disruption could obligate us to provide service credits and we could face subscription or support agreement terminations, which could adversely affect our revenue.

        Our agreements with customers provide certain service level commitments, including with respect to uptime requirements for cloud-based delivery of our services and response time for support. If we are unable to meet the stated service level commitments or suffer extended periods of downtime that exceed the periods allowed under our customer agreements, we could be required to provide service credits or face subscription terminations, either of which could significantly impact our revenue.

        Our customers depend on our customer support team to resolve technical issues relating to our products. We may be unable to respond quickly enough to accommodate short-term increases in customer demand for support services. Increased customer demand for these services, without corresponding revenue, could increase costs and adversely affect our operating results. Any failure to maintain high-quality customer support, or a market perception that we do not maintain high-quality support, could adversely affect our reputation and our ability to sell our products to existing and prospective customers, or could result in terminations of existing customer agreements.

We are dependent on the continued services and performance of our senior management and other key employees, as well as on our ability to successfully hire, train, manage and retain qualified personnel, especially those in sales and marketing and research and development.

        Our future performance depends on the continued services and contributions of our senior management, particularly Patrick Morley, our President and Chief Executive Officer, and other key employees to execute on our business plan and to identify and pursue new opportunities and product innovations. We do not maintain key man insurance for any of our executive officers or key employees. From time to time, there may be changes in our senior management team resulting from the termination or departure of our executive officers and key employees. Our senior management and key employees are generally employed on an at-will basis, which means that they could terminate their employment with us at any time. The loss of the services of our senior management, particularly Mr. Morley, or other key employees for any reason could significantly delay or prevent our development or the achievement of our strategic objectives and harm our business, financial condition and results of operations.

29

---

Table of Contents

        Our ability to successfully pursue our growth strategy will also depend on our ability to attract, motivate and retain our personnel, especially those in sales and marketing and research and development. We face intense competition for these employees from numerous technology, software and other companies, especially in certain geographic areas in which we operate, and we cannot ensure that we will be able to attract, motivate and/or retain additional qualified employees in the future. If we are unable to attract new employees and retain our current employees, we may not be able to adequately develop and maintain new products, or market our existing products at the same levels as our competitors and we may, therefore, lose customers and market share. Our failure to attract and retain personnel, especially those in sales and marketing, research and development and engineering positions, could have an adverse effect on our ability to execute our business objectives and, as a result, our ability to compete could decrease, our operating results could suffer and our revenue could decrease. Even if we are able to identify and recruit a sufficient number of new hires, these new hires will require significant training before they achieve full productivity and they may not become productive as quickly as we would like, or at all.

If we do not effectively expand, train and retain qualified sales and marketing personnel, we may be unable to acquire new customers or sell additional products to successfully pursue our growth strategy.

        We depend significantly on our sales force to attract new customers and expand sales to existing customers. As a result, our ability to grow our revenue depends in part on our success in recruiting, training and retaining sufficient numbers of sales personnel to support our growth, particularly in the United States, Europe, the Middle East, Africa and Asia Pacific. The number of our sales and marketing personnel increased from 343 as of December 31, 2016 to 425 as of December 31, 2017. We expect to continue to expand our sales and marketing personnel significantly and face a number of challenges in achieving our hiring and integration goals. There is intense competition for individuals with sales training and experience. In addition, the training and integration of a large number of sales and marketing personnel in a short time requires the allocation of significant internal resources. We invest significant time and resources in training new sales force personnel to understand our products, platform and our growth strategy. Based on our past experience, it takes approximately six to 12 months before a new sales force member operates at target performance levels, depending on their role. However, we may be unable to achieve or maintain our target performance levels with large numbers of new sales personnel as quickly as we have done in the past. Our failure to hire a sufficient number of qualified sales force members and train them to operate at target performance levels may materially and adversely impact our projected growth rate.

If the general level of advanced cyber attacks declines, or is perceived by our current or potential customers to have declined, our business could be harmed.

        Our business is substantially dependent on enterprises and governments recognizing that advanced cyber attacks are pervasive and are not effectively prevented by legacy security products. High visibility attacks on prominent enterprises and governments have increased market awareness of the problem of advanced cyber attacks and help to provide an impetus for enterprises and governments to devote resources to protecting against advanced cyber attacks, such as testing our products, purchasing them and broadly deploying them within their organizations. If advanced cyber attacks were to decline, or enterprises or governments perceived that the general level of advanced cyber attacks has declined, our ability to attract new customers and expand sales of our products to existing customers could be materially and adversely affected. A reduction in the threat landscape could increase our sales cycles and harm our business, results of operations and financial condition.

Organizations have been and may continue to be reluctant to purchase cyber security offerings that are cloud-based due to the actual or perceived vulnerability of cloud solutions.

        Some organizations, particularly in certain geographies and industries, such as defense and financial services, have been and may continue to be reluctant to use cloud solutions for cyber security because they have concerns regarding the risks associated with the reliability or security of the technology delivery

30

---

Table of Contents

model associated with this solution. If we or other cloud service providers experience security incidents, breaches of customer data, disruptions in service delivery or other problems, the market for cloud solutions as a whole may be negatively impacted.

If we cannot maintain our company culture as we grow, we could lose the innovation, teamwork, passion and focus on execution that we believe contribute to our success and our business may be harmed.

        We believe that a critical component to our success has been our company culture, which we believe fosters innovation, teamwork, passion for customers and focus on execution, and facilitates critical knowledge transfer, knowledge sharing and professional growth. We have invested substantial time and resources in building our team within this company culture. Any failure to preserve our culture could negatively affect our ability to retain and recruit personnel and to effectively focus on and pursue our corporate objectives. As we grow and develop the infrastructure of a public company, we may find it difficult to maintain these important aspects of our company culture. If we fail to maintain our company culture, our business may be adversely impacted.

Fluctuating economic conditions make it difficult to predict revenue for a particular period, and a shortfall in revenue may harm our operating results.

        Our revenue depends significantly on general economic conditions and the demand for products in the next-generation endpoint security market. Economic weakness, customer financial difficulties and constrained spending on cyber security may result in decreased revenue and earnings. Such factors could make it difficult to accurately forecast our sales and operating results and could negatively affect our ability to provide accurate forecasts of our costs and expenses. In addition, concerns regarding continued budgetary challenges in the United States and Europe, geopolitical turmoil and terrorism in many parts of the world, and the effects of climate change have and may continue to put pressure on global economic conditions and overall spending on cyber security. Currently, most enterprises and governments have not allocated a fixed portion of their budgets to protect against next-generation advanced cyber attacks. If we do not succeed in convincing customers that our products should be an integral part of their overall approach to cyber security and that a fixed portion of their annual security budgets should be allocated to our products, general reductions in security spending by our customers are likely to have a disproportionate impact on our business, results of operations and financial condition. General economic weakness may also lead to longer collection cycles for payments due from our customers, an increase in customer bad debt, restructuring initiatives and associated expenses and impairment of investments. Furthermore, the continued weakness and uncertainty in worldwide credit markets, including the sovereign debt situation in certain countries in the European Union, or EU, may adversely impact the ability of our customers to adequately fund their expected capital expenditures, which could lead to delays or cancellations of planned purchases of our products.

        Uncertainty about future economic conditions also makes it difficult to forecast operating results and to make decisions about future investments. Future or continued economic weakness for us or our customers, failure of our customers and markets to recover from such weakness, customer financial difficulties and reductions in spending on cyber security could have a material adverse effect on demand for our products, and consequently on our business, financial condition and results of operations.

If we are not able to maintain and enhance our brand or reputation as an industry leader, our business and operating results may be adversely affected.

        We believe that maintaining and enhancing our reputation as a leader in next-generation endpoint security is critical to our relationship with our existing end-use customers and channel partners and our ability to attract new customers and channel partners. The successful promotion of our brand will depend on a number of factors, including our marketing efforts, our ability to continue to develop high-quality features for our products and our ability to successfully differentiate our products from those of our competitors. Our brand promotion activities may not be successful or yield increased revenue. In addition,

31

---

Table of Contents

independent industry analysts often provide reports of our solutions, as well as the solutions of our competitors, and perception of our solutions in the marketplace may be significantly influenced by these reports. If these reports are negative, or less positive as compared to those of our competitors' products, our reputation may be adversely affected. Additionally, the performance of our channel partners may affect our brand and reputation if customers do not have a positive experience with our products as implemented by our channel partners or with the implementation generally. The promotion of our brand requires us to make substantial expenditures, and we anticipate that the expenditures will increase as our market becomes more competitive, as we expand into new geographies and vertical markets and as more sales are generated through our channel partners. To the extent that these activities yield increased revenue, this revenue may not offset the increased expenses we incur. If we do not successfully maintain and enhance our brand and reputation, our business and operating results may be adversely affected.

Our brand, reputation and ability to attract, retain and serve our customers are dependent in part upon the reliable performance of our products and infrastructure.

        Our brand, reputation and ability to attract, retain and serve our customers are dependent in part upon the reliable performance of, and the ability of our existing customers and new customers to access and use, our solutions and infrastructure. We have experienced, and may in the future experience, disruptions, outages and other performance problems due to a variety of factors, including infrastructure changes, equipment failure, human or software errors, capacity constraints and fraud or security attacks. In some instances, we may not be able to identify the cause or causes of these performance problems within an acceptable period of time.

        We operate and maintain our infrastructure at our headquarters and by using third-party data centers located in the Boston, Massachusetts area. We also utilize Amazon Web Services, or AWS, for the delivery of our cloud-based products. In addition, our ability to access certain third-party software-as-a-service, or SaaS, solutions, such as Salesforce, is important to our operations and our ability to execute sales. Some elements of this complex system are operated by third parties that we do not control and that could require significant time to replace. We expect this dependence on third parties to continue. Interruptions in our systems or the third-party systems on which we rely, whether due to system failures, computer viruses, physical or electronic break-ins, or other factors, could affect the security or availability of our products, network infrastructure, cloud infrastructure and website.

        Prolonged delays or unforeseen difficulties in connection with adding capacity or upgrading our network architecture when required may cause our service quality to suffer. Problems with the reliability or security of our systems could harm our reputation. Damage to our reputation and the cost of remedying these problems could negatively affect our business, financial condition and operating results.

        Additionally, our existing data center facilities and third-party hosting providers have no obligations to renew their agreements with us on commercially reasonable terms or at all, and certain of the agreements governing these relationships may be terminated by either party at any time. If we are unable to maintain or renew our agreements with these providers on commercially reasonable terms or if in the future we add additional data center facilities or third-party hosting providers, we may experience costs or downtime as we transition our operations.

        Any disruptions or other performance problems with our products could harm our reputation and business and may damage our customers' businesses. Interruptions in our service delivery might reduce our revenue, cause us to issue credits to customers, subject us to potential liability and cause customers to not renew their purchases or our products.

In deploying our cloud-based SaaS products, we rely upon AWS to operate our cloud-based offerings; any disruption or interference with our use of AWS would adversely affect our business, results of operations and financial condition.

        AWS is a third-party provider of cloud infrastructure services. We outsource substantially all of the infrastructure relating to our cloud offerings to AWS. Our Predictive Security Cloud resides on hardware

32

---

Table of Contents

owned or leased and operated by us at the AWS data centers. Customers of our cloud-based SaaS products need to be able to access our platform at any time, without interruption or degradation of performance, and we provide them with service level commitments with respect to uptime. Our cloud-based SaaS products depend on protecting the virtual cloud infrastructure hosted in AWS by maintaining its configuration, architecture, features and interconnection specifications, as well as the information stored in these virtual data centers and which third-party internet service providers transmit. Although we have disaster recovery plans that utilize multiple AWS locations, any incident affecting their infrastructure that may be caused by fire, flood, severe storm, earthquake or other natural disasters, cyber attacks, terrorist or other attacks, and other similar events beyond our control could negatively affect our cloud-based SaaS products. For example, in September 2015 and February 2017, AWS suffered significant outages that had a widespread impact on cloud-based software and services companies. Although our customers were not affected by that outage, a similar outage could render our cloud-based offerings inaccessible to customers. A prolonged AWS service disruption affecting our cloud-based offerings for any of the foregoing reasons would negatively impact our ability to serve our customers and could damage our reputation with current and potential customers, expose us to liability, cause us to lose customers or otherwise harm our business. We may also incur significant costs for using alternative equipment or taking other actions in preparation for, or in reaction to, events that damage the AWS services we use.

        In addition, AWS may terminate the agreement with us by providing two years' prior written notice, and may terminate the agreement for cause with 30 days' prior written notice, including any material breach of the agreement by us that we do not cure within the 30-day cure period. In the event that our AWS service agreements are terminated, or there is a lapse of service, elimination of AWS services or features that we utilize, interruption of internet service provider connectivity or damage to such facilities, we could experience interruptions in access to our platform as well as significant delays and additional expense in arranging or creating new facilities and services and/or re-architecting our cloud offering for deployment on a different cloud infrastructure service provider, which may adversely affect our business, operating results and financial condition.

If we fail to manage our operations infrastructure, our customers may experience service outages and/or delays.

        Our future growth is dependent upon our ability to continue to meet the expanding needs of our customers and to attract new customers. As existing customers gain more experience with our products, they may broaden their reliance on our products, which will require that we expand our operations infrastructure as well as our dependence on third parties to support that infrastructure. We also seek to maintain excess capacity in our operations infrastructure to facilitate the rapid provision of new customer deployments. In addition, we need to properly manage our technological operations infrastructure to support changes in hardware and software parameters and the evolution of our solutions, all of which require significant lead time. If we do not accurately predict our infrastructure requirements, our existing customers may experience service outages that may subject us to financial penalties, financial liabilities and customer losses. If our operations infrastructure fails to keep pace with increased sales, customers may experience delays as we seek to obtain additional capacity, which could adversely affect our reputation and our revenue.

If our customers are unable to implement our products successfully, customer perceptions of our products may be impaired or our reputation and brand may suffer.

        Our products are deployed in a wide variety of IT environments, including large-scale, complex infrastructures. Some of our customers have experienced difficulties implementing our products in the past and may experience implementation difficulties in the future. If our customers are unable to implement our products successfully, customer perceptions of our products may be impaired or our reputation and brand may suffer.

        In addition, for our products to achieve their functional potential, our products must effectively integrate into our customers' IT infrastructures, which have different specifications, utilize varied protocol

33

---

Table of Contents

standards, deploy products from multiple different vendors and contain multiple layers of products that have been added over time. Our customers' IT infrastructures are also dynamic, with a myriad of devices and endpoints entering and exiting the customers' IT systems on a regular basis, and our products must be able to effectively adapt to and track these changes.

        Any failure by our customers to appropriately implement our products or any failure of our products to effectively integrate and operate within our customers' IT infrastructures could result in customer dissatisfaction, impact the perceived reliability of our products, result in negative press coverage, negatively affect our reputation and harm our financial results.

We have in the past completed acquisitions and may acquire or invest in other companies or technologies in the future, which could divert management's attention, fail to meet our expectations, result in additional dilution to our stockholders, increase expenses, disrupt our operations or otherwise harm our operating results.

        We have in the past acquired, and we may in the future acquire or invest in, businesses, products or technologies that we believe could complement or expand our platform, enhance our technical capabilities or otherwise offer growth opportunities. For example, in February 2014, we acquired Carbon Black (our name at the time was Bit9, Inc.), a threat detection and response software company; in 2015, we acquired Objective Logistics Inc., a software company, and VisiTrend, Inc., a security analytics company; and in 2016, we acquired Confer Technologies, Inc., a next-generation antivirus software company. We may not be able to fully realize the anticipated benefits of these or any future acquisitions. The pursuit of potential acquisitions may divert the attention of management and cause us to incur various expenses related to identifying, investigating and pursuing suitable acquisitions, whether or not they are consummated.

        There are inherent risks in integrating and managing acquisitions. If we acquire additional businesses, we may not be able to assimilate or integrate the acquired personnel, operations, products, services and technologies successfully or effectively manage the combined business following the acquisition and our management may be distracted from operating our business. We also may not achieve the anticipated benefits from the acquired business due to a number of factors, including, without limitation:

•

unanticipated costs or liabilities associated with the acquisition;



•

incurrence of acquisition-related costs, which would be recognized as a current period expense;



•

inability to generate sufficient revenue to offset acquisition or investment costs;



•

the inability to maintain relationships with customers and partners of the acquired business;



•

the difficulty of incorporating acquired technology and rights into our platform and of maintaining quality and security standards consistent with our brand;



•

delays in customer purchases due to uncertainty related to any acquisition;



•

the need to integrate or implement additional controls, procedures and policies;



•

challenges caused by distance, language and cultural differences;



•

harm to our existing business relationships with business partners and customers as a result of the acquisition;



•

the potential loss of key employees;



•

use of resources that are needed in other parts of our business and diversion of management and employee resources;



•

the inability to recognize acquired deferred revenue in accordance with our revenue recognition policies; and



•

use of substantial portions of our available cash or the incurrence of debt to consummate the acquisition.

        Acquisitions also increase the risk of unforeseen legal liability, including for potential violations of applicable law or industry rules and regulations, arising from prior or ongoing acts or omissions by the

34

---

Table of Contents

acquired businesses that are not discovered by due diligence during the acquisition process. Generally, if an acquired business fails to meet our expectations, our operating results, business and financial condition may suffer. Acquisitions could also result in dilutive issuances of equity securities or the incurrence of debt, which could adversely affect our business, results of operations and financial condition.

        In addition, a significant portion of the purchase price of companies we acquire may be allocated to goodwill and other intangible assets, which must be assessed for impairment at least annually. If our acquisitions do not ultimately yield expected returns, we may be required to take charges to our operating results based on our impairment assessment process, which could harm our results of operations.

The failure of our customers to correctly use our products, or our failure to effectively assist customers in installing our products and provide effective ongoing support, may harm our business.

        Our customers depend in large part on customer support delivered by us to resolve issues relating to the use of our products. However, even with our support, our customers are ultimately responsible for effectively using our products, and ensuring that their IT staff is properly trained in the use of our products, and complementary security products. The failure of our customers to correctly use our products, or our failure to effectively assist customers in installing our products and provide effective ongoing support, may result in an increase in the vulnerability of our customers' IT infrastructures and sensitive business data. We are also in the process of expanding our certification program and professional service organization. It can take significant time and resources to recruit, hire and train qualified technical support and service employees. We may not be able to keep up with demand, particularly if the sales of our products exceed our internal forecasts. To the extent that we are unsuccessful in hiring, training and retaining adequate support resources, our ability to provide adequate and timely support to our customers may be negatively impacted, and our customers' satisfaction with our products may be adversely affected. Additionally, in unusual circumstances, if we were to need to rely on our sales engineers to provide post-sales support while we are growing our service organization, our sales productivity may be negatively impacted. Accordingly, our failure to provide satisfactory maintenance and technical support services could have a material and adverse effect on our business and results of operations.

The sales prices of our products and services may decrease, which may reduce our gross profits and adversely impact our financial results.

        The sales prices for our products and services may decline for a variety of reasons, including competitive pricing pressures, discounts, a change in our mix of products and services, anticipation of the introduction of new products or promotional programs. Competition continues to increase in the market segments in which we participate, and we expect competition to further increase in the future, thereby leading to increased pricing pressures. Larger competitors with more diverse product and service offerings may reduce the price of products that compete with ours or may bundle them with other products and services. Additionally, currency fluctuations in certain countries and regions may negatively impact prices that partners and customers are willing to pay in those countries and regions. Furthermore, we anticipate that the sales prices and gross profits for our products will decrease over product life cycles. We cannot be certain that we will be successful in developing and introducing new products with enhanced functionality on a timely basis, or that our new product offerings, if introduced, will enable us to maintain our prices and gross profits at levels that will allow us to maintain positive gross margins and achieve profitability.

We incorporate technology from third parties into our products, and our inability to obtain or maintain rights to the technology could harm our business.

        We incorporate technology from third parties into our products. We cannot be certain that our suppliers and licensors are not infringing the intellectual property rights of third parties or that the suppliers and licensors have sufficient rights to the technology in all jurisdictions in which we may sell our products. We may not be able to rely on indemnification obligations of third parties if some of our agreements with our suppliers and licensors may be terminated for convenience by them. If we are unable

35

---

Table of Contents

to obtain or maintain rights to any of this technology because of intellectual property infringement claims brought by third parties against our suppliers and licensors or against us, or if we are unable to continue to obtain such technology or enter into new agreements on commercially reasonable terms, our ability to develop and sell products, subscriptions and services containing such technology could be severely limited, and our business could be harmed. Additionally, if we are unable to obtain necessary technology from third parties, including certain sole suppliers, we may be forced to acquire or develop alternative technology, which may require significant time, cost and effort and may be of lower quality or performance standards. This would limit and delay our ability to offer new or competitive products, and increase our costs of production. If alternative technology cannot be obtained or developed, we may not be able to offer certain functionality as part of our products, subscriptions and services. As a result, our margins, market share and results of operations could be significantly harmed.

Our products contain third-party open source software components, and our failure to comply with the terms of the underlying open source software licenses could restrict our ability to sell our products.

        Our products contain software licensed to us by third parties under so-called "open source" licenses. Open source software is typically freely accessible, usable and modifiable. Certain open source software licenses require a user who intends to distribute the open source software as a component of the user's software to disclose publicly part or all of the source code to the user's software. In addition, certain open source software licenses require the user of such software to make any derivative works of the open source code available to others on unfavorable terms or at no cost. This can subject previously proprietary software to open source license terms. From time to time, there have been claims against companies that distribute or use open source software in their products and services, asserting that such open source software infringes the claimants' intellectual property rights. We could be subject to suits by parties claiming that what we believe to be licensed open source software infringes their intellectual property rights. Use and distribution of open source software may entail greater risks than use of third-party commercial software, as open source licensors generally do not provide warranties or other contractual protections regarding infringement claims or the quality of the code. In addition, certain open source licenses require that source code for software programs that are subject to the license be made available to the public and that any modifications or derivative works to such open source software continue to be licensed under the same terms.

        Although we monitor our use of open source software in an effort both to comply with the terms of the applicable open source licenses and to avoid subjecting our products to conditions we do not intend, the terms of many open source licenses have not been interpreted by U.S. courts, and there is a risk that these licenses could be construed in a way that could impose unanticipated conditions or restrictions on our ability to commercialize our products. The terms of certain open source licenses require us to release the source code of our applications and to make our applications available under those open source licenses if we combine or distribute our applications with open source software in a certain manner. In the event that portions of our applications are determined to be subject to an open source license, we could be required to publicly release the affected portions of our source code, re-engineer all, or a portion of, those applications or otherwise be limited in the licensing of our applications. Disclosing our proprietary source code could allow our competitors to create similar products with lower development effort and time and ultimately could result in a loss of sales for us. Disclosing the source code of our proprietary software could also make it easier for cyber attackers and other third parties to discover vulnerabilities in or to defeat the protections of our products, which could result in our products failing to provide our customers with the security they expect. Any of these events could have a material adverse effect on our business, operating results and financial condition.

        We therefore could also be subject to claims alleging that we have not complied with the restrictions or limitations of the applicable open source software license terms. In that event, we could incur significant legal expenses, be subject to significant damages, be enjoined from further sale and distribution of our products or solutions that use the open source software, be required to pay a license fee, be forced to

36

---

Table of Contents

reengineer our products and solutions or be required to comply with the foregoing conditions of the open source software licenses (including the release of the source code to our proprietary software), any of which could adversely affect our business. Even if these claims do not result in litigation or are resolved in our favor or without significant cash settlements, the time and resources necessary to resolve them could harm our business, results of operations, financial condition and reputation.

Our sales cycles can be long and unpredictable, and our sales efforts require considerable time and expense. As a result, our sales and revenue are difficult to predict and may vary substantially from period to period, which may cause our results of operations to fluctuate significantly.

        Our results of operations may fluctuate, in part, because of the resource intensive nature of our sales efforts, the length and variability of our sales cycle and the short-term difficulty in adjusting our operating expenses. Our results of operations depend in part on sales to large organizations. The length of our sales cycle, from proof of concept to delivery of and payment for our platform, is typically three to nine months but can be more than a year for large enterprise customers. To the extent our competitors develop solutions that our prospective customers view as equivalent to ours, our average sales cycle may increase. Because the length of time required to close a sale varies substantially from customer to customer, it is difficult to predict exactly when, or even if, we will make a sale with a potential customer. As a result, large individual sales have, in some cases, occurred in quarters subsequent to those we anticipated, or have not occurred at all. The loss or delay of one or more large transactions in a quarter could impact our results of operations for that quarter and any future quarters for which revenue from that transaction is delayed. As a result of these factors, it is difficult for us to forecast our revenue accurately in any quarter. Because a substantial portion of our expenses are relatively fixed in the short term, our results of operations will suffer if our revenue falls below our or analysts' expectations in a particular quarter, which could cause the price of our common stock to decline.

A portion of our revenue is generated by sales to government entities, which are subject to a number of challenges and risks.

        Selling to government entities can be highly competitive, expensive and time-consuming, and often requires significant upfront time and expense without any assurance that we will win a sale. Government demand and payment for our solutions may also be impacted by changes in fiscal or contracting policies, changes in government programs or applicable requirements, the adoption of new laws or regulations or changes to existing laws or regulations, public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our solutions. Government entities also have heightened sensitivity surrounding the purchase of cyber security products due to the critical importance of their IT infrastructures, the nature of the information contained within those infrastructures and the fact that they are highly visible targets for cyber attacks. Accordingly, increasing sales of our products to government entities may be more challenging than selling to commercial organizations, especially given extensive certification, clearance and security requirements. Government agencies may have statutory, contractual or other legal rights to terminate contracts with us or channel partners. Further, in the course of providing our solutions to government entities, our employees and those of our channel partners may be exposed to sensitive government information. Any failure by us or our channel partners to safeguard and maintain the confidentiality of such information could subject us to liability and reputational harm, which could materially and adversely affect our results of operations and financial performance. Governments routinely investigate and audit government contractors' administrative processes, and any unfavorable audit may cause the government to shift away from our solutions and may result in a reduction of revenue, fines or civil or criminal liability if the audit uncovers improper or illegal activities, which could adversely impact our results or operations.

37

---

Table of Contents

Our efforts to expand our international sales and operations may increasingly expose us to fluctuations in currency exchange rates, which could negatively affect our financial condition and results of operations.

        Our reporting currency is the U.S. dollar, and we generate a substantial majority of our revenue and expenses in U.S. dollars. For the year ended December 31, 2017, approximately 5% of our revenue was generated in foreign currencies from customers located outside of the United States. Additionally, for the year ended December 31, 2017, we incurred approximately 9% of our expenses outside of the United States in foreign currencies, primarily the British pound, principally with respect to salaries and related personnel expenses associated with our sales operations. The exchange rate between the U.S. dollar and foreign currencies has fluctuated substantially in recent years and may continue to fluctuate substantially in the future. Accordingly, as we continue with our anticipated international expansion, changes in exchange rates may have an increasingly adverse effect on our business, operating results and financial condition. To date, we have not engaged in any hedging strategies, and any such strategies, such as forward contracts, options and foreign exchange swaps related to transaction exposures that we may implement to mitigate this risk may not eliminate our exposure to foreign exchange fluctuations.

Changes in or interpretations of financial accounting standards may cause an adverse impact to our reported results of operations.

        We prepare our consolidated financial statements in conformity with generally accepted accounting principles in the United States, or GAAP. These principles are subject to interpretation by the Securities and Exchange Commission, or SEC, and various bodies formed to interpret and create appropriate accounting standards. It is possible that future requirements, including the released guidance related to revenue recognition (ASU 2014-09, Revenue from Contracts with Customers: Topic 606) described below, could change our current application of GAAP, resulting in a material adverse impact on our reported results of operations or financial position, and may even affect our reporting of transactions completed before the change is effective. New accounting pronouncements and varying interpretations of accounting pronouncements have occurred and may occur in the future. Changes to existing rules or the questioning of current practices may harm our operating results or the way we conduct our business.

        In May 2014, the Financial Accounting Standards Board issued ASU 2014-09, Revenue from Contracts with Customers: Topic 606, or ASC 606, to supersede nearly all existing revenue recognition guidance under GAAP. Effective January 1, 2018, we will be required to adopt ASC 606. We are currently evaluating the impact that adoption of ASC 606 will have on our consolidated financial statements. We plan to adopt ASC 606 as of January 1, 2018 on a full retrospective basis, which will result in us recasting prior year consolidated financial statements to reflect the provisions of the new standard. While our assessment is preliminary, we have reached some conclusions on key accounting assessments related to the impact of the new standard, which are described in Note 21 to our consolidated financial statements appearing at the end of this prospectus.

We may require additional capital to support business growth, and this capital might not be available on acceptable terms, if at all.

        We intend to continue to make investments to support our business growth and may require additional funds to respond to business challenges, including the need to develop new features or enhance our products, improve our operating infrastructure or acquire complementary businesses and technologies. Accordingly, we may need to engage in equity or debt financings to secure additional funds. If we raise additional funds through future issuances of equity or convertible debt securities, our existing stockholders could suffer significant dilution, and any new equity securities we issue could have rights, preferences and privileges superior to those of holders of our common stock. Any debt financing that we may secure in the future could involve restrictive covenants relating to our capital raising activities and other financial and operational matters, which may make it more difficult for us to obtain additional capital and to pursue business opportunities, including potential acquisitions. We may not be able to obtain additional financing on terms favorable to us, if at all. If we are unable to obtain adequate financing or financing on terms

38

---

Table of Contents

satisfactory to us when we require it, our ability to continue to support our business growth and to respond to business challenges could be significantly impaired, and our business may be adversely affected.

Our existing credit agreement contains operating and financial covenants that may adversely impact our business and the failure to comply with such covenants could prevent us from borrowing funds and could cause any outstanding debt to become immediately payable.

        We are a party to a line of credit with Silicon Valley Bank. Borrowings under this line of credit are secured by substantially all of our assets, excluding certain intellectual property rights. We are also subject to various financial reporting requirements and financial covenants under the line of credit, including maintaining specified liquidity measurements. In addition, there are negative covenants restricting our activities, including limitations on dispositions, mergers or acquisitions; encumbering intellectual property; incurring indebtedness or liens; paying dividends and redeeming or repurchasing capital stock; making certain investments; and engaging in certain other business transactions. The obligations under the line of credit are subject to acceleration upon the occurrence of specified events of default, including a material adverse change in our business, operations or financial or other condition. These restrictions and covenants, as well as those contained in any future financing agreements that we may enter into, may restrict our ability to finance our operations and to engage in, expand or otherwise pursue our business activities and strategies. Our ability to comply with these covenants may be affected by events beyond our control, and breaches of these covenants could result in a default under the credit agreement and any future financial agreements that we may enter into. If not waived, defaults could cause our outstanding indebtedness under our credit agreement and any future financing agreements that we may enter into to become immediately due and payable. See the information under the heading "Management's Discussion and Analysis of Financial Condition and Results of Operations—Liquidity and Capital Resources—Sources of Funds" for a more detailed description of our credit agreement.

Our business is subject to the risks of earthquakes, fire, power outages, floods and other catastrophic events, and to interruption by manmade problems such as terrorism.

        A significant natural disaster, such as an earthquake, fire or a flood, or a significant power outage could have a material adverse impact on our business, operating results and financial condition. In addition, natural disasters could affect our channel partners' ability to perform services for us on a timely basis. In the event we or our channel partners are hindered by any of the events discussed above, our ability to provide our products to customers could be delayed.

        In addition, our facilities and those of our third-party data centers and hosting providers are vulnerable to damage or interruption from human error, intentional bad acts, pandemics, earthquakes, hurricanes, floods, fires, war, terrorist attacks, power losses, hardware failures, systems failures, telecommunications failures and similar events. The occurrence of a natural disaster, power failure or an act of terrorism, vandalism or other misconduct, a decision by a third party to close a facility on which we rely without adequate notice, or other unanticipated problems could result in lengthy interruptions in provision or delivery of our products, potentially leaving our customers vulnerable to cyber attacks. The occurrence of any of the foregoing events could damage our systems and hardware or could cause them to fail completely, and our insurance may not cover such events or may be insufficient to compensate us for the potentially significant losses, including the potential harm to the future growth of our business, that may result from interruptions in our platform as a result of system failures.

        All of the aforementioned risks may be exacerbated if the disaster recovery plans for us and our third-party data centers and hosting providers prove to be inadequate. To the extent that any of the above results in delayed or reduced customer sales, our business, financial condition and results of operations could be adversely affected.

39

---

Table of Contents

Risks Related to Government Regulation, Data Collection, Intellectual Property and Litigation

Failure to comply with governmental laws and regulations could harm our business.

        Our business is subject to regulation by various federal, state, local and foreign governments. In certain jurisdictions, these regulatory requirements may be more stringent than those in the United States. Noncompliance with applicable regulations or requirements could subject us to investigations, sanctions, mandatory product recalls, enforcement actions, disgorgement of profits, fines, damages, civil and criminal penalties, injunctions or other collateral consequences. If any governmental sanctions are imposed, or if we do not prevail in any possible civil or criminal litigation, our business, results of operations and financial condition could be materially adversely affected. In addition, responding to any action will likely result in a significant diversion of management's attention and resources and an increase in professional fees. Enforcement actions and sanctions could harm our business, reputation, results of operations and financial condition.

We are subject to governmental export controls and economic sanctions regulations that could impair our ability to compete in international markets and/or subject us to liability if we are not in compliance with applicable laws.

        Like other U.S.-origin cyber security products, our products are subject to U.S. export control laws and regulations, including the U.S. Export Administration Regulations and various economic and trade sanctions regulations administered by the U.S. Treasury Department's Office of Foreign Assets Control. Exports of these products must be made in compliance with these laws and regulations. If we fail to comply with these laws and regulations, we and certain of our employees could be subject to substantial civil and criminal penalties, including fines for our company and responsible employees or managers, and, in extreme cases, incarceration of responsible employees and managers and the possible loss of export privileges. Complying with export control laws and regulations, including obtaining the necessary licenses or authorizations, for a particular sale may be time-consuming, is not guaranteed and may result in the delay or loss of sales opportunities. Changes in export or sanctions laws and regulations, shifts in the enforcement or scope of existing laws and regulations, or changes in the countries, governments, persons or products targeted by such laws and regulations, could also result in decreased use of our products by, or in our decreased ability to export or sell our products to, existing or potential customers. A decreased use of our products or limitation on our ability to export or sell our products could adversely affect our business, financial condition and results of operations.

        Further, our products incorporate encryption technology. These encryption products may be exported outside of the United States only with the required export authorizations, including by a license, a license exception or other appropriate government authorizations; such items may also be subject to certain regulatory reporting requirements. Further, U.S. export control laws and economic sanctions prohibit the shipment or provision of certain products to U.S.-embargoed or sanctioned countries, governments or persons as well as the exposure of software code to nationals of embargoed countries. Although we take precautions to prevent our products from being provided or exposed to those subject to U.S. sanctions, such measures may be circumvented or inadvertently violated.

        In addition, various countries regulate the import and domestic use of certain encryption technology, including through import permitting and licensing requirements, and have enacted laws that could limit our customers' ability to implement our products in those countries.

        Multinational efforts are currently underway as part of the Wassenaar Arrangement on Export Controls for Conventional Arms and Dual-Use Goods and Technologies, or the Wassenaar Arrangement, to impose additional restrictions on certain cyber security products. To implement the controls under the Wassenaar Arrangement in the United States, on May 20, 2015, the U.S. Department of Commerce's Bureau of Industry and Security, or BIS, published a proposed rule for public comment that would amend the Export Administration Regulations with regard to exports, reexports and transfers (in-country) of specified intrusion software, surveillance items and related software and technology. Under the proposed rule, intrusion software and surveillance items were defined broadly and would have established an export

40

---

Table of Contents

license requirement for all countries other than the United States and Canada for many commercially available penetration testing and network monitoring products. The proposed rule was ultimately withdrawn due to wide public objection, and the United States has agreed to renegotiate the breath of the language under the Wassenaar Arrangement. Should the United States adopt an onerous policy, this could affect our business and could result in loss of potential market in certain countries, increased administrative costs and delays or loss of sales opportunities.

Failure to comply with applicable anti-corruption legislation could result in fines, criminal penalties and materially adversely affect our business, financial condition and results of operations.

        We are required to comply with anti-corruption and anti-bribery laws in the jurisdictions in which we operate, including the Foreign Corrupt Practices Act, or FCPA, in the United States, the UK Bribery Act, or the Bribery Act, and other similar laws in other countries in which we do business. As a result of doing business in foreign countries, including through channel partners and agents, we will be exposed to a risk of violating anti-corruption laws. Some of the international locations in which we will operate have developing legal systems and may have higher levels of corruption than more developed nations. The FCPA prohibits providing anything of value to foreign officials for the purposes of obtaining or retaining business or securing any improper business advantage. We may deal with both governments and state-owned business enterprises, the employees of which are considered foreign officials for purposes of the FCPA. The provisions of the Bribery Act extend beyond bribery of foreign public officials and are more onerous than the FCPA in a number of other respects, including jurisdiction, non-exemption of facilitation payments and penalties.

        Although we have adopted policies and procedures designed to ensure that we, our employees and third-party agents will comply with such laws, there can be no assurance that such policies or procedures will work effectively at all times or protect us against liability under these or other laws for actions taken by our employees, channel partners and other third parties with respect to our business. If we are not in compliance with anti-corruption laws and other laws governing the conduct of business with government entities and/or officials (including local laws), we may be subject to criminal and civil penalties and other remedial measures, which could harm our business, financial condition, results of operations, cash flows and prospects. In addition, investigations of any actual or alleged violations of such laws or policies related to us could harm our business, financial condition, results of operations, cash flows and prospects.

Because our products may collect and store user and related information, domestic and international privacy and cyber security concerns, and other laws and regulations, could result in additional costs and liabilities to us or inhibit sales of our products.

        We, our channel partners and our customers are subject to a number of domestic and international laws and regulations that apply to online services and the internet generally. These laws, rules and regulations address a range of issues including data privacy and cyber security, breach notification and restrictions or technological requirements regarding the collection, use, storage, protection, retention or transfer of data. The regulatory framework for online services, data privacy and cyber security issues worldwide can vary substantially from jurisdiction to jurisdiction, is rapidly evolving and is likely to remain uncertain for the foreseeable future. Many federal, state and foreign government bodies and agencies have adopted or are considering adopting laws, rules and regulations regarding the collection, use, storage and disclosure of information, web browsing and geolocation data collection, data analytics, cyber security and breach response and notification procedures. Interpretation of these laws, rules and regulations and their application to our products in the United States and foreign jurisdictions is ongoing and cannot be fully determined at this time.

        In the United States, these include rules and regulations promulgated under the authority of the Federal Trade Commission, the Electronic Communications Privacy Act, Computer Fraud and Abuse Act, HIPAA, the Gramm Leach Bliley Act and state breach notification laws, other state laws and regulations

41

---

Table of Contents

applicable to privacy and data security, as well as regulator enforcement positions and expectations reflected in federal and state regulatory actions, settlements, consent decrees and guidance documents.

        Internationally, virtually every jurisdiction in which we operate and have customers and/or have prospective customers to which we market has established its own data security and privacy legal frameworks with which we, our channel partners or our customers must comply. Further, many federal, state and foreign government bodies and agencies have introduced, and are currently considering, additional laws and regulations. If passed, we will likely incur additional expenses and costs associated with complying with such laws, as well as face heightened potential liability if we are unable to comply with these laws.

        Laws in the European Economic Area, or EEA, regulate transfers of EU personal data to third countries, such as the United States, that have not been found to provide adequate protection to such personal data. We have in the past relied upon adherence to the U.S. Department of Commerce's U.S.-EU Safe Harbor Framework which established a means for legitimating the transfer of personal data from the EEA to the United States. However, the Court of Justice of the European Union invalidated the U.S.-EU Safe Harbor Framework in October 2015 and, in February 2016, EU and U.S. negotiators agreed to a new framework, the EU-U.S. Privacy Shield, which came into effect in July 2016. However, there are recent regulatory concerns about this framework, as well as litigation challenging other EU mechanisms for adequate data transfer (i.e., the standard contractual clauses). We are currently in the process of certifying under the EU-U.S. Privacy Shield, and rely on a mixture of mechanisms to transfer EU personal data to the United States. We could be impacted by changes in law as a result of the current challenges to these mechanisms by regulators and in the European courts which may lead to governmental enforcement actions, litigation, fines and penalties or adverse publicity, which could have an adverse effect on our reputation and business.

        On April 27, 2016, the European Union adopted the General Data Protection Regulation 2016/679, or GDPR, that will take effect on May 25, 2018 replacing the current data protection laws of each EU member state. The GDPR applies to any company established in the EU as well as to those outside the EU if they collect and use personal data in connection with the offering of goods or services to individuals in the EU or the monitoring of their behavior (for example, through email monitoring). The GDPR enhances data protection obligations for processors and controllers of personal data, including, for example, expanded disclosures about how personal information is to be used, limitations on retention of information, mandatory data breach notification requirements and onerous new obligations on services providers. Non-compliance with the GDPR can trigger steep fines of up to €20 million or 4% of total worldwide annual turnover, whichever is higher. Given the breadth and depth of changes in data protection obligations, preparing to meet the GDPR's requirements before its application on May 25, 2018 requires time, resources and a review of the technology and systems currently in use against the GDPR's requirements. We have engaged a third party to assist us in undertaking a data protection review, and are in the process of implementing remedial changes towards GDPR compliance. Separate EU laws and regulations (and member states' implementations thereof) govern the protection of consumers and of electronic communications and these are also evolving. For instance, the current European laws that cover the use of cookies and similar technology and marketing online or by electronic means are under reform. A draft of the new ePrivacy Regulation extends the strict opt-in marketing rules with limited exceptions to business-to-business communications, alters rules on third-party cookies, web beacons and similar technology and significantly increases penalties. We cannot yet determine the impact such future laws, regulations, and standards may have on our business. Such laws and regulations are often subject to differing interpretations and may be inconsistent among jurisdictions. We may incur substantial expense in complying with the new obligations to be imposed by the GDPR and we may be required to make significant changes in our business operations and product and services development, all of which may adversely affect our revenues and our business.

42

---

Table of Contents

        We and our customers are at risk of enforcement actions taken by certain EU data protection authorities until such point in time that we may be able to ensure that all transfers of personal data to us from the EEA are conducted in compliance with all applicable regulatory obligations, the guidance of data protection authorities and evolving best practices. We may find it necessary to establish systems to maintain personal data originating from the EU in the EEA, which may involve substantial expense and may cause us to need to divert resources from other aspects of our business, all of which may adversely affect our business.

        Because the interpretation and application of privacy and data protection laws are still uncertain, it is possible that these laws may be interpreted and applied in a manner that is inconsistent with our existing practices or the features of our products. We may also be subject to claims of liability or responsibility for the actions of third parties with whom we interact or upon whom we rely in relation to various products, including but not limited to vendors and business partners. If so, in addition to the possibility of fines, lawsuits and other claims, we could be required to fundamentally change our business activities and practices or modify our products, which could have an adverse effect on our business. Any inability to adequately address privacy and/or data concerns, even if unfounded, or comply with applicable privacy or data protection laws, regulations and policies, could result in additional cost and liability to us, damage our reputation, inhibit sales and adversely affect our business.

        The costs of compliance with, and other burdens imposed by, the laws, rules, regulations and policies that are applicable to the businesses of our customers may limit the use and adoption of, and reduce the overall demand for, our software. Even the perception of privacy concerns, whether or not valid, may harm our reputation, inhibit adoption of our products by current and future customers, or adversely impact our ability to attract and retain workforce talent. Our failure to comply with applicable laws and regulations, or to protect such data, could result in enforcement action against us, including fines, imprisonment of company officials and public censure, claims for damages by customers and other affected individuals, damage to our reputation and loss of goodwill (both in relation to existing customers and prospective customers), any of which could have a material adverse effect on our operations, financial performance and business.

Our intellectual property rights are valuable and any inability to protect our proprietary technology and intellectual property rights could substantially harm our business and operating results.

        Our future success and competitive position depend in part on our ability to protect our intellectual property and proprietary technologies. To safeguard these rights, we rely on a combination of patent, trademark, copyright and trade secret laws and contractual protections in the United States and other jurisdictions, all of which provide only limited protection and may not now or in the future provide us with a competitive advantage. We maintain a program of identifying technology appropriate for patent protection. Our practice is to require employees and consultants to execute non-disclosure and proprietary rights agreements upon commencement of employment or consulting arrangements. These agreements acknowledge our exclusive ownership of all intellectual property developed by the individuals during their work for us and require that all proprietary information disclosed will remain confidential. Such agreements may not be enforceable in full or in part in all jurisdictions and any breach could have a negative effect on our business and our remedy for such breach may be limited.

        We have approximately 20 U.S. patents and patent applications relating to our products. We cannot be certain that any patents will issue from any patent applications, that patents that issue from such applications will give us the protection that we seek or that any such patents will not be challenged, invalidated, or circumvented. Any patents that may issue in the future from our pending or future patent applications may not provide sufficiently broad protection and may not be enforceable in actions against alleged infringers. We have registered the "Carbon Black," "Arm Your Endpoints" and "Bit9" names and logos in the United States and certain other countries. We have registrations and/or pending applications for additional marks in the United States and other countries, including the "Predictive Security Cloud";

43

---

Table of Contents

however, we cannot be certain that any future trademark registrations will be issued for pending or future applications or that any registered trademarks will be enforceable or provide adequate protection of our proprietary rights. We also license software from third parties for integration into our products, including open source software and other software available on commercially reasonable terms. We cannot be certain that such third parties will maintain such software or continue to make it available.

        In order to protect our unpatented proprietary technologies and processes, we rely on trade secret laws and confidentiality agreements with our employees, consultants, channel partners, vendors and others. Despite our efforts to protect our proprietary technology and trade secrets, unauthorized parties may attempt to misappropriate, reverse engineer or otherwise obtain and use them. In addition, others may independently discover our trade secrets, in which case we would not be able to assert trade secret rights, or develop similar technologies and processes. Further, the contractual provisions that we enter into may not prevent unauthorized use or disclosure of our proprietary technology or intellectual property rights and may not provide an adequate remedy in the event of unauthorized use or disclosure of our proprietary technology or intellectual property rights. Moreover, policing unauthorized use of our technologies, trade secrets and intellectual property is difficult, expensive and time-consuming, particularly in foreign countries where the laws may not be as protective of intellectual property rights as those in the United States and where mechanisms for enforcement of intellectual property rights may be weak. We may be unable to determine the extent of any unauthorized use or infringement of our products, technologies or intellectual property rights.

        From time to time, legal action by us may be necessary to enforce our patents and other intellectual property rights, to protect our trade secrets, to determine the validity and scope of the intellectual property rights of others or to defend against claims of infringement or invalidity. Such litigation could result in substantial costs and diversion of resources and could negatively affect our business, operating results and financial condition.

Assertions by third parties of infringement or other violations by us of their intellectual property rights, whether or not correct, could result in significant costs and harm our business and operating results.

        Patent and other intellectual property disputes are common in our industry. Some companies, including some of our competitors, some of whom have substantially more resources and have been developing relevant technologies for much longer than us, own large numbers of patents, copyrights and trademarks, which they may use to assert claims against us. Third parties have in the past and may in the future assert claims of infringement, misappropriation or other violations of intellectual property rights against us. They may also assert such claims against our customers or channel partners, whom we typically indemnify against claims that our products infringe, misappropriate or otherwise violate the intellectual property rights of third parties. If we do infringe a third party's rights and are unable to provide a sufficient workaround, we may need to negotiate with holders of those rights to obtain a license to those rights or otherwise settle any infringement claim as a party that makes a claim of infringement against us may obtain an injunction preventing us from shipping products containing the allegedly infringing technology. As the number of products and competitors in our market increase and overlaps occur, claims of infringement, misappropriation and other violations of intellectual property rights may increase. Any claim of infringement, misappropriation or other violation of intellectual property rights by a third party, even those without merit, could cause us to incur substantial costs defending against the claim and could distract our management from our business. For example, on April 6, 2018, we agreed to pay $3.9 million pursuant to a settlement agreement with a non-practicing entity that claimed we infringed upon certain patents held by such entity. See Note 21 to our consolidated financial statements appearing at the end of this prospectus.

        The patent portfolios of our most significant competitors are larger than ours. This disparity may increase the risk that they may sue us for patent infringement and may limit our ability to counterclaim for patent infringement or settle through patent cross-licenses. In addition, future assertions of patent rights by third parties, and any resulting litigation, may involve patent holding companies or other adverse patent

44

---

Table of Contents

owners who have no relevant product revenues and against whom our own patents may therefore provide little or no deterrence or protection. There can be no assurance that we will not be found to infringe or otherwise violate any third-party intellectual property rights or to have done so in the past.

        An adverse outcome of a dispute may require us to:

•

pay substantial damages, including treble damages, if we are found to have willfully infringed a third party's patents or copyrights;



•

cease making, licensing or using products that are alleged to infringe or misappropriate the intellectual property of others;



•

expend additional development resources to attempt to redesign our products or otherwise develop non-infringing technology, which may not be successful;



•

enter into potentially unfavorable royalty or license agreements to obtain the right to use necessary technologies or intellectual property rights;



•

take legal action or initiate administrative proceedings to challenge the validity and scope of the third-party rights or to defend against any allegations of infringement; and



•

indemnify our partners and other third parties.

        In addition, royalty or licensing agreements, if required or desirable, may be unavailable on terms acceptable to us, or at all, and may require significant royalty payments and other expenditures. Some licenses may also be non-exclusive, and therefore our competitors may have access to the same technology licensed to us. Any of the foregoing events could seriously harm our business, financial condition and results of operations.

Confidentiality arrangements with employees and others may not adequately prevent disclosure of trade secrets and other proprietary information.

        We have devoted substantial resources to the development of our technology, business operations and business plans. In order to protect our trade secrets and proprietary information, we rely in significant part on confidentiality arrangements with our employees, licensees, independent contractors, advisors, channel partners and customers. These arrangements may not be effective to prevent disclosure of confidential information, including trade secrets, and may not provide an adequate remedy in the event of unauthorized disclosure of confidential information. In addition, if others independently discover trade secrets and proprietary information, we would not be able to assert trade secret rights against such parties. Effective trade secret protection may not be available in every country in which our products are available or where we have employees or independent contractors. The loss of trade secret protection could make it easier for third parties to compete with our products by copying functionality. In addition, any changes in, or unexpected interpretations of, the trade secret and employment laws in any country in which we operate may compromise our ability to enforce our trade secret and intellectual property rights. Costly and time-consuming litigation could be necessary to enforce and determine the scope of our proprietary rights, and failure to obtain or maintain trade secret protection could adversely affect our competitive business position.

We may be subject to damages resulting from claims that our employees or contractors have wrongfully used or disclosed alleged trade secrets of their former employers or other parties.

        We could in the future be subject to claims that employees or contractors, or we, have inadvertently or otherwise used or disclosed trade secrets or other proprietary information of our competitors or other parties. Litigation may be necessary to defend against these claims. If we fail in defending against such claims, a court could order us to pay substantial damages and prohibit us from using technologies or features that are essential to our products, if such technologies or features are found to incorporate or be derived from the trade secrets or other proprietary information of these parties. In addition, we may lose

45

---

Table of Contents

valuable intellectual property rights or personnel. A loss of key personnel or their work product could hamper or prevent our ability to develop, market and support potential products or enhancements, which could severely harm our business. Even if we are successful in defending against these claims, such litigation could result in substantial costs and be a distraction to management.

Our operating results may be harmed if we are required to collect sales and use or other related taxes for our products in jurisdictions where we have not historically done so.

        Taxing jurisdictions, including state, local and foreign taxing authorities, have differing rules and regulations governing sales and use or other taxes, and these rules and regulations are subject to varying interpretations that may change over time. In particular, significant judgment is required in evaluating our tax positions and our worldwide provision for taxes. While we believe that we are in material compliance with our obligations under applicable taxing regimes, one or more states, localities or countries may seek to impose additional sales or other tax collection obligations on us, including for past sales by us or our channel partners. It is possible that we could face sales tax audits and that such audits could result in tax-related liabilities for which we have not accrued. A successful assertion that we should be collecting additional sales or other taxes on our products in jurisdictions where we have not historically done so and do not accrue for sales taxes could result in substantial tax liabilities for past sales, discourage customers from purchasing our products or otherwise harm our business and operating results.

        In addition, our tax obligations and effective tax rates could be adversely affected by changes in the relevant tax, accounting and other laws, regulations, principles and interpretations, including those relating to income tax nexus, by recognizing tax losses or lower than anticipated earnings in jurisdictions where we have lower statutory rates and higher than anticipated earnings in jurisdictions where we have higher statutory rates, by changes in foreign currency exchange rates, or by changes in the valuation of our deferred tax assets and liabilities. Although we believe our tax estimates are reasonable, the final determination of any tax audits or litigation could be materially different from our historical tax provisions and accruals, which could have a material adverse effect on our operating results or cash flows in the period or periods for which a determination is made.

Comprehensive tax reform legislation could adversely affect our business and financial condition.

        The U.S. government has recently enacted comprehensive tax legislation that includes significant changes to the taxation of business entities, referenced herein as the Tax Reform Act. These changes include, among others, a permanent reduction to the corporate income tax rate, limiting interest deductions, adopting elements of a territorial tax system, assessing a repatriation tax or "toll-charge" on undistributed earnings and profits of U.S.-owned foreign corporations, and introducing certain anti-base erosion provisions. The overall impact of this tax reform is uncertain, and our business and financial condition, including with respect to our non-U.S. operations, could be adversely affected. The overall impact of the Tax Reform Act on stockholders is uncertain, and this prospectus does not address, other than as expressly addressed herein, the manner in which it may affect purchasers of our common stock. We urge investors to consult with their legal and tax advisors with respect to any such legislation and the potential tax consequences of investing in our common shares.

We may not be able to utilize a significant portion of our net operating loss carryforwards and research and development tax credit carryforwards.

        As of December 31, 2017, we had federal and state net operating loss carryforwards of $231.0 million and $153.8 million, respectively, which if not utilized will begin to expire in 2023 and 2018, respectively, and federal and state research and development tax credit carryforwards of $4.2 million and $2.4 million, respectively, which if not utilized will begin to expire in 2026 and 2021, respectively. These net operating loss and tax credit carryforwards could expire unused and be unavailable to offset our future income tax liabilities. In addition, under Section 382 of the Internal Revenue Code of 1986, as amended, or the Code, and corresponding provisions of state law, if a corporation undergoes an "ownership change," which is

46

---

Table of Contents

generally defined as a greater than 50% change, by value, in its equity ownership over a three-year period, the corporation's ability to use its pre-change net operating loss carryforwards and other pre-change tax attributes to offset its post-change income may be limited. We have not determined if we have experienced Section 382 ownership changes in the past and if a portion of our net operating loss and tax credit carryforwards is subject to an annual limitation under Section 382. In addition, we may experience ownership changes in the future as a result of subsequent shifts in our stock ownership, including this offering, some of which may be outside of our control. If we determine that an ownership change has occurred and our ability to use our historical net operating loss and tax credit carryforwards is materially limited, it would harm our future operating results by effectively increasing our future tax obligations.

Risk Related to Our Common Stock and this Offering

Our stock price may be volatile, and you may lose some or all of your investment.

        The initial public offering price for the shares of our common stock will be determined by negotiations between us and the representatives of the underwriters and may not be indicative of the market price of our common stock following this offering. The market price of our common stock may be highly volatile and may fluctuate substantially as a result of a variety of factors, some of which are related in complex ways, including:

•

actual or anticipated fluctuations in our financial condition and operating results;



•

variance in our financial performance from expectations of securities analysts;



•

changes in the prices of our products;



•

changes in our projected operating and financial results;



•

changes in laws or regulations applicable to our products;



•

announcements by us or our competitors of significant business developments, acquisitions or new products;



•

our involvement in any litigation;



•

our sale of our common stock or other securities in the future;



•

changes in senior management or key personnel;



•

trading volume of our common stock;



•

changes in the anticipated future size and growth rate of our market; and



•

general economic, regulatory and market conditions.

        The stock markets are subject to extreme price and volume fluctuations that have affected and continue to affect the market prices of equity securities of many companies. These fluctuations have often been unrelated or disproportionate to the operating performance of those companies. Broad market and industry fluctuations, as well as general economic, political, regulatory and market conditions, may negatively impact the market price of our common stock. If the market price of our common stock after this offering does not exceed the initial public offering price, you may lose some or all of your investment. In the past, companies that have experienced volatility in the market price of their securities have been subject to securities class action litigation. We may be the target of this type of litigation in the future, which could result in substantial costs and divert our management's attention.

No public market for our common stock currently exists, and an active public trading market may not develop or be sustained following this offering.

        No public market for our common stock currently exists. An active public trading market may not develop following the completion of this offering or, if developed, may not be sustained. The lack of an active market may impair your ability to sell your shares at the time you wish to sell them or at a price that

47

---

Table of Contents

you consider reasonable. The lack of an active market may also reduce the fair value of your shares. An inactive market may also impair our ability to raise capital to continue to fund operations by selling shares and may impair our ability to acquire other companies or technologies by using our shares as consideration.

If securities or industry analysts do not publish research or reports about our business, or publish negative reports about our business, our stock price and trading volume could decline.

        The trading market for our common stock will depend, in part, on the research and reports that securities or industry analysts publish about us or our business. We do not have any control over these analysts. If our financial performance fails to meet analyst estimates or one or more of the analysts who cover us downgrade our shares or change their opinion of our shares, our share price would likely decline. If one or more of these analysts cease coverage of our company or fail to regularly publish reports on us, we could lose visibility in the financial markets, which could cause our share price or trading volume to decline.

The issuance of additional stock in connection with financings, acquisitions, investments, our stock incentive plans or otherwise will dilute all other stockholders.

        Our amended and restated certificate of incorporation, which will become effective upon the closing of this offering, authorizes us to issue up to 500,000,000 shares of common stock and up to 25,000,000 shares of preferred stock with such rights and preferences as may be determined by our board of directors. Subject to compliance with applicable rules and regulations, we may issue our shares of common stock or securities convertible into our common stock from time to time in connection with a financing, acquisition, investment, our stock incentive plans or otherwise. Any such issuance could result in substantial dilution to our existing stockholders and cause the trading price of our common stock to decline.

We do not intend to pay dividends for the foreseeable future and, as a result, your ability to achieve a return on your investment will depend on appreciation in the price of our common stock.

        We have never declared or paid any cash dividends on our common stock and do not intend to pay any cash dividends in the foreseeable future. We anticipate that we will retain all of our future earnings for use in the development of our business and for general corporate purposes. In addition, our ability to pay cash dividends is currently limited by the terms of our credit agreements, and any future credit agreements may contain terms prohibiting or limiting the amount of dividends that may be declared or paid on our common stock. Accordingly, investors must rely on sales of their common stock after price appreciation, which may never occur, as the only way to realize any future gains on their investments.

Concentration of ownership among our directors, executive officers and holders of 5% or more of our outstanding common stock may prevent new investors from influencing significant corporate decisions.

        Following this offering, our directors, executive officers and holders of more than 5% of our common stock, some of whom are represented on our board of directors, together with their affiliates will beneficially own 41.8% of the voting power of our outstanding capital stock. As a result, these stockholders will, immediately following this offering, be able to determine the outcome of matters submitted to our stockholders for approval. Some of these persons or entities may have interests that are different from yours, and this ownership could affect the value of your shares of common stock if, for example, these stockholders elect to delay, defer or prevent a change in corporate control, merger, consolidation, takeover or other business combination. This concentration of ownership may also adversely affect the market price of our common stock.

48

---

Table of Contents

Our management will have broad discretion over the use of the proceeds we receive in this offering and might not apply the proceeds in ways that increase the value of your investment.

        Our management will have broad discretion to use the net proceeds from this offering, and you will be relying on the judgment of our management regarding the application of these proceeds. Our management might not apply the net proceeds in ways that increase the value of your investment. We currently intend to use a majority of the net proceeds from this offering to invest further in our sales and marketing activities to grow our customer base, to fund our research and development efforts to enhance our technology platform and product functionality, to pay general and administrative expenses and to fund our other growth strategies described elsewhere in this prospectus. We may also use a portion of the net proceeds for the acquisition of complementary businesses, technologies or other assets, although we currently have no agreements, commitments or understandings with respect to any such transactions. Until we use the net proceeds from this offering, we plan to invest them, and these investments may not yield a favorable rate of return. See "Use of Proceeds" for a more detailed description of our intended use of the net proceeds from this offering. If we do not invest or apply the net proceeds from this offering in ways that enhance stockholder value, we may fail to achieve expected financial results, which could cause our stock price to decline.

Future sales of our common stock in the public market could cause our share price to decline.

        After this offering, there will be 65,825,141 shares of our common stock outstanding, assuming no exercise of the underwriters' over-allotment option. Sales of a substantial number of shares of our common stock in the public market after this offering, or the perception that these sales might occur, could depress the market price of our common stock and could impair our ability to raise capital through the sale of additional equity securities. All of the shares sold in this offering will be freely transferable without restrictions or further registration under the Securities Act of 1933, except for any shares acquired by our affiliates, as defined in Rule 144 under the Securities Act. The remaining 57,825,141 shares outstanding after this offering will be restricted as a result of securities laws, lock-up agreements or other contractual restrictions that restrict transfers for 180 days after the date of this prospectus.

        Additionally, following the completion of this offering, stockholders holding approximately 57.8% of our common stock outstanding will, after the expiration of the lock-up periods specified above, have the right, subject to various conditions and limitations, to include their shares of our common stock in registration statements relating to our securities. If the offer and sale of these shares are registered, they will be freely tradable without restriction under the Securities Act. Shares of common stock sold under such registration statements can be freely sold in the public market. In the event such registration rights are exercised and a large number of shares of common stock are sold in the public market, such sales could reduce the trading price of our common stock. See "Description of Capital Stock—Registration Rights" and "Shares Eligible for Future Sale—Lock-Up Agreements" for a more detailed description of these registration rights and the lock-up period.

        We intend to file a registration statement on Form S-8 under the Securities Act to register the total number of shares of our common stock that may be issued under our equity incentive plans. See the information under the heading "Shares Eligible for Future Sale—Registration Statement on Form S-8" for a more detailed description of the shares of common stock that will be available for future sale upon the registration and issuance of such shares, subject to any applicable vesting or lock-up period or other restrictions provided under the terms of the applicable plan and/or the restricted stock unit, or RSU, agreements and option agreements entered into with the RSU and option holders. In addition, in the future we may issue common stock or other securities if we need to raise additional capital. The number of new shares of our common stock issued in connection with raising additional capital could constitute a material portion of the then outstanding shares of our common stock.

49

---

Table of Contents

If you purchase shares of our common stock in this offering, you will experience substantial and immediate dilution.

        If you purchase shares of our common stock in this offering, you will experience substantial and immediate dilution of $15.06 per share in the pro forma as adjusted net tangible book value per share after giving effect to this offering, based on an assumed public offering price of $16.00 per share, which is the midpoint of the price range set forth on the cover page of this prospectus, because the price that you pay will be substantially greater than the pro forma as adjusted net tangible book value per share of the common stock that you acquire. This dilution is due in large part to the fact that our earlier investors paid substantially less than the initial public offering price when they purchased their shares of our capital stock. In addition, you will experience additional dilution upon exercise of any warrant, upon settlement of RSUs, and upon exercise of options to purchase common stock under our equity incentive plans, if we issue restricted stock to our employees under our equity incentive plans or if we otherwise issue additional shares of our common stock. For a further description of the dilution that you will experience immediately after this offering, see "Dilution."

We are an "emerging growth company" and we cannot be certain if the reduced disclosure requirements applicable to emerging growth companies will make our common stock less attractive to investors.

        We are an "emerging growth company," as defined in the JOBS Act, and we may take advantage of certain exemptions from various reporting requirements that are applicable to other public companies that are not "emerging growth companies" including, but not limited to, the auditor attestation requirements of Section 404 of the Sarbanes-Oxley Act, reduced disclosure obligations regarding executive compensation in our periodic reports and proxy statements, and exemptions from the requirements of holding a non-binding advisory vote on executive compensation and stockholder approval of any golden parachute payments not previously approved. We cannot predict if investors will find our common stock less attractive if we choose to rely on these exemptions. If some investors find our common stock less attractive as a result, there may be a less active trading market for our common stock and our stock price may be more volatile.

We will incur increased costs as a result of operating as a public company, and our management will be required to devote substantial time to compliance with our public company responsibilities and corporate governance practices.

        As a public company, and particularly after we are no longer an "emerging growth company," we will incur significant legal, accounting and other expenses that we did not incur as a private company. The Sarbanes-Oxley Act, the Dodd-Frank Wall Street Reform and Consumer Protection Act, the listing requirements of The Nasdaq Global Select Market and other applicable securities rules and regulations impose various requirements on public companies. Our management and other personnel will need to devote a substantial amount of time to compliance with these requirements. Moreover, these rules and regulations will increase our legal and financial compliance costs and will make some activities more time-consuming and costly. For example, we expect that these rules and regulations may make it more difficult and more expensive for us to obtain directors' and officers' liability insurance, which could make it more difficult for us to attract and retain qualified members of our board of directors. We cannot predict or estimate the amount of additional costs we will incur as a public company or the timing of such costs.

As a result of becoming a public company, we will be obligated to develop and maintain proper and effective internal controls over financial reporting and any failure to maintain the adequacy of these internal controls may adversely affect investor confidence in our company and, as a result, the value of our common stock.

        We will be required, pursuant to Section 404 of the Sarbanes-Oxley Act, or Section 404, to furnish a report by management on, among other things, the effectiveness of our internal control over financial reporting for the first fiscal year beginning after the effective date of this offering. This assessment will need to include disclosure of any material weaknesses identified by our management in our internal control over financial reporting. Our independent registered public accounting firm will not be required to attest to the effectiveness of our internal control over financial reporting until our first annual report

50

---

Table of Contents

required to be filed with the SEC following the date we are no longer an "emerging growth company," as defined in the JOBS Act. We will be required to disclose significant changes made in our internal control procedures on a quarterly basis.

        We have commenced the costly and challenging process of compiling the system and processing documentation necessary to perform the evaluation needed to comply with Section 404, and we may not be able to complete our evaluation, testing and any required remediation in a timely fashion. Our compliance with Section 404 will require that we incur substantial accounting expense and expend significant management efforts. We currently do not have an internal audit group, and we will need to hire additional accounting and financial staff with appropriate public company experience and technical accounting knowledge and compile the system and process documentation necessary to perform the evaluation needed to comply with Section 404.

        During the evaluation and testing process of our internal controls, if we identify one or more material weaknesses in our internal control over financial reporting, we will be unable to assert that our internal control over financial reporting is effective. We cannot be certain that there will not be material weaknesses or significant deficiencies in our internal control over financial reporting in the future. Any failure to maintain internal control over financial reporting could severely inhibit our ability to accurately report our financial condition or results of operations. If we are unable to conclude that our internal control over financial reporting is effective, or if our independent registered public accounting firm determines we have a material weakness or significant deficiency in our internal control over financial reporting, we could lose investor confidence in the accuracy and completeness of our financial reports, the market price of our common stock could decline, and we could be subject to sanctions or investigations by The Nasdaq Global Select Market, the SEC or other regulatory authorities. Failure to remedy any material weakness in our internal control over financial reporting, or to implement or maintain other effective control systems required of public companies, could also restrict our future access to the capital markets.

Anti-takeover provisions in our charter documents and Delaware law may delay or prevent an acquisition of our company, limit attempts by our stockholders to replace or remove our current management and limit the market price of our common stock.

        Our amended and restated certificate of incorporation, amended and restated bylaws and Delaware law contain provisions that may have the effect of delaying or preventing a change in control of us or changes in our management. Our amended and restated certificate of incorporation and amended and restated bylaws, which will become effective upon the closing of this offering, include provisions that:

•

authorize "blank check" preferred stock, which could be issued by our board of directors without stockholder approval and may contain voting, liquidation, dividend and other rights superior to our common stock;



•

provide for a classified board of directors whose members serve staggered three-year terms;



•

specify that special meetings of our stockholders can be called only by a majority of the members of our board of directors then in office and only those matters set forth in the notice of the special meeting may be considered or acted upon at a special meeting of stockholders;



•

prohibit stockholder action by written consent;



•

establish an advance notice procedure for stockholder proposals to be brought before an annual meeting of our stockholders, including proposed nominations of persons for election to our board of directors;



•

provide that our directors may be removed only for cause;



•

provide that vacancies on our board of directors may be filled only by a majority of directors then in office, even though less than a quorum;



•

specify that no stockholder is permitted to cumulate votes at any election of directors;

51

---

Table of Contents

•

authorize our board of directors to modify, alter or repeal our amended and restated bylaws; and



•

require supermajority votes of the holders of our common stock to amend specified provisions of our charter documents.

        These provisions, alone or together, could delay or prevent hostile takeovers and changes in control or changes in our management.

        In addition, because we are incorporated in Delaware, we are governed by the provisions of Section 203 of the Delaware General Corporation Law, which limits the ability of stockholders owning in excess of 15% of our outstanding voting stock to merge or combine with us in certain circumstances.

        Any provision of our amended and restated certificate of incorporation, amended and restated bylaws or Delaware law that has the effect of delaying or deterring a change in control could limit the opportunity for our stockholders to receive a premium for their shares of our common stock, and could also affect the price that some investors are willing to pay for our common stock.

Our amended and restated bylaws will designate the Court of Chancery of the State of Delaware or the United States District Court for the District of Massachusetts as the exclusive forum for certain litigation that may be initiated by our stockholders, which could limit our stockholders' ability to obtain a favorable judicial forum for disputes with us.

        Pursuant to our amended and restated bylaws, as will be in effect upon the completion of this offering, unless we consent in writing to the selection of an alternative forum, the Court of Chancery of the State of Delaware will be the sole and exclusive forum for (1) any derivative action or proceeding brought on our behalf, (2) any action asserting a claim of or based on a breach of a fiduciary duty owed by any of our current or former directors, officers or other employees to us or our stockholders, (3) any action asserting a claim against us or any of our current or former directors, officers, employees or stockholders arising pursuant to any provision of the Delaware General Corporation Law, our amended and restated bylaws or our amended and restated bylaws or (4) any action asserting a claim governed by the internal affairs doctrine. Our amended and restated bylaws will further provide that the United States District Court for the District of Massachusetts will be the exclusive forum for resolving any complaint asserting a cause of action arising under the Securities Act. In addition, our amended and restated bylaws will provide that any person or entity purchasing or otherwise acquiring any interest in shares of our common stock is deemed to have notice of and consented to the foregoing provisions. We have chosen the United States District Court for the District of Massachusetts as the exclusive forum for such causes of action because our principal executive offices are located in Waltham, Massachusetts. Some companies that have adopted similar federal district court forum selection provisions are currently subject to a suit in the Court of Chancery of the State of Delaware brought by stockholders who assert that the federal district court forum selection provision is not enforceable. We recognize that the federal district court forum selection clause may impose additional litigation costs on stockholders who assert the provision is not enforceable and may impose more general additional litigation costs in pursuing any such claims, particularly if the stockholders do not reside in or near the Commonwealth of Massachusetts. Additionally, the forum selection clauses in our amended and restated bylaws may limit our stockholders' ability to obtain a favorable judicial forum for disputes with us. Alternatively, if the federal district court forum selection provision is found inapplicable to, or unenforceable in respect of, one or more of the specified types of actions or proceedings, we may incur additional costs associated with resolving such matters in other jurisdictions, which could have an adverse effect on our business, financial condition or results of operations. The United States District Court for the District of Massachusetts may also reach different judgments or results than would other courts, including courts where a stockholder considering an action may be located or would otherwise choose to bring the action, and such judgments may be more or less favorable to us than our stockholders.

52

---

Table of Contents

SPECIAL NOTE REGARDING FORWARD-LOOKING STATEMENTS

        This prospectus contains forward-looking statements that involve substantial risks and uncertainties. All statements, other than statements of historical facts, included in this prospectus regarding our strategy, future operations, future financial position, future revenue, projected costs, prospects, plans, objectives of management and expected market growth are forward-looking statements. The words "anticipate," "believe," "could," "estimate," "expect," "intend," "may," "might," "plan," "predict," "project," "will," "would," or the negative of these words or other similar terms or expressions are intended to identify forward-looking statements, although not all forward-looking statements contain these identifying words. These forward-looking statements include, among other things, statements about:

•

the growth in the market for next-generation endpoint security solutions and future cyber security spending;



•

changes in the nature and quantity of advanced cyber attacks facing our customers and prospects;



•

our predictions about the market transition from legacy antivirus solutions to next-generation endpoint security solutions;



•

our ability to acquire new customers, retain customers and grow revenue from existing customers;



•

our ability to maintain and expand relationships with our channel and strategic partners;



•

our ability to train support personnel;



•

our ability to grow our business, both domestically and internationally;



•

our ability to continue to innovate and enhance our technology platform and product functionality;



•

our ability to acquire complementary businesses, technology and assets;



•

the effects of increased competition and our ability to compete effectively;



•

our ability to adapt to technological change and effectively enhance, innovate and scale our solutions;



•

our ability to maintain, protect and enhance our intellectual property;



•

costs associated with defending intellectual property infringement and other claims;



•

our ability to effectively manage or sustain our growth and to attain and sustain profitability;



•

our ability to diversify our sources of revenue;



•

our future financial and operating results, including our revenue, cost of revenue, gross profit or gross margin, operating expenses (including changes in sales and marketing, research and development and general and administrative expenses) and backlog;



•

our future revenue, hiring plans, expenses, capital expenditures, capital requirements and stock performance;



•

our future products and product features;



•

our expectations concerning our customer retention rates;



•

our expected use of proceeds;



•

our ability to maintain, or strengthen awareness of, our brand;



•

perceived or actual security, integrity, reliability, quality or compatibility problems with our solutions, including related to security breaches in our or our customers' systems, unscheduled downtime or outages;

53

---

Table of Contents

•

our ability to attract and retain qualified employees and key personnel and expand our overall headcount;



•

our ability to stay abreast of new or modified laws and regulations faced by our customers and that currently apply or become applicable to our business both in the United States and internationally, including laws and regulations related to export compliance; and



•

the future trading prices of our common stock and the impact of securities analysts' reports on these prices.

        We might not actually achieve the plans, intentions or expectations disclosed in our forward-looking statements, and you should not place undue reliance on our forward-looking statements. Actual results or events could differ materially from the plans, intentions and expectations disclosed in the forward-looking statements we make. We have included important factors in the cautionary statements included in this prospectus, particularly in the section titled "Risk Factors," which could cause actual results or events to differ materially from the forward-looking statements that we make. New risks and uncertainties emerge from time to time, and it is not possible for us to predict all risks and uncertainties that could have an impact on the forward-looking statements contained in this prospectus.

        You should read this prospectus and the documents that we have filed as exhibits to the registration statement, of which this prospectus is a part, completely and with the understanding that our actual future results may be materially different from what we expect. The forward-looking statements made in this prospectus relate only to events as of the date on which the statements are made. We do not assume any obligation to update any forward-looking statements, whether as a result of new information, future events or otherwise, except as required by law.

54

---

Table of Contents

MARKET AND INDUSTRY DATA

        This prospectus contains estimates and other statistical data, including those relating to our industry and the market in which we operate, that we have obtained or derived from industry publications and reports, including those listed below. These industry publications and reports generally indicate that they have obtained their information from sources believed to be reliable, but do not guarantee the accuracy and completeness of their information. This information involves a number of assumptions and limitations, and you are cautioned not to give undue weight to these estimates. Based on our industry experience, we believe that the publications and reports are reliable and that the conclusions contained in the publications and reports are reasonable. The industry in which we operate is subject to a high degree of uncertainty and risk due to a variety of factors, including those described in the section titled "Risk Factors." These and other factors could cause our actual results to differ materially from those expressed in the industry publications and reports.

        Certain information in the text of this prospectus is contained in independent industry publications and reports. The source of these independent industry publications is provided below:

•

AV-TEST, Security Report 2016/17.



•

Enterprise Management Associates, 2017 Next-Generation Endpoint Security Vendor Landscape and Five-Year Market Forecast.



•

Forrester Research, The Forrester Wave^TM: Managed Security Services Providers, North America, Q3 2016, The 11 Providers That Matter Most And How They Stack Up, August 30, 2016.



•

Forrester Research, The Forrester Wave^TM: Endpoint Security Suites, Q4 2016, The 15 Providers That Matter Most And How They Stack Up, October 19, 2016.



•

International Data Corporation, IDC MarketScape: Worldwide Endpoint Specialized Threat Analysis and Protection 2017 Vendor Assessment, April 2017.



•

International Data Corporation, IDC Semiannual Public Cloud Services Tracker, November 17, 2017.



•

International Data Corporation, Forecast Data of Cloud Infrastructure and Cloud Software Vendor Revenue 2012-2021.



•

International Data Corporation, Worldwide Endpoint Security Market Shares, 2016: Competition Gets Fierce.



•

International Data Corporation, Worldwide IT Asset Management Software Forecast, 2017-2021, May 2017.



•

International Data Corporation, Worldwide Semiannual Security Spending Guide, August 2017.



•

International Data Corporation, Worldwide Virtual Machine Software Market Shares, 2016: Enterprise Virtualization Remains a Datacenter Mainstay, December 2017.



•

MRG Effitas Ltd., Efficacy Assessment of Cb Defense Against Ransomware, September 2017.



•

Ponemon Institute and Accenture, 2017 Cost of Cyber Crime Study: Insights on the Security Investments that Make a Difference.



•

Ponemon Institute and Carbonite, The Rise of Ransomware, January 2017.



•

Ponemon Institute and IBM Security, 2017 Cost of Data Breach Study: Global Overview, June 2017.

55

---

Table of Contents

USE OF PROCEEDS

        We estimate that the net proceeds from the sale of shares of our common stock in this offering will be approximately $114.1 million, based upon an assumed initial public offering price of $16.00 per share, which is the midpoint of the price range set forth on the cover page of this prospectus, and after deducting estimated underwriting discounts and commissions and estimated offering expenses payable by us. If the underwriters' over-allotment option to purchase additional shares from us is exercised in full, we estimate that our net proceeds would be approximately $132.0 million, after deducting estimated underwriting discounts and commissions and estimated offering expenses payable by us.

        A $1.00 increase (decrease) in the assumed initial public offering price of $16.00 per share would increase (decrease) the net proceeds that we receive from this offering by approximately $7.4 million, assuming that the number of shares offered by us, as set forth on the cover page of this prospectus, remains the same and after deducting estimated underwriting discounts and commissions and estimated offering expenses payable by us. An increase (decrease) of 1,000,000 shares in the number of shares of common stock offered by us would increase (decrease) the net proceeds that we receive from this offering by approximately $14.9 million, assuming the assumed initial public offering price remains the same and after deducting estimated underwriting discounts and commissions and estimated offering expenses payable by us.

        The principal reasons for this offering are to create a public market for shares of our common stock, obtain additional capital and to facilitate our future access to public equity markets. We cannot specify with certainty all of the particular uses for the remaining net proceeds from the offering. We have not quantified or allocated any specific portion of the net proceeds or range of the net proceeds to any particular purpose. We anticipate that we will use a majority of the net proceeds we receive from this offering, including any net proceeds we receive from the exercise of the underwriters' over-allotment option to acquire additional shares of common stock, to invest further in our sales and marketing activities to grow our customer base, to fund our research and development efforts to enhance our technology platform and product functionality, and to pay anticipated general and administrative expenses. We also intend to use proceeds from this offering to fund our other growth strategies described elsewhere in this prospectus. We may use a portion of the net proceeds for the acquisition of businesses, technologies or other assets that we believe are complementary to our own, although we currently have no agreements, commitments or understandings with respect to any such transaction.

        The amount of what, and timing of when, we actually spend for these purposes may vary significantly and will depend on a number of factors, including our future revenue and cash generated by operations and the other factors described in the section titled "Risk Factors." Accordingly, our management will have broad discretion in applying the net proceeds from this offering, and investors will be relying on the judgment of our management regarding the application of the net proceeds from this offering. Pending these uses, we intend to invest the remaining net proceeds in high-quality, short-term, interest-bearing, investment-grade securities, certificates of deposit or direct or guaranteed obligations of the U.S. government.

56

---

Table of Contents

DIVIDEND POLICY

        We have never declared or paid dividends on our common stock. We do not expect to pay dividends on our common stock for the foreseeable future. Instead, we anticipate that all of our earnings, if any, will be used for the operation and growth of our business. Any future determination to declare cash dividends would be subject to the discretion of our board of directors and would depend upon various factors, including our results of operations, financial condition and liquidity requirements, restrictions that may be imposed by applicable law and our contracts and other factors deemed relevant by our board of directors. Additionally, our ability to pay dividends on our common stock is limited by restrictions under the terms of our credit facility with Silicon Valley Bank. See "Management's Discussion and Analysis of Financial Condition and Results of Operation—Liquidity and Capital Resources—Sources of Funds."

57

---

Table of Contents

CAPITALIZATION

        The following table sets forth our cash and cash equivalents as well as our capitalization as of December 31, 2017:

•

on an actual basis;



•

on a pro forma basis to give effect to: (1) the conversion of all outstanding shares of our preferred stock into 45,849,708 shares of common stock upon the closing of this offering; (2) the assumed exercise of the outstanding warrant held by SC US GF Holdings, Ltd., an entity affiliated with Sequoia Capital, to purchase 468,587 shares of our common stock, at an exercise price of $0.002 per share, that will become exercisable upon the closing of this offering; (3) outstanding warrants to purchase shares of our preferred stock becoming warrants to purchase 167,500 shares of common stock upon the closing of this offering; and (4) the filing and effectiveness of our amended and restated certificate of incorporation; and



•

on a pro forma as adjusted basis to give further effect to our receipt of the net proceeds from our sale of 8,000,000 shares of common stock in this offering at an assumed initial public offering price of $16.00 per share, which is the midpoint of the price range set forth on the cover page of this prospectus, after deducting estimated underwriting discounts and commissions and estimated offering expenses payable by us.

        The information below is illustrative only, and our cash and cash equivalents and capitalization following the closing of this offering will be adjusted based on the actual initial public offering price and other terms of the offering determined at pricing. You should read this table together with the sections titled "Management's Discussion and Analysis of Financial Condition and Results of Operations," "Selected Consolidated Financial Data" and "Description of Capital Stock," and our consolidated financial statements and related notes included elsewhere in this prospectus.

58

---

Table of Contents

        A $1.00 increase (decrease) in the assumed initial public offering price of $16.00 per share, which is the midpoint of the price range set forth on the cover page of this prospectus, would increase (decrease) the pro forma as adjusted amount of each of cash and cash equivalents, additional paid-in capital, total stockholders' equity and total capitalization by $7.4 million, assuming that the number of shares offered by us, as set forth on the cover page of this prospectus, remains the same and after deducting estimated underwriting discounts and commissions and estimated offering expenses payable by us. An increase (decrease) of 1,000,000 shares in the number of shares offered by us, as set forth on the cover page of this prospectus, would increase (decrease) the pro forma as adjusted amount of each of cash and cash equivalents, additional paid-in capital, total stockholders' equity and total capitalization by $14.9 million, assuming the assumed initial public offering price remains the same and after deducting estimated underwriting discounts and commissions and estimated offering expenses payable by us. If the underwriters' over-allotment option to purchase additional shares is exercised in full, the pro forma as adjusted amount of each of cash and cash equivalents, additional paid-in capital, total stockholders' equity and total capitalization would increase by $17.9 million, after deducting estimated underwriting discounts and commissions and estimated offering expenses payable by us.

59

---

Table of Contents

        The table above does not include:

•

1,800,965 shares of common stock issuable upon the exercise of stock options outstanding under our Amended and Restated 2010 Series A Option Plan, or the 2010 Series A Plan, as of December 31, 2017, at a weighted-average exercise price of $2.56 per share;



•

117,928 shares of common stock issuable upon the exercise of stock options outstanding under our Amended and Restated Equity Incentive Plan as of December 31, 2017, at a weighted-average exercise price of $1.18 per share;



•

13,609,936 shares of common stock issuable upon the exercise of stock options outstanding under our 2012 Stock Option and Grant Plan, or the 2012 Plan, as of December 31, 2017, at a weighted-average exercise price of $4.99 per share;



•

837,835 shares of common stock issuable upon the exercise of stock options outstanding under our Carbon Black, Inc. Amended and Restated 2012 Equity Incentive Plan as of December 31, 2017, at a weighted-average exercise price of $0.86 per share;



•

455,357 shares of common stock issuable upon the exercise of stock options outstanding under our Confer Technologies, Inc. 2013 Stock Plan as of December 31, 2017, at a weighted-average exercise price of $2.58 per share;



•

273,750 shares of common stock issuable upon the exercise of warrants outstanding as of December 31, 2017, at a weighted-average exercise price of $4.83 per share;



•

75,009 shares of common stock issuable upon the exercise of stock options granted after December 31, 2017 under our 2010 Series A Plan, at an exercise price of $9.37 per share;



•

1,804,105 shares of common stock issuable upon the exercise of stock options granted after December 31, 2017 under our 2012 Plan, at an exercise price of $7.46 per share;



•

885,823 shares of common stock issuable upon the exercise of stock options approved subsequent to March 31, 2018 by our board of directors for grant effective upon the pricing of this offering at an exercise price equal to the price to the public listed on the cover page of this prospectus;



•

394,500 shares of our common stock issuable from time to time after this offering upon the settlement of restricted stock units granted after December 31, 2017; and



•

6,270,650 shares of common stock reserved for future issuance under our 2018 Stock Option and Incentive Plan and 1,735,729 shares of common stock reserved for issuance under our 2018 Employee Stock Purchase Plan, each of which will become effective in connection with this offering and contains provisions that will automatically increase its shares reserved each year, as more fully described in "Executive Compensation—Employee Benefit Plans."

60

---

Table of Contents

DILUTION

        If you invest in our common stock in this offering, your ownership interest will be diluted immediately to the extent of the difference between the initial public offering price per share of our common stock and the pro forma as adjusted net tangible book value per share of our common stock immediately after this offering.

        Our historical net tangible book value (deficit) as of December 31, 2017 was $(392.4) million, or $(35.23) per share of our common stock. Our historical net tangible book value (deficit) is the amount of our total tangible assets, including deferred commissions, less our total liabilities and the carrying value of our preferred stock, which is not included within stockholders' equity (deficit). Historical net tangible book value (deficit) per share represents our historical net tangible book value (deficit) divided by the 11,139,690 shares of our common stock outstanding as of December 31, 2017.

        Our pro forma net tangible book value (deficit) as of December 31, 2017 was $(54.9) million, or $(0.96) per share of our common stock. Pro forma net tangible book value (deficit) represents the amount of our total tangible assets, including deferred commissions, less our total liabilities, after giving effect to: (1) the conversion of all outstanding shares of our preferred stock into 45,849,708 shares of common stock upon the closing of this offering; (2) the assumed exercise of the outstanding warrant held by SC US GF Holdings, Ltd., an entity affiliated with Sequoia Capital, to purchase 468,587 shares of our common stock, at an exercise price of $0.002 per share, that will become exercisable upon the closing of this offering; and (3) outstanding warrants to purchase preferred stock becoming warrants to purchase 167,500 shares of common stock upon the closing of this offering. Pro forma net tangible book value (deficit) per share represents our pro forma net tangible book value (deficit) divided by the total number of shares of our common stock outstanding as of December 31, 2017, after giving effect to pro forma adjustments (1) and (2) described above.

        After giving further effect to the sale by us of 8,000,000 shares of common stock in this offering at an assumed initial public offering price of $16.00 per share, which is the midpoint of the price range set forth on the cover page of this prospectus, and after deducting estimated underwriting discounts and commissions and estimated offering expenses payable by us, our pro forma as adjusted net tangible book value as of December 31, 2017 would have been $61.4 million, or $0.94 per share. This represents an immediate increase in pro forma as adjusted net tangible book value of $1.90 per share to our existing stockholders and immediate dilution of $15.06 per share in pro forma as adjusted net tangible book value per share to new investors purchasing shares of common stock in this offering. Dilution per share to new investors is determined by subtracting pro forma as adjusted net tangible book value per share after this offering from the assumed initial public offering price per share paid by new investors. The following table illustrates this dilution on a per share basis:

        The dilution information discussed above is illustrative only and will change based on the actual initial public offering price and other terms of this offering determined at pricing. A $1.00 increase (decrease) in the assumed initial public offering price of $16.00 per share, which is the midpoint of the price range set forth on the cover page of this prospectus, would increase (decrease) our pro forma as adjusted net

61

---

Table of Contents

tangible book value by $7.4 million, our pro forma as adjusted net tangible book value per share after this offering by $0.11 and dilution per share to new investors purchasing shares in this offering by $0.89, assuming that the number of shares offered by us, as set forth on the cover page of this prospectus, remains the same and after deducting estimated underwriting discounts and commissions and estimated offering expenses payable by us. An increase of 1,000,000 shares in the number of shares of common stock offered by us, as set forth on the cover page of this prospectus, would increase the pro forma as adjusted net tangible book value per share after this offering by $0.21 and decrease the dilution per share to new investors purchasing shares in this offering by $0.21, assuming no change in the assumed initial public offering price and after deducting estimated underwriting discounts and commissions and estimated offering expenses payable by us. A decrease of 1,000,000 shares in the number of shares of common stock offered by us, as set forth on the cover page of this prospectus, would decrease the pro forma as adjusted net tangible book value per share after this offering by $0.22 and increase the dilution per share to new investors purchasing shares in this offering by $0.22, assuming no change in the assumed initial public offering price and after deducting estimated underwriting discounts and commissions and estimated offering expenses payable by us.

        If the underwriters' over-allotment option to purchase additional shares from us is exercised in full, our pro forma as adjusted net tangible book value per share after this offering would be $1.19 per share, representing an immediate increase in pro forma as adjusted net tangible book value per share of $2.15 to existing stockholders and immediate dilution of $14.81 per share to new investors purchasing shares in this offering, assuming an initial public offering price of $16.00 per share, which is the midpoint of the price range set forth on the cover page of this prospectus, and after deducting estimated underwriting discounts and commissions and estimated offering expenses payable by us.

        The following table summarizes, on the pro forma as adjusted basis described above, the number of shares of our common stock, the total consideration and the average price per share (1) paid to us by existing stockholders and (2) to be paid by new investors purchasing shares of common stock in this offering at an assumed initial public offering price of $16.00 per share, which is the midpoint of the price range set forth on the cover page of this prospectus, before deducting estimated underwriting discounts and commissions and estimated offering expenses payable by us:

        A $1.00 increase (decrease) in the assumed initial public offering price of $16.00 per share, which is the midpoint of the price range set forth on the cover page of this prospectus, would increase (decrease) the total consideration paid by new investors by $8.0 million and, in the case of an increase, would increase the percentage of total consideration paid by new investors by 1.5% and, in the case of a decrease, would decrease the percentage of total consideration paid by new investors by 1.6%, assuming that the number of shares offered by us, as set forth on the cover page of this prospectus, remains the same. An increase (decrease) of 1,000,000 shares in the number of shares offered by us, as set forth on the cover page of this prospectus, would increase (decrease) the total consideration paid by new investors by $16.0 million and, in the case of an increase, would increase the percentage of total consideration paid by new investors by 2.9% and, in the case of an decrease, would decrease the percentage of total consideration paid by new investors by 3.2%, assuming no change in the initial public offering price.

        The table above assumes no exercise of the underwriters' over-allotment option to purchase additional shares in this offering. If the underwriters' over-allotment option to purchase additional shares from us is exercised in full, the number of shares of our common stock held by existing stockholders would

62

---

Table of Contents

be reduced to 86.2% of the total number of shares of our common stock outstanding after this offering, and the number of shares of common stock held by new investors purchasing shares in this offering would be increased to 13.8% of the total number of shares of our common stock outstanding after this offering.

        The table above does not include:

•

1,800,965 shares of common stock issuable upon the exercise of stock options outstanding under our Amended and Restated 2010 Series A Option Plan, or the 2010 Series A Plan, as of December 31, 2017, at a weighted-average exercise price of $2.56 per share;



•

117,928 shares of common stock issuable upon the exercise of stock options outstanding under our Amended and Restated Equity Incentive Plan as of December 31, 2017, at a weighted-average exercise price of $1.18 per share;



•

13,609,936 shares of common stock issuable upon the exercise of stock options outstanding under our 2012 Stock Option and Grant Plan as of December 31, 2017, at a weighted-average exercise price of $4.99 per share;



•

837,835 shares of common stock issuable upon the exercise of stock options outstanding under our Carbon Black, Inc. Amended and Restated 2012 Equity Incentive Plan as of December 31, 2017, at a weighted-average exercise price of $0.86 per share;



•

455,357 shares of common stock issuable upon the exercise of stock options outstanding under our Confer Technologies, Inc. 2013 Stock Plan as of December 31, 2017, at a weighted-average exercise price of $2.58 per share;



•

273,750 shares of common stock issuable upon the exercise of warrants outstanding as of December 31, 2017, at a weighted-average exercise price of $4.83 per share;



•

75,009 shares of common stock issuable upon the exercise of stock options granted after December 31, 2017 under our 2010 Series A Plan, at an exercise price of $9.37 per share;



•

1,804,105 shares of common stock issuable upon the exercise of stock options granted after December 31, 2017 under our 2012 Plan, at an exercise price of $7.46 per share;



•

885,823 shares of common stock issuable upon the exercise of stock options approved subsequent to March 31, 2018 by our board of directors for grant effective upon the pricing of this offering at an exercise price equal to the price to the public listed on the cover page of this prospectus;



•

394,500 shares of our common stock issuable from time to time after this offering upon the settlement of restricted stock units granted after December 31, 2017; and



•

6,270,650 shares of common stock reserved for future issuance under our 2018 Stock Option and Incentive Plan and 1,735,729 shares of common stock reserved for issuance under our 2018 Employee Stock Purchase Plan, each of which will become effective in connection with this offering and contains provisions that will automatically increase its shares reserved each year, as more fully described in "Executive Compensation—Employee Benefit Plans."

        To the extent that outstanding options or warrants are exercised you will experience further dilution, which may be significant. In addition, we may choose to raise additional capital due to market conditions or strategic considerations, even if we believe we have sufficient funds for our current or future operating plans. To the extent that additional capital is raised through the sale of equity or convertible debt securities, the issuance of these securities may result in further dilution to our stockholders.

63

---

Table of Contents

SELECTED CONSOLIDATED FINANCIAL DATA

        The following tables present selected consolidated financial data for the periods indicated. You should read this information in conjunction with the section titled "Management's Discussion and Analysis of Financial Condition and Results of Operations" and our consolidated financial statements and related notes and other information included elsewhere in this prospectus. The selected consolidated financial data in this section are not intended to replace the consolidated financial statements and are qualified in their entirety by our consolidated financial statements and related notes appearing at the end of this prospectus. We have derived the selected consolidated statement of operations data for the years ended December 31, 2015, 2016 and 2017 and the selected consolidated balance sheet data as of December 31, 2016 and 2017 from our audited consolidated financial statements appearing at the end of this prospectus. Our historical results are not necessarily indicative of the results to be expected in any future period.

64

---

Table of Contents

---

(1)

The following table summarizes the classification of stock-based compensation expense in our consolidated statements of operations:

(2)

See Note 18 to our consolidated financial statements appearing at the end of this prospectus for further details on the calculations of basic and diluted net loss per share attributable to common stockholders and basic and diluted pro forma net loss per share attributable to common stockholders.

---

(1)

We define working capital (deficit) as current assets less current liabilities.

65

---

Table of Contents

MANAGEMENT'S DISCUSSION AND ANALYSIS OF
FINANCIAL CONDITION AND RESULTS OF OPERATIONS

        You should read the following discussion and analysis of our financial condition and results of operations in conjunction with the section titled "Selected Consolidated Financial Data" and our consolidated financial statements and related notes included elsewhere in this prospectus. In addition to historical consolidated financial information, the following discussion and analysis and information set forth elsewhere in this prospectus contain forward-looking statements that involve risks, uncertainties and assumptions. Our actual results could differ materially from those anticipated by these forward-looking statements as a result of many factors. We discuss factors that we believe could cause or contribute to these differences below and elsewhere in this prospectus, including those set forth under "Risk Factors" and "Special Note Regarding Forward-Looking Statements."

Overview

        Carbon Black is a leading provider of next-generation endpoint security solutions. We believe the depth, breadth and real-time nature of our endpoint data, combined with the strength of our analytics platform, provides customers with the most robust and data-intensive solution to address the complete endpoint security lifecycle. Our solutions enable customers to predict, prevent, detect, respond to and remediate cyber attacks before they cause a damaging incident or data breach.

        Enterprise environments have become more open, interconnected and vulnerable to cyber attacks, and an increasingly mobile workforce and the explosion of enterprise data and applications in the cloud have expanded the attack surface beyond the traditional network perimeter. As a result, the endpoint is the new perimeter and the primary focus of cyber attacks. Endpoints store valuable data, perform critical operations and are the interface where attackers can target humans through email, social engineering, and other tactics. Endpoints include desktops, laptops, servers, virtual machines, cloud workloads (services running on cloud servers), fixed-function devices such as ATMs, point of sale systems, and control and data systems for power plants and other industrial assets.

        We offer organizations solutions that enable them to address the full endpoint security lifecycle of an endpoint and integrate endpoint security within their cyber security architecture. Unlike legacy security products that install an agent and collect data specific to its domain or use case, our platform provides a single agent that continuously collects unfiltered endpoint data to address a wide array of security use cases that today are addressed by multiple point products.

        We have a strong heritage of innovative technology leadership in multiple endpoint security categories: application control, through our Cb Protection solution; endpoint detection and response, or EDR, through our Cb Response solution; and next-generation antivirus, or NGAV, through our Cb Defense solution.

        We began selling our initial product in 2005, which was the precursor to Cb Protection. Our initial product focused on delivering endpoint protection for desktops and servers through application control. In February 2014, we acquired Carbon Black, whose solution was the precursor to Cb Response. In 2015, we acquired Objective Logistics Inc., or Objective Logistics, and VisiTrend, Inc., or VisiTrend, primarily to acquire the technical expertise of their employees and certain intellectual property assets. The acquisition of Carbon Black strengthened our position as a leader in advanced threat detection and incident response management solutions, and was an important event for us as it enabled us to provide our customers with solutions designed to address the full endpoint security lifecycle. We believe that our ability to address the full lifecycle of an attack is a critical differentiator versus other endpoint security technologies that address only a portion of the attack lifecycle.

        In more recent periods, we have focused on satisfying the increasing demand for cloud-based software from our customers and prospects and intend to continue to expand our cloud-based product offerings. In

66

---

Table of Contents

August 2015, we released a cloud-based version of Cb Response to our customers under a software-as-a-service, or SaaS, model. In June 2016, we acquired Confer Technologies, Inc., or Confer, whose solution is currently sold to customers as Cb Defense. The acquisition of Confer was an important event for us as it added key capabilities in the areas of cloud-based, multi-tenant, big-data processing and streaming detection and prevention. With this acquisition, we also entered the next-generation antivirus market. The technology that we acquired in this acquisition is foundational to our predictive security cloud platform, which is designed to address the full endpoint security lifecycle, and to our strategy. For more information regarding the Confer, Objective Logistics and VisiTrend acquisitions, see Note 3 to our consolidated financial statements appearing at the end of this prospectus. The percentage of our total revenue generated by sales of our cloud-based solutions was negligible in 2015, 6% in 2016 and 16% in 2017. We have experienced strong growth in the number of customers who purchase our cloud-based solutions, with 49 customers in 2015, 398 customers in 2016 and 1,605 customers in 2017 purchasing our cloud-based solutions.

        A substantial majority of our customers purchase our solutions under a subscription agreement with a term of one or three years. The percentage of our customers that purchased our solutions under a subscription agreement with a term of one or three years was 87%, 92% and 96% as of December 31, 2015, 2016 and 2017, respectively. Our subscription agreements include: access to and the right to utilize the threat intelligence capabilities of the Cb Predictive Security Cloud; ongoing support, which provides our customers with telephone and web-based support, bug fixes and repairs; and software updates on a when-and-if-available basis. Less often, some customers purchase our solutions under a perpetual license with an associated maintenance and support agreement, along with access to the Cb Predictive Security Cloud. Revenue from our subscription agreements, as well as revenue from a perpetual license that is sold with access to the Cb Predictive Security Cloud, a maintenance and support agreement, professional services or training, is deferred on our balance sheet and subsequently recognized ratably over the longest service period of any deliverable in the arrangement, which is generally the support term, beginning once all services in the arrangement have commenced. Revenue from perpetual licenses represented less than 5% of our $149.3 million of subscription, license and support revenue in 2017. Due to our revenue recognition model, all of our subscription, license and support revenue is recognized on a ratable basis, providing us with strong visibility into future revenue.

        We primarily sell our products through a channel partner go-to-market model, which significantly extends our global market reach and ability to rapidly scale our sales efforts. Our inside sales and field sales representatives work alongside an extensive network of value-added resellers, or VARs, distributors, managed security service providers, or MSSPs, and incident response, or IR, firms. Our MSSP and IR firm channel partners both use and recommend our products to their clients. We have established significant relationships with leading channel partners, including Optiv Security, Inc., a leading VAR and MSSP; CDW Corporation, one of the world's largest software VARs; Arrow Electronics, Inc., a major global distributor; SecureWorks, Inc., a leading MSSP; and Kroll, a leading IR firm. In addition, we have technology and go-to-market partnerships with both IBM and VMware, enabling us to leverage their sales organizations to reach their large customer bases. In the three months ended December 31, 2017, 94% of our new and add-on business was closed in collaboration with a channel partner. We expect to continue to focus on generating sales to new and existing customers through our channel partners as a part of our growth strategy. When we transact with a channel partner, our contractual arrangement is with the channel partner and not with the end-use customer. However, whether we receive the order from a channel partner or directly from an end-use customer, our revenue recognition policy and resulting pattern of revenue recognition for the order are the same.

        Our sales team works closely with our end-use customer prospects at every stage of the sales cycle regardless of whether the prospect is sourced directly or indirectly—from initial information meetings through the implementation of our products with our end-use customers. We believe this coordinated

67

---

Table of Contents

approach to sales allows us to leverage the benefits of channel partners as well as maintain face-to-face connectivity and build long-term, trusted relationships with our customers.

        Our customers include many of the world's largest, security-focused enterprises and government agencies that are among the most heavily targeted by cyber adversaries, as well as mid-sized organizations. As of December 31, 2017, we serve over 3,700 customers globally across multiple industries, including 33 of the Fortune 100.

        We have experienced strong revenue growth, with revenue increasing from $70.6 million in 2015 to $116.2 million in 2016 and $162.0 million in 2017, representing a 51% compound annual growth rate over the same period. We have a subscription-based revenue model that provides visibility into future revenue. Recurring revenue represented 77%, 83% and 88% of our total revenue in 2015, 2016 and 2017, respectively. Annual recurring revenue, or ARR, was $76.8 million, $124.2 million and $174.2 million as of December 31, 2015, 2016 and 2017, respectively. We define ARR as the annualized value of all active subscription contracts as of the end of the period. ARR excludes revenue from perpetual licenses and services. The portion of ARR related to our cloud-based subscription contracts was $2.5 million, $15.1 million and $46.0 million as of December 31, 2015, 2016 and 2017, respectively. The percentage of our total recurring revenue generated by sales of our cloud-based solutions was negligible in 2015, 7% in 2016 and 18% in 2017. We incurred net losses of $38.7 million in 2015, $44.6 million in 2016 and $55.8 million in 2017 as we continued to invest for growth to address the large market opportunity for our platform.

        We believe that the growth of our business and our operating results will be dependent upon many factors, including our ability to capitalize on the market shift from legacy prevention offerings to next-generation endpoint security solutions, our success in growing our customer base and expanding deployments of our platform within existing customers, our ability to enhance our platform and product offerings, and our focus on maintaining strong retention rates. While these areas present significant opportunities for us, they also pose challenges and risks that we must successfully address in order to sustain the growth of our business and improve our operating results.

        We have experienced rapid growth and increased demand for our products over the last few years. To manage any future growth effectively, we must continue to improve and expand our information technology and financial infrastructure, our operating and administrative systems and controls, and our ability to manage headcount, capital and processes in an efficient manner. Additionally, we face intense competition in our market, and to succeed, we need to innovate and offer products that are differentiated from legacy antivirus products, established network security products and point solutions provided by smaller security providers. We must also effectively hire, retain, train and motivate qualified personnel and senior management. If we are unable to successfully address these challenges, our business, operating results and prospects could be adversely affected. Our marketing is focused on building our brand reputation, increasing market awareness of our platform, driving customer demand and a strong sales pipeline, and collaborating with our channel partners around the globe.

Cohort Contribution Margin Analysis

        To provide a further understanding of the economics of our customer relationships, we are providing a contribution margin analysis of the customers we acquired during 2015, which we refer to as the 2015 Cohort. We believe the 2015 Cohort is a fair representation of our overall customer base because it includes customers across industries and geographies and includes customers who have expanded their subscriptions as well as those who have reduced or not renewed their subscriptions. We define cohort contribution margin as the ARR of subscription commitments from the customer cohort at the end of the period less the associated cost of subscription, license and support and the estimated allocated sales and marketing expense, which we collectively refer to as associated costs. We define contribution margin percentage as cohort contribution margin divided by the ARR associated with such cohort in a given

68

---

Table of Contents

period. In this analysis, we exclude revenue from perpetual licenses and services for purposes of calculating ARR for the 2015 Cohort. Cohort contribution margin is not prepared in accordance with generally accepted accounting principles in the United States, or GAAP, as it utilizes ARR, which is an operational measure.

        Cohort contribution margin is an operational measure; it is not a financial measure of profitability and is not intended to be used as a proxy for the profitability of our business, nor does it imply profitability. We have not yet achieved profitability, and even if our ARR exceeds our associated costs over time, we may not be able to achieve or maintain profitability. The relationship of ARR to associated costs is not necessarily indicative of future performance, and we cannot predict whether future cohort contribution margin analyses will be similar to the analysis below. Other companies may calculate cohort contribution margin differently and, therefore, the analyses of other companies may not be directly comparable to ours.

        The associated cost of subscription, license and support primarily includes hosting costs, personnel-related costs for employees providing technical support (including compensation and benefits), allocated overhead and amortization of capitalized software development costs for internal-use software, in each case, relating to our subscription, license and support revenue. We allocate a portion of the cost of subscription, license and support to the ARR in each period using our reported subscription, license and support gross margin, excluding stock-based compensation and amortization of acquired intangible assets, each of which is a non-cash charge. Estimated allocated sales and marketing expense includes personnel-related costs for our sales and marketing teams (including salaries, benefits and amortization of deferred commissions) and costs of marketing activities and promotional events associated with our efforts to increase ARR through acquiring new customers, expanding subscriptions of existing customers or retaining existing ARR through subscription renewals. We attribute estimated allocated sales and marketing expense for new ARR to the period when a new customer begins a subscription or when an existing customer expands its subscription with us. We allocate costs associated with renewals of ARR to the renewal period. We allocate a portion of our sales and marketing expenses to the ARR in each period using our reported sales and marketing expense, excluding stock-based compensation and amortization of acquired intangible assets, each of which is a non-cash charge, and to new and existing customers based on the new ARR generated from each group. The associated costs do not include research and development and general and administrative expenses because these expenses support the growth of our business broadly and benefit all customers.

        The estimated allocated sales and marketing expense associated with acquiring the initial ARR from a customer cohort is significant in the period in which the cohort begins their subscriptions with us and, consequently, the cohort contribution margin is low, and may be negative, in that period. In subsequent periods, contribution margin increases meaningfully because the acquisition costs associated with expanding the ARR of the cohort, as well as the costs to support the cohort and renew their subscriptions, are low relative to the ARR of the cohort.

        At the end of 2015, the 2015 Cohort accounted for $28.2 million in ARR and $30.9 million in associated costs, representing a cohort contribution margin of $(2.7) million, or a contribution margin percentage of (9)%. At the end of 2016, the 2015 Cohort accounted for $32.0 million in ARR and $10.0 million in associated costs, representing a cohort contribution margin of $22.0 million, or a contribution margin percentage of 69%. At the end of 2017, the 2015 Cohort accounted for $32.7 million in ARR and $7.5 million in associated costs, representing a cohort contribution margin of $25.2 million, or a contribution margin percentage of 77%. These metrics are illustrated in the chart below.

69

---

Table of Contents

        We believe that our cohort contribution margin analysis demonstrates the powerful customer economics of our business. With our historically high retention rates and high gross margin, we have been able to increase our cohort contribution margin and enhance the value of our customer relationships over time.

        The 2015 Cohort may not be representative of any other group of customers or periods. We expect that the cohort contribution margin and contribution margin percentage of our customer cohorts will fluctuate from one period to another depending upon the number of customers remaining in each cohort, our ability to increase their ARR, other changes in their subscriptions, as well as changes in our associated costs. We may not experience similar financial outcomes from future customers. We do not have consistent corresponding information for prior historical periods that would allow us to present additional historical cohorts, and the ARR, associated costs, cohort contribution margins and contribution margin percentages from such cohorts could vary.

Key Factors Affecting Our Performance

        Our historical financial performance has been, and we expect our financial performance in the future to be, primarily driven by the following factors:

        Market Adoption.    We believe our future success will depend in large part on the growth in the market for next-generation endpoint security. Because network-centric security is no longer adequate, organizations must focus on securing the endpoint. However, while organizations have made significant investments in upgrading to advanced network security solutions, the majority of endpoint security technology in use today relies on multiple agents and uses the same ineffective, traditional signature-based antivirus software originally designed more than 20 years ago. As a result, organizations are increasingly shifting their security budgets toward next-generation endpoint security solutions. We believe that we are well positioned as a market leader to capitalize on this investment cycle and that our ability to address the full lifecycle of a cyber attack will help to drive our market adoption. Additionally, the number of security professionals has not kept pace with total demand. As the number of threats multiplies, legacy solutions either miss threats or produce more alerts than security teams are able to process and investigate. Organizations are increasingly turning to next-generation solutions, advanced analytics and automation tools to empower their security professionals to increase their efficiency and focus on the highest value cyber security tasks, thereby reducing the need for additional security headcount. Organizations are also addressing the talent gap by relying more on security-focused VARs and trusted partners to augment their internal teams of security experts.

70

---

Table of Contents

        Add New Customers.    Our ability to add new customers is a key indicator of our increasing market adoption and future revenue potential. Our customer count, which includes both direct sale customers and customers with one or more subscriptions to our platform through channel partners, grew from 1,774 in 2015, to 2,516 in 2016, and to 3,739 in 2017, representing year-over-year increases of 42% in 2016 and 49% in 2017. The number of our direct sale customers decreased from 354 in 2015, to 316 in 2016, and to 267 in 2017. The number of our customers with one or more subscriptions to our platform through channel partners increased from 1,420 in 2015, to 2,200 in 2016, and to 3,472 in 2017. We expect this trend to continue in future periods as we focus on adding new customers and renewing existing customers through our channel partners. We are focused on continuing to grow our customer base. We have continuously enhanced our endpoint security platform and product offerings, and we have expanded both our domestic and international sales force to drive new customer acquisition. However, our ability to continue to grow our customer base is dependent on a number of factors, including our ability to compete within the increasingly competitive markets in which we participate.

        Maintain Strong Retention Rates.    An important component of our revenue growth strategy is to have our existing customers renew their agreements with us. To assess our performance against this objective, we monitor the retention rate of our existing customers. We calculate retention rate by comparing the annual recurring subscription and support revenue from our customers at the beginning of a measurement period to the annual recurring subscription and support revenue from those same customers at the end of a measurement period. We divide the ending annual recurring revenue by the beginning annual recurring revenue to arrive at our retention rate metric. We exclude the impact of any add-on purchases from these customers during the measurement period; accordingly, our retention rate cannot exceed 100%. In addition, the metric reflects the loss of customers who elected not to renew contracts expiring during the measurement period. Our retention rate was 93% in 2015, 92% in 2016 and 93% in 2017.

        Increase Sales to Existing Customers.    Our current customer base provides us with a significant opportunity to drive incremental sales. Our extensible platform allows us to develop new solutions rapidly and at lower cost over time. As we develop and deploy additional security offerings on the Cb Predictive Security Cloud platform, we see significant additional opportunity to cross-sell as customers benefit by addressing multiple security requirements through a single platform. Our ability to increase sales to existing customers will depend on a number of factors, including customers' satisfaction or dissatisfaction with our solutions, our ability to develop new products, pricing, economic conditions or overall reductions in our customers' spending levels.

        Invest in Growth.    We will continue to focus on long-term revenue growth. We believe that our market opportunity is large and we will continue to invest significantly in sales and marketing to grow our customer base, both domestically and internationally. We also expect to continue to invest in research and development to enhance our technology platform and product functionality. In addition to our ongoing investment in research and development, we may also pursue acquisitions of businesses, technologies and assets that complement and expand the functionality of our products and services, expand the functionality of our solutions, add to our technology or security expertise, or bolster our leadership position by gaining access to new customers or markets.

71

---

Table of Contents

Key Metrics

        We regularly monitor a number of financial and operating metrics, including the following key metrics, in order to measure our current performance and estimate our future performance, as follows:

        Billings.    We define billings, a non-GAAP financial measure, as total revenue plus the change in deferred revenue during the period, excluding acquired deferred revenue. Our deferred revenue consists of amounts that have been invoiced to customers but that have not yet been recognized as revenue. Our deferred revenue balance primarily consists of the portion of products, support and professional services revenue that will be recognized ratably over the longest service period of any deliverable in the arrangement, which is generally the support term, beginning once all services in the arrangement have commenced.

        Most of our revenue is derived from subscriptions to our products with a duration of one or three years. For our subscription arrangements, we typically bill our customers the fee on an annual basis for the upcoming year. For 2017, we changed our policy to require customers with multi-year contract commitments to agree to multi-year upfront billing for the total contract fee. This policy change contributed to the 48% growth in total billings from 2016 to 2017. Beginning in 2018, we are reverting to our former policy and will offer customers who make a multi-year contract commitment the option to be billed the total contract fee upfront or to be billed on an annual basis. We expect that many customers who make a multi-year contract commitment will select to be billed on an annual basis, which could result in a lower growth rate for our billings in 2018 compared to 2017.

        Some of our revenue is also derived from perpetual licenses of our products along with a maintenance and support agreement. For our perpetual licenses, we bill our customers the entire license fee upon delivery of the software, and for support, we typically bill our customers the support fee on an annual basis for the upcoming year.

        For services sold on a fixed-price basis, we bill customers in advance. For services sold on a time-and-materials basis, we bill customers as such services are performed.

        We use billings as one factor to evaluate our business because billings is an important indicator of current period sales activity and provides visibility into corresponding future revenue growth due to our subscription-based revenue model. Accordingly, we believe that billings provides useful information to investors and others in understanding and evaluating our operating results in the same manner as our management. While we believe that billings is useful in evaluating our business, billings is a non-GAAP financial measure that has limitations as an analytical tool, and billings should not be considered as an alternative to, or substitute for, total revenue recognized in accordance with GAAP. In addition, other companies, including companies in our industry, may calculate billings differently or not at all, which reduces the usefulness of billings as a tool for comparison. We recommend that you review the

72

---

Table of Contents

reconciliation of billings to total revenue, the most directly comparable GAAP financial measure, provided below, and that you not rely on billings or any single financial measure to evaluate our business.

        Short-term billings.    We define short-term billings, a non-GAAP financial measure, as total revenue plus the change in current deferred revenue during the period, excluding acquired deferred revenue. We believe that short-term billings provides useful information to investors and others in evaluating our operating performance because it excludes the impact of upfront multi-year billings, which can vary from period to period depending on the timing of large, multi-year customer contracts and customer preferences for annual billing versus multi-year upfront billing. While we believe that short-term billings is useful in evaluating our business, short-term billings is a non-GAAP financial measure that has limitations as an analytical tool, and short-term billings should not be considered as an alternative to, or substitute for, total revenue recognized in accordance with GAAP. In addition, other companies, including companies in our industry, may calculate short-term billings differently or not at all, which reduces the usefulness of short-term billings as a tool for comparison. We recommend that you review the reconciliation of short-term billings to total revenue, the most directly comparable GAAP financial measure, provided below, and that you not rely on short-term billings or any single financial measure to evaluate our business.

        Recurring revenue.    We define recurring revenue, a non-GAAP financial measure, as subscription, license and support revenue (which includes revenue relating to support for perpetual licenses) less perpetual license revenue for the period. We use recurring revenue as one factor to evaluate our business because we believe that recurring revenue provides visibility into the revenue expected to be recognized in the current and future periods. Accordingly, we believe that recurring revenue provides useful information to investors and others in understanding and evaluating our operating results in the same manner as our management. While we believe that recurring revenue is useful in evaluating our business, recurring revenue is a non-GAAP financial measure that has limitations as an analytical tool, and recurring revenue should not be considered as an alternative to, or substitute for, subscription, license and support revenue recognized in accordance with GAAP. In addition, other companies, including companies in our industry, may calculate recurring revenue differently or not at all, which reduces the usefulness of recurring revenue as a tool for comparison. We recommend that you review the reconciliation of recurring revenue to subscription, license and support revenue, the most directly comparable GAAP financial measure,

73

---

Table of Contents

provided below, and that you not rely on recurring revenue or any single financial measure to evaluate our business.

        The percentage of our total recurring revenue generated by sales of our cloud-based solutions was negligible in 2015, 7% in 2016 and 18% in 2017.

        Free cash flow and free cash flow margin.    We define free cash flow, a non-GAAP financial measure, as net cash used in operating activities less purchases of property and equipment and capitalized internal-use software. We define free cash flow margin as free cash flow divided by total revenue. For the 2016 free cash flow calculation, we have also excluded the impact of the management incentive liability payment as this payment was not part of our core operating results. We monitor free cash flow as one measure of our overall business performance, which enables us to analyze our future performance without the effects of non-cash items and allow us to better understand the cash needs of our business. While we believe that free cash flow is useful in evaluating our business, free cash flow is a non-GAAP financial measure that has limitations as an analytical tool, and free cash flow should not be considered as an alternative to, or substitute for, net cash used in operating activities in accordance with GAAP. The utility of free cash flow as a measure of our liquidity is further limited as it does not represent the total increase or decrease in our cash balance for any given period. In addition, other companies, including companies in our industry, may calculate free cash flow differently or not at all, which reduces the usefulness of free cash flow as a tool for comparison. A summary of our cash flows from operating, investing and financing activities is provided below. We recommend that you review the reconciliation of free cash flow to net cash used in operating activities, the most directly comparable GAAP financial measure, and the reconciliation of free cash flow margin to net cash used in operating activities (as a percentage of revenue), the most directly comparable GAAP financial measure, provided below, and that you not rely on free cash flow, free cash flow margin or any single financial measure to evaluate our business.

74

---

Table of Contents

        Our policy change in 2017 to require customers with multi-year contract commitments to agree to multi-year upfront billing for the total contract fee contributed to the increase in free cash flow from 2016 to 2017. As discussed above, beginning in 2018, we are reverting to our former policy of offering customers who make multi-year contract commitments the option to be billed the total contract fee upfront or to be billed on an annual basis. We expect that many customers who make a multi-year contract commitment will select to be billed on an annual basis, which could result in less benefit to free cash flow in 2018 compared to 2017.

        Non-GAAP operating loss.    We define non-GAAP operating loss as loss from operations excluding stock-based compensation and amortization of acquired intangible assets. For the three months ended March 31, 2018, we will also exclude from non-GAAP operating loss the expense related to the payments we agreed to make in 2018 pursuant to a legal settlement. See "—Contractual Obligations and Commitments." We consider non-GAAP operating loss to be a useful metric for investors and other users of our financial information in evaluating our operating performance because it excludes the impact of stock-based compensation and amortization of acquired intangible assets, each of which is a non-cash charge that can vary from period to period for reasons that are unrelated to our core operating performance, and expense recorded by us pursuant to the legal settlement because it is a non-recurring item. While we believe that non-GAAP operating loss is useful in evaluating our business, non-GAAP operating loss is a non-GAAP financial measure that has limitations as an analytical tool, and non-GAAP operating loss should not be considered as an alternative to, or substitute for, loss from operations in accordance with GAAP. In addition, other companies, including companies in our industry, may calculate non-GAAP operating loss differently or not at all, which reduces the usefulness of non-GAAP operating loss as a tool for comparison. We recommend that you review the reconciliation of non-GAAP operating

75

---

Table of Contents

loss to loss from operations, the most directly comparable GAAP financial measure, provided below, and that you not rely on non-GAAP operating loss or any single financial measure to evaluate our business.

        Number of Customers.    We believe that the size of our customer base is an indicator of our market penetration and that net customer additions are an indicator of the growth of our business. We define our total customers at the end of a period as the number of organizations with one or more contractual agreements to use our solutions, either licensed directly by us or through a channel partner.

Components of Results of Operations

Revenue

        We generate revenue through relationships with channel partners and through our direct sales force primarily from three sources: (1) the sale of subscription (i.e., term-based) and perpetual licenses for software products along with access to and the right to utilize the threat intelligence capabilities of the Cb Predictive Security Cloud, as well as maintenance services and customer support, which we refer to collectively as support, (2) cloud-based SaaS subscriptions for access to our Cb Response and Cb Defense software products, and (3) professional services and training, which we refer to collectively as services.

Subscription, License and Support

        Our Cb Protection and Cb Response products are offered through subscription or perpetual software licenses, with a substantial majority of our customers selecting a subscription license. Subscription licenses include access to and the right to utilize the threat intelligence capabilities of the Cb Predictive Security Cloud as well as ongoing support, which provides our customers with telephone and web-based support, bug fixes and repairs and software updates on a when-and-if-available basis. Substantially all customers who purchase licenses on a perpetual basis also purchase an agreement for access to and the right to utilize the threat intelligence capabilities of the Cb Predictive Security Cloud. Revenue for both subscription licenses and perpetual licenses is deferred on our balance sheet and subsequently recognized as revenue ratably over the longest service period of any deliverable in the arrangement, which is generally the support term, beginning once all services in the arrangement have commenced.

        During 2015, we began offering our Cb Response product through cloud-based subscriptions. During 2016, we began offering our Cb Defense product, a cloud-based next-generation antivirus solution obtained through the acquisition of Confer. Revenue for cloud-based subscriptions is deferred on our balance sheet and subsequently recognized as revenue ratably over the term of the subscription.

        Our subscription and support agreements typically have one- or three-year terms. For multi-year arrangements, we typically bill on an annual basis. Prior to 2017, we typically billed multi-year arrangements on an annual basis. For 2017, we changed our policy to require customers with multi-year contract commitments to agree to multi-year upfront billing for the total contract fee. Beginning in 2018, we are reverting to our former policy and will offer customers who make a multi-year contract commitment the option to be billed the total contract fee upfront or to be billed on an annual basis.

76

---

Table of Contents

Services

        We generate services revenue from the sale of professional services related to deployment and training services. Customers primarily purchase our professional services together with our product offerings and, to a lesser extent, on a stand-alone basis. Revenue from professional services sold together with support is recognized ratably over the longest service period of any deliverable in the arrangement, beginning once all services in the arrangement have commenced. Revenue from services sold on a stand-alone basis is recognized as those services are rendered.

        As more customers select our cloud-based offerings, we expect customers to reduce their purchases of deployment services as our cloud-based offerings are typically easier to deploy. Accordingly, we expect our services revenue to increase in absolute dollars but decrease as a percentage of total revenue over time.

Cost of Revenue

        Our total cost of revenue consists of the costs of subscription, license and support revenue as well as the costs of services revenue.

Cost of Subscription, License and Support Revenue

        Cost of subscription, license and support revenue consists of hosting costs associated with our cloud-based offerings, personnel-related costs for our support personnel, including salaries, benefits, bonuses, payroll taxes, stock-based compensation and allocated overhead costs. Also included in cost of subscription, license and support revenue are costs associated with amortization of capitalized software development costs for internal-use software and amortization of developed technology intangible assets related to our prior acquisitions.

        We expect cost of subscription, license and support revenue to increase significantly on an absolute dollar basis in the near term due to the acceleration of our cloud-based offerings. We will incur additional personnel-related costs, including salaries, benefits, bonuses, payroll taxes, stock-based compensation and allocated overhead costs, for employees who support our cloud-based subscriptions and hosting services. The hosting costs for our cloud-based offerings will also increase as the number of customers who purchase our cloud-based offerings increases.

        We expect gross margin on our subscription, license and support revenue to continue to decline as more customer purchase our cloud-based offerings, but at a reduced rate as compared to the decline from 2016 to 2017.

Cost of Services Revenue

        Cost of services revenue consists of personnel-related costs for our professional services team, including salaries, benefits, bonuses, payroll taxes, stock-based compensation, travel expenses and allocated overhead costs. We recognize the costs of providing services when we incur them.

        We expect cost of services revenue to increase as we increase our sales.

Operating Expenses

        Operating expenses consist of sales and marketing, research and development, and general and administrative expenses.

Sales and Marketing Expense

        Sales and marketing expense consists of personnel-related costs for our sales and marketing teams, including salaries, benefits, amortization of deferred commissions, bonuses, payroll taxes, stock-based compensation and other related costs. Additional expenses include costs of marketing activities and

77

---

Table of Contents

promotional events, travel, amortization of trade name and customer relationship intangible assets related to our prior acquisitions, and allocated overhead costs. We capitalize commission costs that are incremental and directly related to the acquisition of customer agreements. Commissions are earned by our sales force and paid in full upon the receipt of customer orders, or bookings, for new and add-on arrangements or renewals. Commission costs are capitalized when earned and are amortized as an expense over the same period that the revenue is recognized for the related non-cancelable customer agreement in proportion to the recognition of the revenue.

        In addition to our field sales staff, we have a dedicated channel team that works with our field and inside sales organization to manage our relationships with channel partners and that works with our channel partners in winning end-use customers. As a result, our sales team works closely with our end-use customer prospects at every stage of the sales cycle regardless of whether the prospect is sourced directly or indirectly—from initial information meetings through the implementation of our products. This sales approach allows us to leverage the benefits of the channel while also building long-term, trusted relationships with our customers. Additionally, we believe this approach delivers the security expertise and support that leads to full realization of the benefits of our technology platform. In the three months ended December 31, 2017, 94% of our new and add-on business was closed in collaboration with our channel partners.

        We expect sales and marketing expense to increase on an absolute dollar basis in the near term as we continue to increase investments to drive our market adoption and revenue growth.

Research and Development Expense

        Research and development expense consists of personnel-related costs for our research and development team, including salaries, benefits, bonuses, payroll taxes, stock-based compensation and other related costs. Additional expenses include subcontracting for third-party engineering resources as well as allocated overhead costs.

        We expect research and development expense to increase on an absolute dollar basis in the near term as we continue to increase investments in our technology architecture and software platform.

General and Administrative Expense

        General and administrative expense consists of personnel-related costs for our executive, administrative, legal, human resources, security, finance and accounting personnel, including salaries, benefits, bonuses, payroll taxes, stock-based compensation and other related costs. Additional expenses include bad debt expense related to customer receivables, recruiting costs, professional fees, travel, insurance and allocated overhead costs.

        We expect general and administrative expense to increase on an absolute dollar basis in the near term as we continue to increase investments to support our anticipated growth and as a result of our becoming a public company.

Interest Expense, Net

        Interest expense, net consists of interest expense related to our outstanding debt obligations and the amortization of deferred financing costs and debt discount associated with such arrangements, as well as interest income related to our invested balances of cash and cash equivalents.

Other Income (Expense), Net

        Other income (expense), net consists primarily of gains and losses related to the revaluation of certain of our outstanding warrant liabilities at each reporting date, foreign currency transactions gains and losses and loss on extinguishment of debt.

78

---

Table of Contents

Income Taxes

        Since our inception in 2002, we have not recorded any U.S. federal or state income tax benefits for the net losses we have incurred in each year or for our earned research and development tax credits, due to our uncertainty of realizing a benefit from those items. Accordingly, we carry a valuation allowance against the full amount of our deferred tax assets. As of December 31, 2017, we had federal net operating loss carryforwards of $231.0 million, which begin to expire in 2023, and state net operating loss carryforwards of $153.8 million, which begin to expire in 2018. As of December 31, 2017, we also had federal and state research and development tax credit carryforwards of $4.2 million and $2.4 million, respectively, which begin to expire in 2026 and 2021, respectively. As of December 31, 2017, we had foreign net operating loss carryforwards of $4.7 million. Of this amount, carryforwards of $1.1 million expire in 2036 and carryforwards of $3.6 million do not expire. We recognized a benefit from income taxes in 2016 due to the release of a portion of our deferred tax asset valuation allowance in connection with our acquisition of Confer. We recognized a provision for income taxes in 2017 due primarily to foreign income taxes.

Results of Operations

        The following table sets forth our consolidated statements of operations in dollar amounts and as a percentage of revenue for the periods indicated:

79

---

Table of Contents

 

80

---

Table of Contents

Revenue

Comparison of the Years Ended December 31, 2017 and 2016

        Total revenue increased by $45.8 million in the year ended December 31, 2017 compared to the same period in 2016, primarily due to an increase of $44.5 million in our subscription, license and support revenue. Subscription, license and support revenue increased 42% in 2017 due to an increase in total customers and an increase in sales to existing customers. Of the $45.8 million increase in total revenue from 2016 to 2017, $27.2 million was due to additional sales to existing customers and $18.6 million was due to sales to new customers. The growth in total revenue was driven by sales of our Cb Response, Cb Protection and Cb Defense products, our increased sales representative capacity to meet the market demand and the expansion of our strategic relationships with channel partners. We added 1,223 net new customers in 2017. Revenue generated by sales of our cloud-based solutions increased from $6.5 million in the year ended December 31, 2016 to $26.0 million in the year ended December 31, 2017. Services revenue increased $1.3 million in the year ended December 31, 2017 compared to the same period in 2016 due to increased demand for deployment and training services.

Comparison of the Years Ended December 31, 2016 and 2015

        Total revenue increased by $45.6 million in the year ended December 31, 2016 compared to the same period in 2015, primarily due to an increase of $41.0 million in our subscription, license and support revenue. Subscription, license and support revenue increased 64% in 2016 due to an increase in total customers and an increase in sales to existing customers. Of the $45.6 million increase in total revenue from 2015 to 2016, $31.8 million was due to additional sales to existing customers and $13.8 million was due to sales to new customers. The growth in total revenue was primarily driven by sales of our Cb Response and Cb Protection products, our increased sales representative capacity to meet the market demand and the expansion of our strategic relationships with channel partners. We added 742 net new customers in 2016. Services revenue increased $4.6 million in the year ended December 31, 2016 compared to the same period in 2015 due to increased demand for deployment and training services.

81

---

Table of Contents

Cost of Revenue

Comparison of the Years Ended December 31, 2017 and 2016

        Total cost of revenue increased by $14.6 million in the year ended December 31, 2017 compared to the same period in 2016, primarily due to a $12.9 million increase in the cost of subscription, license and support revenue.

        The $12.9 million increase in cost of subscription, license and support revenue was primarily due to a $6.5 million increase in hosting costs primarily related to cloud-based subscriptions for our Cb Response and Cb Defense products and a $4.8 million increase in employee-related costs (including an increase of $0.2 million in stock-based compensation) resulting from an increase in our customer support and hosting headcount from 53 in 2016 to 97 in 2017. We also incurred a $0.4 million increase in amortization expense related to developed technology intangible assets acquired in the acquisition of Confer, a $0.4 million increase in outside services for contractors hired to augment our customer service staff, a $0.4 million increase in meeting and travel costs, a $0.2 million increase in allocated overhead costs, which was driven by both the increase in headcount and the overall increase in such costs on a year-over-year basis, and a $0.2 million increase in amortization expense related to capitalized internal-use software development costs.

        The $1.7 million increase in cost of services revenue was largely due to a $1.3 million increase in employee-related costs resulting from an increase in the headcount of our professional services team from 55 in 2016 to 64 in 2017, a $0.2 million increase in allocated overhead costs, which was driven by the increase in headcount and the overall increase in such costs on a year-over-year basis, a $0.1 million increase on outside services for contractors hired to augment our professional services staff and a $0.1 million increase in meeting and travel costs.

        Gross margin decreased from 2016 to 2017. We experienced a decrease in gross margin on our subscription, license and support revenue, which comprised 92% of total revenue in 2017 and 90% in 2016. This decrease was primarily due to increase in the number of customers purchasing our cloud-based subscription products during 2017 and the associated personnel and hosting costs. We expect gross margin on our subscription, license and support revenue to continue to decline as more customers purchase our cloud-based offerings. We also experienced a decline in gross margin on our services revenue, which was primarily due to the increase in employee-related costs.

82

---

Table of Contents

Comparison of the Years Ended December 31, 2016 and 2015

        Total cost of revenue increased by $7.7 million in the year ended December 31, 2016 compared to the same period in 2015, primarily due to a $6.8 million increase in cost of subscription, license and support revenue.

        The $6.8 million increase in cost of subscription, license and support revenue was due to a $2.8 million increase in employee-related costs (including an increase of $0.1 million in stock-based compensation) resulting from an increase in our customer support and hosting headcount from 28 in 2015 to 53 in 2016. We incurred a $2.5 million increase in hosting costs primarily related to cloud-based subscriptions for our Cb Response and Cb Defense products. We also incurred a $0.5 million increase in amortization expense related to developed technology intangible assets acquired in the acquisition of Confer, a $0.3 million increase in the cost of software subscriptions driven by the increase in headcount, a $0.1 million increase in amortization expense related to capitalized internal-use software development costs and a $0.6 million increase in allocated overhead costs, which was driven by both the increase in headcount and the overall increase in such costs on a year-over-year basis.

        The $0.9 million increase in cost of services revenue was largely due to a $1.3 million increase in employee-related costs resulting from an increase in the headcount of our professional services team from 45 in 2015 to 55 in 2016 to support our revenue growth and a $0.1 million increase in allocated overhead costs, which was driven by the increase in headcount and the overall increase in such costs on a year-over-year basis. These increases were offset by a $0.3 million decrease in outside contractors costs and a $0.2 million decrease in travel costs.

        Gross margin increased slightly from 2015 to 2016. We experienced a decrease in gross margin on our subscription, license and support revenue, which comprised 90% of total revenue in both 2015 and 2016. This decrease was primarily due to an increase in the number of customers purchasing our cloud-based subscription products during 2016 and the associated personnel and hosting costs. We expect gross margin on our subscription, license and support revenue to continue to decline as more customers purchase our cloud-based offerings. The impact of this decrease was offset by the increase in gross margin on our services revenue in 2016. The increase in gross margin on services revenue was due primarily to the slower growth in employee-related costs in 2016 compared to 2015.

Operating Expenses

Sales and Marketing

Comparison of the Years Ended December 31, 2017 and 2016

        Sales and marketing expense increased by $26.2 million in the year ended December 31, 2017 compared to the same period in 2016 as we continued to invest to support our current and anticipated revenue growth. This increase was primarily due to an increase of $19.8 million in employee-related costs, an increase of $4.5 million related to spending on marketing programs and corporate branding initiatives, an increase of $1.4 million in allocated overhead costs, which was driven by both the increase in headcount and the overall increase in such costs on a year-over-year basis, a $1.2 million increase in outside services for contractors hired to augment our sales and marketing staff, an increase of $0.9 million in meeting and travel costs, and an increase of $0.8 million related to the cost of software subscriptions and hosting

83

---

Table of Contents

services. These increases were offset by a $2.6 million decrease in amortization expense related to the customer relationship intangible assets acquired in the acquisition of Confer. The $19.8 million increase in employee-related costs was primarily due to a $15.6 million increase in compensation expense (including an increase of $0.8 million in stock-based compensation) resulting from an increase in sales, marketing and business development headcount from 343 in 2016 to 425 in 2017 and a $4.2 million increase in amortization of deferred commissions.

Comparison of the Years Ended December 31, 2016 and 2015

        Sales and marketing expense increased by $25.6 million in the year ended December 31, 2016 compared to the same period in 2015 as we continued to invest to support our current and anticipated revenue growth. This increase was primarily due to an increase of $17.2 million in employee-related costs, an increase of $2.6 million in amortization expense related to customer relationship intangible assets acquired in the acquisition of Confer, an increase of $1.5 million related to spending on marketing programs and corporate branding initiatives, an increase of $0.9 million related to the cost of software subscriptions and hosting services, an increase of $2.0 million in meeting and travel costs and an increase of $1.7 million in allocated overhead costs, which was driven by both the increase in headcount and the overall increase in such costs on year-over-year basis. These increases were offset by a $0.3 million decrease in outside contractors costs. The $17.2 million increase in employee-related costs was primarily due to a $14.8 million increase in compensation expense (including an increase of $0.9 million in stock-based compensation) resulting from an increase in sales, marketing and business development headcount from 218 in 2015 to 343 in 2016 and a $2.4 million increase in amortization of deferred commissions.

Research and Development

Comparison of the Years Ended December 31, 2017 and 2016

        Research and development expense increased by $15.6 million in the year ended December 31, 2017 compared to the same period in 2016 as we continued to invest in our technology architecture and software platform. This increase was primarily due to a $10.2 million increase in employee-related costs (including an increase of $0.5 million in stock-based compensation) resulting from an increase in the headcount of research and development personnel from 182 in 2016 to 233 in 2017. We also incurred a $2.4 million increase in allocated overhead costs, which was driven by both the increase in headcount and the overall increase in such costs on a year-over-year basis, a $1.6 million increase in hosting costs related to software development, a $1.0 million increase in event and travel costs as a result of the increase in headcount and more frequent product roadmap planning events, a $0.6 million increase in outside services for contractors hired to augment our research and development staff and a $0.3 million increase in subscription services costs related to threat research. Our capitalized internal-use software development costs were higher by $0.5 million in 2017 compared to 2016.

Comparison of the Years Ended December 31, 2016 and 2015

        Research and development expense increased by $12.5 million in the year ended December 31, 2016 compared to the same period in 2015, primarily due to a $9.9 million increase in employee-related costs (including an increase of $0.4 million in stock-based compensation) resulting from an increase in the headcount of research and development personnel from 112 in 2015 to 182 in 2016 to support our

84

---

Table of Contents

continued product and platform innovation. We also incurred a $0.7 million increase in hosting costs related to software development, a $0.5 million increase in expense related to software subscriptions associated with the increase in headcount, a $0.2 million increase in subscription services costs related to threat research, a $0.2 million increase in travel costs as a result of the increase in headcount and a $1.1 million increase in allocated overhead costs, which was driven by both the increase in headcount and the overall increase in such costs on a year-over-year basis. Our capitalized internal-use software development costs were lower by $0.2 million in 2016 compared to 2015 primarily due to the timing of development projects, most notably the cloud-based version of Cb Response, which was developed during 2015. These increases were partially offset by a $0.3 million decrease in costs of outside services for contractors hired to augment our software engineering efforts.

General and Administrative

Comparison of the Years Ended December 31, 2017 and 2016

        General and administrative expense decreased by $1.0 million in the year ended December 31, 2017 compared to the same period in 2016. The decrease was primarily due to decreases of $0.8 million in bad debt expense, $0.4 million in legal, audit and tax fees, $0.3 million in non-income taxes and fees, $0.2 million in outside service costs for contractors and $0.3 million in severance costs. These decreases were partially offset by a $0.4 million increase in employee-related costs (including an increase of $0.1 million in stock-based compensation) resulting from an increase in the headcount of general and administrative personnel from 88 in 2016 to 113 in 2017. We also incurred increases of $0.3 million in allocated overhead costs, which were driven by both the increase in headcount and the overall increase in such costs on a year-over-year basis, $0.2 million in software subscription costs and $0.1 million in travel costs.

Comparison of the Years Ended December 31, 2016 and 2015

        General and administrative expense increased by $8.9 million in the year ended December 31, 2016 compared to the same period in 2015. The increase was primarily due to a $5.5 million increase in employee-related costs (including an increase of $1.0 million in stock-based compensation) resulting from an increase in headcount of general and administrative personnel from 69 in 2015 to 88 in 2016 as we continued to invest in our senior leadership and finance, legal, security and human resources teams to support our growing business. We also incurred increases of $0.4 million in outside services costs for contractors hired to augment our staff capacity, $0.6 million in costs of software licenses, subscriptions and dues, $0.9 million in legal, audit and tax fees, $0.3 million in bad debt expense, $0.2 million in travel costs, $0.4 million in non-income taxes and fees and $0.6 million in allocated overhead costs, which was driven by both the increase in headcount and the overall increase in such costs on a year-over-year basis.

Interest Expense, Net

85

---

Table of Contents

Comparison of the Years Ended December 31, 2017 and 2016

        Interest expense, net decreased by $0.6 million in the year ended December 31, 2017 compared to the same period in 2016. The decrease was primarily due to the repayment of all principal amounts outstanding under the line of credit in April 2017.

Comparison of the Years Ended December 31, 2016 and 2015

        Interest expense, net decreased by $0.3 million in the year ended December 31, 2016 compared to the same period in 2015. The decrease was due to $0.1 million of lower interest expense as a result of our borrowing under the line of credit in September 2016 to repay the outstanding principal balance on the mezzanine term loan, which had a higher interest rate, and $0.2 million of higher interest income in 2016 compared to 2015 from higher invested cash balances.

Other Income (Expense), Net

Comparison of the Years Ended December 31, 2017 and 2016

        Other expense, net decreased by $0.1 million in the year ended December 31, 2017 compared to the same period in 2016, primarily due to a change in the amount of foreign currency transaction gains and losses, from a loss of $0.5 million in 2016 to a gain of $0.2 million in 2017, as well as no loss on extinguishment of debt in 2017, partially offset by a $0.8 million increase from 2016 to 2017 in the expense associated with the change in the fair value of our warrant liabilities.

Comparison of the Years Ended December 31, 2016 and 2015

        Other expense, net decreased by $0.6 million in the year ended December 31, 2016 compared to the same period in 2015, primarily due to a $0.9 million decrease from 2015 to 2016 in the expense associated with the change in the fair value of our warrant liabilities, offset by a $0.2 million increase in losses associated with foreign currency fluctuations from 2015 to 2016 as well as a $0.2 million loss on extinguishment of debt, which was recognized in 2016 upon the payoff and termination of the mezzanine term loan.

Benefit from (Provision for) Income Taxes

Comparison of the Years Ended December 31, 2017 and 2016

        The provision for income taxes was $0.1 million in the year ended December 31, 2017 compared to a benefit from income taxes of $2.2 million in the same period in 2016. The provision recognized in 2017 was due primarily to foreign income taxes. The benefit recognized in 2016 was due to the release of a portion of our deferred tax asset valuation in connection with the acquisition of Confer; otherwise, no other income tax benefit was recognized in 2017 or 2016 due to the uncertainty of realizing a benefit from our incurred losses for the periods.

Comparison of the Years Ended December 31, 2016 and 2015

        Benefit from income taxes was $2.2 million in the year ended December 31, 2016 compared to $0 in the same period in 2015. The benefit recognized in 2016 was due to the release of a portion of our deferred tax asset valuation allowance in connection with our acquisition of Confer; otherwise, no other income tax

86

---

Table of Contents

benefit was recognized in 2016 or 2015 due to the uncertainty of realizing a benefit from our incurred losses for the periods.

Quarterly Results of Operations

        The following table sets forth our unaudited quarterly consolidated balance sheet and statements of operations data as of and for each of the eight quarters in the period ended December 31, 2017. We have prepared the quarterly financial data on the same basis as the audited consolidated financial statements included in this prospectus. In our opinion, the quarterly financial data reflects all adjustments, consisting only of normal recurring adjustments, that we consider necessary for a fair statement of this data. This quarterly consolidated financial data should be read in conjunction with our consolidated financial statements and related notes appearing at the end of this prospectus. Our historical results are not necessarily indicative of the results to be expected in the future.

87

---

Table of Contents

        The sequential increases in our quarterly revenue have resulted primarily from increases in our number of new customers as well as increased revenue from existing customers as they expanded their use of our solutions.

        Total costs and expenses generally increased sequentially for the periods presented due primarily to the addition of personnel in connection with the expansion of our business and other related expenses to support our growth. We anticipate these expenses will continue to increase in future periods as we continue to focus on investing in the long-term growth of our business.

        Our quarterly operating results may fluctuate due to various factors affecting our performance.

Backlog

        We define backlog as contractually committed orders for our subscriptions and support services for which the associated revenue has not been recognized and the customer has not been invoiced. Amounts that have been invoiced but not yet recognized as revenue are reported as deferred revenue on our consolidated balance sheets and are not included in our calculation of backlog. As of December 31, 2016 and 2017, we had backlog of approximately $65.7 million and $40.7 million, respectively. The decrease in backlog was due largely to a change in our policy in 2017 that required customers with multi-year contract commitments to agree to multi-year upfront billing for the total contract fee. This policy resulted in more customers contracting with us for one-year term agreements during 2017. Of the amount of backlog as of December 31, 2017, we expect that approximately $33.2 million will be invoiced to customers within the following twelve months and will be initially recorded as deferred revenue.

Liquidity and Capital Resources

        We have funded our operations to date primarily with proceeds from the sale of preferred stock, convertible debt financings and borrowings under two loan and security agreements. As of December 31, 2017, we had cash and cash equivalents of $36.1 million, substantially all of which was on deposit or invested in the United States.

88

---

Table of Contents

        Since our inception, we have generated significant losses and expect to continue to generate losses for the foreseeable future. We believe that our existing cash and cash equivalents will be sufficient to meet our working capital expenditure requirements for at least the next 12 months. Our future capital requirements will depend on many factors, including our growth rate, our activities related to the acquisition of complementary businesses, technologies and assets, the timing and extent of spending to support research and development efforts, the expansion of sales and marketing activities, particularly internationally, and the introduction of new and enhanced products as we continue to innovate. In the event that additional financing is required from outside sources, we may be unable to raise the funds on acceptable terms, if at all. If we are unable to raise additional capital when desired, our business, operating results and financial condition could be adversely affected.

Sources of Funds

Line of Credit

        As of December 31, 2016, we were party to a senior loan and security agreement with Silicon Valley Bank, or the line of credit, which, as amended through that date, provided for maximum borrowings in one or more advances of an amount equal to the lesser of $10.0 million or 80% of eligible accounts receivable. Borrowings under the line of credit bore interest at Silicon Valley Bank's prime rate plus 1.50%, which was 5.25% as of December 31, 2016, and matured on March 29, 2017. In September 2016, we borrowed $5.5 million under the line of credit and used the proceeds to pay the outstanding $5.5 million principal balance on the mezzanine term loan, discussed below. As of December 31, 2016, the amount of outstanding principal under the line of credit was $5.5 million and additional borrowings available to us under the line of credit were $4.5 million.

        In March 2017, the line of credit was further amended to increase the maximum borrowings to $40.0 million, without consideration of our eligible accounts receivable. Borrowings under the amended line of credit accrue interest at Silicon Valley Bank's prime rate and may be repaid and reborrowed until March 21, 2020, when the line of credit expires and all outstanding amounts must be repaid. In April 2017, we repaid all amounts outstanding under the line of credit, totaling $5.5 million.

        Borrowings under the line of credit are collateralized by substantially all of our assets, excluding intellectual property. We are subject to various financial reporting requirements and financial covenants under the line of credit, including maintaining specified liquidity measurements. We were in compliance with all such covenants as of and for the years ended December 31, 2015, 2016 and 2017. In addition, there are negative covenants restricting our activities, including limitations on dispositions, mergers or acquisitions; encumbering intellectual property; incurring indebtedness or liens; paying dividends and redeeming or repurchasing capital stock; making certain investments; and engaging in certain other business transactions. The obligations under the line of credit are subject to acceleration upon the occurrence of specified events of default, including a material adverse change in our business, operations or financial or other condition.

Mezzanine Term Loan

        We were also previously party to a subordinated loan and security agreement with Silicon Valley Bank, or the mezzanine term loan, pursuant to which we had borrowed $6.0 million as of December 31, 2015. Borrowings under the agreement, as amended, accrued interest at a rate of 10% per annum. From January 1, 2016 through July 31, 2016, we made monthly interest-only payments. We commenced making monthly principal and interest payments on August 1, 2016. Borrowings under the mezzanine term loan were junior to borrowings under the line of credit. In September 2016, using borrowings from the line of credit, we repaid the outstanding principal balance of $5.5 million under the mezzanine term loan, which then terminated with no additional borrowings available to us.

89

---

Table of Contents

Uses of Funds

        Our historical uses of cash have consisted of cash used for operating activities, such as expansion of our sales and marketing operations, research and development activities and other working capital needs, and cash used for investing activities, including cash paid for business acquisitions and for purchases of property and equipment.

        The following table shows a summary of our cash flows for the years ended December 31, 2015, 2016 and 2017:

Operating Activities

        During the year ended December 31, 2017, operating activities used $7.7 million of cash, primarily resulting from our net loss of $55.8 million, partially offset by net cash provided by changes in our operating assets and liabilities of $31.6 million and non-cash charges of $16.5 million. Net cash provided by changes in our operating assets and liabilities consisted of a $50.8 million increase in deferred revenue and a $4.2 million increase in accrued expenses, both partially offset by a $16.9 million increase in accounts receivable, a $4.4 million increase in deferred commissions, a $0.9 million increase in prepaid expenses and other assets, a $0.7 million decrease in accounts payable, a $0.4 million decrease in deferred rent and a $0.1 million decrease in other long-term liabilities. The increases in deferred revenue and deferred commissions were due to increases in the number of customers and the amounts we billed for our products and services in 2017 compared to 2016. The increase in the amount billed contributed to the increase in deferred revenue as amounts billed for subscriptions, perpetual licenses, support and services are generally deferred on our balance sheet and subsequently recognized as revenue ratably over the longest service period of any deliverable in the arrangement. The increase in accounts receivable was due to the growth of our business in 2017 compared to 2016. The increases in accrued expenses and prepaid expenses and other assets resulted from our increased spending due to the growth of our business. The decrease in accounts payable was due to the timing of payments.

        During the year ended December 31, 2016, operating activities used $33.1 million of cash, primarily resulting from our net loss of $44.6 million and net cash used by changes in our operating assets and liabilities of $2.2 million, partially offset by non-cash charges of $13.7 million. Net cash used by changes in our operating assets and liabilities consisted primarily of a $13.8 million increase in accounts receivable, a $14.0 million decrease in management incentive plan liability, a $4.2 million increase in deferred commissions and a $2.6 million increase in prepaid expenses and other assets, all partially offset by a $27.8 million increase in deferred revenue, a $3.6 million increase in accrued expenses and a $1.0 million increase in accounts payable. The increase in accounts receivable was due to the growth of our business in 2016 compared to 2015. The increases in deferred revenue and deferred commissions were due to increases in the number of customers and the amounts we billed for our products and services in 2016 compared to 2015. The increase in the amount billed contributed to the increase in deferred revenue as amounts billed for subscriptions, perpetual licenses, support and services are generally deferred on our balance sheet and subsequently recognized as revenue ratably over the longest service period of any deliverable in the arrangement. The increases in accrued expenses, accounts payable and in prepaid expenses and other assets resulted from our increased spending due to the growth of our business. The decrease in the management incentive plan liability was due to a $14.0 million cash payment, in addition to

90

---

Table of Contents

our issuance of 960,900 shares of common stock with a fair value of $6.0 million, to settle the management incentive plan obligation. For more information regarding the settlement of the management incentive plan obligation, see Note 15 to our consolidated financial statements appearing at the end of this prospectus.

        During the year ended December 31, 2015, operating activities used $4.1 million of cash, primarily resulting from our net loss of $38.7 million, partially offset by net cash provided by changes in our operating assets and liabilities of $25.1 million and non-cash charges of $9.5 million. Net cash provided by changes in our operating assets and liabilities consisted primarily of a $28.2 million increase in deferred revenue, a $3.4 million increase in accrued expenses and a $4.1 million increase in deferred rent, all partially offset by a $7.6 million increase in accounts receivable, a $2.3 million increase in deferred commissions and a $1.2 million increase in prepaid expenses and other assets. The increases in deferred revenue and deferred commissions were due to an increase in the number of customers and in the amounts we billed for our products and services in 2015 compared to 2014. The increase in the amount billed contributed to the increase in deferred revenue as amounts billed for subscriptions, perpetual licenses, support and services are generally deferred on our balance sheet and subsequently recognized as revenue ratably over the longest service period of any deliverable in the arrangement. The increase in accounts receivable was due to the growth of our business in 2015 compared to 2014. The increases in accrued expenses and in prepaid expenses and other assets resulted from our increased spending due to the growth of our business. The increase in deferred rent was primarily due to $3.4 million in tenant improvement allowances received during 2015 in connection with the lease for our new office in Waltham, Massachusetts.

Investing Activities

        During the year ended December 31, 2017, investing activities used $6.1 million of cash, consisting of purchases of property and equipment of $5.2 million and capitalization of internal-use software costs of $0.9 million. The purchases of property and equipment in 2017 were primarily related to the growth of our headcount and the general expansion of our business.

        During the year ended December 31, 2016, investing activities provided $2.2 million of cash, consisting of net cash of $6.9 million received in connection with our acquisition of Confer, which we funded primarily by the issuance of shares of our preferred and common stock, and a decrease in restricted cash due to the release of $1.5 million by our financial institution, which no longer required us to maintain a certificate of deposit collateralizing a letter of credit issued as a security deposit in connection with our lease of our corporate office facilities, partially offset by purchases of property and equipment of $5.8 million and capitalization of internal-use software costs of $0.4 million. The purchases of property and equipment in 2016 were primarily related to the growth of our headcount and the general expansion of the business.

        During the year ended December 31, 2015, investing activities used $12.9 million of cash, consisting of purchases of property and equipment of $8.9 million, capitalization of internal-use software costs of $0.6 million, net cash paid in connection with business acquisitions of $2.0 million and an increase in restricted cash associated with the security deposit for our Waltham office lease of $1.3 million. Of the $8.9 million used in purchases of property and equipment, $5.4 million related to spending on leasehold improvements, furniture and fixtures in our new offices in Waltham, Massachusetts.

Financing Activities

        During the year ended December 31, 2017, financing activities used $1.7 million of cash, primarily resulting from payments of $5.6 million related to debt obligations, partially offset by proceeds of $3.9 million from the exercise of stock options.

91

---

Table of Contents

        During the year ended December 31, 2016, financing activities provided $15.4 million of cash, primarily resulting from net proceeds of $15.4 million from the issuance of preferred stock, proceeds of $5.5 million from borrowings on our line of credit and proceeds of $2.5 million from the exercise of stock options, partially offset by payments of $6.1 million related to debt obligations and $1.9 million of initial public offering costs. The $15.4 million from the issuance of preferred stock included $2.0 million received upon the exercise of a customer option in connection with our acquisition of Confer, which we were then obligated to remit to the former shareholders of Confer in accordance with the merger agreement.

        During the year ended December 31, 2015, financing activities provided $59.2 million of cash, primarily resulting from net proceeds of $55.8 million from the issuance of preferred stock, proceeds of $3.0 million from borrowings on our mezzanine term loan and proceeds of $0.6 million from the exercise of stock options.

Contractual Obligations and Commitments

        The following table summarizes our contractual obligations as of December 31, 2017 and the effect such obligations are expected to have on our liquidity and cash flows in future periods:

        On April 6, 2018, we agreed to make payments in 2018 totaling $3.9 million pursuant to a settlement agreement with a non-practicing entity that claimed we infringed upon certain patents held by such entity. Such payments, which we accrued in connection with the settlement, are not included in the table above. See Note 21 to our consolidated financial statements appearing at the end of this prospectus.

Critical Accounting Policies

        Our consolidated financial statements are prepared in accordance with GAAP. The preparation of our consolidated financial statements requires us to make estimates, assumptions and judgments that affect the reported amounts of assets, liabilities, revenue, costs and expenses. We base our estimates and assumptions on historical experience and other factors that we believe to be reasonable under the circumstances. We evaluate our estimates and assumptions on an ongoing basis. Our actual results may differ from these estimates. Our most critical accounting policies are summarized below. See Note 2 to our consolidated financial statements appearing at the end of this prospectus for a description of our other significant accounting policies.

Revenue Recognition

        We generate revenue through relationships with channel partners and through our direct sales force primarily from three sources: (1) the sale of subscription (i.e., term-based) and perpetual licenses for software products along with access to and the right to utilize the threat intelligence capabilities of the Cb Predictive Security Cloud, as well as maintenance services and customer support, which we refer to

92

---

Table of Contents

collectively as support, (2) cloud-based SaaS subscriptions for access to our Cb Response and Cb Defense software products, and (3) professional services and training, which we refer to collectively as services.

        We recognize revenue when all of the following criteria are met:

•

Persuasive evidence of an arrangement exists.  Binding agreements or purchase orders are generally evidence of an arrangement.



•

Delivery has occurred.  Delivery occurs (1) when the customer has been provided an access code that allows them to access and download the software product; (2) when the services are performed; or (3) when on-line training has been made available to the customer.



•

The sales price is fixed or determinable.  Fees are considered fixed or determinable when the fees are contractually agreed with the customer and when the payment terms of the transaction do not extend beyond our customary payment terms.



•

Collectibility is probable or reasonably assured.  Collectibility is deemed probable or reasonably assured based on review of a number of factors, including creditworthiness and customer payment history.

Subscription, License and Support Revenue

        Substantially all of our software arrangements are multiple-element arrangements that contain a combination of deliverables, including software licenses, cloud-based subscriptions, support, professional services and training. All of these elements are considered software elements, other than the cloud-based subscriptions, and, thus, are accounted for in accordance with GAAP for software revenue recognition. Cloud-based subscriptions are considered non-software elements.

        Our Cb Protection and Cb Response products are offered through subscription or perpetual software licenses, with a substantial majority of our customers selecting a subscription license. Subscription licenses include access to and the right to utilize the threat intelligence capabilities of the Cb Predictive Security Cloud as well as ongoing support, which provides our customers with telephone and web-based support, bug fixes and repairs and software updates on a when-and-if-available basis. The Cb Predictive Security Cloud automatically distributes real-time threat intelligence, such as detection algorithms, reputation scores and attack classifications, to our customers. Substantially all customers who purchase licenses on a perpetual basis also purchase an agreement for support and an agreement for access to and the right to utilize the threat intelligence capabilities of the Cb Predictive Security Cloud.

        The timing and pattern of revenue recognition varies by arrangement and is dependent on the combination of elements included in the arrangement. Generally, under the software revenue recognition guidance, arrangement consideration is allocated among the elements of a multiple-element arrangement using the residual method. Under the residual method, when vendor-specific objective evidence, or VSOE, of fair value exists for the undelivered elements in an arrangement, consideration is allocated to the undelivered elements based on VSOE of fair value of those elements, which is deferred, and the residual amount of the total arrangement fee is recognized as revenue upon delivery of the software, assuming all other revenue recognition criteria are met. If VSOE of the fair value of one or more of the undelivered elements does not exist, all revenues from the arrangement are deferred until delivery of all of the elements has occurred or until VSOE of the fair values of each of those undelivered elements can be established, whichever is earlier. We do not have VSOE of fair value for our software and support offerings and, therefore, we are unable to apply the residual method to substantially all of our arrangements. For these arrangements, the aggregate arrangement fee is deferred on our balance sheet and subsequently recognized as revenue ratably over the longest service period of any deliverable in the arrangement, which is generally the support term, beginning once all services in the arrangement have commenced, after delivery of the software. We provide customers with access to and the right to utilize the threat intelligence capabilities of the Cb Predictive Security Cloud upon delivery of our licensed software.

93

---

Table of Contents

        During 2015, we began offering our Cb Response product through cloud-based subscriptions. During 2016, we began offering our Cb Defense product, a cloud-based next-generation antivirus solution obtained through the acquisition of Confer. Under our Cb Response product cloud-based subscription arrangements, customers do not have the contractual right to take possession of the software at any time. Under our Cb Defense product cloud-based subscription arrangements, customers do not have the contractual right to take possession of the software at any time, nor is it feasible for customers to run the software on their own or with another third-party. With respect to these cloud-based subscription offerings sold on a stand-alone basis, we recognize revenue ratably over the term of the subscription delivery, assuming that the other criteria for revenue recognition are met.

        When a multiple-element arrangement includes both software elements and non-software elements, the total arrangement consideration is first allocated between the software elements and the non-software elements based on the selling price hierarchy, which includes (1) VSOE, if available, (2) third-party evidence, or TPE, if VSOE is not available or (3) best estimate of selling price, or BESP, if neither VSOE nor TPE is available. We have not been able to establish a selling price for any element using VSOE or TPE. We determine BESP by considering our overall pricing objectives and market conditions. Significant pricing practices taken into consideration include our discounting practices, the size and volume of our transactions, our price lists, our go-to-market strategy, historical standalone sales and contract prices. The determination of BESP is made in consultation with, and is approved by, our management. Our multiple-element arrangements can include a single non-software element, in which case the portion of the consideration allocated to the non-software element is recognized ratably over the service period of the non-software element, assuming all other criteria for revenue recognition have been met. The portion of the consideration allocated to software elements is recognized as described above.

Services Revenue

        We provide professional services to customers, primarily in the form of deployment, and training services. Services are typically sold together with licenses of our software products and, to a lesser extent, on a stand-alone basis. Services are priced separately and are not essential to the functionality of the software license. The professional services can be performed by a third party and have a history of consistent pricing by us. Professional services are sold as time-and-materials contracts based on the number of hours worked and at contractually agreed-upon hourly rates, and on a fixed-fee basis. Revenue from professional services and training sold on a stand-alone basis is recognized as those services are rendered.

        We have established VSOE of fair value for professional services based on an analysis of the stand-alone selling prices of the services. While professional services meet the conditions to qualify as a separate element for revenue recognition, when professional services are included in an arrangement that also includes support, revenue from the entire arrangement is recognized ratably over the longest service period of any deliverable in the arrangement, beginning once all services in the arrangement have commenced because we do not have VSOE of fair value for support.

        Our employees may incur out-of-pocket expenses when providing services to customers that are reimbursable from the customer under the terms of the service contract. We bill any out-of-pocket expenses incurred in the performance of these services to the customer. The expenses are classified on a gross basis as revenue and costs of revenue in our consolidated statements of operations. Our determination of a gross presentation is based on an assessment of the relevant facts and circumstances, including the fact that our customers, instead of us, benefit from the expenditures and we bear the credit risk of the reimbursement until we receive reimbursement from the customer.

94

---

Table of Contents

Channel Partners

        A substantial majority of our revenue is generated by sales in conjunction with our channel partners, such as VARs, MSSPs and IR firms. When we transact with a channel partner, our contractual arrangement is with the channel partner and not with the end-use customer. Whether we transact business with and receive the order from a channel partner or directly from an end-use customer, our revenue recognition policy and resulting pattern of revenue recognition for the order are the same.

        In our business with VARs, we enter into a reseller agreement under which the VAR places orders to us for our products and services in connection with the VAR's own sales to identified end-use customers. Under those contractual arrangements, we invoice the VAR for the arrangement fee (which reflects a channel partner discount relative to typical end-use customer pricing) and payment to us from the VAR is not contingent upon the VAR's collection from the end-use customer. We record revenue based on the amount of the discounted arrangement fee. For sales of our software products and support to VARs, the end-use customer also enters into a click-through license agreement with us and we fulfill the software and provide the support directly to the end-use customer. The key terms of and the accounting for our contractual arrangements with VARs are the same as those of other distributors of our products and services that are not VARs.

        In our business with MSSPs, we enter into a contractual arrangement with the MSSP that permits it to deploy our software products to end-use customers as components of the MSSP's broader managed service offerings. Under those contractual arrangements, we invoice the MSSP for the arrangement fee (which reflects a channel partner discount relative to typical end-use customer pricing) and payment to us from the MSSP is not contingent upon the MSSP's collection from the end-use customer. We record revenue based on the amount of the discounted arrangement fee. We provide support to the MSSP and not to the identified end-use customer. MSSPs do not purchase professional services or training from us, for their own benefit or for the benefit of the end-use customer.

        In our business with IR firms, we enter into contractual arrangements that permit IR firms to deploy our solution into an enterprise environment for a limited time period to assist in their client investigation and incident response service engagements with the goal of referring those clients to us following the engagement. We receive no fees from IR firms and record no revenue from those contractual arrangements.

New Revenue Recognition Standard

        Effective January 1, 2018, we will be required to adopt Accounting Standard Codification Topic 606, Revenue from Contracts with Customers, or ASC 606. We are currently evaluating the impact of the adoption of ASC 606 on our consolidated financial statements. We plan to adopt ASC 606 as of January 1, 2018 on a full retrospective basis, which will result in us recasting prior year consolidated financial statements to reflect the provisions of the new standard. While our assessment is preliminary, we have reached some conclusions on key accounting assessments related to the impact of the new standard, which are described in Note 2 to our consolidated financial statements appearing at the end of this prospectus.

Deferred Commissions

        We capitalize commission costs that are incremental and directly related to the acquisition of customer agreements. Commissions are earned by our sales force and paid in full upon the receipt of customer orders, or bookings, for new arrangements or renewals. Commission costs are capitalized when earned and are amortized as expense over the same period that the revenue is recognized for the related non-cancelable customer agreement in proportion to the recognition of the revenue. We believe that capitalizing commission costs is the preferable method of accounting as the commission charges are so closely related to the revenue from the non-cancelable customer agreements that they should be recorded as an asset and charged to expense over the same period that the related revenue is recognized.

95

---

Table of Contents

Amortization of deferred commissions is included in sales and marketing expense in our consolidated statements of operations and comprehensive loss.

Stock-Based Compensation

        We measure stock options and other stock-based awards granted to employees and directors based on the fair value on the date of the grant and recognize the corresponding compensation expense of those awards, net of estimated forfeitures, over the requisite service period, which is generally the vesting period of the respective award. Generally, we issue stock option awards with only service-based vesting conditions and record the expense for these awards using the straight-line method.

        We measure stock-based awards granted to non-employee consultants based on the fair value of the award on the date at which the related service is complete. Compensation expense is recognized over the period during which services are rendered by such non-employee consultants until completed. At the end of each financial reporting period prior to completion of the service, we remeasure the fair value of these awards using the then-current fair value of the underlying preferred stock or common stock and updated assumption inputs in the Black-Scholes option-pricing model.

        We estimate the fair value of each stock option grant using the Black-Scholes option-pricing model, which uses as inputs the fair value of our preferred stock or common stock and assumptions we make for the volatility of our preferred stock or common stock, the expected term of our stock options, the risk-free interest rate for a period that approximates the expected term of our stock options and our expected dividend yield.

        We estimate the fair value of each restricted stock award or restricted stock unit award based on the difference between the purchase price per share of the award, if any, and the fair value per share of our common stock on the date of grant.

Determination of the Fair Value of Common Stock

        As there has been no public market for our common stock to date, the estimated fair value of our common stock has been determined by our board of directors as of the date of each option grant, with input from management, considering as one of the factors our most recently available third-party valuations of common stock, and our board of directors' assessment of additional objective and subjective factors that it believed were relevant and which may have changed from the date of the most recent valuation through the date of the grant. These third-party valuations were performed in accordance with the guidance outlined in the American Institute of Certified Public Accountants' Accounting and Valuation Guide, Valuation of Privately-Held-Company Equity Securities Issued as Compensation. Our common stock valuations were prepared using either a probability-weighted expected return method, or PWERM, or a hybrid method, each of which used a combination of market and income approaches or a market approach to estimate our enterprise value. The hybrid method is a PWERM where the equity value in one or more of the scenarios is allocated using an option-pricing method, or OPM. Under the PWERM methodology, the fair value of common stock is estimated based upon an analysis of future values for the company, assuming various outcomes. The common stock values are based on the probability-weighted present value of expected future investment returns considering each of the possible outcomes available as well as the rights of each class of stock. The future value of common stock under each outcome is discounted back to the valuation date at an appropriate risk-adjusted discount rate and probability weighted to arrive at an indication of value for each class of stock. The OPM treats common stock and preferred stock as call options on the total equity value of a company, with exercise prices based on the value thresholds at which the allocation among the various holders of a company's securities changes. Under this method, the common stock has value only if the funds available for distribution to stockholders exceed the value of the preferred stock liquidation preferences at the time of a liquidity event, such as a strategic sale or merger.

96

---

Table of Contents

        These third-party valuations were performed at various dates, which resulted in valuations of our common stock of $6.26 per share as of December 31, 2015, $6.34 per share as of March 31, 2016, $6.26 as of June 3, 2016, $6.32 per share as of June 30, 2016, $6.38 per share as of September 30, 2016, $5.98 per share as of December 31, 2016, $5.88 per share as of March 31, 2017, $5.92 per share as of June 30, 2017, $6.08 per share as of September 30, 2017 and $7.46 per share as of December 31, 2017. In addition to considering the results of these third-party valuations, our board of directors considered various objective and subjective factors to determine the fair value of our common stock as of each grant date, which may be as a date later than the most recent third-party valuation date, including:

•

the prices, rights, preferences and privileges of our preferred stock relative to our common stock;



•

our business, financial condition and results of operations, including related industry trends affecting our operations;



•

the likelihood of achieving a liquidity event, such as an initial public offering, or IPO, or a sale of our company, given prevailing market conditions;



•

the lack of marketability of our common stock;



•

our financial position, including cash on hand, and our historical and forecasted performance and operating results;



•

the market performance of comparable publicly traded technology companies; and



•

the United States and global economic and capital market conditions and outlook.

        The assumptions underlying these valuations represent management's best estimates, which involve inherent uncertainties and the application of management judgment. As a result, if factors or expected outcomes change and we use significantly different assumptions or estimates, our stock-based compensation expense could be materially different.

        Following the closing of this offering, the fair value of our common stock will be determined based on the quoted market price of our common stock.

Options Granted

        The following table sets forth by grant date the number of shares of common stock subject to options granted since January 1, 2016, the per share exercise price of the options, the fair value of common stock on each grant date, and the per share estimated fair value of the options:

97

---

Table of Contents

Restricted Stock Units Granted

        On January 29, 2018, we granted restricted stock units that may be settled for an aggregate of 394,500 shares of common stock. The restricted stock units had a fair value of $7.46 per share on the date of grant. We have not granted any other restricted stock units since January 1, 2016.

Business Combinations

        We account for business combinations using the acquisition method of accounting. Application of this method of accounting requires that (1) identifiable assets acquired (including identifiable intangible assets) and liabilities assumed generally be measured and recognized at fair value as of the acquisition date and (2) the excess of the purchase price over the net fair value of identifiable assets acquired and liabilities assumed be recognized as goodwill, which is not amortized for accounting purposes but is subject to testing for impairment at least annually. Transaction costs related to business combinations are expensed as incurred.

        Determining the fair value of assets acquired and liabilities assumed and the allocation of the purchase price requires management to use significant judgment and estimates, especially with respect to intangible assets. Critical estimates in valuing certain identifiable assets include, but are not limited to, the selection of valuation methodologies; estimates of future revenue and cash flows, expected long-term market growth, future expected operating expenses, costs of capital and appropriate discount rates. Our estimates of fair value are based upon assumptions we believe to be reasonable, but which are inherently uncertain and unpredictable and, as a result, actual results may differ from estimates. During the measurement period, we may record certain adjustments to the carrying value of the assets acquired and liabilities assumed with the corresponding offset to goodwill. After the measurement period, which could last up to one year after the transaction date, all adjustments are recorded in the consolidated statements of operations and comprehensive loss.

Impairment of Goodwill and Long-Lived Assets

        Goodwill represents the excess of cost over the fair value of the net tangible and identifiable intangible assets acquired in a business combination. Goodwill is not subject to amortization, but is tested annually for impairment or more frequently if there are indicators of impairment. We consider the following potential indicators of impairment: significant underperformance relative to historical or projected future operating results, significant changes in our use of acquired assets or the strategy of our overall business, significant negative industry or economic trends and a significant decline in our enterprise value as determined by our board of directors based, in part, on the results of common stock valuations prepared by a third-party valuation firm on at least an annual basis.

        We perform an annual impairment test on December 1 or whenever events or changes in circumstances indicate that goodwill may be impaired. Significant judgments required in testing goodwill for impairment and changes in estimates and assumptions could materially affect the determination of whether impairment exists and, if so, the amount of that impairment.

        We have determined that there is one reporting unit for purposes of testing goodwill for impairment. In testing goodwill for impairment, we first consider qualitative factors to determine whether it is more likely than not that the fair value of a reporting unit is less than its carrying value. Such qualitative factors include macroeconomic conditions, industry and market considerations, cost factors, entity-specific financial performance and other events, such as changes in management, strategy and primary customer base. If we determine that it is more likely than not that the fair value of a reporting unit is less than its carrying value, we perform the two-step goodwill impairment test. The two-step test starts with comparing the fair value of the reporting unit to the carrying amount of a reporting unit, including goodwill. If the fair value exceeds the carrying amount, no impairment loss is recognized. However, if the carrying amount of the reporting unit exceeds its fair value, the second step is performed to determine if goodwill is impaired.

98

---

Table of Contents

If we determine that goodwill is impaired, an impairment charge is recorded in the consolidated statements of operations and comprehensive loss. In each of our annual goodwill impairment tests performed as of December 1, 2015, 2016 and 2017, the estimated fair value of our single reporting unit significantly exceeded its carrying amount. During the years ended December 31, 2015, 2016 and 2017, we did not recognize any impairment charges related to goodwill.

        Long-lived assets consist of property and equipment, including internal-use software, and finite-lived acquired intangible assets, such as developed technology, trade name and customer relationships. Long-lived assets to be held and used are tested for recoverability whenever events or changes in business circumstances indicate that the carrying amount of the assets may not be fully recoverable. Factors that we consider in deciding when to perform an impairment review include significant underperformance of the business in relation to expectations, significant negative industry or economic trends and significant changes or planned changes in the use of the assets. If an impairment review is performed to evaluate a long-lived asset group for recoverability, we compare forecasts of undiscounted cash flows expected to result from the use and eventual disposition of the long-lived asset group to its carrying value. An impairment loss would be recognized when estimated undiscounted future cash flows expected to result from the use of an asset group are less than its carrying amount. The impairment loss would be based on the excess of the carrying value of the impaired asset group over its fair value, determined based on discounted cash flows. To date, we have not recorded any impairment losses on long-lived assets. No events or changes in circumstances existed to require an impairment assessment during the years ended December 31, 2015, 2016 and 2017.

Valuation of Warrant Liability

Preferred Stock Warrants

        We classify warrants to purchase shares of our Series B and Series D preferred stock as a liability in our consolidated balance sheets as the warrants are free-standing financial instruments that may require us to transfer assets upon exercise. The warrants were initially recorded at their fair values on date of issuance, and they are subsequently remeasured to fair value at each balance sheet date. Changes in the fair values of the warrants are recognized as other income or expense in our consolidated statements of operations and comprehensive loss. We will continue to adjust the liability for changes in fair value until the earlier of the exercise of the warrants, the expiration of the warrants or the warrants becoming warrants to purchase common stock. Upon the closing of this offering, the underlying preferred stock will be converted to common stock, the preferred stock warrant will become exercisable for common stock instead of preferred stock, and the fair value of the preferred stock warrant liability at that time will be reclassified to additional paid-in capital. No further remeasurement of the warrant would occur if the warrant becomes exercisable for common stock.

Common Stock Warrants

        In connection with our issuance and sale of Series D preferred stock, we issued to an investor a warrant to purchase shares of our common stock. This warrant is exercisable upon completion of an IPO into the number of shares of common stock equal to 12.5% of the sum of (a) the number of shares into which the shares of our Series A preferred stock, including shares issuable upon the exercise of outstanding options to purchase shares of Series A preferred stock, convert upon an IPO and (b) the number of shares of common stock underlying the warrant. This warrant meets the definition of a derivative instrument under the relevant accounting guidance and is recorded as a liability in our consolidated balance sheets. The fair value of the warrant on the date of issuance was recorded as reduction of the carrying value of the Series D preferred stock and as a long-term liability in our consolidated balance sheet. The fair value of the warrant is subsequently remeasured to its fair value at each balance sheet date. Changes in the fair value of the warrant is recognized as other income or expense in our consolidated statements of operations

99

---

Table of Contents

and comprehensive loss. We will continue to adjust the liability for changes in fair value until the earlier of the exercise or expiration of the warrant.

        Upon the closing of this offering, the common stock warrant will become exercisable for one day, and the common stock warrant will either (1) be exercised, resulting in a reclassification of the warrant liability to stockholders' deficit, or (2) expire, resulting in a gain in our consolidated statement of operations equal to the fair value of the warrant liability on the date of expiration, and no further remeasurement of the warrant will occur.

Valuation

        We utilize the Black-Scholes option-pricing model, which incorporates assumptions and estimates, to value the preferred stock warrants and common stock warrant that are classified as liabilities in our consolidated balance sheets. We assess these assumptions and estimates on a quarterly basis as additional information impacting the assumptions is obtained. Estimates and assumptions impacting the fair value measurement include the fair value per share of the underlying common stock and Series B and Series D preferred stock, the remaining contractual terms of the warrants, risk-free interest rates, expected dividend yields, and expected volatility of the price of the underlying common or preferred stock. We determine the fair value per share of the underlying common and preferred stock by taking into consideration our most recent sales of preferred stock, results obtained from third-party valuations, and additional factors that we deem relevant. We have historically been a private company and lack company-specific historical and implied volatility information of our stock. Therefore, we estimate expected stock volatility based on the historical volatility of publicly traded peer companies for a term equal to the remaining contractual term of the warrants. The risk-free interest rates are determined by reference to the U.S. Treasury yield curve for time periods approximately equal to the remaining contractual terms of the warrants. We have estimated the dividend yield based on the fact that we have never paid cash dividends and do not expect to pay any cash dividends in the foreseeable future.

Carrying Value and Fair Value of Preferred Stock

        We recognize changes in the redemption values of our Series B, C, D, E, E-1 and F preferred stock immediately as they occur and adjust the carrying value of each series of preferred stock to equal its redemption value at the end of each reporting period as if the end of each reporting period were the redemption date. Adjustments to the carrying values of the Series B, C, D, E, E-1 and F preferred stock at each reporting date result in an increase or decrease to net income (loss) attributable to common stockholders.

        Because shares of our Series D, E and F preferred stock are redeemable in an amount equal to the greater of the original issue price per share of each series plus all declared but unpaid dividends thereon or the estimated fair value of the Series D, E or F preferred stock at the date of the redemption request, and because shares of our Series E-1 preferred stock are redeemable in an amount equal to the estimated fair value of the Series E-1 preferred stock at the date of the redemption request, it is necessary for us to determine the fair value of each of these series of preferred stock in order to determine the redemption value at each reporting date. As there has been no public market for our preferred stock to date, the estimated fair value of our preferred stock has been determined by management as of each reporting date based, in part, on the results of third-party valuations of our preferred stock performed as of each reporting date as well as management's assessment of additional objective and subjective factors that it believed were relevant. These third-party valuations were performed in accordance with the guidance outlined in the American Institute of Certified Public Accountants' Accounting and Valuation Guide, Valuation of Privately-Held-Company Equity Securities Issued as Compensation. Our preferred stock valuations at each reporting date were prepared using either a PWERM or a hybrid method, which used a combination of market and income approaches or a market approach to estimate our enterprise value.

100

---

Table of Contents

        The assumptions underlying these valuations represent management's best estimates, which involve inherent uncertainties and the application of management judgment. As a result, if factors or expected outcomes change and we use significantly different assumptions or estimates, the estimated fair values of our preferred stock could be materially different.

        Upon the closing of this offering, all of our preferred stock will convert into shares of our common stock and it will no longer be necessary for us to estimate or account for changes in the fair value of our preferred stock.

Capitalization of Software Development Costs

        We capitalize certain costs related to the development of software for internal use and to the development of software for license or sale to customers, including costs incurred for certain upgrades and enhancements that are expected to result in increased functionality.

        Costs incurred to develop software to be licensed or sold to customers are expensed prior to the establishment of technological feasibility of the software and are capitalized thereafter until commercial release of the software. To date, we have not capitalized software development costs related to software to be licensed or sold to customers as the establishment of technological feasibility typically occurs shortly before the commercial release of our software products. As such, all software development costs related to software for license or sale to customers are expensed as incurred and included within research and development expense in our consolidated statements of operations and comprehensive loss.

        Qualifying costs incurred to develop internal-use software are capitalized when (1) the preliminary project stage is completed, (2) we have authorized further funding for the completion of the project and (3) it is probable that the project will be completed and performed as intended. These capitalized costs include salaries for employees who devote time directly to developing internal-use software and external direct costs of services consumed in developing the software. Capitalization of these costs ceases once the project is substantially complete and the software is ready for its intended purpose. Capitalized internal-use software development costs are amortized using the straight-line method over an estimated useful life of three years. Such amortization expense for internal-use software is classified as a cost of revenue in our consolidated statements of operations and comprehensive loss.

Emerging Growth Company Status

        The Jumpstart Our Business Startups Act of 2012, or the JOBS Act, permits an "emerging growth company" such as us to take advantage of an extended transition period to comply with new or revised accounting standards applicable to public companies until those standards would otherwise apply to private companies. We have irrevocably elected to "opt out" of this provision and, as a result, we will comply with new or revised accounting standards when they are required to be adopted by public companies that are not emerging growth companies.

Recent Accounting Pronouncements

        We have reviewed all recently issued standards and have determined that, other than as disclosed in Note 2 to our consolidated financial statements appearing at the end of this prospectus, such standards will not have a material impact on our consolidated financial statements or do not otherwise apply to our operations.

Qualitative and Quantitative Disclosures about Market Risk

        Market risk represents the risk of loss that may impact our financial position due to adverse changes in financial market prices and rates. Our market risk exposure is primarily the result of fluctuations in interest rates and foreign exchange rates as well as, to a lesser extent, inflation.

101

---

Table of Contents

Interest Rate Risk

        We are exposed to interest rate risk in the ordinary course of our business. Our cash and cash equivalents are held in highly liquid, readily available checking and money market accounts. As a result, these amounts are not materially affected by changes in interest rates.

        As of December 31, 2016, we had $5.5 million of borrowings outstanding under our line of credit with Silicon Valley Bank, which bear interest at Silicon Valley Bank's prime rate plus 1.50% (which resulted in an interest rate of 5.25% as of December 31, 2016). A 10% change in the bank's prime rate would not have a material impact on our debt obligations or our consolidated results of operations. We repaid all amounts outstanding under the line of credit in April 2017. As of December 31, 2017, no amounts were outstanding under the line of credit.

Foreign Currency Exchange Risk

        To date, a substantial majority of our revenue from customer arrangements has been denominated in U.S. dollars. The majority of our employees and our major operations are currently located in the United States. We have limited operations outside the United States. The functional currency of each of our foreign subsidiaries is the U.S. dollar. We occasionally engage in contracts with customers and pay contractors or other vendors in a currency other than the U.S. dollar.

        To date, we have had minimal exposure to fluctuations in foreign currency exchange rates as the time period from the date that transactions are initiated and the date of payment or receipt of payment is generally of short duration. Accordingly, we believe we do not have a material exposure to foreign currency risk.

Inflation Risk

        We do not believe that inflation had a material effect on our business, financial condition or results of operations in the last three years. If our costs were to become subject to significant inflationary pressures, we may not be able to fully offset such higher costs through price increases. Our inability or failure to do so could harm our business, financial condition or results of operations.

Off-Balance Sheet Arrangements

        We do not have any relationships with unconsolidated entities or financial partnerships, including entities sometimes referred to as structured finance or special purpose entities that were established for the purpose of facilitating off-balance sheet arrangements or other contractually narrow or limited purposes. We do not engage in off-balance sheet financing arrangements. In addition, we do not engage in trading activities involving non-exchange traded contracts. We therefore believe that we are not materially exposed to any financing, liquidity, market or credit risk that could arise if we had engaged in these relationships.

102

---

Table of Contents

BUSINESS

Overview

        Carbon Black is a leading provider of next-generation endpoint security solutions.¹ Our predictive security cloud platform continuously captures, records and analyzes rich, unfiltered endpoint data. We believe the depth, breadth and real-time nature of our endpoint data, combined with the strength of our analytics platform, provides customers with the most robust and data-intensive solution to address the complete endpoint security lifecycle. Our solutions enable customers to predict, prevent, detect, respond to and remediate cyber attacks before they cause a damaging incident or data breach.

        Organizations globally are re-platforming their IT by investing in cloud computing and workforce mobility, which has resulted in enterprise environments that are more open, interconnected, and vulnerable to cyber attacks. In the past, knowledge workers only had access to applications and data inside the corporate network perimeter, which were firewalled off from potential cyber threats. Today, an increasingly mobile workforce and the explosion of enterprise data and applications in the cloud have expanded the attack surface beyond the traditional network perimeter. In response, cyber attackers have adapted their attack methods and tools to directly target the endpoint. In short, the endpoint is the new perimeter.

        Endpoints are the primary focus of attacks because they store valuable data that attackers seek to steal; perform critical operations that attackers seek to disrupt; and are the interface where attackers can target humans through email, social engineering and other tactics. Endpoints are the physical and virtual locations where sensitive data resides and include desktops, laptops, servers, virtual machines, cloud workloads (services running on cloud servers), fixed-function devices such as ATMs, point of sale systems, and control and data systems for power plants and other industrial assets.

        Based on our experience and investment in next-generation solutions designed to address the full endpoint security lifecycle—predict, prevent, detect, respond to and remediate—we have developed a highly differentiated technology approach with four main pillars:

1.

Unfiltered data collection: Our technology uniquely collects complete, "unfiltered" endpoint data by continuously recording endpoint activity and centrally storing the collected data for advanced

   

---

¹

See (i) Enterprise Management Associates, 2017 Next-Generation Endpoint Security Vendor Landscape and Five-Year Market Forecast; (ii) Forrester Research, The Forrester Wave^TM: Endpoint Security Suites, Q4 2016, The 15 Providers that Matter Most and How They Stack Up, October 19, 2016; and (iii) International Data Corporation, IDC MarketScape: Worldwide Endpoint Specialized Threat Analysis and Protection 2017 Vendor Assessment, April 2017.

103

---

Table of Contents

analytics. Other vendors take a "filtered" approach by capturing a subset of data at select points in time. Unfiltered data is more comprehensive, provides greater visibility and we believe offers more effective security capabilities.

2.

Proprietary data shaping technology: Our unfiltered data approach, which we believe is fundamental to deliver the most effective endpoint security, required us to overcome several difficult technical challenges, which we refer to as the "edge to cloud data pipeline problem." These challenges centered on how to reliably collect and cost effectively analyze and store massive amounts of data from edge devices (i.e., endpoints) in the cloud. To address those challenges, we have developed proprietary data shaping technology that smooths bursts of endpoint data activity; optimizes bandwidth demands to move massive amounts of endpoint data; compresses data at a high ratio to reduce the cost of storing massive amounts of data; and leverages a graph-like custom model for endpoint data that allows analysis of the data in multiple ways for multiple use cases. We believe our proprietary data shaping technology creates a strong and lasting competitive advantage not just in endpoint security, but also as we seek to disrupt and consolidate adjacent security markets that leverage endpoint data.



3.

Streaming analytics: We analyze endpoint data at massive scale leveraging event stream processing technology, which evaluates and classifies a continuously updated stream of events based on their risk level. We also employ machine learning and other advanced analytic techniques.



4.

Extensible and open architecture: Our open architecture was designed to integrate with leading security technologies and IT products used by our customers. Moreover, endpoint data is the fuel that powers multiple security products across an organization's security stack. Our open architecture, when combined with the value of our data, positions our platform to serve as the hub of security activity in a customer's IT organization and enables deep customer relationships.

        We have a strong heritage of innovative technology leadership in multiple endpoint security categories: application control, endpoint detection and response, or EDR, and next-generation antivirus, or NGAV.² Our flagship solutions are technology leaders in each of these categories, and we are integrating each with our predictive cloud platform.² Unlike legacy security products that install an agent and collect data specific to its domain or use case, our platform provides a single agent that continuously collects unfiltered endpoint data to address the entire endpoint security lifecycle, which today is addressed by multiple point products. We believe that we are well positioned to continue serving the $6.5 billion endpoint security market.

        We focus on solutions that enable organizations to address the entire security lifecycle of an endpoint and integrate endpoint security within their cyber security architecture. We are transforming cyber security with our predictive security cloud, which positions us to address adjacent security use cases requiring endpoint data, such as IT asset management, public cloud security software and security and vulnerability management, which, according to IDC, represented markets of $1.9 billion, $5.3 billion and $5.4 billion, respectively, in 2016. This presents us with the opportunity to extend into adjacent security markets, and potentially expand our market opportunity from $6.5 billion to $19.1 billion. While we have not yet penetrated these adjacent security markets, and there are multiple challenges associated with doing so, we believe that we can leverage the unfiltered endpoint data, proprietary data shaping technology, streaming analytics capabilities and extensible open architecture of our predictive security cloud to address adjacent

   

---

²

See (i) Enterprise Management Associates, 2017 Next-Generation Endpoint Security Vendor Landscape and Five-Year Market Forecast; (ii) Forrester Research, The Forrester Wave^TM: Endpoint Security Suites, Q4 2016, The 15 Providers that Matter Most and How They Stack Up, October 19, 2016; and (iii) International Data Corporation, IDC MarketScape: Worldwide Endpoint Specialized Threat Analysis and Protection 2017 Vendor Assessment, April 2017.

104

---

Table of Contents

security use cases and the market opportunities that they present through the development of additional product functionality.

        Our customers include many of the world's largest, security-focused enterprises and government agencies that are among the most heavily targeted by cyber adversaries, as well as mid-sized organizations. We serve over 3,700 customers globally across multiple industries, including 33 of the Fortune 100. Our solutions address the needs of a diverse range of customers. Over 70 security technology companies, including industry leaders such as VMware, Inc., or VMware, Splunk Inc., or Splunk, and the International Business Machines Corporation, or IBM, have integrated their products with Carbon Black to access our unfiltered endpoint data.

        We primarily sell our products through a channel go-to-market model, which significantly extends our global market reach and ability to rapidly scale our sales efforts. Our inside sales and field sales representatives work alongside an extensive network of value-added resellers, or VARs, distributors, managed security service providers, or MSSPs, and incident response, or IR, firms. Our MSSP and IR partners both use and recommend our products to their clients. We have established significant relationships with leading channel partners, including the CDW Corporation, one of the world's largest software VARs; Arrow Electronics, Inc., a major global distributor; SecureWorks, Inc., a leading MSSP; and Kroll Inc., or Kroll, a leading IR firm. In addition, we have technology and go-to-market partnerships with both IBM and VMware, enabling us to leverage their sales organizations to reach their large customer bases. In the three months ended December 31, 2017, 94% of our new and add-on business was closed in collaboration with a channel partner.

        We have experienced strong revenue growth, with revenue increasing from $70.6 million in 2015 to $116.2 million in 2016 and $162 million in 2017, representing a 51% compound annual growth rate over the same period. We have a subscription-based revenue model that provides visibility into future revenue. Recurring revenue represented 77%, 83% and 88% of our total revenue in 2015, 2016 and 2017, respectively. Annual recurring revenue, or ARR, was $76.8 million, $124.2 million and $174.2 million as of December 31, 2015, 2016 and 2017, respectively. We define ARR as the annualized value of all active subscription contracts as of the end of the period. ARR excludes revenue from perpetual licenses and services. The portion of our ARR related to our cloud-based subscription contracts was $2.5 million, $15.1 million and $46.0 million as of December 31, 2015, 2016 and 2017, respectively. The percentage of our total recurring revenue generated by sales of our cloud-based solutions was negligible in 2015, 7% in 2016 and 18% in 2017. We incurred net losses of $38.7 million in 2015, $44.6 million in 2016 and $55.8 million in 2017 as we continued to invest for growth to address the large market opportunity for our platform.

Industry Background

        Cyber security is critical to organizations as they face an increasingly hostile threat environment with a growing number of cyber adversaries launching stealthy, sophisticated and targeted attacks. The following major trends are driving strong and growing demand for our products:

Endpoints are the new front line in the cyber war, and organizations are shifting their defenses as a result

        The attack surface is expanding.    Workforce mobility is increasing the number of connected devices that operate outside the traditional network perimeter, which is expanding the potential "attack surface." Moreover, enterprises are increasing their use of public clouds for a broad range of services, such as virtual machines, cloud workloads and customer relationship management (e.g., Salesforce.com), human resource management (e.g., Workday) and financial management (e.g., NetSuite) applications. As a result, enterprises' critical data and operations have increasingly shifted outside of their traditional network defenses, and the importance of protecting their endpoint devices has become paramount.

105

---

Table of Contents

        Endpoints are the primary target of cyber attacks.    Endpoint devices are the primary targets of attacks because these devices store valuable data and intellectual property such as authentication credentials (e.g., usernames, account IDs, passwords), personal information (e.g., Social Security numbers, health records), financial data (e.g., credit card account data), digital assets (e.g., proprietary software code, movies, blueprints, product plans) and trade secrets. Endpoints are also the interface where attackers can target humans through email, social engineering techniques (e.g., phishing), keylogging and other tactics. Furthermore, the type of endpoint devices being targeted by cyber attackers is expanding and includes IoT devices, such as industrial control systems that manage and monitor critical operations for power plants, water utilities and factories.

        Endpoint data is critical to an effective cyber security program.    Effective security critically depends on having complete visibility into what is happening on each endpoint. Multiple categories of security products, from vulnerability assessment to patch management, require endpoint data for their core functionality. Legacy security products lack continuous recording of unfiltered endpoint data, instead gathering data by periodically "scanning" endpoints at a point in time and filtering for only select data, resulting in a lack of visibility and context.

        Organizations are shifting their defenses to focus on next-generation endpoint security solutions.    Because network-centric security is no longer adequate, organizations must focus on securing the endpoint. However, while organizations have made significant investments in upgrading to advanced network security solutions, the majority of endpoint security technology in use today relies on multiple agents and uses the same ineffective, traditional signature-based antivirus software originally designed more than 20 years ago. As a result, organizations are increasingly shifting their security budgets toward next-generation endpoint security solutions.

        With the continued success of cyber attacks, organizations are shifting from a passive prevention-only response to a holistic approach.    Historically, organizations have relied on passive prevention-only technologies that sought to block attackers from penetrating the network perimeter and protect corporate endpoints and data. This limited, passive prevention-only approach has proven inadequate and the number of successful cyber attacks has continued to grow. Organizations are shifting to a holistic and active security approach that is predicated on predicting, preventing, detecting and responding to today's advanced cyber attacks. As organizations shift away from a prevention-only approach, they increasingly require next-generation technologies that rely on rich endpoint data as part of a more active approach to cyber security.

The cyber threat is large, sophisticated and growing and requires new and more advanced approaches to combat it

        Cyber security is a board-level issue and a focal point for governments worldwide.    According to a study conducted by Ponemon Institute and Accenture, the annual cost from cybercrime was estimated to be $11.7 million per organization, on average, in 2017. A single data breach, according to a 2017 study by the Ponemon Institute and IBM Security, costs the breached entity $3.62 million on average. The ongoing occurrence and devastating consequences of high profile cyber attacks have elevated cyber security to a top priority for executives. Additionally, organizations are increasingly subject to new regulatory and compliance requirements for cyber security, data protection and internal IT controls. Examples include the EU's General Data Protection Regulation (adopted in 2016), the 2014 Framework for Improving Critical Infrastructure Cybersecurity, the Health Insurance Portability and Accountability Act, or HIPAA, and Payment Card Industry Data Security Standards, or PCI DSS, among many others. These regulations carry significant financial and reputational consequences for non-compliance. Due to the financial, operational and reputational risks of breaches and non-compliance, C-level security officers are now commonplace and cyber security strategy is a critical focus area for boards of directors.

106

---

Table of Contents

        The rise of ransomware has made every organization a potential target.    In the past, cyber attackers tended to target entities that held commercially valuable data that could be stolen and used for financial gain, such as credit card data, authentication credentials and trade secrets. However, with the emergence and proliferation of ransomware in recent years, cyber attackers now target organizations regardless of type or size to extort money by holding computers and data hostage. The U.S. Federal Bureau of Investigation estimated that the ransomware industry grew from $24 million in 2015 to $1 billion in 2016, and is expected to continue growing. As the ransomware industry grows, organizations are increasingly vulnerable to attacks. A 2017 study by the Ponemon Institute found that only 27% of companies felt confident that their current antivirus software can protect them from ransomware.

        Today's attacks are stealthy, sophisticated and targeted.    Today's organizations face a complex threat landscape with a broad range of well-funded cyber attackers that include criminal syndicates, state sponsored agents, international hacking collectives and nation states. Advanced attackers use techniques designed to circumvent traditional security approaches, including custom malware and zero-day attacks, social engineering through targeted spear phishing, polymorphic malware and infected USB keys. Less skilled attackers can purchase these attacks through cybercrime marketplaces on the "Dark Web," leading to a widespread proliferation of successful, advanced attacks. According to independent security research institute AV-Test, researchers discovered more than 125 million malware samples in 2016, an average of approximately four new malware variants every second. Once an organization has been breached, attackers can move unseen for months or even years, exfiltrating a larger amount of data and intellectual property. The longer these invisible breaches remain undetected, the greater the costs and reputational damage they can cause. According to a 2017 Ponemon Institute study, the mean time to identify a malicious or criminal cyber attack is 214 days and the mean time to contain such an attack, once identified, is an additional 77 days.

        The shortage of security talent creates a need for next-generation solutions.    The continuous growth in the number and sophistication of cyber attacks and the expansion of the attack surface is driving the need for more security professionals with deeper expertise. As the number of threats multiplies, legacy solutions either miss threats or produce more alerts than security teams are able to process and investigate. The number of security professionals has not kept pace with total demand. Organizations are increasingly turning to next-generation solutions, advanced analytics and automation tools to empower their security professionals to increase their efficiency and focus on the highest value cyber security tasks, thereby reducing the need for additional security headcount.

Our Market Opportunity

        We believe that our cloud platform addresses a significant capability gap in the evolving enterprise security landscape in which the endpoint is the new perimeter. Legacy endpoint products employ 20-year-old "scanning" technology to periodically pull data from endpoints at various points in time when a scan is executed in order to identity potential cyber threats. By contrast, our platform enables organizations to improve the efficacy of, and reduce the overhead associated with, managing security systems and teams through the collection of continuous and unfiltered endpoint data. Our predictive cloud platform enables organizations to utilize unfiltered endpoint data and advanced analytics to better predict, prevent, detect, respond to and remediate cyber attacks as compared to traditional endpoint security solutions.

        According to International Data Corporation, or IDC, the market for enterprise endpoint security software, our primary market, was $6.5 billion in 2016 and is expected to reach $8.3 billion by 2021. Additionally, we believe that our solutions will address an increasing subset of use cases in public cloud security software, security and vulnerability management and IT asset management. According to IDC, the market for security and vulnerability management was $5.4 billion in 2016 and is expected to reach $9.0 billion in 2021. According to IDC, the market for public cloud security software was $5.3 billion in

107

---

Table of Contents

2016 and is expected to reach almost $10.0 billion in 2021. According to IDC, the market for IT asset management was $1.9 billion in 2016 and is expected to reach $2.8 billion in 2021.

Our Solutions

        Powered by the Cb Predictive Security Cloud, our solutions provide best-in-class security by collecting and analyzing unfiltered data from the endpoint, where attacks and breaches are increasingly focused, and by integrating seamlessly with leading third-party security solutions. Addressing the entire security lifecycle, our solutions are designed to predict, prevent, detect, respond to and remediate the maximum number of attacks for our customers, and to enable our customers to continuously improve their security posture by proactively detecting and responding to threats, and remediating potential vulnerabilities. Our solutions can be quickly deployed by customers to realize immediate benefits, and are easily scaled and tailored to fit their needs.

        Our customers use our products to:

•

Augment or replace legacy antivirus software;



•

Prevent malware and fileless attacks that do not use malware;



•

Protect against ransomware;



•

Hunt down threats;



•

Respond to and remediate security incidents;



•

Lock down critical systems and applications;



•

Protect fixed-function devices;



•

Secure workloads and applications in virtualized and cloud environments;



•

Comply with regulatory mandates; and



•

Enhance other security products through our unfiltered endpoint data.

108

---

Table of Contents

Benefits of Our Platform and Solutions

Decreased risk of breach by protecting against known and unknown endpoint attacks

        By leveraging the benefits of unfiltered data, analytics and the cloud, we believe our solutions extend beyond legacy antivirus solutions to detect and stop the widest possible array of cyber attacks. These encompass both previously identified and novel attacks never seen before, including file-based attacks such as malware and ransomware, as well as next-generation attacks, such as memory-based, PowerShell and script-based attacks. Our solutions apply a full spectrum of technologies including application whitelisting and advanced analytics techniques—such as behavioral analysis, reputation analysis, artificial intelligence and machine learning—to analyze attack patterns in the cloud using richer and more complete endpoint data than any other vendor. According to a MRG Effitas Ltd. efficacy assessment commissioned by us, Cb Defense has a 100% prevention rate against known and unknown ransomware samples. We believe the increased security efficacy from the use of our solutions results in a decreased risk of breach for our customers.

Ability to identify root cause of attacks and quickly respond to security incidents

        Modern cyber adversaries routinely exploit known and newly discovered vulnerabilities in their targets infrastructure and operations. As long as those vulnerabilities remain, adversaries have a potential path to reach their goal. Our next-generation detection and response capabilities enable organizations and incident responders to rapidly identify the root cause of an attack and the scope of compromise on the network. By capturing unfiltered data, the Cb Predictive Security Cloud provides full visibility into potential threats, both proactively as well as retroactively after a threat is blocked or identified, providing complete details of what happened and what was impacted.

        We create a system of record for all endpoint activity through our platform's collection of unfiltered endpoint data. By having a system of record, security professionals can immediately determine the root cause and scope of a breach, without the need for physical access to machines, time-consuming disk imaging or deep, manual investigation. We believe that due to the combination of our continuous and centralized recording technology that captures rich, unfiltered endpoint data, and the advanced analytics that we apply to that data, we provide our customers with the industry's most robust solution for root cause identification and incident response.

Automated remediation and threat containment

        Using the unfiltered data that is continuously collected from each endpoint where our solutions are deployed, our users can launch automated remediation and threat containment actions, such as terminating processes, deleting files and isolating endpoints on the network. These automated capabilities enable organizations to respond to attacks as they happen and minimize the impact and cost of an attack.

Continuous enhancement by leveraging intelligence from across the security community

        Our solutions allow organizations to continuously improve their security posture, benefiting from ongoing refinement of endpoint hardening and the latest threat intelligence. Through the Cb Predictive Security Cloud, our customers anonymously share data with each other. The Carbon Black community provides global visibility into the cyber threat landscape through our more than 3,700 customers and 10,000 security professionals who use our solutions. Our solutions unite the Carbon Black community of security experts, our network of partners and our internal threat research team, and deliver shared intelligence through the Cb Predictive Security Cloud, which elevates the security expertise of each community member. This enables organizations to share, refine and operationalize new intelligence on attacker behavior through watchlists and security procedures based on the collective experiences of our community. We believe the ability to share intelligence across our users increases the security expertise of each customer in our community and reduces their need to hire additional security experts.

109

---

Table of Contents

Seamless integration with other best-of-breed security solutions

        Our next-generation endpoint security solutions are designed to integrate seamlessly with other security technologies deployed in an organization's IT environment. Our open architecture and API framework allows organizations to integrate other best-of-breed security solutions, such as network security and security information and event management, or SIEM, solutions, with our platform to provide a unified security strategy where data is shared across the environment. The addition of our endpoint data to a customer's SIEM significantly reduces the occurrence of false positive alerts that would otherwise require attention. This in turn helps improve efficiency, thereby reducing the need for security teams to increase headcount. Further, our open API platform enables customers to build their own integrations with other systems across their IT environment. Our emphasis on open architecture and integration with partners at all layers of the security stack enhances an enterprise's security posture, reduces incident response times and increases overall operational efficiency. Ultimately, this ability enables customers to evolve with the dynamic threat landscape and achieve greater utility across their cyber security architecture.

Security efficacy without blocking legitimate activity

        Customers require security products that are highly effective in detecting and preventing attacks (i.e., that have a low rate of "false negatives"), while also minimizing the number of "false positive" alerts that interrupt legitimate end-user activity. In order to achieve these dual requirements, we apply an approach that combines endpoint-based prevention models that are optimized for low false positives, with cloud-based detection algorithms that are optimized for low false negatives. As a result, we are able to deliver maximum endpoint security efficacy without blocking legitimate activity.

Increased security operations efficiency and less reliance on scarce security talent

        Organizations are under increasing pressure to drive greater efficiencies across their security operations, while global shortage of trained security professionals continues to grow. By providing customers with automated security solutions, streamlined workflow management and access to the collective expertise available on the Cb Predictive Security Cloud, Carbon Black solutions enable our customers to significantly improve the efficiency of their security operations and reduce their reliance on additional security professionals. Using our solutions, for example, security teams are able to reduce investigation and remediation efforts from days to hours or minutes, and dramatically reduce the need for time-consuming tasks such as re-imaging of devices.

Greater ability to meet compliance requirements

        Our solutions enable organizations to comply with numerous regulatory requirements for data collection, analysis, reporting, archival and retrieval, while also optimizing the overall enterprise cyber security posture. The ability to establish real-time monitoring and alerts on key controls, maintain a digital chain of custody on endpoint data, perform efficient forensic investigations and automate endpoint analysis and reporting is seamlessly integrated into our solutions. As a result, our solutions allow our customers to consolidate compliance costs and help them comply with regulations such as the General Data Protection Regulation, the 2014 Framework for Improving Critical Infrastructure Cybersecurity, HIPAA, PCI DSS, NERC-CIP and the Sarbanes-Oxley Act.

Ability to deploy endpoint security at any scale and grow and evolve their defenses

        Carbon Black products are used by customers of all sizes, from small and medium sized businesses, or SMBs, to large global enterprises with several hundred thousand endpoints under protection. Carbon Black products are designed to deploy in minutes, with no adverse impact on end users or endpoint performance. Carbon Black products typically consume a negligible amount of the endpoint's processing

110

---

Table of Contents

power, far less than legacy antivirus products. Customer deployment options include the cloud, on premise, or via MSSP. Moreover, we have designed the Cb Predictive Security Cloud to enable customers to easily grow and evolve their defenses. Customers can start by deploying whichever solutions best match their immediate needs and then extend and enhance their deployment over time.

Our Competitive Strengths

        We believe a number of competitive advantages enable us to maintain and extend our leadership position, including:

Differentiated technology and intellectual property

        Our predictive security approach continuously captures unfiltered endpoint activity for real-time and retrospective analysis using our analytics technology that incorporates event stream processing, dynamic and static behavioral analysis, machine learning and reputation analysis and scoring. We have spent six years developing and cost-effectively scaling the technology to enable unfiltered data capture, which provides a complete system of record, immediate root cause discovery and precise attack scope and impact assessment. It also offers an historical data set which organizations can continually analyze using newly discovered indicators and patterns of attacker behavior. We believe our unfiltered approach is highly scalable and uniquely positions us to address the needs of adjacent security markets by delivering additional products that leverage this data.

Extensible next-generation security cloud platform

        The Cb Predictive Security Cloud Platform is designed to address a wide range of next-generation security requirements and use cases by leveraging our unfiltered data to deliver a broad set of security offerings for customers of all types and sizes. As organizations strive to limit the number of vendors they rely on, we believe the breadth and extensibility of our platform is a competitive advantage. The extensible architecture of our platform positions us to continue enhancing and expanding our offerings in order to address additional requirements and use cases, as customers' needs evolve and as the landscape of cyber threats changes over time.

Pioneers in application control

        We pioneered the zero trust model at the endpoint with Cb Protection, our application control solution, which allows software to execute only if it is known and explicitly trusted. We believe that application control remains the most effective endpoint prevention approach for use cases that require "high enforcement" security policies. Building on this foundation, we have enhanced our application control offering by expanding our range of threat prevention options to create the most effective and complete endpoint prevention solution available in the market, and by leveraging the capabilities of the Cb Predictive Security Cloud, such as pre-optimized security configurations delivered through the cloud. Our flexible and automated protection policies allow broad deployment within enterprises, from data centers to knowledge workers to fixed-function devices. Our approach allows organizations to tailor enforcement levels across the enterprise to suit their desired security posture and risk profile.

Powerful ecosystem based on unfiltered endpoint data and open platform

        In the security ecosystem, endpoints yield the most valuable security data because they are the primary target of modern cyber attacks. Through a combination of our continuous recording that captures unfiltered endpoint data, along with our customer base of industry leaders that are among the world's most heavily targeted organizations, we believe the endpoint data that we capture is considered the "gold standard" for the industry and is preferred by leading security vendors. This strategically positions our platform as the system of record for the security industry and we are therefore an enabler for any other

111

---

Table of Contents

offering in the security market. Leveraging our open platform that integrates with our customers' existing security architecture, we are well-positioned to provide the core platform on which a growing ecosystem of partners can build complementary offerings.

High-leverage channel model

        We believe our partnerships with leading MSSPs and security-focused VARs are a unique competitive differentiator, as enterprises increasingly engage external experts as trusted advisors to help select security solutions, integrate architectures and manage their ongoing defense posture. Enterprises value best-in-breed technology solutions at each level of the security architecture but often lack the resources and expertise to identify, assess, select and configure optimal solutions. As a result, we believe many customers prefer to seek the guidance of, and purchase components from, a trusted advisor. Our strong relationships with leading MSSPs align with the needs of our enterprise customers and powerfully extend our sales force reach and capabilities.

Partnerships with leading incident response firms

        We have established contractual relationships with more than 100 IR firms, including many industry leaders such as Kroll and Ernst & Young. These firms engage with companies that have experienced a security incident and provide services to investigate the incident and remediate the situation. We provide our IR partners with Carbon Black software at no charge, and we train and certify their personnel in using our software to support their IR engagements. We benefit from this arrangement because our IR partners recommend the use of our software to their client companies and refer them to us as prospective customers. In 2017, our IR partners leveraged our platform in 374 incident response engagements. We believe our IR partnerships are a significant competitive strength that extends our ability to build sales pipeline and acquire new customers.

Strategic partnerships with IBM and VMware

        We have established significant and promising partnerships with both IBM and VMware, two of the largest and most influential technology companies in the world. Both of these partnerships include joint go-to-market, product integration, and reselling components. With respect to IBM, we have product integrations with three of IBM's core security-related offerings (BigFix, Qradar and Resilient), and IBM is able to resell Carbon Black products in the over 130 countries in which they operate. With respect to VMware, we have developed a joint solution, Cb Defense for VMware, which is integrated with VMware AppDefense, to protect applications running in virtualized data centers. Both Carbon Black and VMware, as well channel partners of both companies, are able to sell the bundled offering. We believe these relationships are a competitive strength that will enable us to reach the large global customer bases of these technology leaders.

Deep security DNA

        Our management and technical leadership teams are comprised of cyber security leaders who have deep expertise from leading corporations and government organizations, such as the National Security Agency, the Department of Defense and the Central Intelligence Agency. As of December 31, 2017, 58 members of our technical staff had previously served on the front lines of the cyber war in an offensive or defensive capacity. Our extensive background in offensive and defensive cyber security positions us to respond to new threats and innovate products that protect against the most dangerous cyber attacks.

112

---

Table of Contents

Our Growth Strategy

        The key elements of our growth strategy include:

        Drive new customer growth.    We operate in a large, growing market that offers substantial opportunities to grow our customer base. We believe most organizations, regardless of industry, size or location, would benefit from our next-generation endpoint security platform and solutions, as cyber attacks continue to evade legacy security defenses. We are pursuing expansion of our customer footprint globally by continuing to grow our sales organization and expand and leverage our channel partnerships. We also believe we have a significant opportunity to increase our global market penetration in terms of customer type, segment (such as government) and geography.

        Expand the use of our solutions by our existing customer base.    With more than 3,700 customers across industries and geographies, we believe we have a significant opportunity to sell additional Carbon Black solutions to our existing customers. Our sales organization includes a dedicated Customer Success Team, which focuses exclusively on customer engagement and education to drive loyalty and increased purchases. Since the beginning of 2016, we have launched three new products. Our extensible platform allows us to develop new solutions rapidly and at low cost. As we develop and deploy additional security offerings on the Cb Predictive Security Cloud platform, we see significant additional opportunity to cross-sell and upsell as customers benefit by addressing multiple security requirements through a single platform.

        Strengthen relationships with channel distributors and strategic partners.    Our relationships with our channel partners are a significant strength for our company. We have established a formidable channel composed of over 350 of the world's leading MSSPs, IR firms, distributors and VARs. In the three months ended December 31, 2017, 94% of our new and add-on business was closed in collaboration with our channel partners. We plan to drive operating leverage and greater sales by continuing to expand our sales channel, particularly in international regions where we can benefit from the local expertise and existing relationships of these partners. In August 2017, we announced a strategic partnership with VMware to secure virtual workloads in their environments, and in October 2017, we announced an expansion of our partnership with IBM to deliver Cb Response to IBM customers. We intend to continue to leverage these strategic partnerships and establish new ones in order to grow our business in the future.

        Grow our international business.    In 2016, we generated approximately 12% of our revenue from customers located outside of the United States. We believe there is significant opportunity to grow our international business, and we have expanded our international operations to include Europe, the Middle East, Asia Pacific and Australia. In 2015 and 2016, we established our Asia Pacific headquarters in Singapore and opened offices in Tokyo and Melbourne. We intend to continue our international expansion model of entering new markets through our channel partners and then incubating growth through inside sales teams based in regional hubs.

        Continue to innovate and add new offerings to our platform.    We will continue to make investments in research and development to enhance our platform and product functionality. In 2016 and 2017, we released major enhancements to the Cb Predictive Security Cloud platform, including innovations in our streaming analytics technology and investments in our open architecture, to support a larger ecosystem of partners. Leveraging the Cb Predictive Security Cloud Platform and the unfiltered data that we collect, we intend to build and deliver new offerings that enable us to expand beyond endpoint security to adjacent security markets. We intend to develop and offer a version of Cb Response built as a native solution on the Cb Predictive Security Cloud Platform, designed to support threat hunting and incident response for security teams; a "live operations" solution, designed to help customers discover, investigate, and manage endpoint assets in their organization; and a "workloads" solution, designed to secure workloads that run in public cloud environments.

113

---

Table of Contents

        Increase sales to the U.S. federal government.    We have a dedicated federal subsidiary and federal sales team, focused on selling our solutions to departments and agencies of the U.S. federal government. We have established significant traction by winning major deals with various branches of the U.S. federal government. Building on this successful track record, we believe we are well positioned to increase sales to the U.S. federal government.

        Selectively pursue acquisitions of complementary businesses, technologies and assets.    We believe we have established a successful track record of identifying, acquiring and integrating strategic businesses, technologies and assets, including our acquisitions of Carbon Black in 2014, Objective Logistics Inc. and VisiTrend, Inc. in 2015 and Confer Technologies, Inc. in 2016. We will continue to seek opportunistic acquisitions that complement and expand the functionality of our products and services, add to our technology or security expertise, or bolster our leadership position by gaining access to new customers or markets.

Cb Predictive Security Cloud Platform

        The Cb Predictive Security Cloud Platform is an open, multi-tenant, scalable, and extensible cloud-based platform. It provides a set of core platform capabilities—including endpoint data collection, streaming analytics, collective intelligence and open APIs—as well as a set of security services that leverage these core capabilities to power Carbon Black products:

•

Unfiltered endpoint data collection.  Unlike other vendors that take a "filtered" approach by capturing a subset of data at select points in time, our platform collects all endpoint data without any filtering. Our differentiated "unfiltered" approach is critically important, because it is not possible to know in advance how an adversary will attempt an attack; the attacker might use novel methods or malware that has never been seen before. Therefore, it is imperative to gather and analyze all endpoint data. In addition, our customer footprint comprises a large cross section of organizations that are among the most heavily targeted by highly sophisticated and novel cyber attacks. These include industry leaders in streaming media, social networking, search and online advertising, investment banking and ridesharing services, among others. The result of these combined factors is a uniquely rich and high-value dataset that powers our analytics, generating better predictive capabilities by virtue of the completeness and high quality of the data.



•

Proprietary data shaping technology.  Our unfiltered data approach, which we believe is fundamental to deliver the most effective endpoint security, required us to overcome several difficult technical challenges, which we refer to as the "edge to cloud data pipeline problem." These challenges centered on how to reliably collect and cost effectively analyze and store massive amounts of data from edge devices (i.e., endpoints) in the cloud. To address those challenges, we have developed proprietary data shaping technology that smooths bursts of endpoint data activity; optimizes bandwidth demands to move massive amounts of endpoint data; compresses data at a high ratio to reduce the cost of storing massive amounts of data; and leverages a graph-like custom model for endpoint data that allows analysis of the data in multiple ways for multiple use cases. We believe our proprietary data shaping technology creates a strong and lasting competitive advantage not just in endpoint security, but also as we seek to disrupt and consolidate adjacent security markets that leverage endpoint data.



•

Streaming analytics and collective intelligence.  Our platform leverages event stream processing, a technology that has revolutionized other industries such as high-speed algorithmic financial trading, to analyze massive amounts of unfiltered data captured from millions of endpoints across the Carbon Black customer footprint. Additional analytic techniques include dynamic and static behavioral analysis, machine learning and reputation analysis and scoring, which are applied to the unfiltered endpoint data our products collect in order to predict, prevent, detect, respond to and remediate attacks. Analysis goes beyond inspecting attributes of files and includes analyzing

114

---

Table of Contents

behavior on the endpoint and the relationships between activities on the endpoint in order to identify malicious intent. Our data is enhanced with collective intelligence gathered from numerous proprietary and third-party data sources and includes reputation scoring, threat indicators, and attack classification. Collective intelligence combines data from our in-house threat research unit, industry-leading third-party intelligence sources, such as the Facebook Threat Exchange, and insights from the Cb User Exchange, which is our online community of more than 10,000 users that include security experts from across our ecosystem of more than 400 channel partners including leading MSSPs, IR firms and security-focused VARs. Customers can leverage collective knowledge and information, which is anonymized, to mutually strengthen their security posture.

•

Extensible and open architecture.  The Cb Predictive Security Cloud platform is designed with an extensible and open architecture via open APIs. Not only does this allow customers and partners to build their own analytics, automation and orchestration capabilities on top of our platform, it also enables us to rapidly and cost effectively build and deliver additional security offerings that address adjacent security categories beyond endpoint security by leveraging our core platform capabilities of unfiltered endpoint data, streaming analytics and collective intelligence. We are able to deliver those offerings to customers via a single agent and single console, which helps customers simplify their security operations and reduce costs through lower deployment, integration and management overhead.

Our Software Solutions

        Powered by the Cb Predictive Security Cloud Platform, our software solutions are designed to address a broad set of use cases and customer requirements, providing what we believe is the most complete next-generation security offering on the market. Our customers deploy our software solutions across physical and virtual endpoints, including servers, desktops, laptops, and fixed-function devices, to augment or replace traditional signature-based antivirus solutions on their endpoints. Our software solutions include:

•

Cb Defense, a leading NGAV and endpoint detection and response solution;



•

Cb Response, a market-leading solution for threat hunting and incident response;



•

Cb Protection, a market-leading product for application control to lock down critical infrastructure;



•

Cb Defense for VMware, a new offering to protect applications running inside virtualized data centers; and



•

Cb ThreatSight, a managed service for Cb Defense customers, designed to monitor, prioritize, and analyze threats.

115

---

Table of Contents

        Cb Defense.    Cb Defense is a cloud-delivered solution that combines NGAV and endpoint detection and response, or EDR, capabilities. Built as a native offering on the Cb Predictive Security Cloud platform, it is lightweight, fast to deploy, and easy to manage. Cb Defense is designed to deliver the best endpoint security with the least amount of administrative effort, protecting against the full spectrum of modern cyber attacks, including the ability to detect and prevent both known and unknown attacks. In addition, Cb Defense provides a suite of response and remediation tools, including "live response," which allows security personnel to perform remote live investigations, intervene with ongoing attacks and instantly remediate endpoint threats. Customers deploy Cb Defense either to augment or replace legacy antivirus products. Cb Defense leverages the powerful capabilities of the Cb Predictive Security Cloud, applying our unique streaming analytics to unfiltered endpoint data in order to predict, detect, prevent, respond to and remediate cyber threats. Cb Defense is available directly or via our channel partners as software-as-a-service.

        Cb Response.    Cb Response is a market-leading incident response and threat hunting solution designed for security operations center, or SOC, teams. Cb Response continuously records and captures unfiltered endpoint data, so that security professionals can hunt threats in real time and visualize the complete attack kill chain. It provides advanced tools enabling users to understand the current state of an endpoint, perform remote live investigations, intervene with ongoing attacks and instantly remediate endpoint threats. Cb Response leverages the Cb Predictive Security Cloud's aggregated threat intelligence, which is applied to our endpoint activity system of record for evidence of these identified threats and patterns of behavior. In addition, we are able to apply new patterns and indicators to historical endpoint data to identify previously unknown attacks. Top SOC teams, IR firms and MSSPs have adopted Cb Response as a core component of their detection and response capability stack. Customers that augment or replace legacy antivirus solutions with Cb Response do so because those legacy solutions lack visibility and context, leaving customers blind to attacks. Cb Response is available via MSSP or directly via on-premise deployment, virtual private cloud or software-as-a-service.

        Cb Protection.    Cb Protection is the market-leading application control solution, used by organizations to lock down servers and critical systems, prevent unwanted changes, and ensure continuous compliance with regulatory mandates. Leveraging the Cb Predictive Security Cloud, Cb Protection utilizes a combination of cloud reputation services, IT-based trust policies and multiple sources of threat intelligence to ensure that only trusted and approved software is allowed to execute on an organization's critical systems and endpoints. IT, compliance, infrastructure and security teams use Cb Protection to establish automated software execution controls and protection policies that safeguard corporate and customer data. Cb Protection works with existing software distribution systems and reputation services to automate approval of trusted software and eliminate whitelist management. Customers often deploy Cb Protection to replace ineffective legacy antivirus products. Cb Protection is available through MSSPs or directly through on-premise or virtual private cloud deployment.

        Cb Defense for VMware.    Pre-integrated with VMware's AppDefense, Cb Defense for VMware is a new offering built as a native solution on the Cb Predictive Security Cloud. Developed jointly as part of our strategic partnership with VMware, the integrated solution is designed to stop threats to applications inside the virtualized data center. VMware has more than 500,000 customers globally who use its products to operate virtualized data centers (running more than 60 million virtual machines), and had an 83% market share by revenue of the virtualization software market in 2016, according to IDC. Protecting assets from cyber attacks in these virtualized environments has specific requirements that are uniquely addressed by our joint solution. The solution combines the ability to lock down applications and infrastructure in a "least privilege" model; behavioral threat detection and prevention; and automated response, including the ability to suspend or quarantine a compromised virtual machine. In our bidirectional reselling agreement, both VMware and Carbon Black, as well as our channel partners, are able to sell the bundled offering.

116

---

Table of Contents

        Cb ThreatSight.    As enterprises face a shortage of skilled security professionals, security teams often spend too much time monitoring and validating alerts, which limits their ability to address other security needs. Moreover, when prevalent outbreaks occur, security team investigations are limited by the resources and data available in their own environment. In addition, it is difficult to craft an effective remediation plan before the full scope of an event is determined. Cb ThreatSight solves all these problems by providing subscription-based monitoring for Cb Defense customers, which validates and prioritizes alerts, uncovers new threats, and accelerates investigations with capabilities such as predictive root cause reporting. Cb ThreatSight is staffed by threat experts who keep watch over the customer's environment 24x7 and advise customers on security issues.

Our Technology

        Our core technologies are purpose-built to combat advanced threats and enable greater efficiency for security operations personnel. These technologies (several of which are patented or patent pending), which serve as the foundation for our Predictive Security Cloud and product offerings, are: (i) unfiltered data collection, (ii) cloud-based, big data processing, (iii) a streaming analytics engine, (iv) a zero-trust prevention engine, (v) extensible detection, (vi) live response, (vii) open APIs and (viii) a reputation scoring engine.

        We have built and refined our technology over the course of 15 years of research and development, and we believe each technology represents a competitive advantage for us in the market.

•

Unfiltered Data Collection.  Our innovative approach to unfiltered endpoint data collection powers all of our capabilities, which span the security lifecycle. Through our use of unfiltered data, we are able to provide more accurate and more comprehensive protection due to the granularity and fidelity of the data we collect. In addition, in conjunction with our threat intelligence, the collection of unfiltered endpoint data enables customers to look at their environment retrospectively: customers can go back in time, against recorded and centrally stored data, to see if new emerging threat intelligence indicators, such as a previously unknown behavioral pattern, hash or other indicator of compromise were ever present in their environment.

•

Cloud-based, Big Data Processing.  Our unfiltered endpoint data approach, when aggregated in our cloud across all our customers, results in big data at a massive volume, variety and velocity. To support our cutting-edge cyber security use cases, we have built a proprietary system that allows us to collect, index, search and transform this data at low latency and cost while maintaining a level of flexibility that supports future expansion of capabilities.

117

---

Table of Contents

•

Streaming Analytics Engine.  Our detection and prevention engine leverages event stream processing technology to continuously analyze unfiltered endpoint data. It tracks the state of each potential attack and updates the associated risk as additional operations occur, such as the launching of additional processes, copying of files or creation of network connections. This stateful behavior detection uses advanced analytics techniques—such as behavioral analysis, reputation analysis, artificial intelligence and machine learning—and allows our system to identify complex, multi-step attack patterns, whether they are file-based or file-less in origination, that evade traditional detection and prevention engines.

•

Zero Trust Prevention Engine.  This "Zero Trust" approach is used to lock down servers and critical systems by enabling organizations to approve or deny various behaviors, on a policy basis, including registry changes, file system operations, script execution, device usage (such as USB keys) and memory manipulation. This empowers customers to allow or restrict individual applications entirely or limit their ability to perform particular actions. Examples include allowing web browsers to run, but restricting them from loading particular plugins or performing memory operations should those browsers become exploited. In addition, we have the capability to deny specific behaviors associated with malicious intent. This is a critical capability against attacks that leverage known good software to perform malicious activities or zero-day threats that are unknown by the entire security community and thus bypass traditional tools.



•

Extensible Detection.  We have designed a syntax engine for patterns of attacker behavior that allows for easy sharing across customers and partners, easy ingesting of third-party feeds and easy exporting into industry standard formats such as Structured Threat Information Expression and Trusted Automated Exchange of Indicator Information. These patterns are primarily sourced from four groups: (i) vendors and commercial providers who showcase common malicious patterns, (ii) expert users who share data with the Cb Predictive Security Cloud via the Cb User Exchange, our online community of security professionals across our customer and partner network, (iii) advanced analytics on our customer endpoint data provided by the Cb Predictive Security Cloud and (iv) our in-house threat intelligence team. This sharing system does not impact endpoint performance and allows alerts to be emailed, sent to SIEM systems, fed into our proprietary automation engine and sent to a correlation or orchestration engine that may exist in a customer's environment.



•

Live Response.  We provide proactive recovery, remediation and deep investigation capabilities during all stages of an incident. Our technology provides an incident responder with real-time access to the suspected endpoints, regardless of location. From a central console, live response enables operational efficiency, including the uploading of additional forensics tools, downloading of more data, isolating of network access and terminating of malicious activity. Alternatively, these operations can be automated based on enterprise-specific rules.

118

---

Table of Contents

•

Open APIs.  Our solutions provide organizations with an open platform for seamless integration and extensibility, improving the economics of security operations by enabling automation and reporting. Our open APIs also facilitate faster security response times by easily integrating endpoint data with third-party security products such as firewalls, detonation tools and exploit mitigation tools, thereby multiplying the value of the customer's existing security technology investments. Our APIs allow response personnel to both "pull in" capabilities from other security solutions and threat intelligence, as well as expose and "push out" the data captured by our software. As of December 31, 2017, more than 120 integrations with products from over 70 technology partners have been developed.



•

Reputation Scoring Engine.  Our reputation scoring algorithm encompasses a comprehensive catalog of executables, drivers and patches found in commercial applications and software packages. Malware and other unauthorized software that affect Windows, Mac and Linux computers are also indexed. Our reputation scoring engine uses a number of data points, such as age, prevalence, size, source, publisher, community actions, and the relationship to other diagnosed patterns and files to provide our customers with an analysis of the likelihood that the file poses a threat. To ensure that relevant new data is included in our reputation scoring and is marked for dissemination, we have developed internal systems to update our dataset and analytics when new patches, operating system versions and malicious software are discovered.

Customers

        Our customer base, which includes both direct sale customers and customers with one or more subscriptions to our platform through channel partners, has grown from approximately 1,774 customers as of December 31, 2015 to over 3,700 customers as of December 31, 2017. We have experienced strong growth in the number of customers who purchase our cloud-based solutions, with 49 customers in 2015, 398 customers in 2016 and 1,605 customers in 2017 purchasing our cloud-based solutions.

119

---

Table of Contents

        Our customer base comprises many leading Fortune 1000 companies, including 33 of the Fortune 100. Our software is used by organizations of various sizes and types including large and small businesses, universities, and government entities. Our solutions are industry-agnostic—our current customer base spans a broad range of industry verticals, including financial services, retail, technology, manufacturing, services, utilities, healthcare, oil and gas, education and government. Our revenue is not dependent on any single customer; however, sales to customers through the reseller agreement with Optiv Security, Inc. accounted for approximately 35%, 31% and 27% of our revenue in the years ended December 31, 2015, 2016 and 2017, respectively. See the section titled "Business—Our Partners—Channel Partners" for additional information about our reseller relationship with Optiv Security, Inc. and other channel partners.

Case Studies

MLB

        Major League Baseball, or MLB, is one of the world's premier professional sports organizations. Comprised of 30 Clubs in North America as well as international leagues and operations, MLB has millions of fans and spectators throughout the world.

        Situation:    MLB's Cybersecurity team helps secure critical data, ticket transactions, web presences, game-day, streaming and broadcast operations, and industrial stadium control systems for its 30 clubs across the American and National Leagues. Their end users include many remote and mobile workers, such as scouts and field personnel, who travel extensively. In recent years, MLB, like other professional sports organizations, has experienced a significant rise in being targeted with more aggressive cyber attacks, including ransomware and an increasing number of previously unknown ("zero-day") attacks. As a result, the signature-based approach of traditional antivirus software was not an option for MLB.

        Solution:    MLB extensively evaluated a number of leading security solutions against a wide range of attacks. Following the evaluation, MLB selected Carbon Black, including Cb Response as well as Cb Defense, Carbon Black's NGAV solution built on the Cb Predictive Security Cloud platform. MLB has deployed more than 24,000 Carbon Black agents across the league. MLB chose Carbon Black because they found the comprehensive solution more effective in detecting and preventing attacks than competitive offerings and easier to integrate with other products in their IT infrastructure. In their evaluation of Cb Defense, they were particularly impressed with both its ability to prevent all the attacks they tested it against, in contrast to other products they evaluated, as well as its exceptional ease of use.

        Results:    Since deploying Cb Response in 2015 and Cb Defense in 2016, MLB has achieved far better visibility into potential threats due to the richness of unfiltered data they are able to capture and analyze, resulting in a significantly stronger security posture. MLB has realized a measurable improvement in their security efficacy, including enhanced protection against ransomware and other types of attacks. MLB's incident response capabilities have been significantly enhanced by the depth of functionality of the Carbon Black platform and the broad array of integrations supported by Carbon Black. As a result, satisfaction with Carbon Black across the league has been very high.

Philips Lighting

        Philips Lighting, N.V., or Philips Lighting, is a global market leader with 34,000 employees in over 70 countries, recognized for their expertise in the development, manufacturing and application of innovative (LED) lighting solutions. For over 120 years, Philips Lighting has been at the forefront of innovation, providing high-quality light in public places, professional spaces and homes.

        Situation:    A key objective of their security strategy was to be able to quickly adapt and stay ahead of the evolving threat landscape. After Carl Erickson, Chief Information Security Officer at Philips Lighting, launched the organization's first Security Operations Center, or SOC, his mission was to get to "world-

120

---

Table of Contents

class response capability." That meant finding and deploying a solution providing complete visibility to empower his team and company to conduct business safely.

        Solution:    Philips Lighting extensively examined a number of leading endpoint security solutions against a wide range of attacks. Cb Response, Carbon Black's market-leading solution for high-speed security teams, was the only product they found that gave their SOC a custom level of control over threat intel sources and was able to support their increasingly mobile user base via a cloud-based implementation.

        Results:    Since deploying Cb Response in 2016, Philips Lighting has been able to quickly detect advanced threats and close security gaps. Company-wide indicator sweeps, which took weeks to reach 75% completion with a previous solution, are now able to be completed in a fraction of the time. Leveraging the unfiltered data collection by Cb Response, the Threat Hunting team can perform rapid queries on live and historic endpoint data to identify new, suspicious activity, thereby eliminating the need to acquire a separate hunting sandbox. Overall, the SOC's ability to quickly determine if an emerging threat is present in the environment allows for quicker decision-making by Security leadership.

Large Multinational Manufacturing Organization

        A leading global manufacturer with thousands of employees and operations at over 100 sites in 30+ countries.

        Situation:    After a number of companies in the manufacturing sector were hit by cyber attacks, the organization sought to proactively enhance its endpoint security posture. Their requirements were for an endpoint security product that could be applied at scale and would provide the highest level of protection against malware.

        Solution:    After testing Carbon Black against other endpoint application control products in 2011, the customer deployed Cb Protection across its tens of thousands of workstations and servers. Testing indicated that Cb Protection was significantly more effective than other products in stopping cyber threats.

        Results:    Not long after implementation, the customer was targeted by a broad ransomware attack. Carbon Black protected all targeted machines and the company successfully managed all resulting events. Prior to deploying Carbon Black's Cb Protection product, the customer's IT/Security team had been re-imaging between 200-300 machines per month due to security impacts. Today, that number is nearly zero, translating into significant cost savings.

Leading Global Manufacturing Organization

        With over 50,000 employees across dozens of subsidiaries worldwide, this organization is a global manufacturing company committed to innovation and addressing the needs of its customers.

        Situation:    Global manufacturing companies are increasingly targeted by cyber adversaries who are intent on stealing intellectual property, trade secrets and other valuable assets. In the face of rising cyber attacks across the industry, this manufacturing company wanted to strengthen its security posture. It was seeking a highly scalable, next-generation endpoint security solution that would provide exceptional enterprise visibility for its security operations team, as well as protection against ransomware, commodity and advanced malware, and non-malware attacks.

        Solution:    After testing Carbon Black alongside a number of leading endpoint and antivirus products in 2012, the company decided to deploy Cb Response across over 50,000 computer systems. The Carbon Black solution has provided the company visibility across its global enterprise via a single platform, resulting in operational efficiency gains and improved security threat management for the organization.

121

---

Table of Contents

Large Oil and Gas Organization

        This organization is one of the world's largest companies operating in the oil and gas industry.

        Situation:    As other oil and gas companies across the globe had been experiencing an increasing rate of cyber attacks, this organization sought to proactively strengthen its security posture. The company required a highly scalable endpoint security solution that would provide the highest level of protection against cyber attacks, including ransomware.

        Solution:    The company tested Carbon Black against the leading antivirus products and selected both Cb Protection and Cb Response. Since 2013, it has deployed Cb Protection to secure 23,000 workstations and 5,600 servers, as well as Cb Response to provide advanced detection and response capabilities for 15,000 critical systems. Using Carbon Black, the company has been able to extend the life and sustain the productivity of its existing security systems.

Our Partners

Technology Partners

        Our Carbon Black Integration Network, or CbIN, is a partner program designed to improve cyber security through collective defense and vendor interoperability. CbIN is powered by our open APIs and the Cb Predictive Security Cloud, and provides a network of integrated solutions to cyber security issues. By working together to certify interoperability, we and our technology partners can help customers strengthen their security postures, gain increased visibility into security events and achieve end-to-end advanced threat protection. More than 80 companies are members of our technology partner network, including Software-Defined Data Center, or SDDC, infrastructure provider VMware; network security solutions providers such as Palo Alto Networks Inc., Check Point Software Technologies Ltd., Fortinet Inc., and Lastline, Inc.; threat intelligence providers such as Facebook, Inc., AlienVault, Inc. and ThreatQuotient, Inc.; and analytics and SIEM solutions providers such as Splunk, Exabeam, Inc. and LogRhythm, Inc.

        In the case of Splunk, for example, a leader in big data and analytics, we have established a partnership to provide security operation teams with fast, actionable intelligence that unites real-time endpoint data from Cb Response with other relevant security information, such as network and other enterprise data sources. To make integration easier and improve operational intelligence, Carbon Black and Splunk have developed an application to automatically import file activity and event data from Cb Protection into Splunk Enterprise for advanced security reporting and analysis.

Strategic Partners

        We have established strategic partnerships with VMware and IBM, which we believe create a significant competitive advantage.

        IBM.    In 2017, we launched a far-reaching technology and business partnership with IBM Security, which we believe strongly positions us to leverage IBM's extensive global distribution and trusted brand to drive new business. The partnership includes four key elements: (1) IBM has the right to resell our solutions in all 130+ countries in which it conducts business; (2) the partnership includes the integration of our products with IBM's QRadar (security intelligence), Resilient (orchestration) and BigFix (endpoint management) solutions, which IBM markets and sells globally; (3) IBM is adopting Cb Response as the core product for its X-Force Incident Response Services; and (4) IBM is a Carbon Black MSSP partner, utilizing Carbon Black products in its managed EDR and NGAV offerings. We believe the deep and broad scope of our partnership with IBM provides a substantial competitive advantage.

        VMware.    We established a significant technology and business partnership with VMware in 2017, which we believe strongly positions us to leverage VMware's global market leadership in providing SDDC infrastructure. As enterprises shift workloads to the cloud, VMware sits at the center of this major trend as

122

---

Table of Contents

the leading provider of virtualization technology for SDDC environments. Securing the virtual endpoints that run those workloads in the cloud is critical. VMware selected Carbon Black as a key partner for its security offerings. The relationship includes an exclusive bidirectional reseller arrangement that gives Carbon Black access to VMware's 500,000 customers running 60 million virtual machines, as well as joint product development of an integrated solution for securing cloud workloads and joint go-to-market efforts. Through our partnership with VMware, we are well positioned to capture a significant share of the cloud security software market, which according to IDC is a $5.3 billion opportunity in 2016.

Channel Partners

        Our go-to-market strategy leverages channel partners, including MSSPs, IR firms and security-focused VARs, to drive adoption of our product. These partners are an important driver of new business opportunities through their recommendations of our platform and direct sales referrals. In 2017, our MSSP and IR partners accounted for over 300 new customers.

        Managed Security Service Providers.    MSSPs serve as trusted advisors to their customers, and provide an outsourced and managed security solution, including security hardware, security software and security operations. As the global shortage of security professionals continues to grow, we believe MSSPs will increasingly become a preferred solution for enterprises across industries, as they provide a level of security expertise and resources that organization may not be able to procure and maintain on their own. We have entered into partnership agreements with more than 130 MSSP partners globally, who utilize our solutions as components of broader managed service offerings in the form of hardware, hosting, software integration or technology outsourcing. MSSP partners help drive sales of our platform through a broader funnel of sales opportunities which require full managed solutions. Of the 11 companies designated as "most significant" in Forrester's Wave report on North American Managed Security Services Providers, six use our solutions including IBM, Secureworks and Trustwave.

        Incident Response Firms.    IR firms work with enterprise customers to respond to and mitigate the operational, financial and reputational risks associated with data breaches. Our IR partners deploy Cb Response into an enterprise environment to assist in their client investigation and incident response service engagements, with the goal of referring those clients to us following the engagement. To date, we have trained more than 1,000 partner personnel on our products. We have entered into partnership agreements with more than 100 IR firms including many of the industry leaders, such as IBM, Kroll, Optiv Security, Inc., Rapid7, Inc., Ernst & Young and Solutionary, Inc. We believe that our training program and partnership agreements provide a significant competitive moat against other IR solutions. Our IR partners serve as a powerful lead engine for new customers as they demonstrate the effectiveness and value of our solutions, recommend that customers deploy Carbon Black into their environment on an ongoing basis and connect customers with our direct sales teams.

        VARs and Distribution.    Our channel strategy also extends our reach by utilizing leading distributors and security-focused VARs, as well as a wide range of traditional software resellers on a global level. To date, we have partnerships with more than 200 leading security-focused VARs, such as Optiv Security, Inc., CDW Corporation, Dimension Data Holding Plc and SHI International, and global distributors, such as Arrow Electronics, Inc. Optiv Security, Inc., one of our channel partners, accounted for approximately 35%, 31% and 27% of our revenue in the years ended December 31, 2015, 2016 and 2017, respectively. Our relationships with resellers are generally governed by our standard, non-exclusive reseller agreement, which provides for the appointment of the channel partner in a specified territory and payment to us from the reseller within 30 days of the date of invoice. Additionally, these agreements generally have a one year automatically renewing term, and we may terminate the reseller agreement without cause with 30 days written notice.

123

---

Table of Contents

Sales and Marketing

        Sales.    We sell our products through a channel sales model that leverages various partners, including security-focused VARs, distributors, MSSPs and IR firms. By utilizing a channel model, we are able to generate increased volumes of sales leads, expand our geographic sales reach to key markets such as Europe, the Middle East, Africa and Asia-Pacific and sell to customers that prefer to outsource some or all of their security needs to MSSPs. Our sales team collaborates with our channel partners to identify new sales prospects, renew expiring contracts and sell additional products and services to existing customers. Our sales team works closely with our end-use customer prospects at every stage of the sales cycle, regardless of whether the prospect is sourced directly or indirectly. This approach allows us to leverage the benefits of the channel while also building long-term, trusted relationships with our customers. In the three months ended December 31, 2017, 94% of our new and add-on business was closed in collaboration with our channel partners.

        Our sales team is organized by customer segment. Larger, enterprise customers (greater than 5,000 employees) are addressed through a field sales organization and we use an inside sales force to sell to the SMB (less than 500 employees) and Corporate (500-5,000 employees) markets. We have a customer success team that focuses exclusively on customer value and education to drive retention and increased sales of our solutions. Our sales representatives are supported by sales engineers with deep technical domain expertise. Our sales engineers act as the liaison between customers and our marketing and product development organizations. Our sales organization includes a dedicated channel team that is responsible for monitoring the effectiveness of our existing channel partners, including VARs, distributors, MSSPs and IR firms, and for sourcing and qualifying new channel partners.

        Our sales cycle varies by industry and size of company, but can often last several months. However, some deals close in only a few weeks due to the shorter time required to provide a product demonstration rather than perform a full "proof of concept." In addition, organizations that have experienced security breaches typically have shorter sales cycles due to the relative urgency to implement our products to remediate breaches and prevent future attacks.

        Marketing.    Our marketing is focused on building our brand reputation, increasing market awareness of our platform, driving customer demand and a strong sales pipeline and collaborating with our channel partners around the globe. We use a data science driven, multi-channel approach to deliver and promote targeted content to demonstrate our thought leadership in security, to drive interest in our platform and to generate leads and opportunities for our sales organization.

        We engage with our customers, our partners and our greater community to promote education and awareness of the threat landscape and to promote effective and expanded use of our software within our community. We work with our own security experts and researchers, as well as the broader security community, to share important information about vulnerabilities and threats. We share that information through the Cb User Exchange, our active online community, our public website, social media and traditional public relations. In addition, we attend and host regional and national events to engage both customers and prospects, deliver product training and foster community collaboration.

        Our marketing team consists primarily of corporate marketing, product marketing, channel marketing, field marketing, account and lead development, operations and corporate communications. Marketing activities include demand generation, advertising, managing our corporate Website and partner portal, attending trade shows and conferences, press and analyst relations and increasing customer awareness.

Research and Development

        Our research and development organization works to plan, build, deliver and maintain our current multi-product offerings across our customer base while driving innovation with new enhancements,

124

---

Table of Contents

features, and products. We consider our innovative approach to product development to be an asset to our business. We believe our investments in products, our R&D talent and our security community are vital to furthering our leadership and competitive advantage in the security space.

        Our engineers, product managers, designers and threat researchers have an extensive reach into the security and cloud platform communities, among both practitioners and developers. We work closely with our customers to continuously develop new functionality while enhancing and maintaining our existing solutions. We utilize agile software development techniques, in combination with a cloud-based delivery model, which allows us to deliver enhanced software features across our customer base on a frequent basis. Through our standardized agile process, our delivery teams are kept closely aligned with customer needs while maintaining flexibility to react to changing market demands. Research and development expense was $24.0 million, $36.5 million and $52.0 million during 2015, 2016 and 2017, respectively.

Competition

        We operate in the highly competitive cyber security market that is characterized by constant technological innovation, shifting customer requirements and fragmented approaches. The state of our market and the pace of innovation are highly correlated to the ever evolving and equally competitive threat landscape.

        Within the endpoint security market, we observe the following three general categories of competitors:

•

Large incumbent security providers who provide a very broad range of approaches and solutions with traditional approaches, such as antivirus protection, that appeal to the mass market, such as McAfee, Inc. and Symantec Corporation.



•

Large network security providers who are pushing past their core competencies into the next-generation endpoint security market through acquisitions and by leveraging their existing footprint to gain distribution, such as Cisco Systems, Inc., Palo Alto Networks, Inc. and FireEye, Inc.



•

Niche security providers who offer point solutions that generally focus on one or more advanced security problems involving malware prevention, such as Cylance Inc., or detection and response, such as CrowdStrike Inc. Additionally, some providers, such as Tanium Inc., offer solutions generally focused on areas that could be related to security, such as endpoint management.

        As the market for next-generation endpoint security grows and IT budgets are either created or expanded to support the procurement of advanced threat protection solutions, we believe the cyber security space will attract more highly specialized niche vendors as well as larger providers with the ability to acquire additional capabilities and market their products more effectively on a global scale. The dimensions of competition include, but are not limited to:

•

completeness and efficacy of capabilities specifically as they relate to the security operations lifecycle;



•

ease of administration and impact of the solution on end users;



•

flexibility of deployment models and fit between the security approach and the customer's culture;



•

exposure of root cause and the ability of the solution to improve security posture over time;



•

ability to integrate into existing security stacks and scalability to support all sizes of customers;



•

audit and compliance controls and the corresponding reduction in security risk;

125

---

Table of Contents

•

brand and quality of the overall customer interaction experience; and



•

total cost of ownership.

        We believe we compete favorably on these factors due, in large part, to the features and functionality of our products, our open architecture, our broad community of security professionals and our deep security expertise. Although certain of our competitors may have greater resources, better brand recognition, deeper customer relationships, larger existing customer bases or more mature intellectual property portfolios, we believe that we are well positioned to continue to be a leader in the endpoint security space.

Intellectual Property

        Our success depends in part upon our ability to protect our core technology and intellectual property. We rely on, among other things, patents, trademarks, copyrights and trade secret laws, confidentiality safeguards and procedures and employee non-disclosure and invention assignment agreements to protect our intellectual property rights.

        We have approximately 20 U.S. patents and patent applications, and approximately the same number of foreign counterpart patents and patent applications. We cannot be certain that any of our patent applications will result in the issuance of a patent or that the examination process will result in patents of valuable breadth or applicability. In addition, any patents that may be issued may be contested, circumvented, found unenforceable or invalidated, and we may not be able to detect or prevent third parties from infringing them. We also license software from third parties for integration into our products, including open source software and other software available on standard terms.

        We have registered the "Carbon Black" name and logos in the United States and certain other countries. We have registrations and/or pending applications for additional marks in the United States and other countries; however, we cannot be certain that any future trademark registrations will be issued for pending or that future applications or any registered trademarks will be enforceable or provide adequate protection of our proprietary rights.

        We are the registered holder of a variety of domestic and international domain names that include carbonblack.com, as well as similar variations on those names.

        We control access to and use of our proprietary software, technology and other proprietary information through the use of internal and external controls, including contractual protections with employees, contractors, end customers and partners, our software is protected by U.S. and international copyright laws and aspects of our software are also protected by patent and trade secret laws. Despite our efforts to protect our software, technology and other proprietary information, unauthorized parties may still copy or otherwise obtain and use our software, technology and other proprietary information. In addition, we intend to expand our international operations, and effective patent, copyright, trademark and trade secret protection may not be available or enforceable or may be limited in foreign countries.

        If we become more successful, we believe that competitors will be more likely to try to develop solutions and services that are similar to ours and that may infringe our proprietary rights. It may also be more likely that competitors or other third parties will claim that our platform infringes their proprietary rights.

        Patent and other intellectual property disputes are common in our industry and we have been involved in such disputes from time to time in the ordinary course of our business. Some of our competitors have many more patents than we do, and this asymmetry may provide them with an advantage over us in the event of a patent dispute. Competitors, non-practicing entities and other third parties may in the future assert claims of infringement, misappropriation or other violations of intellectual property rights against us. They may also assert such claims against our customers or channel partners, whom we typically

126

---

Table of Contents

indemnify against claims that our solutions infringe, misappropriate or otherwise violate the intellectual property rights of third parties. As the numbers of products and competitors in our market increase and overlaps occur, claims of infringement, misappropriation and other violations of intellectual property rights may increase. Any claim of infringement, misappropriation or other violation of intellectual property rights by a third party, even those without merit, could cause us to incur substantial costs defending against the claim and could distract our management from our business. We may initiate litigation or administrative proceedings to challenge the validity and scope of the third-party rights or to defend against any allegations of infringement, which may also cause us to incur substantial costs and could distract our management team from our business. See "Risk Factors—Risks Related to Government Regulation, Data Collection, Intellectual Property and Litigation—Our intellectual property rights are valuable and any inability to protect our proprietary technology and intellectual property rights could substantially harm our business and operating results." and "Risk Factors—Risks Related to Government Regulation, Data Collection, Intellectual Property and Litigation—Assertions by third parties of infringement or other violations by us of their intellectual property rights, whether or not correct, could result in significant costs and harm our business and operating results."

Employees

        As of December 31, 2017, we had 932 full-time employees, including 161 in services and support, 425 in sales and marketing, 233 in research and development and 113 in general and administrative. As of December 31, 2017, we had 841 full-time employees in the United States and 91 full-time employees internationally. None of our U.S. employees are covered by collective bargaining agreements. We believe our employee relations are good and we have not experienced any work stoppages.

Facilities

        We currently lease approximately 81,991 square feet of space for our corporate headquarters in Waltham, Massachusetts under a lease agreement that expires on April 30, 2022, unless sooner terminated or extended as provided in the lease. We maintain additional offices in Hillsboro, Oregon; Boston, Massachusetts; Southborough, Massachusetts; Palo Alto, California; San Antonio, Texas; Boulder, Colorado; Australia; England; Japan; and Singapore. We also utilize third-party data centers located in the Boston, Massachusetts area. We believe that our current facilities are adequate to meet our ongoing needs, and that, if we require additional space, we will be able to obtain additional facilities on commercially reasonable terms.

Legal Proceedings

        From time to time we may become involved in legal proceedings or be subject to claims arising in the ordinary course of our business. We are not presently a party to any legal proceedings that, if determined adversely to us, would individually or taken together have a material adverse effect on our business, operating results, financial condition or cash flows. Regardless of the outcome, litigation can have an adverse impact on us because of defense and settlement costs, diversion of management resources and other factors.

127

---

Table of Contents

MANAGEMENT

        The following table provides information regarding our executive officers and directors as of March 31, 2018:

        Each executive officer serves at the discretion of our board of directors and holds office until his or her successor is duly elected and qualified or until his or her earlier resignation or removal. There are no family relationships among any of our directors or executive officers.

Executive Officers

        Patrick Morley has served as our President, Chief Executive Officer and a member of our board of directors since December 2007. From 2005 to 2007, Mr. Morley served in a variety of roles for Corel Corporation, including Chief Operating Officer and Executive Vice President of Sales for Americas. Prior to that, Mr. Morley served as Chief Executive Officer and President of Imprivata, Inc. Mr. Morley has served on the board of a number of private companies. Mr. Morley holds a B.A. from Providence College. We believe that based on Mr. Morley's knowledge of our company and our business, and his service as our President and Chief Executive Officer, Mr. Morley is qualified to serve on our board of directors.

        Mark P. Sullivan has served as our Executive Vice President and Chief Financial Officer since October 2015. From 2009 to 2015, Mr. Sullivan served in a variety of roles with Aspen Technology, Inc., including Executive Vice President from 2010 to 2015 and Chief Financial Officer from 2009 to 2015, Senior Vice President from 2009 to 2010 and a financial consultant in 2009. From 1994 to 2008, Mr. Sullivan served in various financial executive positions at Fidelity Investments. Mr. Sullivan holds a B.A. from Middlebury College and a M.S. from the Massachusetts Institute of Technology.

        Thomas Hansen has served as our Executive Vice President and Chief Revenue Officer since July 2017. Prior to that, Mr. Hansen served as Global Vice President of Revenue of Dropbox, Inc. from 2015 to 2017. From 2001 to 2015, Mr. Hansen served in a variety of roles at Microsoft Corporation, including Worldwide Vice President of Small and Medium Business from 2010 to 2015, Worldwide General Manager of Distribution from 2009 to 2010, Regional General Manager from 2007 to 2009 and Regional Director from

128

---

Table of Contents

2001 to 2006. Mr. Hansen holds a MSc and a BSc in Economics from Copenhagen Business School in Denmark.

        Ryan Polk has served as our Senior Vice President and Chief Product Officer since January 2017. From 2015 to 2017, Mr. Polk served as Vice President and Senior Vice President of Product Management at CA Technologies' Agile Management. Prior to that, Mr. Polk held a variety of roles at Rally Software Development Corp. until its acquisition by CA Technologies, including VP of Product Management from 2014 to 2015 and Transformation Consultant from 2011 to 2014. From 2009 to 2011, Mr. Polk served as Director of Engineering and Enterprise Agile Coach of WMS Gaming, a subsidiary of WMS Industries, Inc. Mr. Polk holds a B.A. from the University of Nevada, Las Vegas.

        Michael Viscuso has served as our Chief Technology Officer since December 2015, and previously served as our Chief Strategy Officer from February 2014 to December 2015 and Senior Vice President of Products from January 2016 to January 2017. Since June 2017, Mr. Viscuso has served as a Venture Partner at Accomplice. Since 2009, Mr. Viscuso has also served as a Co-Founder of Kyrus Tech, Inc. From 2011 to 2014, Mr. Viscuso was the Chief Executive Officer of Carbon Black, Inc., which we acquired in 2014 (our name at the time was Bit9, Inc.). Mr. Viscuso holds a B.S. from Villanova University.

Non-Employee Directors

        Maria A. Cirino has served as a member of our board of directors since February 2005. Ms. Cirino serves as a Managing Partner and Co-Founder of .406 Ventures, a venture capital firm, where she has been since 2006. From 2005 until 2006, Ms. Cirino served as Senior Vice President of VeriSign Managed Security Services, a division of VeriSign, Inc., a provider of infrastructure services for Internet and telecommunications networks. From 2000 until 2005, Ms. Cirino served as Co-Founder, Chief Executive Officer and Chairman of Guardent, Inc., a managed security services corporation. Ms. Cirino served as a board member of Keane, Inc., a provider of information technology and business process services, from 2000 until 2007, and has also served on the board of a number of private companies. Ms. Cirino holds a B.A. from Mount Holyoke College. We believe that Ms. Cirino's experience in executive-level positions at technology companies and in working with numerous early-stage companies through her venture capital career provide her with the qualifications and skills to serve as a member of our board of directors.

        Jeffrey Fagnan has served as a member of our board of directors since December 2004. Mr. Fagnan has served as a General Partner at Atlas Venture since 2004, and a Founding Partner at Accomplice since 2015. Since 2014, Mr. Fagnan has also served as a Founder of Maiden Lane Ventures, the first online venture capital firm, and Spearhead, a program that funds and mentors first time founder angel investors. Previously, Mr. Fagnan was a Partner with Seed Capital Partners. Mr. Fagnan is also a founder and the President of the nonprofit Technology Underwriting Greater Good, or TUGG. He currently serves on the boards of numerous private companies. Mr. Fagnan holds a B.S. from the University of Alaska and a M.B.A. from the William E. Simon Graduate School of Business at the University of Rochester. We believe that Mr. Fagnan's experience in working with numerous early-stage companies through his venture capital career provide him with the qualifications and skills to serve as a member of our board of directors.

        Peter Thomas Killalea has served as a member of our board of directors since April 2017. Mr. Killalea is the Owner and President of Aoinle, LLC, a consulting firm that he founded in 2014. From 1998 to 2014, Mr. Killalea served in various leadership roles at Amazon.com, Inc., most recently as its Vice President of Technology for the Kindle Content Ecosystem from 2008 to 2014. Previously, he served as its Vice President of Infrastructure and Distributed Systems from 2003 to 2008 and prior to that as Chief Information Security Officer and Vice President of Security. Mr. Killalea currently serves on the board of directors of Capital One Financial Corp., MongoDB, Inc. and Akamai Technologies, Inc. Mr. Killalea previously served on the board of directors of Xoom Corporation from March 2015 until its acquisition by PayPal Inc. in November 2015. Mr. Killalea holds a B.Ed. in Education from the National University of Ireland and a B.S. in Computer Science from Trinity College Dublin in Ireland. We believe that

129

---

Table of Contents

Mr. Killalea's product, technology and security experience, as well as his experience on the boards of public companies, provides him with the qualifications and skills to serve as a member of our board of directors.

        Paul A. Maeder has served as a member of our board of directors since September 2015 and previously from 2006 to 2011. Mr. Maeder serves as a General Partner and Founder of Highland Capital Partners LLC, or Highland, a venture capital firm, where he has been since 1988. Before co-founding Highland, Mr. Maeder spent three years in venture capital concentrating on software investments. He also held engineering and management positions for six years in medical technology companies. He currently serves on the boards of numerous private companies and is currently a director and the chairman of the board of directors of 2U, Inc. Mr. Maeder holds a B.S.E. from Princeton University, a M.S.E. from Stanford University and a M.B.A. from Harvard Business School. We believe that Mr. Maeder's experience investing in the software industry and his experience serving as a board member for numerous early-stage companies through his venture capital career provide him with the qualifications and skills to serve as a member of our board of directors.

        Ronald H. Nordin has served as a member of our board of directors since November 2007. From 1998 to 2005, Mr. Nordin served in a number of roles at Atlas Venture, including as a Senior Partner. Previously, Mr. Nordin served in a variety of senior management roles for information technology companies, including Chief Executive Officer of SQA, Inc. from 1992 to 1997, and a number of roles, including Senior Vice President, at Cognos Incorporated from 1982 to 1992. Mr. Nordin has served on the boards of numerous private companies. Mr. Nordin holds a BASc degree from the University of Waterloo in Canada. We believe that Mr. Nordin's experience in executive-level positions at technology companies, as well as working with numerous early-stage companies through his venture capital experience provide him with the qualifications and skills to serve as a member of our board of directors.

        Joseph S. Tibbetts, Jr. has served as a member of our board of directors since July 2015. Mr. Tibbetts served as the interim chief financial officer of Acquia Corporation, a provider of cloud-based, digital experience management solutions from March 2017 to March 2018. Prior to that, Mr. Tibbetts served as the Senior Vice President and Chief Financial Officer of the Publicis.Sapient unit of Publicis Group SA, from February 2015, when Publicis acquired Sapient Corporation, to September 2015. Previously, from 2006 to 2015, Mr. Tibbetts served in a variety of roles with Sapient Corporation, including Senior Vice President and Chief Financial Officer. Previously, Mr. Tibbetts served as Administrative General Partner of Charles River Ventures and served for 20 years in a variety of roles for Price Waterhouse LLP (now PricewaterhouseCoopers LLP), including Audit Partner and National Director of the Software Services Group. Mr. Tibbetts serves on the boards of numerous private companies and is a director of Vivint Solar, Inc., and Casa Systems, Inc. Mr. Tibbetts holds a B.S. from the University of New Hampshire. We believe that Mr. Tibbetts' finance and accounting experience in executive-level positions at technology companies and in working with numerous early-stage companies through his venture capital career, as well as his experience on the boards of public companies, provide him with the qualifications and skills to serve as a member of our board of directors.

        Anthony Zingale has served as a member of our board of directors since December 2015. From 2010 to 2014, Mr. Zingale served as Chief Executive Officer of Jive Software, Inc. From 2004 to 2006 he served as President and Chief Executive Officer of Mercury Interactive Corporation. From 1998 to 2001, Mr. Zingale served as President and Chief Executive Officer of Clarify Inc. From 2007 to 2017, Mr. Zingale served as a member of the board of directors of Jive Software, Inc. and as its Executive Chairman from 2014 to 2017. From 2009 to 2012, Mr. Zingale served as a member of the board of directors of Service Source International, Inc. From 2007 until 2011, he served on the board of directors of McAfee, Inc. Mr. Zingale also serves on the board of directors for numerous private companies. Mr. Zingale holds B.A. and B.S. degrees from the University of Cincinnati. We believe that Mr. Zingale's experience in executive-level positions at software companies, as well as his experience on the boards of

130

---

Table of Contents

public companies, provide him with the qualifications and skills to serve as a member of our board of directors.

Board Composition

        Our board of directors currently consists of eight (8) members. Our certificate of incorporation and bylaws that will be effective upon the closing of this offering provide that the number of our directors shall be fixed from time to time by a resolution of the majority of our board of directors. Upon the closing of this offering, our board of directors will be divided into three staggered classes of directors. At each annual meeting of stockholders, a class of directors will be elected for a three-year term to succeed the same class of directors whose terms are then expiring. The terms of the directors will expire upon the election and qualification of successor directors at the annual meeting of stockholders to be held during 2019 for the Class I directors, 2020 for the Class II directors and 2021 for the Class III directors.

•

Our Class I directors will be Maria A. Cirino and Joseph S. Tibbetts, Jr.



•

Our Class II directors will be Paul A. Maeder, Anthony Zingale and Peter Thomas Killalea.



•

Our Class III directors will be Patrick Morley, Ronald H. Nordin and Jeffrey Fagnan.

        The division of our board of directors into three classes with staggered three-year terms may delay or prevent a change of our management or a change of control. See the section of this prospectus captioned "Description of Capital Stock—Anti-Takeover Effects of Delaware Law and Our Certificate of Incorporation and Bylaws" for a discussion of other anti-takeover provisions found in our certificate of incorporation and bylaws to be effective upon the closing of this offering.

        Upon the closing of this offering, under the terms of our investors' rights agreement, which is described under "Certain Relationships and Related Party Transactions," (i) SC US GF Holdings, Ltd., an entity affiliated with Sequoia Capital, will have the right to designate one nominee for election to our board of directors so long as SC US GF Holdings, Ltd. and its affiliates hold more than 5% of the shares of our outstanding common stock following the closing of this offering, (ii) we will take certain actions to support such nominee for election and (iii) should such nominee be elected to our board of directors and subsequently be unable to serve or be removed during the course of such director's term, we will take certain actions to appoint a replacement selected by SC US GF Holdings, Ltd. or its affiliates.

Director Independence

        Under the rules of The Nasdaq Global Select Market, independent directors must comprise a majority of a listed company's board of directors within a specified period after the closing of its offering. In addition, the rules of The Nasdaq Global Select Market require that, subject to specified exceptions, each member of a listed company's audit, compensation and nominating and corporate governance committees be independent. Under the rules of The Nasdaq Global Select Market, a director will only qualify as an "independent director" if, in the opinion of that company's board of directors, that person does not have a relationship that would interfere with the exercise of independent judgment in carrying out the responsibilities of a director.

        Audit committee members must also satisfy the independence criteria set forth in Rule 10A-3 under the Securities Exchange Act of 1934, as amended, or the Exchange Act. To be considered independent for purposes of Rule 10A-3, a member of an audit committee of a listed company may not, other than in his or her capacity as a member of the audit committee, the board of directors or any other board committee: (1) accept, directly or indirectly, any consulting, advisory or other compensatory fee from the listed company or any of its subsidiaries or (2) be an affiliated person of the listed company or any of its subsidiaries.

        On April 17, 2018, our board of directors undertook a review of its composition, the composition of its committees and the independence of each director. Based upon information requested from and provided

131

---

Table of Contents

by each director concerning his or her background, employment and affiliations, our board of directors has determined that none of the members of the board of directors, except for Patrick Morley, has a relationship that would interfere with the exercise of independent judgment in carrying out the responsibilities of a director and that each of these directors is "independent" as that term is defined under the rules of The Nasdaq Global Select Market. Our board of directors also determined that Joseph Tibbetts, Jr., Paul Maeder and Ronald Nordin, who comprise our audit committee, Anthony Zingale, Maria Cirino and Jeffrey Fagnan, who comprise our compensation committee, and Peter Thomas Killalea, Maria Cirino and Ronald Nordin, who comprise our nominating and corporate governance committee, satisfy the independence standards for those committees established by applicable Securities and Exchange Commission, or SEC, rules and the rules of The Nasdaq Global Select Market. In making this determination, our board of directors considered the relationships that each non-employee director has with our company and all other facts and circumstances our board of directors deemed relevant in determining his or her independence, including the beneficial ownership of our capital stock by each non-employee director.

Board Leadership Structure and Role of the Board in Risk Oversight

        One of the key functions of our board of directors is informed oversight of our risk management process. Our board of directors does not have a standing risk management committee, but rather administers this oversight function directly through the board of directors as a whole, as well as through its standing committees that address risks inherent in their respective areas of oversight. In particular, our board of directors is responsible for monitoring and assessing strategic risk exposure. Our audit committee is responsible for reviewing and discussing our major financial risk exposures and the steps our management has taken to monitor and control these exposures, including guidelines and policies with respect to risk assessment and risk management. Our audit committee also monitors compliance with legal and regulatory requirements, in addition to oversight of the performance of our external audit function. Our nominating and corporate governance committee monitors the effectiveness of our corporate governance guidelines. Our compensation committee reviews and discusses the risks arising from our compensation philosophy and practices applicable to all employees that are reasonably likely to have a materially adverse effect on us.

Board Committees

        Our board of directors has an audit committee, a compensation committee and a nominating and corporate governance committee, each of which has the composition and responsibilities described below. The audit committee, compensation committee and nominating and corporate governance committee all operate under charters approved by our board of directors, which will be available on our website prior to the closing of this offering.

Audit committee

        Our audit committee oversees our corporate accounting and financial reporting process and assists the board of directors in monitoring our financial systems and our legal and regulatory compliance. Our audit committee will also:

•

oversee the work of our independent auditors;



•

approve the hiring, discharging and compensation of our independent auditors;



•

approve engagements of the independent auditors to render any audit or permissible non-audit services;



•

review the qualifications and independence of the independent auditors;



•

monitor the rotation of partners of the independent auditors on our engagement team as required by law;

132

---

Table of Contents

•

review our financial statements and review our critical accounting policies and estimates;



•

review the adequacy and effectiveness of our internal controls; and



•

review and discuss with management and the independent auditors the results of our annual audit and our interim financial statements.

        The members of our audit committee are Joseph S. Tibbetts, Jr., Paul A. Maeder and Ronald H. Nordin. Mr. Tibbetts, Jr. is our audit committee chairman. Our board of directors has concluded that each of Mr. Tibbetts, Mr. Maeder and Mr. Nordin meets the requirements for independence under, and the functioning of our audit committee complies with, the current requirements of The Nasdaq Global Select Market and SEC rules and regulations, including Rule 10A-3 of the Exchange Act. Our board of directors has determined that Mr. Tibbetts is an audit committee financial expert as defined under SEC rules and regulations.

Compensation committee

        Our compensation committee oversees our corporate compensation programs. The compensation committee will also:

•

review and approve corporate goals and objectives relevant to compensation of our chief executive officer and other executive officers;



•

evaluate the performance of our executive officers in light of established goals and objectives;



•

review and recommend compensation of our executive officers based on its evaluations;



•

review and recommend compensation of our directors;



•

administer the issuance of stock options and other awards under our stock plans;



•

review and discuss with management the compensation discussion and analysis that we may be required from time to time to include in our SEC filings; and



•

prepare a compensation committee report on executive compensation as may be required from time to time to be included in our annual proxy statements or annual reports on Form 10-K to be filed with SEC.

        The members of our compensation committee are Anthony Zingale, Maria A. Cirino and Jeffrey Fagnan. Mr. Zingale is the chairman of our compensation committee. Our board of directors has determined that each of Mr. Zingale, Ms. Cirino and Mr. Fagnan is "independent" for compensation committee purposes as that term is defined under the applicable rules, including Rule 10C-1 of the Exchange Act.

Nominating and corporate governance committee

        Our nominating and corporate governance committee oversees and assists our board of directors in reviewing and recommending corporate governance policies and nominees for election to our board of directors. The nominating and corporate governance committee will also:

•

evaluate and make recommendations regarding the organization and governance of the board of directors and its committees;



•

assess the performance of members of the board of directors and make recommendations regarding committee and chair assignments;



•

recommend desired qualifications for board of directors membership and conduct searches for potential members of the board of directors; and



•

review and make recommendations with regard to our corporate governance guidelines.

133

---

Table of Contents

        The members of our nominating and corporate governance committee are Peter Thomas Killalea, Maria Cirino and Ronald Nordin. Mr. Killalea is the chairman of our nominating and corporate governance committee. Our board of directors has determined that each of Mr. Killalea, Ms. Cirino and Mr. Nordin is independent under applicable SEC and Nasdaq Global Select Market rules and regulations.

        Our board of directors may from time to time establish other committees.

Non-Employee Director Compensation

        The following table presents the total compensation for each person who served as a non-employee member of our board of directors during 2017. Other than as set forth in the table and described more fully below, we did not pay any compensation, make any equity awards or non-equity awards to, or pay any other compensation to any of the non-employee members of our board of directors in 2017. Directors who are employees do not receive any compensation for their service on our board of directors. Accordingly, Mr. Morley, who is also our president and chief executive officer, receives no compensation for his services as a director and is not included in this table. The compensation received by Mr. Morley during 2017 is set forth in the section of this prospectus captioned "Executive Compensation—2017 Summary Compensation Table."

Director Compensation Table—2017

        Prior to this offering, we did not have a formal policy or plan to compensate our non-employee directors. In connection with this offering, our board of directors adopted the Non-Employee Director Compensation Policy. The policy is designed to ensure that the compensation aligns the directors' interests with the long-term interests of the stockholders, that the structure of the compensation is simple,

134

---

Table of Contents

transparent and easy for stockholders to understand and that our directors are fairly compensated. Employee directors will not receive additional compensation for their services as directors.

        Pursuant to the policy, our non-employee directors will be eligible to receive the following cash retainers and equity awards:

        Each non-employee director is paid an annual retainer of $30,000 for his or her services, and the non-executive chair of the board of directors receives an extra $20,000 for his or her contributions in leading our board of directors. Committee members also receive additional annual retainers. These additional payments for service on a committee are due to the workload and broad-based responsibilities of the committees. These committee retainers are as follows:

        Cash retainers are paid quarterly, and each non-employee director may be eligible to elect to receive equity in lieu of all or part of the cash retainers in accordance with and pursuant to such procedures and programs that may be established from time to time.

        In addition, upon initial election to our board of directors, each non-employee director will be granted an equity award having a grant date fair value of $300,000, or the Initial Grant. In addition, on the date of each of our annual meetings of stockholders following the completion of this offering, each non-employee director who has been a member of our board of directors for at least six months and who is re-elected to our board of directors at the annual meeting will be granted an annual equity award in having a grant date fair value of $150,000, or the Annual Grant. The Initial Grants and Annual Grants may be in the form of restricted stock units or nonqualified stock options, as determined by our compensation committee. If either an Initial Grant or an Annual Grant is in the form of a nonqualified stock option, then the exercise price will equal the fair market value of our common stock, as measured by reference to market quotations on The Nasdaq Global Select Market, as of the grant date. The Initial Grant will vest in equal annual installments over three years, subject to continued service as a director through the applicable vesting dates. The Annual Grant will vest in full on the earlier of (i) the anniversary of the grant date or (ii) our next annual meeting of stockholders, subject to continued service as a director through the applicable vesting date. Such awards are subject to full accelerated vesting upon a "sale event," as defined in the 2018 Plan.

        We will continue to reimburse our non-employee directors for their travel, lodging and other reasonable expenses incurred in attending meetings of our board of directors and committees of the board of directors.

Compensation Committee Interlocks and Insider Participation

        During 2017, our compensation committee was comprised of Mr. Fagnan, Ms. Cirino, and Mr. Zingale.

        None of the members of our compensation committee is an officer or employee of our company. None of our executive officers currently serves, or in the past year has served, as a member of the board of directors or compensation committee of any entity that has one or more executive officers serving on our board of directors or compensation committee.

        In September and October 2015 and January 2016, we issued and sold an aggregate of 11,515,005 shares of our Series F preferred stock for an aggregate purchase price of approximately $68.3 million. As part of this offering, we sold an aggregate of 1,264,755 shares of our Series F preferred stock for an aggregate purchase price of approximately $7.5 million to entities affiliated with Point 406 Ventures, of

135

---

Table of Contents

which Ms. Cirino is a Managing Partner. For more information regarding sales of our preferred stock, see "Certain Relationships and Related Party Transactions—Sales of Preferred Stock."

        In connection with the sales of our preferred stock, we entered into our investor rights agreement that grants specified rights to all of our major preferred stock investors, including the entities affiliated with Ms. Cirino and Mr. Fagnan. These rights include registration rights, information rights, director nomination rights to SC US GF Holdings, Ltd., and other similar rights. All of these rights, other than the registration rights and the SC US GF Holdings, Ltd. director nomination right, will terminate upon the closing of this offering. For a description of the registration rights, see "Description of Capital Stock—Registration Rights."

        In July 2017, we agreed to waive certain restrictions on transfer in connection with, and to assist the administration of, a transfer by one of our stockholders of an aggregate of 37,500 shares of our common stock for an aggregate purchase price of approximately $0.2 million to entities affiliated with Point 406 Ventures, of which Ms. Cirino is a Managing Partner.

Code of Business Conduct and Ethics

        Prior to the closing of this offering, we expect to adopt a code of business conduct and ethics that will be applicable to all of our employees, officers and directors, including our principal executive officer, principal financial officer and principal accounting officer. The code of business conduct and ethics will be available on our website prior to the closing of this offering. The board of directors will be responsible for overseeing the code of business conduct and ethics and must approve any waivers for employees, executive officers and directors. We expect that any amendments or waivers will be disclosed on our website or in a current report on Form 8-K.

136

---

Table of Contents

EXECUTIVE COMPENSATION

        The following discussion contains forward-looking statements that are based on our current plans, considerations, expectations and determinations regarding future compensation programs. The actual amount and form of compensation and the compensation policies and practices that we adopt in the future may differ materially from currently planned programs as summarized in this discussion.

2017 Summary Compensation Table

        The following table provides information regarding the total compensation that was earned by our Chief Executive Officer and the two most highly compensated executive officers (other than our Chief Executive Officer) who were serving as executive officers as of December 31, 2017 for services rendered in all capacities during 2017. These individuals are our named executive officers for the year ended December 31, 2017.

137

---

Table of Contents

Outstanding Equity Awards at Fiscal 2017 Year-End

        The following table sets forth information regarding outstanding equity awards held by our named executive officers as of December 31, 2017:

Employment Arrangements with Our Named Executive Officers

        We have entered into employment agreements with each of our named executive officers.

Patrick Morley

        We entered into an employment agreement with Patrick Morley, our Chief Executive Officer, effective as of January 1, 2016, and such agreement was subsequently amended, effective January 1, 2018. Under his employment agreement, Mr. Morley's current base salary is $375,000, which is subject to redetermination by our board of directors or our compensation committee, and he is eligible to earn an annual bonus with a target amount equal to 100% of his base salary. Mr. Morley is also eligible to participate in the employee benefit plans available to our employees, subject to the terms of those plans.

        Mr. Morley's employment agreement provides that, in the event that his employment is terminated by us without "cause" (as defined in his employment agreement) or Mr. Morley resigns for "good reason" (as defined in his employment agreement), subject to the execution and effectiveness of a separation agreement, including a general release of claims in our favor, he will be entitled to receive (i) an amount equal to 15 months of his base salary, payable in substantially equal installments over 15 months following his termination, and (ii) if Mr. Morley is participating in our group health plan immediately prior to his termination, benefits continuation until the earlier of 15 months following termination or the end of Mr. Morley's COBRA health continuation period, with such monthly employer and employee contributions paid by us directly to the applicable health insurance company. In lieu of the payments and benefits described in the preceding sentence, in the event that Mr. Morley's employment is terminated by

138

---

Table of Contents

us without cause or Mr. Morley resigns for good reason, in either case within 12 months following a "sale event" (as defined in his employment agreement), subject to the execution and effectiveness of a separation agreement, including a general release of claims in our favor, he will be entitled to receive (i) an amount equal to 18 months of his base salary, plus 150% of his annual target bonus, payable in substantially equal installments over 18 months following his termination, (ii) if Mr. Morley is participating in our group health plan immediately prior to his termination, benefits continuation until the earlier of 18 months following termination or the end of Mr. Morley's COBRA health continuation period, with such monthly employer and employee contributions paid by us directly to the applicable health insurance company, and (iii) full acceleration of all time-based equity awards held by Mr. Morley.

        The payments and benefits provided to Mr. Morley under his employment agreement in connection with a sale event may not be eligible for a federal income tax deduction for us pursuant to Section 280G of the Code. These payments and benefits also may be subject to an excise tax under Section 4999 of the Code. If the payments or benefits payable to Mr. Morley in connection with a sale event would be subject to the excise tax on golden parachutes imposed under Section 4999 of the Code, then those payments or benefits will be reduced if such reduction would result in a higher net after-tax benefit to such officer.

        In addition, Mr. Morley has entered into a confidentiality, non-disclosure, non-competition and developments agreement with us that contains, among other things, non-competition and non-solicitation provisions that apply during the term of Mr. Morley's employment and for 12 months thereafter.

Thomas Hansen

        We entered into an employment agreement with Thomas Hansen, our Executive Vice President and Chief Revenue Officer, effective as of July 12, 2017, and such agreement was subsequently amended, effective as of January 1, 2018. Under his employment agreement, Mr. Hansen's current base salary is $400,000, which is subject to redetermination by our board of directors or our compensation committee, and he is eligible to earn an annual bonus with a target amount equal to 100% of his base salary. Mr. Hansen is also eligible to participate in the employee benefit plans available to our employees, subject to the terms of those plans.

        Mr. Hansen's employment agreement provides that, in the event that his employment is terminated by us without "cause" (as defined in his employment agreement) or Mr. Hansen resigns for "good reason" (as defined in his employment agreement), subject to the execution and effectiveness of a separation agreement, including a general release of claims in our favor, he will be entitled to receive (i) an amount equal to 12 months of his base salary, payable in substantially equal installments over 12 months following his termination, and (ii) if Mr. Hansen is participating in our group health plan immediately prior to his termination, benefits continuation until the earlier of 12 months following termination or the end of Mr. Hansen's COBRA health continuation period, with such monthly employer and employee contributions paid by us directly to the applicable health insurance company. In lieu of the payments and benefits described in the preceding sentence, in the event that Mr. Hansen's employment is terminated by us without cause or Mr. Hansen resigns for good reason, in either case within 12 months following a "sale event" (as defined in his employment agreement), subject to the execution and effectiveness of a separation agreement, including a general release of claims in our favor, he will be entitled to receive (i) an amount equal to 12 months of his base salary, plus 100% of his annual target bonus, payable in substantially equal installments over 12 months following his termination, (ii) if Mr. Hansen is participating in our group health plan immediately prior to his termination, benefits continuation until the earlier of 12 months following termination or the end of Mr. Hansen's COBRA health continuation period, with such monthly employer and employee contributions paid by us directly to the applicable health insurance company, and (iii) full acceleration of all time-based equity awards held by Mr. Hansen.

        The payments and benefits provided to Mr. Hansen under his employment agreement in connection with a sale event may not be eligible for a federal income tax deduction for us pursuant to Section 280G of

139

---

Table of Contents

the Code. These payments and benefits also may be subject to an excise tax under Section 4999 of the Code. If the payments or benefits payable to Mr. Hansen in connection with a sale event would be subject to the excise tax on golden parachutes imposed under Section 4999 of the Code, then those payments or benefits will be reduced if such reduction would result in a higher net after-tax benefit to such officer.

        In addition, Mr. Hansen has entered into a confidentiality, non-disclosure, non-competition and developments agreement with us that contains, among other things, non-competition and non-solicitation provisions that apply during the term of Mr. Hansen's employment and for 12 months thereafter.

Ryan Polk

        We entered into an employment agreement with Ryan Polk, our Senior Vice President and Chief Product Officer, effective as of January 1, 2017, and such agreement was subsequently amended, effective as of January 1, 2018. Under his employment agreement, Mr. Polk's current base salary is $300,000, which is subject to redetermination by our board of directors or our compensation committee, and he is eligible to earn an annual bonus with a target amount equal to 40% of his base salary. Mr. Polk is also eligible to participate in the employee benefit plans available to our employees, subject to the terms of those plans.

        Mr. Polk's employment agreement provides that, in the event that his employment is terminated by us without "cause" (as defined in his employment agreement) or Mr. Polk resigns for "good reason" (as defined in his employment agreement), subject to the execution and effectiveness of a separation agreement, including a general release of claims in our favor, he will be entitled to receive (i) an amount equal to nine months of his base salary, payable in substantially equal installments over nine months following his termination, and (ii) if Mr. Polk is participating in our group health plan immediately prior to his termination, benefits continuation until the earlier of nine months following termination or the end of Mr. Polk's COBRA health continuation period, with such monthly employer and employee contributions paid by us directly to the applicable health insurance company. In lieu of the payments and benefits described in the preceding sentence, in the event that Mr. Polk's employment is terminated by us without cause or Mr. Polk resigns for good reason, in either case within 12 months following a "sale event" (as defined in his employment agreement), subject to the execution and effectiveness of a separation agreement, including a general release of claims in our favor, he will be entitled to receive (i) an amount equal to nine months of his base salary, plus 75% of his annual target bonus, payable in substantially equal installments over nine months following his termination, (ii) if Mr. Polk is participating in our group health plan immediately prior to his termination, benefits continuation until the earlier of nine months following termination or the end of Mr. Polk's COBRA health continuation period, with such monthly employer and employee contributions paid by us directly to the applicable health insurance company, and (iii) full acceleration of all time-based equity awards held by Mr. Polk.

        The payments and benefits provided to Mr. Polk under his employment agreement in connection with a sale event may not be eligible for a federal income tax deduction for us pursuant to Section 280G of the Code. These payments and benefits also may be subject to an excise tax under Section 4999 of the Code. If the payments or benefits payable to Mr. Polk in connection with a sale event would be subject to the excise tax on golden parachutes imposed under Section 4999 of the Code, then those payments or benefits will be reduced if such reduction would result in a higher net after-tax benefit to such officer.

        In addition, Mr. Polk has entered into a confidentiality, non-disclosure, non-competition and developments agreement with us that contains, among other things, non-competition and non-solicitation provisions that apply during the term of Mr. Polk's employment and for 12 months thereafter.

140

---

Table of Contents

Employee Benefit Plans

2018 Stock Option and Incentive Plan

        In April 2018, our board of directors, upon the recommendation of the compensation committee of the board of directors, adopted our 2018 Stock Option and Incentive Plan, or the 2018 Plan, which was subsequently approved by our stockholders. The 2018 Plan will become effective the day before the date that the registration statement of which this prospectus is part is declared effective. The 2018 Plan will replace our 2012 Stock Option and Grant Plan, or the 2012 Plan, and our Amended and Restated 2010 Series A Option Plan, or the 2010 Series A Plan, as our board of directors has determined not to make additional awards under the 2012 Plan and the 2010 Series A Plan following the closing of this offering. Our 2018 Plan provides flexibility to our compensation committee to use various equity-based incentive awards as compensation tools to motivate our workforce.

        We have initially reserved 6,075,051 shares of our common stock, or the Initial Limit, for the issuance of awards under the 2018 Plan, plus the shares of common stock remaining available for issuance under our 2012 Plan. The 2018 Plan provides that the number of shares reserved and available for issuance under the plan will automatically increase each January 1, beginning on January 1, 2019, by 5% of the outstanding number of shares of our common stock on the immediately preceding December 31 or such lesser number determined by our compensation committee, or the Annual Increase. This number is subject to adjustment in the event of a stock split, stock dividend or other change in our capitalization.

        The shares we issue under the 2018 Plan will be authorized but unissued shares or shares that we reacquire. The shares of common stock underlying any awards that are forfeited, cancelled, held back upon exercise or settlement of an award to satisfy the exercise price or tax withholding, reacquired by us prior to vesting, satisfied without any issuance of stock, expire or are otherwise terminated (other than by exercise) under the 2018 Plan, the 2012 Plan and our Amended and Restated Equity Incentive Plan, or the 2003 Plan, will be added back to the shares of common stock available for issuance under the 2018 Plan.

        The maximum aggregate number of shares that may be issued in the form of incentive stock options shall not exceed the Initial Limit cumulatively increased on January 1, 2019 and on each January 1 thereafter by the lesser of the Annual Increase for such year or 6,075,051 shares of common stock. The maximum value of all awards that may be granted under the 2018 Plan to any non-employee director in any calendar year shall not exceed $600,000.

        The 2018 Plan will be administered by our compensation committee. Our compensation committee has full power to select, from among the individuals eligible for awards, the individuals to whom awards will be granted, to make any combination of awards to participants, and to determine the specific terms and conditions of each award, subject to the provisions of the 2018 Plan. Persons eligible to participate in the 2018 Plan will be those full or part-time officers, employees, non-employee directors and other key persons (including consultants) as selected from time to time by our compensation committee in its discretion.

        The 2018 Plan permits the granting of both options to purchase common stock intended to qualify as incentive stock options under Section 422 of the Internal Revenue Code, or the Code, and options that do not so qualify. The option exercise price of each option will be determined by our compensation committee but may not be less than 100% of the fair market value of our common stock on the date of grant. The term of each option will be fixed by our compensation committee and may not exceed ten years from the date of grant. Our compensation committee will determine at what time or times each option may be exercised.

        Our compensation committee may award stock appreciation rights subject to such conditions and restrictions as it may determine. Stock appreciation rights entitle the recipient to shares of common stock, or cash, equal to the value of the appreciation in our stock price over the exercise price. The exercise price

141

---

Table of Contents

of each stock appreciation right may not be less than 100% of the fair market value of the common stock on the date of grant.

        Our compensation committee may award restricted shares of common stock and restricted stock units to participants subject to such conditions and restrictions as it may determine. These conditions and restrictions may include the achievement of certain performance goals and/or continued employment with us through a specified vesting period. Our compensation committee may also grant shares of common stock that are free from any restrictions under the 2018 Plan. Unrestricted stock may be granted to participants in recognition of past services or other valid consideration and may be issued in lieu of cash compensation due to such participant.

        The 2018 Plan provides that in the case of, and subject to, the consummation of a "sale event" as defined in the 2018 Plan, all outstanding awards may be assumed, substituted or otherwise continued by the successor entity. To the extent that the successor entity does not assume, substitute or otherwise continue such awards, then (i) all stock options and stock appreciation rights will automatically become fully exercisable and the restrictions and conditions on all other awards with time-based conditions will automatically be deemed waived, and awards with conditions and restrictions relating to the attainment of performance goals may become vested and non-forfeitable in connection with a sale event in the compensation committee's discretion and (ii) upon the effectiveness of the sale event, the 2018 Plan and all awards will automatically terminate. In the event of such termination, (i) individuals holding options and stock appreciation rights will be permitted to exercise such options and stock appreciation rights (to the extent exercisable) prior to the sale event, or (ii) we may make or provide for a cash payment to participants holding options and stock appreciation rights equal to the difference between the per share cash consideration payable to stockholders in the sale event and the exercise price of the options or stock appreciation rights (to the extent then exercisable).

        Our board of directors may amend or discontinue the 2018 Plan and our compensation committee may amend the exercise price of options and amend or cancel outstanding awards for purposes of satisfying changes in law or any other lawful purpose but no such action may adversely affect rights under an award without the holder's consent. Certain amendments to the 2018 Plan require the approval of our stockholders. No awards may be granted under the 2018 Plan after the date that is ten years from the date of stockholder approval.

Confer Technologies, Inc. 2013 Stock Plan

        In May 2016, we acquired Confer Technologies, Inc., which we refer to as Confer. In connection with our acquisition of Confer in May 2016, we assumed the Confer Technologies, Inc. 2013 Stock Plan, or the Confer Plan, and assumed all then outstanding options granted under the Confer Plan and converted them into options to purchase shares of our common stock. We reserved an aggregate of 796,850 shares of our common stock for the issuance of options under the Confer Plan. This number is subject to adjustment in the event of a stock split, stock dividend, merger or other change in our capitalization. As of March 31, 2018, options to purchase 409,305 shares of common stock were outstanding under the Confer Plan at a weighted-average exercise price of $2.66 per share, and no shares remained available for future grant under the Confer Plan. Effective as of June 3, 2016, our board of directors has determined not to grant any further awards under the Confer Plan, but all outstanding awards under the Confer Plan will continue to be governed by their existing terms.

        The shares we issue in connection with the exercise of assumed options under the Confer Plan are authorized but unissued shares. The shares of common stock underlying any awards that were forfeited, canceled, reacquired by us prior to vesting, satisfied without the issuance of stock or otherwise terminated (other than by exercise) under the Confer Plan have been added back to the shares of common stock available for issuance under the Confer Plan. Upon the closing of this offering, such shares will not be added to the shares of common stock available for issuance under the 2018 Plan.

142

---

Table of Contents

        The Confer Plan is administered by our board of directors. The board of directors or a committee appointed by the board has full authority and discretion to take any actions it deems necessary or advisable for the administration of the Confer Plan, including, with respect to the terms and conditions of awards, varying from the provisions of the Confer Plan to the extent the board of directors deems it necessary and appropriate to do so.

        The Confer Plan permits grants of incentive stock options and non-qualified stock options, as well as the direct award or sale of shares of common stock to employees, non-employee directors and consultants of Confer Technologies.

        The Confer Plan permits the granting of (1) options to purchase common stock intended to qualify as incentive stock options under Section 422 of the Code and (2) options that do not so qualify. The option exercise price of each option is determined by our board or directors or a committee appointed by the board but may not be less than 100% of the fair market value of the common stock on the date of grant. In the case of an incentive stock option granted to a participant who, at the time of grant of such option, owns stock representing more than 10% of the voting power of all our classes of stock, then the exercise price may not be less than 110% of the fair market value of the common stock on the date of grant. The term of each option will be fixed by the board of directors or a committee appointed by the board and may not exceed ten years from the date of grant.

        The Confer Plan provides that upon the occurrence of a "corporate transaction" (as defined in the Confer Plan), awards may be assumed, substituted for new awards of a successor entity, or otherwise continued or terminated at the effective time of such corporate transaction. In the event of termination, the holders of options are permitted, for a period of at least five days prior to the effective time of the corporate transaction, to exercise all portions of their awards that are then exercisable or become exercisable upon or prior to the corporate transaction. The board of directors may also make or provide for payment to holders of options equal to the difference between the per share cash consideration in the corporate transaction and the exercise price of the holders of vested and exercisable options. Such payment may be made in the form of cash, cash equivalents or securities of the successor entity having an equivalent value. The board of directors also has the discretion to accelerate, in whole or part, the vesting or exercisability of an option or other award in connection with a corporate transaction.

        Our board of directors may amend, suspend or terminate the Confer Plan at any time, subject to stockholder approval where such approval is required by applicable law. The board of directors may also modify, extend, assume or cancel any outstanding option, provided that no modification of an option will impair the rights or increase the obligations of the holder of such options. The board of directors has determined not to make any further grants under the Confer Plan following the closing of this offering.

2012 Stock Option and Grant Plan

        The 2012 Stock Option and Grant Plan, or the 2012 Plan, was approved by our board of directors and our stockholders on July 11, 2012, and was most recently amended in January 2018. We have reserved an aggregate of 18,890,543 shares of our common stock, in addition to any shares of common stock underlying awards that are forfeited, canceled, reacquired by us prior to vesting, satisfied without the issuance of stock or otherwise terminated (other than by exercise) under the 2003 Plan, for the issuance of options and other equity awards under the 2012 Plan. This number is subject to adjustment in the event of a stock split, stock dividend or other change in our capitalization. As of March 31, 2018, options to purchase 14,869,768 shares of our common stock were outstanding under the 2012 Plan at a weighted-average exercise price of $5.29 per share, restricted stock units, or RSUs, that may be settled for an aggregate of 394,500 shares of our common stock were outstanding under the 2012 Plan and 1,081,422 shares of our common stock remained available for future grant under the 2012 Plan. Effective upon the closing of this offering, our board of directors has determined not to grant any further awards under our 2012 Plan, but all outstanding awards under the 2012 Plan will continue to be governed by their existing terms.

143

---

Table of Contents

        The shares we issue under the 2012 Plan are authorized but unissued shares or shares we reacquire. The shares of common stock underlying any awards that are forfeited, canceled, reacquired by us prior to vesting, satisfied without the issuance of stock or otherwise terminated (other than by exercise) under the 2012 Plan and the 2003 Plan are currently added back to the shares of common stock available for issuance under the 2012 Plan. Upon the closing of this offering, such shares will be added to the shares of common stock available for issuance under the 2018 Plan.

        The 2012 Plan is administered by our board of directors. The board of directors or a committee appointed by the board has the authority to select the individuals to whom awards will be granted, to make any combination of awards to participants, to accelerate the exercisability or vesting of any award, to provide substitute awards and to determine the specific terms and conditions of each award.

        The 2012 Plan permits us to make grants of incentive stock options, non-qualified stock options, restricted stock awards, unrestricted stock awards and restricted stock units to our officers, employees, directors and consultants.

        The 2012 Plan permits the granting of (1) options to purchase common stock intended to qualify as incentive stock options under Section 422 of the Code and (2) options that do not so qualify. The option exercise price of each option is determined by our board or directors or a committee appointed by the board but may not be less than 100% of the fair market value of the common stock on the date of grant. In the case of an incentive stock option granted to a participant who, at the time of grant of such option, owns stock representing more than 10% of the voting power of all our classes of stock, then the exercise price may not be less than 110% of the fair market value of the common stock on the date of grant. The term of each option will be fixed by the board of directors or a committee appointed by the board and may not exceed ten years from the date of grant.

        The 2012 Plan provides that upon the occurrence of a "sale event" as defined in the 2012 Plan, awards may be assumed, substituted for new awards of a successor entity, or otherwise continued or terminated at the effective time of such sale event. In the case of the termination of all outstanding options, such options may be exercised to the extent then exercisable within a period of time prior to the consummation of the sale event. In the case of forfeiture of restricted stock, such awards may be repurchased by us for a price per share equal to the lower of the original per share purchase price paid or the current fair market value of the shares. We may also make or provide for cash payment to holders of options equal to the difference between the per share cash consideration in the sale event and the exercise price to the holders of vested and exercisable options. We may make or provide for cash payment to holders of restricted stock and restricted stock unit awards in an amount equal to the product of the per share cash consideration and the number of shares subject to each such award.

        Our board of directors may amend, suspend or terminate the 2012 Plan at any time, subject to stockholder approval where such approval is required by applicable law. The board of directors may also amend, modify or terminate any outstanding award, including the exercise price, provided that no amendment to an award may materially and adversely affect any of the rights of a participant under any awards previously granted without his or her written consent. The board of directors has determined not to make any further grants under the 2012 Plan following the closing of this offering.

Carbon Black Amended and Restated 2012 Equity Incentive Plan

        In February 2014, we acquired Carbon Black, Inc., which we refer to as the acquired company. In connection with our acquisition of the acquired company in February 2014, we assumed the Carbon Black, Inc. Amended and Restated 2012 Equity Incentive Plan, or the Carbon Black Plan, and assumed all vested and then outstanding options granted under the Carbon Black Plan and converted them into options to purchase shares of our Series E-1 preferred stock. We reserved an aggregate of 6,415,146 shares of our Series E-1 preferred stock for the issuance of options under the Carbon Black Plan. This number is subject to adjustment in the event of a stock split, stock dividend, merger or other change in our

144

---

Table of Contents

capitalization. After giving effect to the conversion of our Series E-1 preferred stock into 2,369,729 shares of common stock, which will occur upon the closing of this offering, options to purchase 837,835 shares of common stock were outstanding under the Carbon Black Plan as of March 31, 2018 at a weighted-average exercise price of $0.86 per share, and no shares remained available for future grant under the Carbon Black Plan. Effective as of February 10, 2014, our board of directors determined not to grant any further awards under the Carbon Black Plan, but all outstanding awards under the Carbon Black Plan continue to be governed by their existing terms.

        The shares of Series E-1 preferred stock we issued in connection with the exercise of assumed options under the Carbon Black Plan were authorized but unissued shares. The shares of Series E-1 preferred stock underlying any awards that were forfeited, canceled, reacquired by us prior to vesting, satisfied without the issuance of stock or otherwise terminated (other than by exercise) under the Carbon Black Plan have been added back to the shares of Series E-1 preferred stock available for issuance under the Carbon Black Plan. After the conversion of all of our outstanding preferred stock into 45,931,491 shares of common stock upon the closing of this offering, such converted shares of Series E-1 preferred stock will not be added to the shares of common stock available for issuance under the 2018 Plan.

        The Carbon Black Plan is administered by our board of directors. The board of directors or a committee appointed by the board has the authority to (i) determine the eligible persons to whom awards will be granted, (ii) determine the types of awards to be granted, (ii) determine the number of shares to be covered by each award, (iv) impose such terms, limitations, restrictions and conditions upon any award, (v) modify, amend, extend or renew outstanding awards, or accept the surrender of outstanding awards and substitute new awards, (vi) accelerate or otherwise change the time in which an award may be exercisable or becomes payable and (vii) establish objectives and conditions, if any, for earning awards and determining whether awards will be paid after the end of a performance period.

        The Carbon Black Plan permitted grants of incentive stock options, non-qualified stock options, restricted stock awards, phantom stock and performance awards to officers, employees, directors and consultants of the acquired company.

        The Carbon Black Plan provides that upon the occurrence of a change of control, awards may be assumed, substituted for new awards of a successor entity, or otherwise continued or terminated at the effective time of such change in control. In the event of termination, the holders of options are permitted, for a period of at least five days prior to the effective time of the change in control, (i) to exercise all portions of their awards that are then exercisable or become exercisable upon or prior to the change in control or (ii) to exercise all portions of awards that are exercisable and surrender such portion to receive a number of shares equal to the "net issuance amount" (as defined in the Carbon Black Plan), which is based on the fair market value of one share at the effective time of the change in control, less the exercise price for such option.

        Our board of directors may amend, suspend or terminate the Carbon Black Plan at any time, subject to stockholder approval where such approval is required by applicable law. The board of directors may also amend, modify or terminate any outstanding award, provided that no amendment to an award may materially and adversely affect any of the rights of a participant under any awards previously granted without his or her written consent.

Amended and Restated 2010 Series A Option Plan

        The Amended and Restated 2010 Series A Option Plan, or the 2010 Series A Plan, was originally adopted by our board of directors and approved by our stockholders in September 2010 and subsequently amended and restated in July 2012. We have reserved an aggregate of 8,800,000 shares of our Series A preferred stock for the issuance of options under the 2010 Series A Plan. This number is subject to adjustment in the event of a stock split, stock dividend, merger or other change in our capitalization. After giving effect to the conversion of our Series A preferred stock into 1,560,931 shares of common stock, which will occur upon the closing of this offering, options to purchase 1,805,009 shares of common stock

145

---

Table of Contents

were outstanding under our 2010 Series A Plan as of March 31, 2018 at a weighted-average exercise price of $2.85 per share. Effective upon the closing of this offering, our board of directors has determined not to grant any further awards under our 2010 Series A Plan.

        The shares we issue under the 2010 Series A Plan are authorized but unissued Series A preferred shares or shares of Series A preferred stock that we reacquire. The shares of Series A preferred stock underlying any awards that are forfeited, canceled, reacquired by us prior to vesting, satisfied without the issuance of stock or otherwise terminated (other than by exercise) under the 2010 Series A Plan are currently added back to the shares of Series A preferred stock available for issuance under the 2010 Series A Plan.

        The 2010 Series A Plan is administered by our board of directors. The board of directors has the authority (i) to construe and determine the respective option award agreements, awards and the 2010 Series A Plan, (ii) to prescribe, amend and rescind rules and regulations relating to the 2010 Series A Plan and any awards, (iii) to determine the terms and provisions of awards, (iv) to initiate an option exchange program, (v) to make all other determinations necessary or desirable for administration and interpretation of the 2010 Series A Plan, (vi) to determine the specific terms and conditions of each award and (vi) to accelerate the exercisability or vesting of any award.

        The 2010 Series A Plan permits us to make grants of incentive stock options and non-qualified stock options to our officers, employees, directors, consultants and advisors.

        The 2010 Series A Plan permits the granting of (1) options to purchase common stock intended to qualify as incentive stock options under Section 422 of the Code and (2) options that do not so qualify. The option exercise price of each option is determined by our board or directors or a committee appointed by the board but may not be less than 100% of the fair market value of the Series A preferred stock on the date of grant. In the case of an incentive stock option granted to a participant who, at the time of grant of such option, owns stock representing more than 10% of the voting power of all of our classes of stock, then the exercise price may not be less than 110% of the fair market value of the Series A preferred stock on the date of grant. The term of each option will be fixed by the board of directors or a committee appointed by the board and may not exceed ten years from the date of grant.

        The 2010 Series A Plan provides that upon the occurrence of a "change of control" (as defined in the 2010 Series A Plan), awards may be assumed, substituted for new awards of a successor entity, or otherwise continued or terminated at the effective time of such change of control. The board of directors may also accelerate the date of exercise or vesting of any award or permit the exchange of an award for the right to participate in any option or other employee benefit plan of a successor entity. Additionally, the board of directors may make or provide for the repurchase of an award for an amount equal to the difference between the per share cash consideration in the change of control and the exercise price. Such amount may be payable in cash or the property payable in respect of such securities in connection with the change of control.

        Our board of directors may amend, suspend or terminate the 2010 Series A Plan at any time, subject to stockholder approval where such approval is required by applicable law. The board of directors may also amend, modify or terminate any outstanding award, including the exercise price, provided that no amendment to an award may materially and adversely affect any of the rights of a participant under any awards previously granted without his or her written consent.

Amended and Restated Equity Incentive Plan

        The Amended and Restated Equity Incentive Plan, or the 2003 Plan, was originally adopted by our board of directors and approved by our stockholders in June 2003 and was subsequently amended and restated in May 2006. We reserved an aggregate of 1,490,011 shares of our common stock for the issuance of options and restricted stock awards under the 2003 Plan. This number was subject to adjustment in the event of a stock split, stock dividend, merger or other change in our capitalization. As of March 31, 2018,

146

---

Table of Contents

options to purchase 89,716 shares of our common stock were outstanding under the 2003 Plan at a weighted-average exercise price of $1.18 per share and no shares remained available for future grant under the 2003 Plan. Effective as of July 11, 2012, our board of directors determined not to grant any further awards under our 2003 Plan, but all outstanding awards under the 2003 Plan continue to be governed by their existing terms.

        The shares we issued under the 2003 Plan are authorized but unissued shares or shares we reacquired. The shares of common stock underlying any awards that are forfeited, canceled, reacquired by us prior to vesting, satisfied without the issuance of stock or otherwise terminated (other than by exercise) under the 2003 Plan are currently added back to the shares of common stock available for issuance under the 2012 Plan. Upon the closing of this offering, such shares will be added to the shares of common stock available for issuance under the 2018 Plan.

        The 2003 Plan is administered by our board of directors. The board of directors or a committee appointed by the board had the authority (i) to construe and determine the respective option award agreements, awards and the 2003 Plan, (ii) to prescribe, amend and rescind rules and regulations relating to the 2003 Plan and any awards, (iii) to determine the terms and provisions of awards, (iv) to initiate an option exchange program, (v) to make all other determinations necessary or desirable for administration and interpretation of the 2003 Plan, (vi) to determine the specific terms and conditions of each award and (vii) to accelerate the exercisability or vesting of any award.

        The 2003 Plan permitted us to make grants of incentive stock options and non-qualified stock options and restricted stock awards to our officers, employees, directors, consultants and advisors.

        The 2003 Plan provides that upon the occurrence of a "change of control" (as defined in the 2003 Plan), awards may be assumed, substituted for new awards of a successor entity, or otherwise continued or terminated at the effective time of such change of control. The board of directors may also accelerate the date of exercise or vesting of any award or permit the exchange of an award for the right to participate in any option or other employee benefit plan of a successor entity. Additionally, the board of directors may make or provide for the repurchase of an award for an amount equal to the difference between the per share cash consideration in the change of control and the exercise price. Such amount may be payable in cash or the property payable in respect of such securities in connection with the change of control.

        The board of directors may also amend, modify or terminate any outstanding award, including the exercise price, provided that no amendment to an award may materially and adversely affect any of the rights of a participant under any awards previously granted without his or her written consent. The 2003 Plan terminated pursuant to its terms on June 25, 2013.

2018 Employee Stock Purchase Plan

        In April 2018 our board of directors adopted and our stockholders approved our 2018 Employee Stock Purchase Plan, or the ESPP. The ESPP authorizes the issuance of up to a total of 1,735,729 shares of common stock to participating employees. The ESPP provides that the number of shares reserved and available for issuance under the ESPP shall be cumulatively increased each January 1, beginning on January 1, 2019, and ending on January 1, 2028, by the lesser of (i) one percent of the outstanding number of shares of our common stock on the immediately preceding December 31, (ii) 1,735,729 shares of common stock or (iii) such lesser number of shares as determined by our compensation committee. The number of shares reserved and available for issuance under the ESPP is subject to adjustment in the event of a stock split, stock dividend or other change in our capitalization.

        All employees who are employed by us or any designated subsidiary are eligible to participate in the ESPP; provided that any highly compensated employee who is a Section 16 officer will not be eligible to participate, unless otherwise determined by our compensation committee. Any employee who owns five percent or more of the voting power or value of our shares of common stock is not eligible to purchase shares under the ESPP.

147

---

Table of Contents

        We may make one or more offerings each year to our employees to purchase shares under the ESPP. Each eligible employee may elect to participate in any offering by submitting an enrollment form at least 15 business days before the relevant offering date. Unless otherwise determined by our compensation committee, the initial offering under the ESPP will commence upon January 1, 2019 and will end on the following June 30, 2019, with subsequent offering periods to begin on the first business day following each January 1 and July 1 and end on the last business day occurring on or before the following June 30 and December 31, respectively.

        Each employee who is a participant in the ESPP may purchase shares by authorizing payroll deductions at a minimum of two percent and up to ten percent of his or her base compensation during an offering period. Unless the participating employee has previously withdrawn from the offering, his or her accumulated payroll deductions will be used to purchase shares of common stock on the last business day of the offering period at a price equal to 85 percent of the fair market value of the common stock on the first business day or the last business day of the offering period, whichever is lower, provided that no more than a number of shares of common stock determined by dividing $12,500 by the fair market value of the common stock on the first day of the offering may be purchased by any one employee during each offering period. Under applicable tax rules, an employee may purchase no more than $25,000 worth of shares, valued at the start of the purchase period, under the ESPP in any calendar year.

        The accumulated payroll deductions of any employee who is not a participant on the last day of an offering period will be refunded. An employee's rights under the ESPP terminate upon voluntary withdrawal from the plan or when the employee ceases employment with us for any reason.

        The ESPP may be terminated or amended by our board of directors at any time. An amendment that increases the number of shares of common stock that are authorized under the ESPP and certain other amendments require the approval of our stockholders.

Senior Executive Cash Incentive Bonus Plan

        In April 2018 our board of directors adopted the Senior Executive Cash Incentive Bonus Plan, or the Bonus Plan. The Bonus Plan provides for cash bonus payments based upon the attainment of performance targets established by our compensation committee. The payment targets will be related to financial and operational measures or objectives with respect to our company, or corporate performance goals, as well as individual performance objectives.

        Our compensation committee may select corporate performance goals from among the following: earnings before interest, taxes, depreciation and amortization, net income (loss) (either before or after interest, taxes, depreciation and/or amortization), changes in the market price of our common stock, economic value-added, revenue, corporate revenue, acquisitions or strategic transactions, operating income (loss), cash flow (including, but not limited to, operating cash flow and free cash flow), return on capital, assets, equity, or investment, stockholder returns, return on sales, gross or net profit levels, productivity, expense, margins, operating efficiency, customer satisfaction, working capital, earnings (loss) per share of stock, sales or market shares and number of customers, number of new customers or customer references, research and development, billings, bookings, new bookings or renewals, operating income and/or net annual recurring revenue, any of which may be measured in absolute terms, as compared to any incremental increase, in terms of growth, or as compared to results of a peer group.

        Each executive officer who is selected to participate in the Bonus Plan will have a target bonus opportunity set for each performance period. The bonus formulas will be adopted in each performance period by the compensation committee and communicated to each executive. The corporate performance goals will be measured at the end of each performance period after our financial reports have been published or such other appropriate time as the compensation committee determines. If the corporate performance goals and individual performance objectives are met, payments will be made as soon as practicable following the end of each performance period. Subject to the rights contained in any agreement between the executive officer and us, an executive officer must be employed by us on the bonus payment

148

---

Table of Contents

date to be eligible to receive a bonus payment. The Bonus Plan also permits the compensation committee to approve additional bonuses to executive officers in its sole discretion and provides the compensation committee with discretion to adjust the size of the award as it deems appropriate to account for unforeseen factors beyond management's control that affected corporate performance.

Retirement Plans

        We maintain a tax-qualified 401(k) retirement plan for eligible employees in the United States to save for retirement on a tax-advantaged basis. Under our 401(k) plan, employees may elect to defer up to 75% of their eligible compensation subject to applicable annual limits set pursuant to the Internal Revenue Code. Our 401(k) plan permits participants to make both pre-tax and certain after-tax (Roth) deferral contributions. While we have the option to provide a discretionary employer matching contribution under the 401(k) plan, we have not made a matching contribution to date. Employees are 100% vested in their contributions to the 401(k) plan.

Indemnification of Officers and Directors

        We have agreed to indemnify our directors and executive officers in certain circumstances. See "Certain Relationships and Related Party Transactions—Limitation of Liability and Indemnification of Officers and Directors."

Rule 10b5-1 Sales Plans

        Our directors and executive officers may adopt written plans, known as Rule 10b5-1 plans, in which they will contract with a broker to buy or sell shares of our common stock on a periodic basis. Under a Rule 10b5-1 plan, a broker executes trades pursuant to parameters established by the director or executive officer when entering into the plan, without further direction from them. The director or executive officer may amend a Rule 10b5-1 plan in some circumstances and may terminate a plan at any time. Our directors and executive officers also may buy or sell additional shares outside of a Rule 10b5-1 plan when they are not in possession of material nonpublic information subject to compliance with the terms of our insider trading policy. Prior to 180 days after the date of this offering, subject to early termination, the sale of any shares under Rule 10b5-1 plan would be subject to the lock-up agreement that the director or executive officer has entered into with the underwriters.

Compensation Risk Assessment

        We believe that although a portion of the compensation provided to our executive officers and other employees is performance-based, our executive compensation program does not encourage excessive or unnecessary risk taking. This is primarily due to the fact that our compensation programs are designed to encourage our executive officers and other employees to remain focused on both short-term and long-term strategic goals, in particular in connection with our pay-for-performance compensation philosophy. As a result, we do not believe that our compensation programs are reasonably likely to have a material adverse effect on us.

149

---

Table of Contents

CERTAIN RELATIONSHIPS AND RELATED PARTY TRANSACTIONS

        In addition to the director and executive compensation arrangements discussed in the sections titled "Management" and "Executive Compensation," we have been a party to the following transactions since January 1, 2015, in which the amount involved exceeded or will exceed $120,000, and in which any director, executive officer or beneficial owner of more than 5% of any class of our voting stock, or any member of the immediate family of or entities affiliated with any of them, had or will have a direct or indirect material interest. We also describe below certain transactions and series of similar transactions since January 1, 2015 with our directors, executive officers and beneficial owners of more than 5% of any class of our voting securities, or any member of the immediate family of or any entities affiliated with any of the foregoing persons to which we are party.

Sales of Preferred Stock

Series F Preferred Stock

        In September and October 2015 and January 2016, we issued and sold an aggregate of 11,515,005 shares of our Series F preferred stock for an aggregate purchase price of approximately $68.3 million. We believe that the terms obtained and consideration received in connection with the Series F financing are comparable to terms available and the amounts we would have received in an arm's length transaction.

        The table below summarizes purchases of shares of our Series F preferred stock by holders of more than 5% of any class of our voting securities. For more information, see "Management—Compensation Committee Interlocks and Insider Participation." Each outstanding share of our Series F preferred stock will be converted into one share of our common stock upon the closing of this offering.

150

---

Table of Contents

Acquisitions of Companies or Assets

Objective Logistics

        On June 11, 2015, we entered into an Asset Purchase Agreement with Objective Logistics Inc., or Objective Logistics, pursuant to which we acquired certain specified assets and agreements of Objective Logistics for aggregate cash consideration of $1.9 million. In connection with the Asset Purchase Agreement, Objective Logistics also granted us a license to certain Objective Logistics patents and other intellectual property. Atlas Venture Fund VIII, L.P. and Atlas Venture Fund IX, L.P., which are entities affiliated with Atlas Venture, owned shares of Objective Logistics. Entities affiliated with Atlas Venture are holders of greater than 5% of certain classes of our equity securities. Mr. Fagnan, a member of our board of directors, is a General Partner at Atlas Venture. We believe that the terms obtained and consideration received in connection with this acquisition and sale are comparable to terms available and the amounts we would have received in an arm's length transaction.

VisiTrend, Inc.

        On August 14, 2015, we entered into an Asset Purchase Agreement with VisiTrend, Inc., or VisiTrend, and certain stockholders of VisiTrend pursuant to which we acquired certain assets of VisiTrend for (i) aggregate cash consideration of $0.1 million, (ii) the issuance of 113,981 shares of our Series E preferred stock, (iii) the issuance of an additional 68,389 shares of our Series E preferred stock that were placed in trust and were released therefrom as provided in the Asset Purchase Agreement and (iv) the future issuance of up to an additional 220,365 shares of our Series E preferred stock so long as two former key employees of VisiTrend remain employed by us as of August 14, 2016. Atlas Venture Fund IX, L.P., an entity affiliated with Atlas Venture, owned shares of VisiTrend. Entities affiliated with Atlas Venture are holders of greater than 5% of certain classes of our equity securities. Mr. Fagnan, a member of our board of directors, is a General Partner at Atlas Venture. We believe that the terms obtained and consideration received in connection with this acquisition and sale are comparable to terms available and the amounts we would have received in an arm's length transaction.

        On February 14, 2016 and on August 14, 2016, we issued 189,970 and 30,395 shares of our Series E preferred stock, respectively, to VisiTrend, pursuant to the terms of the Asset Purchase Agreement.

Commercial Arrangements With Related Parties

        In June 2015, we entered into a technical services agreement with Red Canary, Inc., or Red Canary, pursuant to which Red Canary provides us with managed threat detection services on some of our computer systems. From June 2015 through December 31, 2017, we have received invoices totaling approximately $0.3 million in connection with this technical services agreement. In addition, in August 2014, we entered into a partner alliance agreement and a managed security service provider addendum with Red Canary pursuant to which Red Canary agreed to market and resell our products to end users through its managed security service provider business. From August 2014 through December 31, 2017, we have invoiced Red Canary approximately $1.5 million in connection with this partner alliance agreement. Michael Viscuso, one of our executive officers, is a member of the board of directors and a stockholder of Kyrus Holdings, Inc., an entity that controls Legion Capital, LLC, an entity that is a stockholder of ours and controls Red Canary. We believe that the terms obtained and consideration received in connection with these agreements are comparable to terms available and the amounts we would have exchanged in arm's length transactions.

        In September 2014, we entered into a technical services agreement with Kyrus Tech, Inc., or Kyrus Tech, pursuant to which Kyrus Tech provides us with a range of consulting services. From September 2014 through December 31, 2017, we have received invoices totaling approximately $0.3 million in connection with this technical services agreement. Michael Viscuso, one of our executive officers, is a member of the board of directors and a stockholder of Kyrus Holdings, Inc., an entity that controls Legion Capital, LLC,

151

---

Table of Contents

an entity that is a stockholder of ours and controls Kyrus Tech. We believe that the terms obtained and consideration paid in connection with this agreement are comparable to terms available and the amounts we would have paid in an arm's length transaction.

Third Amended and Restated Management Incentive Plan

        In February 2016, we terminated the Third Amended and Restated Management Incentive Plan, in which Patrick Morley, our Chief Executive Officer, participated. Mr. Morley was entitled to receive an aggregate distribution of $9.8 million and elected to receive shares of our common stock to the fullest extent possible, and to receive cash proceeds only to the extent necessary to cover any taxes associated with the distribution. Accordingly, Mr. Morley received 784,963 shares of our common stock in this distribution and $4.9 million to cover taxes.

Secondary Transfers of our Common Stock

        In July 2017, we agreed to waive certain restrictions on transfer in connection with, and to assist the administration of, a transfer by one of our stockholders of an aggregate of 37,500 shares of our common stock for an aggregate purchase price of approximately $0.2 million to entities affiliated with Point 406 Ventures, of which Ms. Cirino is a Managing Partner.

Investor Rights Agreement

        We have entered into an investor rights agreement with certain key holders of our common stock, including Mr. Morley, our Chief Executive Officer, and certain of our preferred stockholders, including funds affiliated with Atlas Venture, Blackstone Innovations, Highland Capital Partners, Kleiner Perkins Caufield & Byers, Point 406 Ventures and Sequoia Capital, each of which is a holder of more than five percent of a class of our voting securities. Ms. Cirino, Mr. Fagnan and Mr. Maeder are managing partners, general partners or partners of Point 406 Ventures, Atlas Venture, and Highland Capital Partners, respectively. The investor rights agreement provides a right of purchase in respect of certain issuances of our securities, including in connection with this offering, and provides specified registration rights. For more information regarding the registration rights granted under this agreement, see the section of this prospectus captioned "Description of Capital Stock—Registration Rights." The investor rights agreement also provides that (i) SC US GF Holdings, Ltd., an entity affiliated with Sequoia Capital, will have the right to designate one nominee for election to our board of directors so long as SC US GF Holdings, Ltd. and its affiliates hold more than 5% of the shares of our outstanding common stock following the closing of this offering, (ii) we will take certain actions to support such nominee for election and (iii) should such nominee be elected to our board of directors and subsequently be unable to serve or be removed during the course of such director's term, we will take certain actions to appoint a replacement selected by SC US GF Holdings, Ltd. or its affiliates. The provisions of the investor rights agreement, other than those relating to registration rights, the SC US GF Holdings, Ltd. director nomination right, confidentiality and successor indemnification, will terminate upon completion of this offering. This summary discusses certain material provisions of the investor rights agreement and is qualified by the full text of the agreement filed as an exhibit to the registration statement of which this prospectus is a part.

Limitation of Liability and Indemnification of Officers and Directors

        Our amended and restated certificate of incorporation, which will become effective upon the closing of this offering, will contain provisions that limit the liability of our directors for monetary damages to the fullest extent permitted by Delaware law. Consequently, our directors will not be personally liable to us or our stockholders for monetary damages for any breach of fiduciary duties as directors, except liability for the following:

•

any breach of their duty of loyalty to our company or our stockholders;

152

---

Table of Contents

•

any act or omission not in good faith or that involves intentional misconduct or a knowing violation of law;



•

unlawful payments of dividends or unlawful stock repurchases or redemptions as provided in Section 174 of the Delaware General Corporation Law; or



•

any transaction from which they derived an improper personal benefit.

        Any amendment to, or repeal of, these provisions will not eliminate or reduce the effect of these provisions in respect of any act, omission or claim that occurred or arose prior to that amendment or repeal. If the Delaware General Corporation Law is amended to provide for further limitations on the personal liability of directors of corporations, then the personal liability of our directors will be further limited to the greatest extent permitted by the Delaware General Corporation Law.

        In addition, prior to the closing of this offering, we expect to adopt amended and restated bylaws which will provide that we will indemnify, to the fullest extent permitted by law, any person who is or was a party or is threatened to be made a party to any action, suit or proceeding by reason of the fact that he or she is or was one of our directors or officers or is or was serving at our request as a director or officer of another corporation, partnership, joint venture, trust or other enterprise. Our amended and restated bylaws are expected to provide that we may indemnify to the fullest extent permitted by law any person who is or was a party or is threatened to be made a party to any action, suit, or proceeding by reason of the fact that he or she is or was one of our employees or agents or is or was serving at our request as an employee or agent of another corporation, partnership, joint venture, trust or other enterprise. Our amended and restated bylaws will also provide that we must advance expenses incurred by or on behalf of a director or officer in advance of the final disposition of any action or proceeding, subject to very limited exceptions.

        Further, prior to the closing of this offering, we expect to enter into indemnification agreements with each of our directors and executive officers that may be broader than the specific indemnification provisions contained in the Delaware General Corporation Law. These indemnification agreements will require us, among other things, to indemnify our directors and executive officers against liabilities that may arise by reason of their status or service. These indemnification agreements will also require us to advance all expenses incurred by the directors and executive officers in investigating or defending any such action, suit or proceeding. We believe that these agreements are necessary to attract and retain qualified individuals to serve as directors and executive officers.

        The limitation of liability and indemnification provisions that are expected to be included in our amended and restated certificate of incorporation, amended and restated bylaws and in indemnification agreements that we enter into with our directors and executive officers may discourage stockholders from bringing a lawsuit against our directors and executive officers for breach of their fiduciary duties. They may also reduce the likelihood of derivative litigation against our directors and executive officers, even though an action, if successful, might benefit us and other stockholders. Further, a stockholder's investment may be harmed to the extent that we pay the costs of settlement and damage awards against directors and executive officers as required by these indemnification provisions. At present, we are not aware of any pending litigation or proceeding involving any person who is or was one of our directors, officers, employees or other agents or is or was serving at our request as a director, officer, employee or agent of another corporation, partnership, joint venture, trust or other enterprise, for which indemnification is sought, and we are not aware of any threatened litigation that may result in claims for indemnification.

        We have obtained insurance policies under which, subject to the limitations of the policies, coverage is provided to our directors and executive officers against loss arising from claims made by reason of breach of fiduciary duty or other wrongful acts as a director or executive officer, including claims relating to public securities matters, and to us with respect to payments that may be made by us to these directors and executive officers.

153

---

Table of Contents

Policies and Procedures for Related Party Transactions

        Following the closing of this offering, the audit committee of our board of directors will have the primary responsibility for reviewing and approving or disapproving "related party transactions," which are transactions between us and related persons in which the aggregate amount involved exceeds or may be expected to exceed $120,000 and in which a related person has or will have a direct or indirect material interest. Our audit committee charter will provide that the audit committee shall review and approve or disapprove any related party transactions. Prior to this offering, we have not had a formal policy regarding approval of transactions with related parties. Prior to the completion of this offering, we expect to adopt a related person transaction policy that sets forth our procedures for the identification, review, consideration and approval or ratification of related person transactions. For purposes of this policy, a related person will be defined as a director, executive officer, nominee for director or greater than 5% beneficial owner of our common stock, in each case since the beginning of the most recently completed year, and their immediate family members. The policy will become effective upon the closing of this offering.

        All of the transactions described above were entered into prior to the adoption of a formal policy. Accordingly, each was approved by disinterested members of our board of directors after making a determination that the transaction was executed on terms no less favorable than those that could have been obtained from an unrelated third party.

154

---

Table of Contents

PRINCIPAL STOCKHOLDERS

        The following table sets forth information regarding beneficial ownership of our common stock as of March 31, 2018 by:

•

each person or group of affiliated persons known by us to be the beneficial owner of more than 5% of our outstanding common stock;



•

each of our named executive officers;



•

each of our directors; and



•

all executive officers and directors as a group.

        We have determined beneficial ownership in accordance with SEC rules. The information does not necessarily indicate beneficial ownership for any other purpose. Under these rules, the number of shares of common stock deemed outstanding includes 3,223,579 shares issuable upon exercise of options held by the respective person or group which may be exercised or converted within 60 days after March 31, 2018. For purposes of calculating each person's or group's percentage ownership, stock options exercisable within 60 days after March 31, 2018 are included for that person or group but not the stock options of any other person or group.

        Applicable percentage ownership is based on 57,825,141 shares of common stock outstanding as of March 31, 2018, assuming the conversion of all outstanding shares of our preferred stock as of March 31, 2018 into common stock, which will occur upon the closing of this offering, and the exercise of the outstanding warrant held by SC US GF Holdings, Ltd., which we expect will occur upon the closing of this offering. For purposes of the table below, we have assumed that 65,825,141 shares of common stock will be outstanding upon the closing of this offering, assuming the sale of 8,000,000 shares by us.

        Unless otherwise indicated and subject to applicable community property laws, to our knowledge, each stockholder named in the following table possesses sole voting and investment power over the shares

155

---

Table of Contents

listed. Unless otherwise noted below, the address of each person listed in the table is c/o Carbon Black, Inc., 1100 Winter Street, Waltham, Massachusetts 02451.

156

---

Table of Contents

157

---

Table of Contents

158

---

Table of Contents

DESCRIPTION OF CAPITAL STOCK

General

        The following description summarizes the most important terms of our capital stock, as they are expected to be in effect upon the closing of this offering. We expect to adopt an amended and restated certificate of incorporation and amended and restated bylaws in connection with this offering, and this description summarizes the provisions that are expected to be included in such documents. Because it is only a summary, it does not contain all the information that may be important to you. For a complete description of the matters set forth in "Description of Capital Stock," you should refer to our amended and restated certificate of incorporation and amended and restated bylaws, which are or will be included as exhibits to the registration statement of which this prospectus forms a part, and to the applicable provisions of Delaware law. Immediately following the closing of this offering, our authorized capital stock will consist of 500,000,000 shares of common stock, $0.001 par value per share, and 25,000,000 shares of undesignated preferred stock, $0.001 par value per share.

        Assuming the conversion of all outstanding shares of our preferred stock as of March 31, 2018 into shares of our common stock, which will occur upon the closing of this offering, and the assumed exercise of the outstanding warrant held by SC US GF Holdings, Ltd., which we expect will occur upon the closing of this offering, there would have been 57,825,141 shares of our common stock outstanding, held by 369 stockholders of record, and no shares of our preferred stock outstanding. Our board of directors is authorized, without stockholder approval except as required by the listing standards of The Nasdaq Global Select Market to issue additional shares of our capital stock.

Common Stock

        The holders of our common stock are entitled to one vote per share on all matters to be voted on by our stockholders. The holders of our common stock do not have any cumulative voting rights. Subject to preferences that may be applicable to any outstanding shares of preferred stock, holders of common stock are entitled to receive ratably such dividends as may be declared by our board of directors out of funds legally available for that purpose. In the event of our liquidation, dissolution or winding up, the holders of common stock are entitled to share ratably in all assets remaining after the payment of liabilities, subject to the prior distribution rights of preferred stock then outstanding. Holders of common stock have no preemptive, conversion or subscription rights. There are no redemption or sinking fund provisions applicable to the common stock.

Preferred Stock

        Upon the completion of this offering, all currently outstanding shares of preferred stock will convert into shares of our common stock, and there will be no shares of preferred stock outstanding.

        Though we currently have no plans to issue any shares of preferred stock, upon the closing of this offering and the filing of our certificate of incorporation, our board of directors will have the authority, without further action by our stockholders, to designate and issue up to 25,000,000 shares of preferred stock in one or more series. Our board of directors may also designate the rights, preferences and privileges of the holders of each such series of preferred stock, any or all of which may be greater than or senior to those granted to the holders of common stock. Though the actual effect of any such issuance on the rights of the holders of common stock will not be known until such time as our board of directors determines the specific rights of the holders of preferred stock, the potential effects of such an issuance include:

•

diluting the voting power of the holders of common stock;



•

reducing the likelihood that holders of common stock will receive dividend payments;

159

---

Table of Contents

•

reducing the likelihood that holders of common stock will receive payments in the event of our liquidation, dissolution, or winding up; and



•

delaying, deterring or preventing a change-in-control or other corporate takeover.

Warrants

        In July 2012, in connection with the sale of shares of our Series D preferred stock, we issued a warrant to SC US GF Holdings, Ltd., an entity affiliated with Sequoia Capital, which, on the date of this offering, will be exercisable for up to 480,848 shares of our common stock at $0.002 per share. This warrant expires (i) upon the closing of a consolidation, merger or dissolution involving us or sale of our assets, or (ii) if unexercised on the date of the closing of this offering, the warrant will terminate one day after the closing of this offering.

        In August 2013, we entered into a Subordinated Loan and Security Agreement, or Subordinated Loan, with Silicon Valley Bank, or SVB. As part of this arrangement, we issued two warrants to SVB and WestRiver Mezzanine Loans, LLC, or WestRiver, to purchase up to an aggregate of 335,000 shares of our Series D preferred stock at an exercise price of $2.9891 per share. Upon the completion of this offering, these warrants will become exercisable for an aggregate of up to 167,500 shares of common stock. These warrants expire on August 21, 2023. If the warrants have not been exercised prior to August 21, 2023, the warrants will be deemed to automatically be exercised on a net exercise basis.

        In July 2014, we amended the terms of our Subordinated Loan. As part of this arrangement, we issued additional warrants to SVB and WestRiver to purchase up to an aggregate of 212,500 shares of our common stock at an exercise price of $3.02 per share. As of March 31, 2018, these warrants are exercisable for up to an aggregate of 106,250 shares of our common stock until their expiration on July 30, 2024. Pursuant to the terms of these warrants and the Subordinated Loan, no additional shares of our common stock will become exercisable. If these warrants have not been exercised prior to July 30, 2024, these warrants will be deemed to automatically be exercised on a net exercise basis.

Registration Rights

        Upon the completion of this offering, the holders of an aggregate of 48,828,536 shares of our common stock issued or issuable upon conversion of preferred stock are entitled to the following rights with respect to the registration of such shares for public resale under the Securities Act pursuant to an investor rights agreement by and among us and certain of our stockholders. We refer to these shares collectively as registrable securities.

        The registration of shares of common stock as a result of the following rights being exercised would enable the holders to trade these shares without restriction under the Securities Act when the applicable registration statement is declared effective. Ordinarily, we will be required to pay all expenses, other than underwriting discounts and commissions, related to any registration effected pursuant to the exercise of these registration rights.

Demand Registration Rights

        If, at any time after 180 days following the date of this prospectus, the holders of at least 40% of the registrable securities then outstanding request in writing that we effect a registration, we may be required to register the offer and sale of their shares. At most, we are obligated to effect two registrations for the holders of registrable securities in response to these demand registration rights. Depending on certain conditions, however, we may defer such registration for up to 90 days. If the holders requesting registration intend to distribute their shares by means of an underwriting, the managing underwriter of such offering will have the right to limit the number of shares to be underwritten for reasons related to the marketing of the shares.

160

---

Table of Contents

Piggyback Registration Rights

        If at any time after this offering we propose to register the offer and sale of any securities under the Securities Act solely for cash, the holders of registrable securities will be entitled to notice of the registration and to include their shares of registrable securities in the registration. We have the right to terminate or withdraw any registration initiated by us prior to the effectiveness of such registration whether or not the holders of registrable securities have elected to include their shares in the registration.

Form S-3 Registration Rights

        If we become entitled under the Securities Act to register our shares on Form S-3 and the holders of registrable securities then outstanding request in writing that we register their shares for public resale on Form S-3 with an aggregate price to the public of at least $10 million, subject to certain limitations, we will be required to effect the requested registration. However, if our board of directors determines, in good faith, that such registration would be materially detrimental to us and our stockholders at such time, we may defer the registration for up to 90 days. We are only obligated to effect one registration on Form S-3 within any 3-month period, and in no event within 180 days of the effectiveness of a registration statement to which the holders of registrable securities were entitled to piggyback registration rights.

Termination of Registration Rights

        The registration rights granted under the investor rights agreement will terminate with respect to a particular holder, upon the earlier of the fifth anniversary of the completion of this offering or such time as such holder and its affiliates may sell all of their shares of common stock pursuant to Rule 144 under the Securities Act within a 90-day period.

Voting Rights

        Under the provisions of our certificate of incorporation to become effective upon the closing of this offering, holders of our common stock are entitled to one vote for each share of common stock held by such holder on any matter submitted to a vote at a meeting of stockholders. Our post-offering certificate of incorporation does not provide cumulative voting rights to holders of our common stock.

Anti-Takeover Effects of Delaware Law and Our Certificate of Incorporation and Bylaws

        Certain provisions of Delaware law and our restated certificate of incorporation and bylaws that will become effective upon the closing of this offering contain provisions that could have the effect of delaying, deferring or discouraging another party from acquiring control of us. These provisions, which are summarized below, may discourage certain types of coercive takeover practices and inadequate takeover bids. These provisions are also designed in part to encourage anyone seeking to acquire control of us to first negotiate with our board of directors. We believe that the advantages gained by protecting our ability to negotiate with any unsolicited and potentially unfriendly acquirer outweigh the disadvantages of discouraging such proposals, including those priced above the then-current market value of our common stock, because, among other reasons, the negotiation of such proposals could improve their terms.

Amended and Restated Certificate of Incorporation and Amended and Restated Bylaw Provisions

        Our amended and restated certificate of incorporation and our amended and restated bylaws to become effective upon the closing of this offering will include a number of provisions that could deter hostile takeovers or delay or prevent changes in control of our board of directors or management team. Among other things, these provisions:

•

authorize our board of directors to issue, without further action by the stockholders, up to            shares of undesignated preferred stock;

161

---

Table of Contents

•

specify that special meetings of our stockholders can be called only by our board of directors;



•

establish an advance notice procedure for stockholder proposals to be brought before an annual meeting of our stockholders, including proposed nominations of persons for election to our board of directors;



•

provide that directors may be removed only for cause;



•

provide that vacancies on our board of directors may be filled only by a majority of directors then in office, even though less than a quorum;



•

establish that our board of directors is divided into three classes—Class I, Class II, and Class III—with each class serving staggered terms; and



•

require super-majority voting to amend certain of the above-mentioned provisions.

Delaware Anti-Takeover Statute

        We are subject to the provisions of Section 203 of the General Corporation Law of the State of Delaware regulating corporate takeovers. In general, Section 203 prohibits a publicly held Delaware corporation from engaging, under certain circumstances, in a business combination with an interested stockholder for a period of three years following the date the person became an interested stockholder unless:

•

prior to the date of the transaction, the board of directors of the corporation approved either the business combination or the transaction which resulted in the stockholder becoming an interested stockholder;



•

upon completion of the transaction that resulted in the stockholder becoming an interested stockholder, the interested stockholder owned at least 85% of the voting stock of the corporation outstanding at the time the transaction commenced, excluding for purposes of determining the voting stock outstanding, but not for determining the outstanding voting stock owned by the interested stockholder, (1) shares owned by persons who are directors and also officers, and (2) shares owned by employee stock plans in which employee participants do not have the right to determine confidentially whether shares held subject to the plan will be tendered in a tender or exchange offer; or



•

at or subsequent to the date of the transaction, the business combination is approved by the board of directors of the corporation and authorized at an annual or special meeting of stockholders, and not by written consent, by the affirmative vote of at least 66²/3% of the outstanding voting stock which is not owned by the interested stockholder.

        Generally, a business combination includes a merger, asset or stock sale, or other transaction resulting in a financial benefit to the interested stockholder. An interested stockholder is a person who, together with affiliates and associates, owns or, within three years prior to the determination of interested stockholder status, did own 15% or more of a corporation's outstanding voting stock. We expect the existence of this provision to have an anti-takeover effect with respect to transactions our board of directors does not approve in advance. We also anticipate that Section 203 may discourage business combinations or other attempts that might result in a premium over the market price for the shares of common stock held by our stockholders.

        The provisions of Delaware law and our restated certificate of incorporation and bylaws to become effective upon the closing of this offering could have the effect of discouraging others from attempting hostile takeovers and, as a consequence, may also inhibit temporary fluctuations in the market price of our common stock that often result from actual or rumored hostile takeover attempts. These provisions may also have the effect of preventing changes in our management. It is possible that these provisions could

162

---

Table of Contents

make it more difficult to accomplish transactions that stockholders may otherwise deem to be in their best interests.

Choice of Forum

        Our amended and restated bylaws to become effective upon the closing of this offering provide that, unless we consent in writing to an alternative forum, the Court of Chancery of the State of Delaware will be the sole and exclusive forum for (i) any derivative action or proceeding brought on our behalf, (ii) any action asserting a claim of or based on a breach of a fiduciary duty owed by any of our current or former directors, officers and employees to us or our stockholders, (iii) any action asserting a claim against us or any of our current or former directors, officers, employees or stockholders arising pursuant to any provision of the Delaware General Corporation Law, our certificate of incorporation or our bylaws, or (iv) any action asserting a claim that is governed by the internal affairs doctrine, in each case subject to the Court of Chancery having personal jurisdiction over the indispensable parties named as defendants therein. Our amended and restated bylaws further provide that, unless we consent in writing to an alternative forum, the United States District Court for the District of Massachusetts will be the exclusive forum for resolving any complaint asserting a cause of action arising under the Securities Act. We have chosen the United States District Court for the District of Massachusetts as the exclusive forum for such causes of action because our principal executive offices are located in Waltham, Massachusetts. Some companies that have adopted similar federal district court forum selection provisions are currently subject to a suit in the Court of Chancery of the State of Delaware by stockholders who assert that the federal district court forum selection provision is not enforceable. We recognize that the federal district court forum selection clause may impose additional litigation costs on stockholders who assert the provision is not enforceable and may impose more general additional litigation costs in pursuing any such claims, particularly if the stockholders do not reside in or near the Commonwealth of Massachusetts. Additionally, the forum selection clauses in our amended and restated bylaws may limit our stockholders' ability to obtain a favorable judicial forum for disputes with us. Alternatively, if the federal district court forum selection provision is found inapplicable to, or unenforceable in respect of, one or more of the specified types of actions or proceedings, we may incur additional costs associated with resolving such matters in other jurisdictions, which could have an adverse effect on our business, financial condition or results of operations. The United States District Court for the District of Massachusetts may also reach different judgments or results than would other courts, including courts where a stockholder considering an action may be located or would otherwise choose to bring the action, and such judgments may be more or less favorable to us than our stockholders. Although we believe this provision benefits us by providing increased consistency in the application of Delaware law in the types of lawsuits to which it applies, the provision may have the effect of discouraging lawsuits against our directors and officers.

Transfer Agent and Registrar

        Upon the closing of this offering, the transfer agent and registrar for our common stock will be American Stock Transfer & Trust Company, LLC. The transfer's agent address is 6201 15^th Avenue, Brooklyn, NY 11219.

Stock Exchange Listing

        We have applied to list our common stock on The Nasdaq Global Select Market under the symbol "CBLK."

163

---

Table of Contents

SHARES ELIGIBLE FOR FUTURE SALE

        Prior to this offering, there has been no public market for our common stock, and we cannot predict the effect, if any, that market sales of shares of our common stock or the availability of shares of our common stock for sale will have on the market price of our common stock prevailing from time to time. Future sales of our common stock in the public market, or the availability of such shares for sale in the public market, could adversely affect market prices prevailing from time to time. As described below, only a limited number of shares will be available for sale shortly after this offering due to contractual and legal restrictions on resale. Nevertheless, sales of our common stock in the public market after such restrictions lapse, or the perception that those sales may occur, could adversely affect the prevailing market price at such time and our ability to raise equity capital in the future.

        Following the closing of this offering, based on the number of shares of our capital stock outstanding as of March 31, 2018, we will have a total of 65,825,141 shares of our common stock outstanding. Of these outstanding shares, all of the 8,000,000 shares of common stock sold in this offering will be freely tradable, except that any shares purchased in this offering by our affiliates, as that term is defined in Rule 144 under the Securities Act, would only be able to be sold in compliance with the Rule 144 limitations described below.

        The remaining outstanding shares of our common stock will be deemed "restricted securities" as defined in Rule 144. Restricted securities may be sold in the public market only if they are registered or if they qualify for an exemption from registration under Rule 144 or Rule 701 under the Securities Act, which rules are summarized below. In addition, all of our executive officers, directors and holders of substantially all of our common stock and securities convertible into or exercisable for our common stock have entered into market standoff agreements with us or lock-up agreements with the underwriters under which they have agreed, subject to specific exceptions, not to sell any of our stock for at least 180 days following the date of this prospectus. As a result of these agreements, subject to the provisions of Rule 144 or Rule 701, the shares outstanding following this offering will be available for sale in the public market as follows:

•

beginning on the date of this prospectus, the 8,000,000 shares of common stock sold in this offering will be immediately available for sale in the public market;



•

beginning 181 days after the date of this prospectus, 57,825,141 additional shares of common stock will become eligible for sale in the public market, of which 30,851,883 shares will be held by affiliates and subject to the volume and other restrictions of Rule 144, as described below; and



•

the remainder of the shares of common stock will be eligible for sale in the public market from time to time thereafter, subject in some cases to the volume and other restrictions of Rule 144, as described below.

Lock-Up Agreements

        We, our executive officers, directors and holders of substantially all of our common stock and securities convertible into or exercisable for our common stock have agreed that, subject to certain exceptions, for a period of 180 days from the date of this prospectus, we and they will not, without the prior written consent of Morgan Stanley & Co. LLC and J.P. Morgan Securities LLC, dispose of or hedge any shares or any securities convertible into or exercisable for shares of our capital stock. Morgan Stanley & Co. LLC and J.P. Morgan Securities LLC may, in their discretion, and with our consent, release any of the securities subject to these lock-up agreements at any time. Any determination to release shares subject to the lock-up agreements would be based on a number of factors at the time of determination, including but not necessarily limited to the market price of the common stock, the liquidity of the trading market for the common stock, general market conditions, the number of shares proposed to be sold, contractual obligations to release certain shares subject to the lock-up agreements in the event any such shares are released, subject to certain specific limitations and thresholds, and the timing, purpose and terms of the proposed sale.

        These agreements are described in the section titled "Underwriters."

164

---

Table of Contents

Rule 144

        In general, under Rule 144 as currently in effect, once we have been subject to the public company reporting requirements of Section 13 or Section 15(d) of the Exchange Act for at least 90 days, a person who is not deemed to have been one of our affiliates for purposes of the Securities Act at any time during the 90 days preceding a sale and who has beneficially owned the shares proposed to be sold for at least six months, including the holding period of any prior owner other than our affiliates, is entitled to sell those shares without complying with the manner of sale, volume limitation or notice provisions of Rule 144, subject to compliance with the public information requirements of Rule 144. If such a person has beneficially owned the shares proposed to be sold for at least one year, including the holding period of any prior owner other than our affiliates, then that person would be entitled to sell those shares without complying with any of the requirements of Rule 144.

        In general, under Rule 144, as currently in effect, our affiliates or persons selling shares on behalf of our affiliates are entitled to sell upon expiration of the lock-up agreements described above, within any three-month period, a number of shares that does not exceed the greater of:

•

1% of the number of shares of our common stock then outstanding, which will equal approximately 658,251 shares immediately after this offering; or



•

the average weekly trading volume of our common stock during the four calendar weeks preceding the filing of a notice on Form 144 with respect to that sale.

        Sales under Rule 144 by our affiliates or persons selling shares on behalf of our affiliates are also subject to certain manner of sale provisions and notice requirements and to the availability of current public information about us.

Rule 701

        Rule 701 generally allows a stockholder who purchased shares of our common stock pursuant to a written compensatory plan or contract and who is not deemed to have been an affiliate of our company during the immediately preceding 90 days to sell these shares in reliance upon Rule 144, but without being required to comply with the public information, holding period, volume limitation or notice provisions of Rule 144. Rule 701 also permits affiliates of our company to sell their Rule 701 shares under Rule 144 without complying with the holding period requirements of Rule 144. All holders of Rule 701 shares, however, are required by that rule to wait until 90 days after the date of this prospectus before selling those shares pursuant to Rule 701.

Registration Rights

        Upon the completion of this offering, the holders of an aggregate of 48,828,536 shares of our common stock will be entitled to various rights with respect to the registration of the offer and sale of these shares under the Securities Act. Registration of the offer and sale of these shares under the Securities Act would result in these shares becoming freely tradable without restriction under the Securities Act immediately upon the effectiveness of the applicable registration statement, except for shares purchased by affiliates. See the section of this prospectus captioned "Description of Capital Stock—Registration Rights" for additional information.

Registration Statement on Form S-8

        As of March 31, 2018, RSUs representing the right to receive an aggregate of 394,500 shares of our common stock and options to purchase a total of 18,011,633 shares of common stock pursuant to our 2012 Plan, 2003 Plan, Carbon Black Plan, Confer Plan and 2010 Series A Plan were outstanding, of which options to purchase 10,504,361 shares were exercisable. We intend to file a registration statement on Form S-8 under the Securities Act as promptly as possible after the closing of this offering to register shares that may be issued pursuant to our 2012 Plan, 2003 Plan, Carbon Black Plan, Confer Plan, Series A Plan and our 2018 Plan. The registration statement on Form S-8 will become effective immediately upon filing, and shares covered by the registration statement will then become eligible for sale in the public market, subject to the Rule 144 limitations applicable to affiliates, vesting restrictions and any applicable lock-up agreements and market standoff agreements. See "Executive Compensation—Employee Benefits Plans" for a description of our equity incentive plans.

165

---

Table of Contents

MATERIAL U.S. FEDERAL INCOME TAX CONSIDERATIONS FOR NON-U.S. HOLDERS OF COMMON STOCK

        The following discussion is a summary of material U.S. federal income tax considerations applicable to non-U.S. holders (as defined below) with respect to their ownership and disposition of shares of our common stock issued pursuant to this offering. For purposes of this discussion, a non-U.S. holder means a beneficial owner of our common stock that is for U.S. federal income tax purposes:

•

a non-resident alien individual;



•

a foreign corporation or any other organization taxable as a corporation for U.S. federal income tax purposes or;



•

a foreign estate or trust, the income of which is not subject to U.S. federal income tax on a net-income basis.

        This discussion does not address the tax treatment of partnerships or other entities that are pass-through entities for U.S. federal income tax purposes or persons that hold their common stock through partnerships or other pass-through entities. A partner in a partnership or other pass-through entity that will hold our common stock should consult his, her or its own tax advisor regarding the tax consequences of acquiring, holding and disposing of our common stock through a partnership or other pass-through entity, as applicable.

        This discussion is based on current provisions of the U.S. Internal Revenue Code of 1986, as amended, which we refer to as the Code, existing and proposed U.S. Treasury Regulations promulgated thereunder, current administrative rulings and judicial decisions, all as in effect as of the date of this prospectus and all of which are subject to change or to differing interpretation, possibly with retroactive effect. Any such change or differing interpretation could alter the tax consequences to non-U.S. holders described in this prospectus. As discussed above under "Risk Factors," the U.S. government recently enacted the Tax Reform Act. The overall impact of the Tax Reform Act on shareholders is uncertain, and this summary does not address the manner in which it may affect purchasers of our common stock. Non-U.S. holders should consult with their advisors regarding the impact of the Tax Reform Act on the tax consequences of acquiring, owning and disposing of our common stock in their particular circumstances. There can be no assurance that the Internal Revenue Service, which we refer to as the IRS, will not challenge one or more of the tax consequences described herein. We assume in this discussion that a non-U.S. holder holds shares of our common stock as a capital asset, generally property held for investment.

        This discussion does not address all aspects of U.S. federal income taxation that may be relevant to a particular non-U.S. holder in light of that non-U.S. holder's individual circumstances nor does it address any aspects of U.S. state, local or non-U.S. taxes, the alternative minimum tax, estate tax, or the Medicare tax on net investment income. This discussion also does not consider any specific facts or circumstances that may apply to a non-U.S. holder and does not address the special tax rules applicable to particular non-U.S. holders, such as:

•

banks, insurance companies, and other financial institutions;



•

tax-exempt organizations and governmental organizations;



•

tax-qualified retirement plans;



•

brokers, dealers or traders in securities;



•

regulated investment companies;



•

pension plans;

166

---

Table of Contents

•

"controlled foreign corporations," "passive foreign investment companies," and corporations that accumulate earnings to avoid U.S. federal income tax;



•

"qualified foreign pension funds, "or entities wholly owned by a "qualified foreign pension fund";



•

partnerships or other entities or arrangements treated as partnerships for U.S. federal income tax purposes (and partners and investors therein);



•

persons that have a functional currency other than the U.S. dollar;



•

owners deemed to sell our common stock under the constructive sale provisions of the Code;



•

owners that hold our common stock as part of a straddle, hedge, conversion transaction, synthetic security or other integrated investment; and



•

certain U.S. expatriates.

        This discussion is for general information only and is not tax advice. Accordingly, all prospective non-U.S. holders of our common stock should consult their own tax advisors with respect to the U.S. federal, state, local and non-U.S. tax consequences of the purchase, ownership and disposition of our common stock.

Distributions on Our Common Stock

        Distributions, if any, on our common stock will constitute dividends for U.S. federal income tax purposes to the extent paid from our current or accumulated earnings and profits, as determined under U.S. federal income tax principles. If a distribution exceeds our current and accumulated earnings and profits, the excess will be treated as a tax-free return of the non-U.S. holder's investment, up to such holder's tax basis in the common stock. Any remaining excess will be treated as capital gain, subject to the tax treatment described below in "Gain on Sale or Other Taxable Disposition of Our Common Stock." Any such distributions will also be subject to the discussion below under the section titled "Withholding and Information Reporting Requirements—FATCA."

        Subject to the discussion in the following two paragraphs in this section, dividends paid to a non-U.S. holder generally will be subject to withholding of U.S. federal income tax at a 30% rate or such lower rate as may be specified by an applicable income tax treaty between the United States and such holder's country of residence.

        Dividends that are treated as effectively connected with a trade or business conducted by a non-U.S. holder within the United States and, if an applicable income tax treaty so provides, that are attributable to a permanent establishment or a fixed base maintained by the non-U.S. holder within the United States, are generally exempt from the 30% withholding tax if the non-U.S. holder satisfies applicable certification and disclosure requirements. However, such U.S. effectively connected income, net of specified deductions and credits, is taxed at the same graduated U.S. federal income tax rates applicable to United States persons (as defined in the Code). Any U.S. effectively connected income received by a non-U.S. holder that is a corporation may also, under certain circumstances, be subject to an additional "branch profits tax" at a 30% rate or such lower rate as may be specified by an applicable income tax treaty between the United States and such holder's country of residence.

        A non-U.S. holder of our common stock who claims the benefit of an applicable income tax treaty between the United States and such holder's country of residence generally will be required to provide a properly executed IRS Form W-8BEN or W-8BEN-E (or successor form) to the applicable withholding agent and satisfy applicable certification and other requirements. Non-U.S. holders are urged to consult their tax advisors regarding their entitlement to benefits under a relevant income tax treaty.

167

---

Table of Contents

        A non-U.S. holder that is eligible for a reduced rate of U.S. withholding tax under an income tax treaty may obtain a refund or credit of any excess amounts withheld by timely filing a U.S. tax return with the IRS.

Gain on Sale or Other Taxable Disposition of Our Common Stock

        Subject to the discussions below under "Backup Withholding and Information Reporting" and "Withholding and Information Reporting Requirements—FATCA," a non-U.S. holder generally will not be subject to any U.S. federal income tax on any gain realized upon such holder's sale or other taxable disposition of shares of our common stock unless:

•

the gain is effectively connected with the non-U.S. holder's conduct of a U.S. trade or business and, if an applicable income tax treaty so provides, is attributable to a permanent establishment or a fixed-base maintained by such non-U.S. holder in the United States, in which case the non-U.S. holder generally will be taxed on a net income basis at the graduated U.S. federal income tax rates applicable to United States persons (as defined in the Code) and, if the non-U.S. holder is a foreign corporation, the branch profits tax described above in "Distributions on Our Common Stock" also may apply;



•

the non-U.S. holder is a nonresident alien individual who is present in the United States for 183 days or more in the taxable year of the disposition and certain other conditions are met, in which case the non-U.S. holder will be subject to a 30% tax (or such lower rate as may be specified by an applicable income tax treaty between the United States and such holder's country of residence) on the net gain derived from the disposition, which may be offset by certain U.S. source capital losses of the non-U.S. holder, if any (even though the individual is not considered a resident of the United States, provided that the non-U.S. holder has timely filed U.S. federal income tax returns with respect to such losses); or



•

we are, or have been, at any time during the five-year period preceding such sale or other taxable disposition (or the non-U.S. holder's holding period, if shorter) a "U.S. real property holding corporation," unless our common stock is regularly traded on an established securities market and the non-U.S. holder holds no more than 5% of our outstanding common stock, directly or indirectly, actually or constructively, during the shorter of the 5-year period ending on the date of the disposition or the period that the non-U.S. holder held our common stock.

        If we are determined to be a U.S. real property holding corporation and the foregoing exception does not apply, then a purchaser generally may withhold 15% of the proceeds payable to a non-U.S. holder from a sale of our common stock and the non-U.S. holder generally will be taxed on its net gain derived from the disposition at the graduated U.S. federal income tax rates applicable to United States persons (as defined in the Code). Generally, a corporation is a U.S. real property holding corporation only if the fair market value of its U.S. real property interests equals or exceeds 50% of the sum of the fair market value of its worldwide real property interests plus its other assets used or held for use in a trade or business. Although there can be no assurance, we do not believe that we are, or have been, a U.S. real property holding corporation, or that we are likely to become one in the future. No assurance can be provided that our common stock will be regularly traded on an established securities market for purposes of the rules described above.

Backup Withholding and Information Reporting

        We must report annually to the IRS and to each non-U.S. holder the gross amount of the distributions on our common stock paid to such holder and the tax withheld, if any, with respect to such distributions. Non-U.S. holders may have to comply with specific certification procedures to establish that the holder is not a United States person (as defined in the Code) to avoid backup withholding at the applicable rate with respect to dividends on our common stock. Dividends paid to non-U.S. holders subject to withholding

168

---

Table of Contents

of U.S. federal income tax, as described above in "Distributions on Our Common Stock," generally will be exempt from U.S. backup withholding.

        Information reporting and backup withholding will generally apply to the proceeds of a disposition of our common stock by a non-U.S. holder effected by or through the U.S. office of any broker, U.S. or foreign, unless the holder certifies its status as a non-U.S. holder and satisfies certain other requirements, or otherwise establishes an exemption. Generally, information reporting and backup withholding will not apply to a payment of disposition proceeds to a non-U.S. holder where the transaction is effected outside the United States through a non-U.S. office of a broker. However, for information reporting purposes, dispositions effected through a non-U.S. office of a broker with substantial U.S. ownership or operations generally will be treated in a manner similar to dispositions effected through a U.S. office of a broker. Non-U.S. holders should consult their own tax advisors regarding the application of the information reporting and backup withholding rules to them.

        Copies of information returns may be made available to the tax authorities of the country in which the non-U.S. holder resides or is incorporated under the provisions of a specific treaty or agreement. Backup withholding is not an additional tax. Any amounts withheld under the backup withholding rules from a payment to a non-U.S. holder can be refunded or credited against the non-U.S. holder's U.S. federal income tax liability, if any, provided that an appropriate claim is filed with the IRS in a timely manner.

Withholding and Information Reporting Requirements—FATCA

        The Foreign Account Tax Compliance Act, or FATCA, generally imposes a U.S. federal withholding tax at a rate of 30% on payments of dividends on, or gross proceeds from the sale or other disposition of, our common stock paid to a foreign entity unless (i) if the foreign entity is a "foreign financial institution," such foreign entity undertakes certain due diligence, reporting, withholding, and certification obligations, (ii) if the foreign entity is not a "foreign financial institution," such foreign entity identifies certain of its U.S. investors, if any, or (iii) the foreign entity is otherwise exempt under FATCA. Under applicable U.S. Treasury regulations, withholding under FATCA currently applies to payments of dividends on our common stock, but will only apply to payments of gross proceeds from a sale or other disposition of our common stock made after December 31, 2018. Under certain circumstances, a non-U.S. holder may be eligible for refunds or credits of this withholding tax. An intergovernmental agreement between the United States and an applicable foreign country may modify the requirements described in this paragraph. Non-U.S. holders should consult their own tax advisors regarding the possible implications of this legislation on their investment in our common stock and the entities through which they hold our common stock, including, without limitation, the process and deadlines for meeting the applicable requirements to prevent the imposition of the 30% withholding tax under FATCA.

169

---

Table of Contents

UNDERWRITERS

        Under the terms and subject to the conditions in an underwriting agreement dated the date of this prospectus, the underwriters named below, for whom Morgan Stanley & Co. LLC and J.P. Morgan Securities LLC are acting as representatives, have severally agreed to purchase, and we have agreed to sell to them, severally, the number of shares indicated below:

        The underwriters and the representatives are collectively referred to as the "underwriters" and the "representatives," respectively. The underwriters are offering the shares of common stock subject to their acceptance of the shares from us and subject to prior sale. The underwriting agreement provides that the obligations of the several underwriters to pay for and accept delivery of the shares of common stock offered by this prospectus are subject to the approval of certain legal matters by their counsel and to certain other conditions. The underwriters are obligated to take and pay for all of the shares of common stock offered by this prospectus if any such shares are taken. However, the underwriters are not required to take or pay for the shares covered by the underwriters' over-allotment option described below.

        The underwriters initially propose to offer part of the shares of common stock directly to the public at the offering price listed on the cover page of this prospectus and part to certain dealers. After the initial offering of the shares of common stock, the offering price and other selling terms may from time to time be varied by the representatives.

        We have granted to the underwriters an over-allotment option, exercisable for 30 days from the date of this prospectus, to purchase up to 1,200,000 additional shares of common stock at the public offering price listed on the cover page of this prospectus, less underwriting discounts and commissions. The underwriters may exercise this over-allotment option solely for the purpose of covering over-allotments, if any, made in connection with the offering of the shares of common stock offered by this prospectus. To the extent the over-allotment option is exercised, each underwriter will become obligated, subject to certain conditions, to purchase about the same percentage of the additional shares of common stock as the number listed next to the underwriter's name in the preceding table bears to the total number of shares of common stock listed next to the names of all underwriters in the preceding table.

        The following table shows the per share and total public offering price, underwriting discounts and commissions, and proceeds before expenses to us. These amounts are shown assuming both no exercise and full exercise of the underwriters' over-allotment option to purchase up to an additional 1,200,000 shares of common stock.

170

---

Table of Contents

        The estimated offering expenses payable by us, exclusive of the underwriting discounts and commissions, are approximately $4.9 million. We have agreed to reimburse the underwriters for certain expenses, including clearance of this offering with the Financial Industry Regulatory Authority, up to $40,000. The underwriters have agreed to reimburse us for certain expenses in connection with this offering.

        The underwriters have informed us that they do not intend sales to discretionary accounts to exceed 5% of the total number of shares of common stock offered by them.

        We have applied to list our common stock on The Nasdaq Global Select Market under the trading symbol "CBLK."

        We and all directors and officers and the holders of substantially all of our outstanding stock and stock options have agreed that, without the prior written consent of the representatives on behalf of the underwriters, we and they will not, during the period ending 180 days after the date of this prospectus, or the restricted period:

•

offer, pledge, sell, contract to sell, sell any option or contract to purchase, purchase any option or contract to sell, grant any option, right or warrant to purchase, lend or otherwise transfer or dispose of, directly or indirectly, any shares of common stock or any securities convertible into or exercisable or exchangeable for shares of common stock;



•

file any registration statement with the Securities and Exchange Commission relating to the offering of any shares of common stock or any securities convertible into or exercisable or exchangeable for common stock; or



•

enter into any swap or other arrangement that transfers to another, in whole or in part, any of the economic consequences of ownership of the common stock;

whether any such transaction described above is to be settled by delivery of common stock or such other securities, in cash or otherwise. In addition, we and each such person agrees that, without the prior written consent of the representatives on behalf of the underwriters, we or such other person will not, during the restricted period, make any demand for, or exercise any right with respect to, the registration of any shares of common stock or any security convertible into or exercisable or exchangeable for common stock.

        The restrictions described in the immediately preceding paragraph, other than those related to registration of shares, do not apply to our directors, officers and other holders of substantially all of our outstanding stock and stock options with respect to:

•

shares of our common stock sold pursuant to the underwriting agreement or transactions relating to shares of our common stock or other securities acquired either in this offering or in open market transactions after the completion of this offering, provided that no filing under Section 16(a) of the Exchange Act shall be required or shall be voluntarily made during the restricted period in connection with subsequent sales of our common stock or other securities acquired in such open market transactions;



•

transfers of shares of our common stock or any security convertible into our common stock as a bona fide gift;



•

any transfer to or from certain trusts or to a stockholder's immediate family;



•

(i) transfers to a direct or indirect affiliate (as defined in Rule 405 promulgated under the Securities Act of 1933, as amended) or (ii) distributions of shares of our common stock or any security convertible into or exercisable for our common stock to limited partners, limited liability company members or stockholders;

171

---

Table of Contents

•

the receipt of our common stock upon the exercise or vesting event of RSUs or options to purchase our securities on a "cashless" or "net exercise" basis only in an amount necessary to cover the applicable exercise price or tax withholding obligations in connection with such vesting or exercise, but for the avoidance of doubt, excluding all methods of exercise that would involve a sale of any shares of our common stock relating to options other than to us, provided that no public report or filing under Section 16(a) of the Exchange Act, or any other public filing or disclosure of such receipt or transfer, shall be required or shall be voluntarily made during the restricted period, except that a filing under Section 16(a) of the Exchange Act may be made if (A) such filing relates to options that will expire prior to the expiration of the restricted period and (B) the footnotes thereto clearly indicate (1) that no shares were sold by the reporting person and that the shares received upon exercise of the stock option are subject to a lock-up agreement with the underwriters of this offering and (2) the disposition of any shares was made solely to us;



•

the establishment of a trading plan pursuant to Rule 10b5-1 under the Exchange Act for the transfer of shares of our common stock, provided that (i) such plan does not provide for the transfer of our common stock during the restricted period and (ii) to the extent a public announcement or filing under the Exchange Act, if any, is required of or voluntarily made regarding the establishment of such plan, such announcement or filing shall include a statement to the effect that no transfer of our common stock may be made under such plan during the restricted period;



•

the transfer by operation of law pursuant to a qualified domestic order or in connection with a divorce settlement, provided that (i) any required filings under Section 16(a) of the Exchange Act shall state that the transfer is by operation of law, court order, or in connection with a divorce settlement, as the case may be, and (ii) no public filings are voluntarily made;



•

the conversion of the outstanding shares of our preferred stock into shares of our common stock, provided that such shares of our common stock remain subject to the terms of the lock-up agreement; and



•

the transfer of shares of our common stock or any security convertible into or exercisable or exchangeable for our common stock pursuant to a bona fide third-party tender offer, merger, consolidation or other similar transaction that occurs after the consummation of this offering is approved by our board of directors, involving a change of control of our company, provided, that in the event that the tender offer, merger, consolidation or other such transaction is not completed, the common stock shall remain subject to the restrictions contained in the lock-up agreement.

        The representatives, in their sole discretion, may release the common stock and other securities subject to the lock-up agreements described above in whole or in part at any time; provided, however, that if the release is granted for one of our officers or directors, the representatives, on behalf of the underwriters, agree that at least three business days before the effective date of the release or waiver, the representatives, on behalf of the underwriters, will notify us of the impending release or waiver, and we are obligated to announce the impending release or waiver by press release through a major news service at least two business days before the effective date of the release or waiver.

        In order to facilitate the offering of the common stock, the underwriters may engage in transactions that stabilize, maintain or otherwise affect the price of the common stock. Specifically, the underwriters may sell more shares than they are obligated to purchase under the underwriting agreement, creating a short position. A short sale is covered if the short position is no greater than the number of shares available for purchase by the underwriters under the over-allotment option. The underwriters can close out a covered short sale by exercising the over-allotment option or purchasing shares in the open market. In determining the source of shares to close out a covered short sale, the underwriters will consider, among other things, the open market price of shares compared to the price available under the over-allotment option. The underwriters may also sell shares in excess of the over-allotment option, creating a naked short position. The underwriters must close out any naked short position by purchasing shares in the open

172

---

Table of Contents

market. A naked short position is more likely to be created if the underwriters are concerned that there may be downward pressure on the price of the common stock in the open market after pricing that could adversely affect investors who purchase in this offering. As an additional means of facilitating this offering, the underwriters may bid for, and purchase, shares of common stock in the open market to stabilize the price of the common stock. These activities may raise or maintain the market price of the common stock above independent market levels or prevent or retard a decline in the market price of the common stock. The underwriters are not required to engage in these activities and may end any of these activities at any time.

        We and the underwriters have agreed to indemnify each other against certain liabilities, including liabilities under the Securities Act.

        A prospectus in electronic format may be made available on websites maintained by one or more underwriters, or selling group members, if any, participating in this offering. The representatives may agree to allocate a number of shares of common stock to underwriters for sale to their online brokerage account holders. Internet distributions will be allocated by the representatives to underwriters that may make Internet distributions on the same basis as other allocations.

        The underwriters and their respective affiliates are full service financial institutions engaged in various activities, which may include securities trading, commercial and investment banking, financial advisory, investment management, investment research, principal investment, hedging, financing and brokerage activities. Certain of the underwriters and their respective affiliates have, from time to time, performed, and may in the future perform, various financial advisory and investment banking services for us, for which they received or will receive customary fees and expenses.

        In addition, in the ordinary course of their various business activities, the underwriters and their respective affiliates may make or hold a broad array of investments and actively trade debt and equity securities (or related derivative securities) and financial instruments (including bank loans) for their own account and for the accounts of their customers and may at any time hold long and short positions in such securities and instruments. Such investment and securities activities may involve our securities and instruments. The underwriters and their respective affiliates may also make investment recommendations or publish or express independent research views in respect of such securities or instruments and may at any time hold, or recommend to clients that they acquire, long or short positions in such securities and instruments.

Pricing of the Offering

        Prior to this offering, there has been no public market for our common stock. The initial public offering price was determined by negotiations between us and the representatives. Among the factors considered in determining the initial public offering price were our future prospects and those of our industry in general, our sales, earnings and certain other financial and operating information in recent periods, and the price-earnings ratios, price-sales ratios, market prices of securities, and certain financial and operating information of companies engaged in activities similar to ours.

Selling Restrictions

Canada

        The shares of our common stock may be sold only to purchasers purchasing, or deemed to be purchasing, as principal that are accredited investors, as defined in National Instrument 45-106 Prospectus Exemptions or subsection 73.3(1) of the Securities Act (Ontario), and are permitted clients, as defined in National Instrument 31-103 Registration Requirements, Exemptions and Ongoing Registrant Obligations. Any resale of the shares of our common stock must be made in accordance with an exemption from, or in a transaction not subject to, the prospectus requirements of applicable securities laws.

173

---

Table of Contents

        Securities legislation in certain provinces or territories of Canada may provide a purchaser with remedies for rescission or damages if this prospectus (including any amendment thereto) contains a misrepresentation, provided that the remedies for rescission or damages are exercised by the purchaser within the time limit prescribed by the securities legislation of the purchaser's province or territory. The purchaser should refer to any applicable provisions of the securities legislation of the purchaser's province or territory for particulars of these rights or consult with a legal advisor.

        Pursuant to section 3A.3 of National Instrument 33-105 Underwriting Conflicts (NI 33-105), the underwriters are not required to comply with the disclosure requirements of NI 33-105 regarding underwriter conflicts of interest in connection with this offering.

European Economic Area

        In relation to each Member State of the European Economic Area which has implemented the Prospectus Directive, each a Relevant Member State, an offer to the public of any shares of our common stock may not be made in that Relevant Member State, except that an offer to the public in that Relevant Member State of any shares of our common stock may be made at any time under the following exemptions under the Prospectus Directive, if they have been implemented in that Relevant Member State:

(a)

to any legal entity which is a qualified investor as defined in the Prospectus Directive;



(b)

to fewer than 150, natural or legal persons (other than qualified investors as defined in the Prospectus Directive), as permitted under the Prospectus Directive, subject to obtaining the prior consent of the representatives for any such offer; or



(c)

in any other circumstances falling within Article 3(2) of the Prospectus Directive, provided that no such offer of shares of our common stock shall result in a requirement for the publication by us or any underwriter of a prospectus pursuant to Article 3 of the Prospectus Directive.

        For the purposes of this provision, the expression an "offer to the public" in relation to any shares of our common stock in any Relevant Member State means the communication in any form and by any means of sufficient information on the terms of the offer and any shares of our common stock to be offered so as to enable an investor to decide to purchase any shares of our common stock, as the same may be varied in that Member State by any measure implementing the Prospectus Directive in that Member State, the expression "Prospectus Directive" means Directive 2003/71/EC (and amendments thereto, including the 2010 PD Amending Directive, to the extent implemented in the Relevant Member State), and includes any relevant implementing measure in the Relevant Member State.

United Kingdom

        Each underwriter has represented and agreed that:

(a)

it has only communicated or caused to be communicated and will only communicate or cause to be communicated an invitation or inducement to engage in investment activity (within the meaning of Section 21 of the Financial Services and Markets Act 2000 ("FSMA") received by it in connection with the issue or sale of the shares of our common stock in circumstances in which Section 21(1) of the FSMA does not apply to us; and



(b)

it has complied and will comply with all applicable provisions of the FSMA with respect to anything done by it in relation to the shares of our common stock in, from or otherwise involving the United Kingdom.

174

---

Table of Contents

LEGAL MATTERS

        The validity of the shares of common stock offered by this prospectus will be passed upon for us by Goodwin Procter LLP, Boston, Massachusetts. Latham & Watkins LLP, Waltham, Massachusetts is acting as counsel for the underwriters in this offering.

EXPERTS

        The consolidated financial statements of Carbon Black, Inc. as of December 31, 2017 and 2016 and for each of the three years in the period ended December 31, 2017 included in this prospectus have been so included in reliance on the report of PricewaterhouseCoopers LLP, an independent registered public accounting firm, given on the authority of said firm as experts in auditing and accounting.

        The consolidated financial statements of Confer Technologies, Inc. as of December 31, 2015 and 2014 and for each of the years in the two-year period ended December 31, 2015 included in this prospectus have been audited by RSM US LLP, independent auditors, as stated in their report thereon, and included in this prospectus and registration statement in reliance upon such report and upon the authority of such firm as experts in accounting and auditing.

ADDITIONAL INFORMATION

        We have filed with the SEC a registration statement on Form S-1 under the Securities Act with respect to the shares of common stock offered by this prospectus. This prospectus, which constitutes a part of the registration statement, does not contain all of the information set forth in the registration statement, some of which is contained in exhibits to the registration statement as permitted by the rules and regulations of the SEC. For further information with respect to us and our common stock, we refer you to the registration statement, including the exhibits filed as a part of the registration statement. Statements contained in this prospectus concerning the contents of any contract or any other document are not necessarily complete. If a contract or document has been filed as an exhibit to the registration statement, please see the copy of the contract or document that has been filed. Each statement in this prospectus relating to a contract or document filed as an exhibit is qualified by the filed exhibit. You may obtain copies of this information by mail from the Public Reference Section of the SEC, 100 F Street, N.E., Room 1580, Washington, D.C. 20549, at prescribed rates. You may obtain information on the operation of the public reference rooms by calling the SEC at 1-800-SEC-0330. The SEC also maintains an Internet website that contains reports, proxy statements and other information about issuers, like us, that file electronically with the SEC. The address of that website is www.sec.gov.

        As a result of this offering, we will become subject to the information and reporting requirements of the Exchange Act and, in accordance with this law, will file periodic reports, proxy statements and other information with the SEC. These periodic reports, proxy statements and other information will be available for inspection and copying at the SEC's public reference facilities and the website of the SEC referred to above. We also maintain a website at www.carbonblack.com. Upon the closing of this offering, you may access these materials free of charge as soon as reasonably practicable after they are electronically filed with, or furnished to, the SEC. Information contained on our website is not a part of this prospectus and the inclusion of our website address in this prospectus is an inactive textual reference only.

175

---

Table of Contents

INDEX TO CONSOLIDATED FINANCIAL STATEMENTS

---

Table of Contents

REPORT OF INDEPENDENT REGISTERED PUBLIC ACCOUNTING FIRM

To the Board of Directors and Stockholders of
Carbon Black, Inc.

Opinion on the Financial Statements

        We have audited the accompanying consolidated balance sheets of Carbon Black, Inc. and its subsidiaries as of December 31, 2017 and 2016, and the related consolidated statements of operations and comprehensive loss, of redeemable convertible and convertible preferred stock and stockholders' deficit and of cash flows for each of the three years in the period ended December 31, 2017, including the related notes (collectively referred to as the "consolidated financial statements"). In our opinion, the consolidated financial statements present fairly, in all material respects, the financial position of the Company as of December 31, 2017 and 2016, and the results of their operations and their cash flows for each of the three years in the period ended December 31, 2017 in conformity with accounting principles generally accepted in the United States of America.

Basis for Opinion

        These consolidated financial statements are the responsibility of the Company's management. Our responsibility is to express an opinion on the Company's consolidated financial statements based on our audits. We are a public accounting firm registered with the Public Company Accounting Oversight Board (United States) ("PCAOB") and are required to be independent with respect to the Company in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB.

        We conducted our audits of these consolidated financial statements in accordance with the standards of the PCAOB. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether the consolidated financial statements are free of material misstatement, whether due to error or fraud.

        Our audits included performing procedures to assess the risks of material misstatement of the consolidated financial statements, whether due to error or fraud, and performing procedures that respond to those risks. Such procedures included examining, on a test basis, evidence regarding the amounts and disclosures in the consolidated financial statements. Our audits also included evaluating the accounting principles used and significant estimates made by management, as well as evaluating the overall presentation of the consolidated financial statements. We believe that our audits provide a reasonable basis for our opinion.

F-2

---

Table of Contents

CARBON BLACK, INC.

CONSOLIDATED BALANCE SHEETS

(In thousands, except share and per share amounts)

The accompanying notes are an integral part of these consolidated financial statements.

F-3

---

Table of Contents

CARBON BLACK, INC.

CONSOLIDATED STATEMENTS OF OPERATIONS AND COMPREHENSIVE LOSS

(In thousands, except share and per share amounts)

   

The accompanying notes are an integral part of these consolidated financial statements.

F-4

---

Table of Contents

CARBON BLACK, INC.

CONSOLIDATED STATEMENTS OF REDEEMABLE CONVERTIBLE AND CONVERTIBLE PREFERRED STOCK AND
STOCKHOLDERS' DEFICIT

(In thousands, except share amounts)

F-5

---

Table of Contents

CARBON BLACK, INC.

CONSOLIDATED STATEMENTS OF REDEEMABLE CONVERTIBLE AND CONVERTIBLE PREFERRED STOCK AND
STOCKHOLDERS' DEFICIT (Continued)

(In thousands, except share amounts)

The accompanying notes are an integral part of these consolidated financial statements.

F-6

---

Table of Contents

CARBON BLACK, INC.

CONSOLIDATED STATEMENTS OF CASH FLOWS

(In thousands)

   

The accompanying notes are an integral part of these consolidated financial statements.

F-7

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS

(Amounts in thousands, except share and per share amounts)

1. Nature of Business and Basis of Presentation

        Carbon Black, Inc. (the "Company") is a leading provider of next-generation endpoint security solutions. The Company's solutions enable customers to predict, prevent, detect, respond to and remediate cyber attacks before they cause a damaging incident or data breach.

        The Company was incorporated under the laws of the State of Delaware in December 2002 as Bit 9, Inc. and in April 2005 changed its name to Bit9, Inc. In January 2016, the Company amended its certificate of incorporation to change its name to Carbon Black, Inc.

        The Company is headquartered in Waltham, Massachusetts. The Company has wholly owned subsidiaries in the United Kingdom, Singapore and Australia, each of which commenced operations in 2015, and Canada, Malaysia and Japan, each of which commenced operations in 2016.

        The Company is subject to a number of risks similar to other companies of a similar size in the high technology industry, including, but not limited to, uncertainty of progress in developing technologies, new technological innovations, dependence on key personnel, protection of proprietary technology, uncertainty of market acceptance of products, lack of marketing and sales history, and the need for additional funding.

        The accompanying consolidated financial statements have been prepared in accordance with accounting principles generally accepted in the United States of America ("GAAP") and include the accounts of the Company and its wholly owned subsidiaries. All intercompany accounts and transactions have been eliminated in consolidation.

2. Summary of Significant Accounting Policies

Use of Estimates

        The preparation of financial statements in conformity with GAAP requires management to make estimates and assumptions that affect the reported amounts of assets and liabilities, the disclosure of contingent assets and liabilities at the date of the financial statements and the reported amounts of revenue and expense during the reporting periods. Significant estimates and assumptions reflected in these consolidated financial statements include, but are not limited to, revenue recognition, allowances for doubtful accounts, stock-based compensation, valuation allowances for deferred tax assets, the valuation of common stock and preferred stock, the valuation of preferred stock and common stock warrant liabilities, and the valuation of assets acquired and liabilities assumed in business combinations, including identifiable intangible assets. Estimates are periodically reviewed in light of changes in circumstances, facts and experience. Changes in estimates are recorded in the period in which they become known. Actual results could differ materially from the Company's estimates.

Unaudited Pro Forma Information

        The Company is seeking to complete an initial public offering ("IPO") of its common stock, which, if successful, would provide additional capital to fund its operations. Upon the closing of a qualified public offering on specified terms, all of the Company's outstanding redeemable convertible and convertible preferred stock will automatically convert into shares of common stock.

        The accompanying unaudited pro forma consolidated balance sheet as of December 31, 2017 has been prepared to give effect to the following events as if the proposed IPO had occurred on December 31, 2017: (i) the automatic conversion of all outstanding shares of redeemable convertible and convertible preferred

F-8

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

2. Summary of Significant Accounting Policies (Continued)

stock into 45,849,708 shares of common stock, (ii) the outstanding warrants to purchase preferred stock becoming warrants to purchase shares of common stock and (iii) the assumed exercise of an outstanding warrant to purchase 468,587 shares of common stock, which will become exercisable upon the closing of an IPO at an exercise price of $0.002 per share (see Note 12).

        In the accompanying consolidated statements of operations and comprehensive loss, the unaudited pro forma basic and diluted net loss per share attributable to common stockholders for the year ended December 31, 2017 has been prepared to give effect to the following events as if the proposed IPO had occurred on the later of January 1, 2017 or the issuance date of the redeemable convertible or convertible preferred stock: (i) the automatic conversion of all outstanding shares of redeemable convertible and convertible preferred stock into shares of common stock; (ii) the outstanding warrants to purchase preferred stock becoming warrants to purchase shares of common stock and (iii) the assumed exercise of an outstanding warrant to purchase 468,587 shares of common stock, which will become exercisable upon the closing of an IPO at an exercise price of $0.002 per share.

Segment Information

        The Company operates as one operating segment. Operating segments are defined as components of an enterprise for which discrete financial information is available and is regularly reviewed by the chief operating decision maker, or decision-making group, in making decisions regarding resource allocation and performance assessment. The Company has determined that its chief operating decision maker is its President and Chief Executive Officer. The Company's chief operating decision maker reviews the Company's financial information on a consolidated basis for purposes of allocating resources and evaluating financial performance.

        The Company does not have significant operations outside of the United States. During the years ended December 31, 2015, 2016 and 2017, revenue from customers located outside of the United States in the aggregate accounted for 11.2%, 11.7% and 13.2%, respectively, of the Company's total revenue, with no country representing greater than 10% of total revenue for those periods. Additionally, substantially all of the Company's long-lived tangible assets (consisting of property and equipment) were held within the United States as of December 31, 2016 and 2017.

Revenue Recognition

        The Company generates revenue through relationships with channel partners and through its direct sales force primarily from three sources: (i) the sale of subscription (i.e., term-based) and perpetual licenses for the Company's Cb Protection and Cb Response software products along with access to and the right to utilize the threat intelligence capabilities of the Cb Predictive Security Cloud, as well as maintenance services and customer support (collectively "support"), (ii) cloud-based software-as-a-service ("SaaS") subscriptions for access to the Company's Cb Response and Cb Defense software products, and (iii) professional services and training (collectively "services").

        The Company recognizes revenue when all of the following criteria are met:

•

Persuasive evidence of an arrangement exists.  Binding agreements or purchase orders are generally evidence of an arrangement.

F-9

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

2. Summary of Significant Accounting Policies (Continued)

•

Delivery has occurred.  Delivery occurs (i) when the customer has been provided an access code that allows them to access and/or download the software product; (ii) when the services are performed; or (iii) when on-line training has been made available to the customer.



•

The sales price is fixed or determinable.  Fees are considered fixed or determinable when the fees are contractually agreed with the customer and when the payment terms of the transaction do not extend beyond the Company's customary payment terms.



•

Collectibility is probable or reasonably assured.  Collectibility is deemed probable or reasonably assured based on review of a number of factors, including creditworthiness and customer payment history.

Subscription, License and Support Revenue

        Substantially all of the Company's software arrangements are multiple-element arrangements that contain a combination of deliverables including software licenses, cloud-based subscriptions, support, professional services and training. All of these elements are considered software elements, other than the cloud-based subscriptions, and, thus, are accounted for in accordance with GAAP for software revenue recognition. Cloud-based subscriptions are considered non-software elements.

        The Company's Cb Protection and Cb Response products are offered through subscription or perpetual software licenses, with a substantial majority of its customers selecting a subscription license. Subscription licenses include access to and the right to utilize the threat intelligence capabilities of the Cb Predictive Security Cloud as well as ongoing support, which provides customers with telephone and web-based support, bug fixes and repairs and software updates on a when-and-if-available basis. The Cb Predictive Security Cloud automatically distributes real-time threat intelligence, such as detection algorithms, reputation scores and attack classifications, to the Company's customers. Substantially all customers who purchase licenses on a perpetual basis also purchase an agreement for support and an agreement for access to and the right to utilize the threat intelligence capabilities of the Cb Predictive Security Cloud.

        The timing and pattern of revenue recognition varies by arrangement and is dependent on the combination of elements included in the arrangement. Generally, under the software revenue recognition guidance, arrangement consideration is allocated among the elements of a multiple-element arrangement using the residual method. Under the residual method, when vendor-specific objective evidence ("VSOE") of fair value exists for the undelivered elements in an arrangement, consideration is allocated to the undelivered elements based on VSOE of fair value of those elements, which is deferred, and the residual amount of the total arrangement fee is recognized as revenue upon delivery of the software, assuming all other revenue recognition criteria are met. If VSOE of the fair value of one or more of the undelivered elements does not exist, all revenue from the arrangement is deferred until delivery of all of the elements has occurred or until VSOE of the fair values of each of those undelivered elements can be established, whichever is earlier. The Company does not have VSOE of fair value for its software and support offerings and, therefore, the Company is unable to apply the residual method to substantially all of its arrangements. For these arrangements, the aggregate arrangement fee is deferred on the Company's consolidated balance sheet and subsequently recognized as revenue ratably over the longest service period of any deliverable in the arrangement, which is generally the support term, beginning once all services in the

F-10

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

2. Summary of Significant Accounting Policies (Continued)

arrangement have commenced, after delivery of the software. The Company provides customers with access to and the right to utilize the threat intelligence capabilities of the Cb Predictive Security Cloud upon delivery of its licensed software.

        During 2015, the Company began offering its Cb Response product through cloud-based subscriptions. During 2016, the Company began offering its Cb Defense product, a cloud-based next-generation antivirus solution obtained through the acquisition of Confer Technologies, Inc. (see Note 3). Under the Company's Cb Response product cloud-based subscription arrangements, customers do not have the contractual right to take possession of the software at any time. Under the Company's Cb Defense product cloud-based subscription arrangements, customers do not have the contractual right to take possession of the software at any time, nor is it feasible for customers to run the software on their own or with another third-party. With respect to these cloud-based subscription offerings sold on a stand-alone basis, the Company recognizes revenue ratably over the term of the subscription delivery, assuming that the other criteria for revenue recognition are met.

        When a multiple-element arrangement includes both software elements and non-software elements, the total arrangement consideration is first allocated between the software elements and the non-software elements based on the selling price hierarchy, which includes (1) VSOE, if available, (2) third-party evidence ("TPE"), if VSOE is not available, or (3) best estimate of selling price ("BESP"), if neither VSOE nor TPE is available. The Company has not been able to establish a selling price for any element using VSOE or TPE. The Company determines BESP by considering its overall pricing objectives and market conditions. Significant pricing practices taken into consideration include the Company's discounting practices, the size and volume of the Company's transactions, the Company's price lists, the Company's go-to-market strategy, historical standalone sales and contract prices. The determination of BESP is made in consultation with, and is approved by, the Company's management. The Company's multiple-element arrangements can include a single non-software element, in which case the portion of the consideration allocated to the non-software element is recognized ratably over the service period of the non-software element, assuming all other criteria for revenue recognition have been met. The portion of the consideration allocated to software elements is recognized as described above.

Services Revenue

        The Company provides professional services to customers, primarily in the form of deployment, and training services. Services are typically sold together with licenses of the Company's software products and, to a lesser extent, on a stand-alone basis. Services are priced separately and are not essential to the functionality of the software license. The professional services can be performed by a third party and have a history of consistent pricing by the Company. Professional services are sold as time-and-materials contracts based on the number of hours worked and at contractually agreed-upon hourly rates, and also on a fixed-fee basis. Revenue from professional services and training sold on a stand-alone basis is recognized as those services are rendered.

        The Company has established VSOE of fair value for professional services based on an analysis of the stand-alone selling prices of the services. While professional services meet the conditions to qualify as a separate element for revenue recognition, when professional services are included in an arrangement that also includes support, revenue from the entire arrangement is recognized ratably over the longest service

F-11

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

2. Summary of Significant Accounting Policies (Continued)

period of any deliverable in the arrangement, beginning once all services in the arrangement have commenced because the Company does not have VSOE of fair value for support.

        The Company's employees may incur out-of-pocket expenses when providing services to customers that are reimbursable from the customer under the terms of the service contract. The Company bills any out-of-pocket expenses incurred in the performance of these services to the customer. The expenses are classified on a gross basis as revenue and costs of revenue in the consolidated statements of operations and comprehensive loss. The Company's determination of a gross presentation is based on an assessment of the relevant facts and circumstances, including the fact that the Company's customers, rather than the Company, benefit from the expenditures and the Company bears the credit risk of the reimbursement until it receives reimbursement from the customer.

Channel Partners

        A substantial majority of the Company's revenue is generated by sales in conjunction with its channel partners, such as security-focused value added resellers ("VARs"), managed security service providers ("MSSPs") and incident response ("IR") firms. When the Company transacts with a channel partner, its contractual arrangement is with the channel partner and not with the end-use customer. Whether the Company transacts business with and receives the order from a channel partner or directly from an end-use customer, its revenue recognition policy and resulting pattern of revenue recognition for the order are the same.

        In its business with VARs, the Company enters into a reseller agreement under which the VAR places orders to the Company for its products and services in connection with the VAR's own sales to identified end-use customers. Under those contractual arrangements, the Company invoices the VAR for the arrangement fee (which reflects a channel partner discount relative to typical end-use customer pricing) and payment to the Company from the VAR is not contingent upon the VAR's collection from the end-use customer. The Company records revenue based on the amount of the discounted arrangement fee. For sales of the Company's software products and support to VARs, the end-use customer also enters into a click-through license agreement with the Company and the Company fulfills the software and provides the support directly to the end-use customer. The key terms of and the accounting for the Company's contractual arrangements with VARs are the same as those of other distributors of the Company's products and services that are not VARs.

        In its business with MSSPs, the Company enters into a contractual arrangement with the MSSP that permits it to deploy the Company's software products to end-use customers as components of the MSSP's broader managed service offerings. Under those contractual arrangements, the Company invoices the MSSP for the arrangement fee (which reflects a channel partner discount relative to typical end-use customer pricing) and payment to the Company from the MSSP is not contingent upon the MSSP's collection from the end-use customer. The Company records revenue based on the amount of the discounted arrangement fee. The Company provides support to the MSSP and not to the identified end-use customer. MSSPs do not purchase professional services or training from the Company, for their own benefit or for the benefit of the end-use customer.

        In its business with IR firms, the Company enters into contractual arrangements that permit IR firms to deploy the Company's solution into an enterprise environment for a limited time period to assist in their

F-12

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

2. Summary of Significant Accounting Policies (Continued)

client investigation and incident response service engagements with the goal of referring those clients to the Company following the engagement. The Company receives no fees from IR firms and records no revenue from those contractual arrangements.

Accounts Receivable, Net

        Accounts receivable are presented net of an allowance for doubtful accounts, which is an estimate of amounts that may not be collectible. The Company generally does not require collateral to secure accounts receivable. In determining the amount of the allowance at each reporting date, the Company makes judgments about general economic conditions, historical write-off experience and any specific risks identified in customer collection matters, including the aging of unpaid accounts receivable and changes in customer financial conditions. Account balances are written off after all means of collection are exhausted and the potential for non-recovery is determined to be probable. Adjustments to the allowance for doubtful accounts are recorded as general and administrative expenses in the consolidated statements of operations and comprehensive loss.

Deferred Revenue

        Deferred revenue consists of amounts that have been invoiced but that have not been recognized as revenue. Deferred revenue that is expected to be recognized as revenue during the succeeding twelve months is recorded as current, and the remaining deferred revenue is recorded as non-current in the consolidated balance sheets.

Concentrations of Credit Risk and Significant Customers

        Financial instruments that potentially subject the Company to concentrations of credit risk consist primarily of cash, cash equivalents and accounts receivable. The Company maintains the majority of its cash and cash equivalents with one financial institution, which management believes to be of a high credit quality, in amounts that at times may exceed federally insured limits. The Company does not believe that it is subject to unusual credit risk beyond the normal credit risk associated with commercial banking relationships.

        As of December 31, 2016, one channel partner accounted for 23.8% of outstanding accounts receivable. As of December 31, 2017, two channel partners accounted for 16.2% and 20.2% of outstanding accounts receivable, respectively. For the years ended December 31, 2015, 2016 and 2017, sales to one channel partner represented 34.9%, 31.3% and 26.9%, respectively, of total revenue.

Fair Value Measurements

        Certain assets and liabilities are carried at fair value under GAAP. Fair value is defined as the exchange price that would be received for an asset or paid to transfer a liability (an exit price) in the principal or most advantageous market for the asset or liability in an orderly transaction between market participants on the measurement date. Valuation techniques used to measure fair value must maximize the use of observable inputs and minimize the use of unobservable inputs. Financial assets and liabilities carried at fair value are to be classified and disclosed in one of the following three levels of the fair value hierarchy, of which the first two are considered observable and the last is considered unobservable:

•

Level 1—Quoted prices in active markets for identical assets or liabilities.

F-13

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

2. Summary of Significant Accounting Policies (Continued)

•

Level 2—Observable inputs (other than Level 1 quoted prices), such as quoted prices in active markets for similar assets or liabilities, quoted prices in markets that are not active for identical or similar assets or liabilities, or other inputs that are observable or can be corroborated by observable market data.



•

Level 3—Unobservable inputs that are supported by little or no market activity and that are significant to determining the fair value of the assets or liabilities, including pricing models, discounted cash flow methodologies and similar techniques.

        The Company's cash equivalents, preferred stock warrant liabilities and common stock warrant liability are carried at their fair values as determined according to the fair value hierarchy described above (see Note 4). The carrying values of accounts receivable, accounts payable and accrued expenses approximate their respective fair values due to the short-term nature of these assets and liabilities. The carrying value of outstanding borrowings under the Company's line of credit arrangement approximates fair value as it bears interest at a rate approximating a market interest rate (see Note 9).

Cash Equivalents

        The Company considers all highly liquid investments with original maturities of three months or less when purchased to be cash equivalents. At December 31, 2016 and 2017, cash equivalents consisted of short-term money market accounts that are stated at fair value.

Restricted Cash

        As of December 31, 2016 and 2017, the Company had no restricted cash balances. During the year ended December 31, 2016, the Company's financial institution no longer required the Company to maintain collateral for two existing letters of credit, including one issued as a security deposit in connection with the Company's lease of its corporate office facilities (see Note 14).

Foreign Currency Translation

        The functional currency of each of the Company's foreign subsidiaries is the U.S. dollar. Monetary assets and liabilities that are denominated in a foreign currency are revalued into U.S. dollars at the exchange rates in effect at each reporting date. Income and expense accounts are revalued into U.S. dollars on the date of the transaction using the exchange rate in effect on the transaction date. Nonmonetary assets, liabilities, and equity transactions are converted at historical exchange rates in effect at the time of the transaction. All resulting foreign currency transaction gains and losses are recorded in the consolidated statements of operations and comprehensive loss as other income or expense. The net foreign currency transaction gains (losses) recorded by the Company for the years ended December 31, 2015, 2016 and 2017 were $(363), $(511) and $227, respectively.

Property and Equipment

        Property and equipment are stated at cost less accumulated depreciation and amortization. Equipment under capital leases is stated at fair value at the inception of the lease less accumulated depreciation. Depreciation and amortization is recognized using the straight-line method over the estimated useful lives of the assets. Computer equipment is depreciated over three or four years.

F-14

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

2. Summary of Significant Accounting Policies (Continued)

Computer software, furniture and fixtures and office equipment are depreciated over three years. Equipment held under capital leases is depreciated over the shorter of the remaining lease term or the three-year estimated useful life of the equipment. Leasehold improvements are amortized over the shorter of the remaining lease term or the estimated useful life of seven years. Repair and maintenance costs are expensed as incurred. Upon retirement or sale, the cost and related accumulated depreciation or amortization of assets disposed of are removed from the accounts and any resulting gain or loss is included in loss from operations.

Software Development Costs

        The Company capitalizes certain costs related to the development of software for internal use and the development of software for license or sale to customers, including costs incurred for certain upgrades and enhancements that are expected to result in increased functionality.

        Costs incurred to develop software to be licensed or sold to customers are expensed prior to the establishment of technological feasibility of the software and are capitalized thereafter until commercial release of the software. The Company has not historically capitalized software development costs as the establishment of technological feasibility typically occurs shortly before the commercial release of its software products. As such, all software development costs related to software for license or sale to customers are expensed as incurred and included within research and development expense in the consolidated statements of operations and comprehensive loss.

        Qualifying costs incurred to develop internal-use software are capitalized when (i) the preliminary project stage is completed, (ii) management has authorized further funding for the completion of the project and (iii) it is probable that the project will be completed and performed as intended. These capitalized costs include salaries for employees who devote time directly to developing internal-use software and external direct costs of services consumed in developing the software. Capitalization of these costs ceases once the project is substantially complete and the software is ready for its intended purpose. Capitalized internal-use software development costs are amortized using the straight-line method over an estimated useful life of three years. Such amortization expense for internal-use software is classified as cost of subscription, license and support revenue in the consolidated statements of operations and comprehensive loss.

Business Combinations

        The Company accounts for business combinations using the acquisition method of accounting. Application of this method of accounting requires that (i) identifiable assets acquired (including identifiable intangible assets) and liabilities assumed generally be measured and recognized at fair value as of the acquisition date and (ii) the excess of the purchase price over the net fair value of identifiable assets acquired and liabilities assumed be recognized as goodwill, which is not amortized for accounting purposes but is subject to testing for impairment at least annually. Transaction costs related to business combinations are expensed as incurred.

        Determining the fair value of assets acquired and liabilities assumed and the allocation of the purchase price requires management to use significant judgment and estimates, especially with respect to intangible assets. Critical estimates in valuing certain identifiable assets include, but are not limited to, the

F-15

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

2. Summary of Significant Accounting Policies (Continued)

selection of valuation methodologies, estimates of future revenue and cash flows, expected long-term market growth, future expected operating expenses, costs of capital and appropriate discount rates. Management's estimates of fair value are based upon assumptions believed to be reasonable, but which are inherently uncertain and unpredictable and, as a result, actual results may differ from estimates. During the measurement period, the Company may record certain adjustments to the carrying value of the assets acquired and liabilities assumed with the corresponding offset to goodwill. After the measurement period, which could last up to one year after the transaction date, all adjustments are recorded in the consolidated statements of operations and comprehensive loss.

        Contingent payments that are dependent upon post-combination services, if any, are considered separate transactions outside of the business combination and are, therefore, included in the post-combination consolidated statements of operations and comprehensive loss. In addition, uncertain tax positions assumed and valuation allowances related to the net deferred tax assets acquired in connection with a business combination are estimated as of the acquisition date and recorded as part of the purchase. Thereafter, any changes to these uncertain tax positions and valuation allowances are recorded as part of the provision for income taxes in the consolidated statements of operations and comprehensive loss.

Goodwill

        Goodwill represents the excess of cost over the fair value of the net tangible and identifiable intangible assets acquired in a business combination. Goodwill is not subject to amortization, but is tested annually for impairment or more frequently if there are indicators of impairment. Management considers the following potential indicators of impairment: significant underperformance relative to historical or projected future operating results, significant changes in the Company's use of acquired assets or the strategy of the Company's overall business, significant negative industry or economic trends and a significant decline in the Company's enterprise value as determined by the Company's board of directors based, in part, on the results of common stock valuations prepared by a third-party valuation firm on at least an annual basis.

        The Company performs an annual impairment test on December 1 or whenever events or changes in circumstances indicate that goodwill may be impaired. Significant judgments required in testing goodwill for impairment and changes in estimates and assumptions could materially affect the determination of whether impairment exists and, if so, the amount of that impairment.

        The Company has determined that there is one reporting unit for purposes of testing goodwill for impairment. In testing goodwill for impairment, the Company has the option to first consider qualitative factors to determine whether it is more likely than not that the fair value of a reporting unit is less than its carrying value. Such qualitative factors include macroeconomic conditions, industry and market considerations, cost factors, entity-specific financial performance and other events, such as changes in management, strategy and primary customer base. The Company also has the option to perform the two-step goodwill impairment test. The two-step test starts with comparing the fair value of the reporting unit to the carrying amount of a reporting unit, including goodwill. If the fair value exceeds the carrying amount, no impairment loss is recognized. However, if the carrying amount of the reporting unit exceeds its fair value, the second step is performed to determine if goodwill is impaired. If the Company determines that goodwill is impaired, an impairment charge is recorded in the consolidated statements of operations and comprehensive loss. In each of its annual goodwill impairment tests performed as of

F-16

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

2. Summary of Significant Accounting Policies (Continued)

December 1, 2015, 2016 and 2017, the estimated fair value of the Company's single reporting unit significantly exceeded its carrying amount. During the years ended December 31, 2015, 2016 and 2017, the Company did not recognize any impairment charges related to goodwill.

Intangible Assets, Net

        Intangible assets acquired in a business combination are recognized at fair value using generally accepted valuation methods deemed appropriate for the type of intangible asset acquired and reported net of accumulated amortization, separately from goodwill. Intangible assets with finite lives are amortized over their estimated useful lives. Intangible assets include developed technology, trade name and customer relationships obtained through business acquisitions that occurred during the years ended December 31, 2014, 2015 and 2016.

Impairment of Long-Lived Assets

        Long-lived assets consist of property and equipment, including internal-use software, and finite-lived acquired intangible assets, such as developed technology, trade name and customer relationships. Long-lived assets to be held and used are tested for recoverability whenever events or changes in business circumstances indicate that the carrying amount of the assets may not be fully recoverable. Factors that the Company considers in deciding when to perform an impairment review include significant underperformance of the business in relation to expectations, significant negative industry or economic trends and significant changes or planned changes in the use of the assets. If an impairment review is performed to evaluate a long-lived asset group for recoverability, the Company compares forecasts of undiscounted cash flows expected to result from the use and eventual disposition of the long-lived asset group to its carrying value. An impairment loss would be recognized when estimated undiscounted future cash flows expected to result from the use of an asset group are less than its carrying amount. The impairment loss would be based on the excess of the carrying value of the impaired asset group over its fair value, determined based on discounted cash flows. To date, the Company has not recorded any impairment losses on long-lived assets. No events or changes in circumstances existed to require an impairment assessment during the years ended December 31, 2015, 2016 and 2017.

Deferred Offering Costs

        The Company capitalizes certain legal, professional accounting and other third-party fees that are directly associated with in-process equity financings as deferred offering costs until such financings are consummated. After consummation of the equity financing, these costs are recorded in stockholders' equity (deficit) as a reduction of additional paid-in capital generated as a result of the offering. Should the equity financing no longer be considered probable of being consummated, the deferred offering costs would be expensed immediately as a charge to operating expenses in the consolidated statements of operations and comprehensive loss. As of December 31, 2016 and 2017, the Company recorded $1,908 and $2,167, respectively, of deferred offering costs in other long-term assets in the consolidated balance sheet.

Deferred Rent

        The Company records rent expense on a straight-line basis using a constant periodic rate over the term of its lease agreements. The excess of the cumulative rent expense incurred over the cumulative

F-17

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

2. Summary of Significant Accounting Policies (Continued)

amounts due under the lease agreements is deferred and recognized over the term of the leases. Leasehold improvement reimbursements from landlords are recorded as deferred rent and amortized as reductions to lease expense over the lease term.

Preferred Stock Warrant Liability

        The Company classifies warrants to purchase shares of its preferred stock as a liability on its consolidated balance sheets as these warrants are free-standing financial instruments that may require the Company to transfer assets upon exercise (see Note 12). The warrants were initially recorded at their fair values on date of issuance, and they are subsequently remeasured to fair value at each balance sheet date. Changes in the fair values of the warrants are recognized as other income or expense in the consolidated statements of operations and comprehensive loss. The Company will continue to adjust the warrant liability for changes in fair value until the earlier of the exercise of the warrants, the expiration of the warrants or the warrants becoming warrants to purchase common stock instead of preferred stock.

        The Company uses the Black-Scholes option-pricing model, which incorporates assumptions and estimates, to value the preferred stock warrants. The Company assesses these assumptions and estimates on a quarterly basis as additional information impacting the assumptions is obtained. Estimates and assumptions impacting the fair value measurement of each warrant include the fair value per share of the underlying preferred stock, the remaining contractual term of the warrant, risk-free interest rate, expected dividend yield and expected volatility of the price of the underlying preferred stock. The Company determines the fair value per share of the underlying preferred stock by taking into consideration the most recent sales of its redeemable convertible preferred stock, results obtained from third-party valuations and additional factors that are deemed relevant. The Company historically has been a private company and lacks company-specific historical and implied volatility information of its stock. Therefore, it estimates its expected stock volatility based on the historical volatility of publicly traded peer companies for a term equal to the remaining contractual term of each warrant. The risk-free interest rate is determined by reference to the U.S. Treasury yield curve for time periods approximately equal to the remaining contractual term of each warrant. Expected dividend yield is determined based on the fact that the Company has never paid cash dividends and does not expect to pay any cash dividends in the foreseeable future.

Common Stock Warrants

        The Company has issued warrants to purchase shares of common stock to an investor in connection with the issuance of the Series D redeemable convertible preferred stock and to a lender in connection with the issuance of debt.

        The warrant to purchase common stock issued in connection with the Series D redeemable convertible preferred stock is exercisable upon completion of the Company's IPO into the number of shares of common stock equal to 12.5% of the sum of (a) the number of shares of common stock into which the shares of Series A convertible preferred stock, including shares issuable upon the exercise of outstanding options to purchase shares of Series A convertible preferred stock, convert upon an IPO (see Note 12) and (b) the number of shares of common stock underlying the warrant. This warrant meets the definition of a derivative instrument under the relevant accounting guidance and is recorded as a liability in the consolidated balance sheets. The fair value of the warrant on the date of issuance was recorded as a

F-18

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

2. Summary of Significant Accounting Policies (Continued)

reduction of the carrying value of the Series D redeemable convertible preferred stock and as a long-term liability in the consolidated balance sheets. As a result, the warrant liability is remeasured to its fair value at the end of each reporting period, with the related change in fair value recorded as other income or expense in the consolidated statements of operations and comprehensive loss. The Company uses the Black-Scholes option-pricing model, which incorporates assumptions and estimates, to value this common stock warrant. The Company has assessed these assumptions and estimates on a quarterly basis as additional information impacting the assumptions is obtained. Estimates and assumptions impacting the fair value measurement of the warrant include the fair value per share of the underlying common stock, the remaining contractual term of the warrant, risk-free interest rate, expected dividend yield and expected volatility of the price of the underlying common stock. The Company determines the fair value per share of the underlying common stock by taking into consideration the most recent sales of its redeemable convertible preferred stock, results obtained from third-party valuations and additional factors that are deemed relevant. The Company historically has been a private company and lacks company-specific historical and implied volatility information of its stock. Therefore, it estimates its expected stock volatility based on the historical volatility of publicly traded peer companies for a term equal to the remaining contractual term of the warrant. The risk-free interest rate is determined by reference to the U.S. Treasury yield curve for time periods approximately equal to the remaining contractual term of the warrant. Expected dividend yield is determined based on the fact that the Company has never paid cash dividends and does not expect to pay any cash dividends in the foreseeable future.

        The warrants to purchase common stock issued in connection with the Mezzanine Term Loan (see Note 12) represents rights to a fixed number of shares and are considered to be indexed to the Company's stock because their values are based upon the value of the underlying shares. As such, the warrants were classified within stockholders' equity (deficit) under the relevant accounting guidance. The Company recorded a discount to the carrying value of the Mezzanine Term Loan based on the relative fair values of such debt and the warrants issued in conjunction with the debt. The debt discount under this arrangement was amortized to interest expense using the effective interest rate method over the term of the related debt to its date of maturity.

Advertising Costs

        Advertising costs are expensed as incurred and are included in sales and marketing expense in the consolidated statements of operations and comprehensive loss. During the years ended December 31, 2015, 2016 and 2017, advertising costs were $3,555, $4,024 and $4,712, respectively.

Research and Development Costs

        Research and development costs, other than capitalized software development costs discussed above, are expensed as incurred. Research and development expenses include payroll, employee benefits and other expenses associated with product development.

Stock-Based Compensation

        The Company measures all stock options and other stock-based awards granted to employees and directors based on the fair value on the date of the grant and recognizes compensation expense of those awards, net of estimated forfeitures, over the requisite service period, which is generally the vesting period

F-19

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

2. Summary of Significant Accounting Policies (Continued)

of the respective award. Generally, the Company issues stock options to employees with only service-based vesting conditions and records the expense for these awards using the straight-line method.

        The Company measures stock-based awards granted to non-employee consultants based on the fair value of the award on the date on which the related service is complete. Compensation expense is recognized over the period during which services are rendered by such non-employee consultants until completed. At the end of each financial reporting period prior to completion of the service, the fair value of these awards is remeasured using the then-current fair value of the Company's common stock and updated assumption inputs in the Black-Scholes option-pricing model.

        The Company classifies stock-based compensation expense in its consolidated statements of operations and comprehensive loss in the same manner in which the award recipient's payroll costs are classified or in which the award recipients' service payments are classified.

        The Company recognizes compensation expense for only the portion of awards that are expected to vest. In developing a forfeiture rate estimate, the Company has considered its historical experience to estimate pre-vesting forfeitures for service-based awards. The impact of a forfeiture rate adjustment will be recognized in full in the period of adjustment, and if the actual forfeiture rate is materially different from the Company's estimate, the Company may be required to record adjustments to stock-based compensation expense in future periods.

        The fair value of each stock option grant is estimated on the date of grant using the Black-Scholes option-pricing model. The Company historically has been a private company and lacks company-specific historical and implied volatility information. Therefore, it estimates its expected stock volatility based on the historical volatility of a publicly traded set of peer companies and expects to continue to do so until such time as it has adequate historical data regarding the volatility of its own traded stock price. The expected term of the Company's stock options has been determined utilizing the "simplified" method for awards that qualify as "plain-vanilla" options. The expected term of stock options granted to non-employees is equal to the contractual term of the option award. The risk-free interest rate is determined by reference to the U.S. Treasury yield curve in effect at the time of grant of the award for time periods approximately equal to the expected term of the award. Expected dividend yield is based on the fact that the Company has never paid cash dividends and does not expect to pay any cash dividends in the foreseeable future.

        The fair value of each restricted stock award or restricted stock unit award is measured as the difference between the purchase price per share of the award, if any, and the fair value per share of the Company's common stock on the date of grant.

Deferred Commissions

        The Company capitalizes commission costs that are incremental and directly related to the acquisition of customer agreements. Commissions are earned by the Company's sales force and paid in full upon the receipt of customer orders for new arrangements or renewals. Commission costs are capitalized when earned and are amortized as expense over the same period that the revenue is recognized for the related non-cancelable customer agreement in proportion to the recognition of the revenue. Amortization of deferred commissions is included in sales and marketing expense in the consolidated statements of operations and comprehensive loss.

F-20

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

2. Summary of Significant Accounting Policies (Continued)

        Commission costs capitalized as deferred commissions during the years ended December 31, 2015, 2016 and 2017 totaled $9,508, $13,870 and $18,309, respectively. Amortization of deferred commissions during the years ended December 31, 2015, 2016 and 2017 totaled $7,206, $9,708 and $13,897, respectively, and is included in sales and marketing expense in the consolidated statements of operations and comprehensive loss.

Carrying Value of Redeemable Convertible Preferred Stock

        The Company recognizes changes in the redemption values of its Series B, C, D, E, E-1 and F redeemable convertible preferred stock immediately as they occur and adjusts the carrying value of each series of the redeemable convertible preferred stock to equal its redemption value at the end of each reporting period as if the end of each reporting period were the redemption date. Adjustments to the carrying values of the Series B, C, D, E, E-1 and F redeemable convertible preferred stock at each reporting date result in an increase or decrease to net income (loss) attributable to common stockholders.

        Because shares of the Company's Series D, E and F redeemable convertible preferred stock are redeemable in an amount equal to the greater of the original issue price per share of each series plus all declared but unpaid dividends thereon or the estimated fair value of the Series D, E or F redeemable convertible preferred stock at the date of the redemption request, and because shares of the Company's Series E-1 redeemable convertible preferred stock are redeemable in an amount equal to the estimated fair value of the Series E-1 redeemable convertible preferred stock at the date of the redemption request, it is necessary for the Company to determine the fair value of each of these series of preferred stock in order to determine the redemption value at each reporting date. As there has been no public market for the Company's preferred stock to date, the estimated fair value of the Company's preferred stock has been determined by management as of each reporting date based, in part, on the results of third-party valuations of the Company's preferred stock performed as of each reporting date as well as management's assessment of additional objective and subjective factors that it believed were relevant. These third-party valuations were performed in accordance with the guidance outlined in the American Institute of Certified Public Accountants' Accounting and Valuation Guide, Valuation of Privately-Held-Company Equity Securities Issued as Compensation. The Company's preferred stock valuations at each reporting date were prepared using either a probability-weighted expected return method ("PWERM") or a hybrid method, which used a combination of market and income approaches or a market approach to estimate the Company's enterprise value. The hybrid method is a PWERM where the equity value in one or more of the scenarios is allocated using an option-pricing method ("OPM").

        The assumptions underlying these valuations represent management's best estimates, which involve inherent uncertainties and the application of management judgment. As a result, if factors or expected outcomes change and the Company uses significantly different assumptions or estimates, the estimated fair values of preferred stock could be materially different.

Comprehensive Loss

        Comprehensive loss includes net loss as well as other changes in stockholders' equity (deficit) that result from transactions and economic events other than those with stockholders. There was no difference between net loss and comprehensive loss for each of the periods presented in the accompanying consolidated financial statements.

F-21

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

2. Summary of Significant Accounting Policies (Continued)

Income Taxes

        The Company accounts for income taxes using the asset and liability method, which requires the recognition of deferred tax assets and liabilities for the expected future tax consequences of events that have been recognized in the financial statements or in the Company's tax returns in different periods. Deferred tax assets and liabilities are determined on the basis of the differences between the financial statements and tax basis of assets and liabilities using enacted tax rates in effect for the year in which the differences are expected to reverse. Changes in deferred tax assets and liabilities are recorded in the provision for income taxes. The Company assesses the likelihood that its deferred tax assets will be recovered from future taxable income and, to the extent it believes, based upon the weight of available evidence, that it is more likely than not that all or a portion of the deferred tax assets will not be realized, a valuation allowance is established through a charge to income tax expense. Potential for recovery of deferred tax assets is evaluated by considering taxable income in carryback years, existing taxable temporary differences, prudent and feasible tax planning strategies and estimated future taxable profits.

        The Company accounts for uncertainty in income taxes recognized in the financial statements by applying a two-step process to determine the amount of tax benefit to be recognized. First, the tax position must be evaluated to determine the likelihood that it will be sustained upon external examination by the taxing authorities. If the tax position is deemed more-likely-than-not to be sustained, the tax position is then assessed to determine the amount of benefit to recognize in the financial statements. The amount of the benefit that may be recognized is the largest amount that has a greater than 50% likelihood of being realized upon ultimate settlement. The provision for income taxes includes the effects of any resulting tax reserves, or unrecognized tax benefits, that are considered appropriate as well as the related net interest and penalties.

Net Loss per Share

        The Company follows the two-class method when computing net income (loss) per share as the Company has issued shares that meet the definition of participating securities. The two-class method determines net income (loss) per share for each class of common and participating securities according to dividends declared or accumulated and participation rights in undistributed earnings. The two-class method requires income available to common stockholders for the period to be allocated between common and participating securities based upon their respective rights to receive dividends as if all income for the period had been distributed.

        Basic net income (loss) per share attributable to common stockholders is computed by dividing the net income (loss) attributable to common stockholders by the weighted-average number of shares of common stock outstanding for the period. Diluted net income (loss) attributable to common stockholders is computed by adjusting net income (loss) attributable to common stockholders to reallocate undistributed earnings based on the potential impact of dilutive securities, including outstanding stock options, unvested restricted stock units and warrants for the purchase of preferred stock and common stock. Diluted net income (loss) per share attributable to common stockholders is computed by dividing the diluted net income (loss) attributable to common stockholders by the weighted-average number of common shares outstanding for the period, including potential dilutive common shares, assuming the dilutive effect of outstanding stock options, unvested restricted stock units and warrants for the purchase of preferred stock and common stock.

F-22

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

2. Summary of Significant Accounting Policies (Continued)

        The Company's redeemable convertible and convertible preferred stock contractually entitles the holders of such shares to participate in dividends but does not contractually require the holders of such shares to participate in losses of the Company. Accordingly, in periods in which the Company reports a net loss attributable to common stockholders, diluted net loss per share attributable to common stockholders is the same as basic net loss per share attributable to common stockholders, since dilutive common shares are not assumed to have been issued if their effect is anti-dilutive. The Company reported a net loss attributable to common stockholders for the years ended December 31, 2015, 2016 and 2017.

Impact of Recently Adopted Accounting Standards

        In March 2016, the Financial Accounting Standards Board ("FASB") issued Accounting Standards Update ("ASU") No. 2016-09, Compensation—Stock Compensation (Topic 718) ("ASU 2016-09"). ASU 2016-09 identifies areas for simplification involving several aspects of accounting for share-based payment transactions, including the income tax consequences, classification of awards as either equity or liabilities, an option to recognize gross stock compensation expense with actual forfeitures recognized as they occur, and certain classifications on the statement of cash flows. This guidance is effective for annual and interim periods beginning after December 15, 2016. Early adoption is permitted. The Company adopted ASU 2016-09 during the first quarter of 2017. The Company has chosen to continue to recognize stock compensation expense net of estimated forfeitures. The adoption of ASU 2016-09 also requires excess tax benefits and tax deficiencies to be recorded in the income statement as opposed to additional paid-in capital when the awards vest or are settled, and has been applied on a prospective basis. In connection with the adoption of this standard on January 1, 2017, the Company recorded a $491 deferred tax asset related to unrecognized excess tax benefits, with an offsetting adjustment to the valuation allowance.

Impact of Recently Issued Accounting Standards

        In May 2014, the FASB issued ASU 2014-09, Revenue from Contracts with Customers (Topic 606) ("ASU 2014-09"), which supersedes existing revenue recognition guidance under GAAP. The standard's core principle is that a company will recognize revenue when it transfers promised goods or services to customers in an amount that reflects the consideration to which the company expects to be entitled in exchange for those goods or services. The standard defines a five-step process to achieve this principle, and will require companies to use more judgment and make more estimates than under the current guidance. The Company expects that these judgments and estimates will include identifying performance obligations in the customer contract, estimating the amount of variable consideration to include in the transaction price and allocating the transaction price to each separate performance obligation. ASU 2014-09 also requires additional disclosure about the nature, amount, timing and uncertainty of revenue and cash flows arising from customer contracts. In August 2015, the FASB issued ASU 2015-14, Revenue from Contracts with Customers (Topic 606): Deferral of the Effective Date, which delays the effective date of ASU 2014-09 such that the standard is effective for public entities for annual periods beginning after December 15, 2017 and for interim periods within those fiscal years and for private entities for annual periods beginning after December 15, 2018. Early adoption of the standard is permitted for annual periods beginning after December 15, 2016. The Company will adopt ASU 2014-09 as of January 1, 2018 on a full retrospective basis. The Company's ability to apply the requirements retrospectively to all prior periods presented is dependent on system readiness and the completion of the Company's analysis of information necessary to

F-23

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

2. Summary of Significant Accounting Policies (Continued)

recast prior period financial statements. The Company has reached some conclusions on key accounting assessments related to the new standard, which are described below.

        The Company's recognition of total revenue related to subscription (i.e., term-based) licenses, cloud-based subscriptions, access to the threat intelligence capabilities of the Cb Predictive Security Cloud, maintenance services and customer support, and stand-alone professional services will remain substantially unchanged under the new standard. However, as further discussed herein, the timing of recognition related to certain aspects of term-based license subscriptions, perpetual licenses and associated professional services likely will be different under the new standard.

        For subscription license sales of Cb Protection and Cb Response, under the new standard, the Company will consider the software license and the access to the threat intelligence capabilities of the Cb Predictive Security Cloud, which provides continuous updates of real-time threat intelligence, to be a single performance obligation. As a result, the arrangement consideration allocated to the software license will be deferred on the Company's balance sheet and recognized ratably over the term of the subscription as the performance obligation is satisfied. However, under the new standard, the Company will no longer be required to delay the commencement of revenue recognition of subscription licenses until the commencement of any professional services and training sold with the subscription license. While under the new standard, maintenance services and customer support related to subscription licenses will be a stand-alone performance obligation, the related revenue will continue to be recognized ratably over the term of the maintenance and support arrangement as the performance obligation is satisfied.

        For its infrequent sales of perpetual licenses of Cb Protection and Cb Response, the Company currently recognizes revenue ratably over the longest service period of any deliverable in the arrangement, which is generally the maintenance and support term, due to the lack of VSOE of fair value for its maintenance and support offerings. Under the new standard, the Company will no longer be required to delay revenue recognition of perpetual licenses until the commencement of any bundled professional services and training sold with the perpetual license. Further, the Company expects to recognize the revenue related to the sale of perpetual software licenses ratably over the customer's estimated economic life, which the Company has estimated to be five years, rather than over the initially committed period of maintenance and support.

        In addition, under the new standard, for subscription and perpetual licenses that are sold with professional services in a multiple-element arrangement, the professional services will represent a separate performance obligation and the Company will recognize revenue associated with the professional services as such services are performed. Revenue associated with professional services sold in a multiple-element arrangement with subscription and perpetual licenses currently is recognized ratably over the longest service period of any deliverable in the arrangement, which is generally the maintenance and support term, due to the lack of VSOE of fair value for the Company's maintenance and support offerings.

        Another significant provision of the new standard requires the capitalization and amortization of costs associated with obtaining a contract, such as sales commissions. Under the new standard, all incremental costs to acquire a contract are capitalized and amortized using a systematic basis over the pattern of transfer of the goods and services to which the asset relates. Under the existing standard, the Company currently capitalizes commission costs that are incremental and directly related to the acquisition of a customer arrangement. The commission costs are capitalized when earned and are amortized as expense

F-24

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

2. Summary of Significant Accounting Policies (Continued)

over the period that the revenue is recognized for the related non-cancelable customer arrangement in proportion to the recognition of revenue, without regard to anticipated customer renewals. Under the new standard, the Company will continue to capitalize all incremental commission costs to obtain a customer arrangement, but will amortize the capitalized costs on a straight-line basis over the estimated customer relationship period, which will include anticipated customer renewals, because the Company anticipates that a majority of customers will renew their license and cloud-based subscriptions and the commissions paid by the Company for such renewals are not commensurate with the commissions paid for new sales. Accordingly, the Company expects that its capitalized commission costs will be amortized to expense over a longer period under the new standard than under the existing standard. The Company has estimated the customer relationship period to be five years.

        Finally, the new standard requires expanded footnote disclosures regarding revenue recognition. The Company continues to evaluate the application of these expanded requirements to its revenue recognition under the new standard, but expects that its disclosures will be increased commencing in its financial statements for the interim periods in and for the year ending December 31, 2018. The Company's ability to apply the disclosure requirements upon adoption of the new standard is dependent partially on its system readiness and the completion of the Company's analysis of information necessary to support the expanded disclosures.

        In February 2016, the FASB issued ASU No. 2016-02, Leases (Topic 842) ("ASU 2016-02"). ASU 2016-02 was issued to increase transparency and comparability among organizations by recognizing lease assets and lease liabilities on the balance sheet and disclosing key information about leasing arrangements. This guidance is effective for annual and interim periods beginning after December 15, 2018. Early adoption is permitted. The Company plans to adopt this standard as of January 1, 2019. This standard requires a modified retrospective transition approach for all leases existing at, or entered into after, the date of initial application, with an option to use certain transition relief. The Company is currently evaluating the impact that the adoption of ASU 2016-02 will have on its consolidated financial statements.

        In August 2016, the FASB issued ASU No. 2016-15, Classification of Certain Cash Receipts and Cash Payments (Topic 230) ("ASU 2016-15"). ASU 2016-15 is intended to add or clarify guidance on the classification of certain cash receipts and payments in the statement of cash flows and to eliminate the diversity in practice related to such classifications. The guidance in ASU 2016-15 is required for annual reporting periods beginning after December 15, 2017, with early adoption permitted. The Company will adopt ASU 2016-15 during the first quarter of 2018, and its adoption is not expected to have a material impact on the Company's consolidated financial statements.

        In November 2016, the FASB issued ASU No. 2016-18, Statement of Cash Flows: Restricted Cash (Topic 230) ("ASU 2016-18"), which requires that restricted cash and restricted cash equivalents be included as components of total cash and cash equivalents as presented on the statement of cash flows. This guidance is effective for fiscal years beginning after December 15, 2017, with early adoption permitted. Upon the Company's adoption of ASU 2016-18 in 2018, the $1,503 transfer between restricted cash and unrestricted cash previously presented on the consolidated statement of cash flows for the year ended December 31, 2016 will no longer be presented as a component of the Company's investing activities.

F-25

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

2. Summary of Significant Accounting Policies (Continued)

        In January 2017, the FASB issued ASU 2017-01, Business Combinations (Topic 805)—Clarifying the Definition of a Business ("ASU 2017-01"). This standard changes the definition of a business to assist entities in evaluating when a set of transferred assets and activities constitutes a business. The guidance is effective for annual periods, including interim periods within those annual periods, beginning after December 15, 2017. Early adoption is permitted. The Company will adopt ASU 2017-01 during the first quarter of 2018, and its adoption is not expected to have a material impact on the Company's consolidated financial statements.

        In January 2017, the FASB issued ASU 2017-04, Intangibles—Goodwill and Other Topics (Topic 350)—Simplifying the Test for Goodwill Impairment ("ASU 2017-04"). This standard eliminates the requirement to calculate the implied fair value of goodwill to measure a goodwill impairment charge (i.e., Step 2 of the current guidance) and requires goodwill impairment to be measured as the amount by which a reporting unit's carrying amount exceeds its fair value, not to exceed the carrying amount of goodwill. The guidance is effective for annual periods, including interim periods within those annual periods, beginning after December 15, 2017. The Company will adopt ASU 2017-04 during the first quarter of 2018, and its adoption is not expected to have a material effect on the Company's consolidated financial statements or related disclosures.

        In May 2017, the FASB issued ASU 2017-09, Compensation—Stock Compensation (Topic 718): Scope of Modification Accounting ("ASU 2017-09), which provides clarity on what changes to share-based payment awards are considered substantive and require modification accounting to be applied. The guidance is effective for annual reporting periods beginning after December 15, 2017 and interim periods within those fiscal years. The Company will adopt ASU 2017-09 during the first quarter of 2018 and will apply it prospectively to award modifications after the adoption date. The Company does not regularly modify the terms and conditions of share-based awards and does not believe ASU 2017-09 will have a material impact on its consolidated financial statements.

3. Business Combinations

Confer Technologies, Inc.

        On June 3, 2016, the Company acquired 100% of the outstanding shares of Confer Technologies, Inc. ("Confer") pursuant to the terms of an agreement and plan of merger between the parties (the "Merger Agreement"). The acquisition of Confer was intended to strengthen the Company's endpoint-security platform and allow the Company to offer a product specifically targeted at a significant customer segment that exhibited demand for a lightweight, next-generation antivirus solution. As initial consideration for the acquisition, the Company issued 13,026,145 shares of Series F redeemable convertible preferred stock ("Series F preferred stock") and 2,652,957 shares of common stock to the former stockholders of Confer on the closing date. In addition, the consideration for the acquisition included the fair values as of the acquisition date of employee stock options replaced by the Company as well as a stock option and a stock purchase warrant held by a Confer customer that were replaced by the Company, as described below.

Elements of Purchase Consideration

        Customer Option.    Under an agreement that existed prior to the Company's acquisition of Confer, Confer had granted to one of its customers the option to purchase up to $2,000 in shares of Confer's

F-26

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

3. Business Combinations (Continued)

preferred stock at a price of $2.86 per share. This agreement provided that the customer's option to purchase shares would continue to exist in the event that Confer was acquired by or merged with another party. As a result, in connection with the Company's acquisition of Confer, the customer received the right to purchase 699,720 shares of the Company's Series F preferred stock at a price of $2.86 per share for a period of 60 days after June 3, 2016 (the "Customer Option"). Pursuant to the terms of the Merger Agreement, in the event that the customer exercised this option, the Company would remit the exercise proceeds of $2,000 to the former stockholders of Confer. If the customer did not exercise this option before expiration, the shares of Series F preferred stock reserved for purchase were to be distributed on a pro rata basis to the former stockholders of Confer based on the preferred stock, common stock or options received by them on the closing date of the acquisition by the Company. The Company determined that the Customer Option (and its required issuance of shares to either the customer or to the former stockholders of Confer) represented additional purchase consideration and recorded the fair value of the Customer Option, of $4,121, as a credit to additional paid-in capital on the date of acquisition. In August 2016, the customer exercised the Customer Option and paid $2,000 to the Company, and the Company issued 699,720 shares of the Series F preferred stock and reclassified the value of $4,121 from additional paid-in capital to the carrying value of the Series F preferred stock. Upon receipt of the exercise proceeds, the Company remitted the $2,000 to the former stockholders of Confer, as required. On the Company's consolidated statement of cash flows for the year ended December 31, 2016, the receipt of the $2,000 from the exercise of the Customer Option was presented as a cash flow from financing activities and the payment of the $2,000 was presented as a cash flow from investing activities.

        Under that same agreement, Confer agreed to provide the customer with licensed software, threat analysis feeds and support services in exchange for specified fees payable to Confer. Based on the terms of customer acceptance outlined in the agreement, Confer could not invoice the customer for any fees until the customer had accepted the software. As of the date of the Company's acquisition of Confer, the acceptance criteria had not been met and Confer had not invoiced or received any payments under the agreement. Pursuant to the terms of the Merger Agreement, the Company agreed to pay the former Confer stockholders up to $2,160 for license fee amounts received by the Company subsequent to the customer's acceptance of the software. As of the acquisition date, the Company concluded that there was a remote probability that the customer would accept the software and that any license fees would be remitted to the former stockholders of Confer. This conclusion was primarily due to the fact that the tasks outlined to achieve acceptance under the customer agreement had not commenced as of the acquisition date and the Company did not have any expectation that the customer would be able to successfully deploy the software. Due to the remote probability of customer acceptance of the software and payment of license fee amounts, the Company determined that the fair value of this contingent payment obligation to the former stockholders of Confer was $0 on the date of acquisition. As of December 31, 2016, the customer had not accepted the software and the Company had not invoiced or received any fees under the customer agreement. The Company and the customer mutually agreed to terminate the customer agreement and entered into a Termination Agreement and Mutual Release as of March 15, 2017. As a result, the customer no longer has the right to the licensed software, threat analysis feeds and support services and the Company will not receive any fees.

        Customer Warrant.    Under a second agreement with the same customer that existed prior to the Company's acquisition of Confer, Confer agreed to grant to the customer a warrant to purchase up to $1,000 in shares of Confer's preferred stock, issuable to the customer only upon Confer and the customer

F-27

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

3. Business Combinations (Continued)

entering into a channel partner agreement. This agreement provided that the customer's warrant would continue to exist in the event that Confer was acquired by or merged with another party. Pursuant to the terms of the Merger Agreement, the customer would be issued a warrant to purchase up to $1,000 in shares of the Company's Series F preferred stock at an exercise price of $2.86 per share for a period of 60 days after June 3, 2016, conditioned upon the Company and the customer entering into a channel partner agreement (the "Customer Warrant"). Pursuant to the terms of the Merger Agreement, in the event that the customer was issued the warrant and the warrant was exercised by the customer, the Company would remit the exercise proceeds of $1,000 to the former stockholders of Confer. If the customer and the Company failed to execute a channel partner agreement and the warrant was not issued to the customer, then the shares reserved for the Customer Warrant were to be distributed on a pro rata basis to the former stockholders of Confer based on the preferred stock, common stock or options received by them on the closing date of the acquisition by the Company. The Company determined that the Customer Warrant (and its potential issuance of shares to either the customer or to the former stockholders of Confer) represented additional purchase consideration and recorded the fair value of the Customer Warrant, of $1,639, as a credit to additional paid-in capital on the date of acquisition. As of the acquisition date, the Company concluded that there was a remote probability that the customer and the Company would enter into a channel partner agreement. As a result, for the purpose of estimating the fair value of additional purchase consideration, the Company assumed that the customer would not be issued the warrant and that the shares would instead be distributed to the former stockholders of Confer.

        Following the acquisition date and during the remainder of 2016, the Company agreed to extend the period during which the Company and the customer could enter into a channel partner agreement through February 2017, at which time the negotiation period expired without a channel partner agreement being consummated. The Company and the customer mutually agreed to terminate these discussions and entered into a Termination Agreement and Mutual Release as of March 15, 2017 with respect to this initiative. As a result, the Company concluded that the customer would not be issued the warrant, and the Company would instead issue 228,715 shares of Series F preferred stock, 46,576 shares of common stock and options to purchase 13,985 shares of common stock to the former stockholders of Confer.

        In June 2017, the Company issued 228,715 shares of Series F preferred stock, 46,576 shares of common stock and options to purchase 13,985 shares of common stock to the former stockholders of Confer. The Company recorded the issuance of the 228,715 shares of Series F preferred stock and the 46,576 shares of common stock based on the fair value of the Customer Warrant of $1,639 that was recorded as of the Confer acquisition date. That fair value of the Customer Warrant consisted of (i) $1,347 for 228,715 shares of Series F preferred stock, based on the acquisition-date fair value of $5.89 per share of Series F preferred stock, and (ii) $292 for 46,576 shares of common stock, based on the acquisition-date fair value of $6.26 per share of common stock.

        The Company accounted for the issuance of the 228,715 shares of Series F preferred stock in June 2017 by recording a $1,347 increase to the carrying value of Series F preferred stock and a corresponding decrease to additional paid-in capital previously recorded as part of the fair value of the Customer Warrant. The Company accounted for the issuance of the 46,576 shares of common stock in June 2017 by recording a $292 increase to additional paid-in capital and a corresponding decrease to additional paid-in capital previously recorded as part of the fair value of the Customer Warrant.

F-28

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

3. Business Combinations (Continued)

        The Company accounted for the issuance of the options to purchase 13,985 shares of common stock as new grants to employees under its 2012 Stock Option and Grant Plan (see Note 12). The options have an exercise price of $5.88 per share, vest over a four-year period, and had a fair value of $2.80 per share on the grant date, as determined using the Black-Scholes option-pricing model.

        Replacement Stock Options.    In connection with the acquisition of Confer, the Company also replaced all outstanding stock options held by employees of Confer immediately prior to the acquisition with options to acquire shares of the Company's common stock with substantially the same terms and conditions as were applicable under the original options. In total, the Company replaced outstanding options to purchase Confer common stock with options to purchase 796,817 shares of the Company's common stock at a weighted-average exercise price of $2.19 per share. Of the total amount of options, options to purchase 154,801 shares of common stock were fully vested on the acquisition date. The Company determined that there was no post-combination employee service required for the fully vested replacement awards. As a result, the aggregate fair value of the vested replacement options on the acquisition date, determined to be $731, was recorded as additional purchase consideration transferred to the stockholders of Confer and as additional paid-in capital in the Company's consolidated balance sheet. The Company determined that there was both pre-combination and post-combination service required for the unvested replacement awards. In addition, a portion of the fair value of the unvested replacement awards, aggregating $119, was determined to be related to pre-combination service based on the vesting terms of the original options and was recorded as additional purchase consideration transferred to the stockholders of Confer and as additional paid-in capital in the Company's consolidated balance sheet. The remaining fair value of the unvested awards determined to be related to post-combination service will be recognized by the Company as stock-based compensation expense over the remaining service periods of the respective awards, beginning on the acquisition date.

        The aggregate acquisition-date fair value of purchase consideration transferred was determined to be $99,941, consisting of the following:

        The aggregate fair value of the 13,026,145 shares of Series F preferred stock issued at closing was determined to be $76,724, based on a fair value of $5.89 per share of Series F preferred stock. The aggregate fair value of the 2,652,957 shares of common stock issued at closing was determined to be $16,607, based on a fair value of $6.26 per share of common stock. The aggregate fair value of the replacement options to purchase common stock recorded as purchase consideration for pre-combination services was determined to be $850, based on a weighted-average fair value of $4.72 per option. The per share fair values of $5.89 for Series F preferred stock, of $6.26 for common stock and of $4.72 for replacement options were based on the results of a third-party valuation performed as of the acquisition date. The third-party valuation was prepared using a hybrid of the PWERM and the OPM, which used a

F-29

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

3. Business Combinations (Continued)

combination of market and income approaches to estimate the Company's enterprise value. In the third-party valuation, three types of future-event scenarios were considered: an IPO scenario,a sale scenario and a remain-private scenario. Each type of future-event scenario was probability weighted by the Company based on an evaluation of its historical and forecasted performance and operating results, an analysis of market conditions at the time, and its expectations as to the timing and likely prospects of the future-event scenarios. A discount for lack of marketability was then applied to arrive at an indication of fair value per share for each of the Series F preferred stock, common stock and replacement options to purchase common stock.

        The Company determined the fair value of the Customer Option, of $4,121, based on the $5.89 fair value per share of Series F preferred stock on the date of the Company's acquisition of Confer, multiplied by the 699,720 shares of the Company's Series F preferred stock that were required to be issued by the Company to the customer upon exercise of the Customer Option (with exercise proceeds being remitted to the former stockholders of Confer).

        The Company determined the fair value of the Customer Warrant, of $1,639, based on the aggregate acquisition-date fair values of the (i) 228,715 shares of the Company's Series F preferred stock and (ii) 46,576 shares of common stock that were required to be issued by the Company to the former stockholders of Confer in the event that the Customer Warrant was not issued to the customer, due to the fact the Company believed that there was a remote probability that it and the customer would enter into a channel partner agreement, a condition required for the Customer Warrant to be issued and exercisable.

Allocation of the Purchase Consideration

        The acquisition of Confer was accounted for in accordance with the acquisition method of accounting for business combinations. Acquisition-related costs totaling $567 were expensed to general and administrative expenses as incurred. Under the acquisition method of accounting, the total purchase consideration is allocated to the tangible and intangible assets acquired and liabilities assumed based on their estimated fair values. The allocation of the total purchase price was as follows:

        Identifiable intangible assets acquired in the acquisition consisted of developed technology and customer relationships. The developed technology includes a combination of patented and unpatented technology, trade secrets, computer software and research processes that represent the foundation for existing and planned new products and services. The customer relationships asset relates to Confer's ability to sell existing, in-process and future products and services to its existing and potential customers. There

F-30

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

3. Business Combinations (Continued)

was no value assigned to the Confer trade name as its use was discontinued. The estimated useful lives and fair values of the identifiable intangible assets are as follows:

        The fair value of the developed technology was estimated using the relief-from-royalty method, a form of the income approach, which assumes that, in lieu of ownership, a third party would be willing to pay a royalty in order to exploit the related benefits of these types of assets. The relief-from-royalty method involves two steps: (i) estimation of reasonable royalty rates for the assets and (ii) the application of these royalty rates to a revenue stream and discounting the resulting cash flows to determine a value. The Company multiplied the selected royalty rate by the forecasted net revenue stream to calculate the cost savings (i.e., relief-from-royalty payment) associated with the developed technology. The cash flows were then discounted to present value by the selected discount rate. Key assumptions used in this model were revenue projections, discount rates and royalty rates, all of which were estimated by management.

        The fair value of the customer relationship intangible asset was estimated using the replacement method, a form of the cost approach, which estimates the costs to replace the customer base. The Company estimated the time to recreate the customer base and multiplied it by the estimated annual costs, which were based on Confer's historical sales and marketing costs and included an overhead allocation. The key assumption in the model was the estimated time to recreate the customer base.

        The excess of the total purchase price over the fair value of the net tangible and identifiable intangible assets acquired in the acquisition was allocated to goodwill in the amount of $87,785. Goodwill recognized in the acquisition was attributed to the longer-term opportunity for future enhancement of the Company's product offerings and to the cyber-security expertise of the assembled workforce obtained.

        The goodwill recorded as part of the Confer acquisition is not deductible for U.S. federal income tax purposes. In addition to the $2,429 of deferred tax liabilities recorded as part of the business combination for the non-deductible intangible assets acquired, the Company also recorded $6,221 of acquired deferred tax assets, primarily related to net operating loss and tax credit carryforwards and deferred revenue, but recorded those in purchase accounting with a full valuation allowance due to the uncertainty of realizing a benefit from those assets.

        The results of operations of Confer have been included in the Company's consolidated statements of operations and comprehensive loss from the acquisition date. The operations of Confer were fully integrated into the Company's operations and no separate financial results of the business were maintained. Therefore, it is impracticable for the Company to report the amounts of revenues and earnings of Confer included in its consolidated results of operations.

F-31

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

3. Business Combinations (Continued)

Pro Forma Information (Unaudited)

        The following pro forma financial information presents the combined results of operations of the Company and Confer as if the Confer acquisition had occurred on January 1, 2015. The pro forma financial information does not reflect any adjustments for anticipated synergies resulting from the acquisition and is not necessarily indicative of the operating results that would have actually occurred had the transaction been consummated on January 1, 2015.

Objective Logistics Inc.

        On June 11, 2015, the Company acquired substantially all of the assets of Objective Logistics Inc. ("Objective Logistics"), a software company. The principal reason for this acquisition was the hiring of employees for their technical expertise. The purchase consideration consisted of $946 paid in cash at closing and $946 paid in cash in September 2015. In addition, employees of Objective Logistics became employees of the Company as part of the transaction. The acquisition was accounted for in accordance with the acquisition method of accounting for business combinations.

        The assets acquired consisted of equipment and fixtures as well as intellectual property related to an exclusive license to certain patents held by Objective Logistics. The Company determined that the acquired equipment and fixtures had no value. The Company also determined that the intellectual property had no value as it was not applicable to the Company's industry and not sought after by other market participants. The value in the acquisition was the assembled workforce obtained and, accordingly, the total purchase consideration of $1,892 was allocated to goodwill.

        The goodwill recorded as part of the acquisition of Objective Logistics is deductible for U.S. federal income tax purposes.

        The results of operations of Objective Logistics have been included in the Company's consolidated statements of operations and comprehensive loss from the acquisition date. Actual revenue and earnings of Objective Logistics since the acquisition date as well as pro forma combined results of operations for the Objective Logistics acquisition have not been presented because the effect of the acquisition was not material to the Company's consolidated financial results for the periods presented.

VisiTrend, Inc.

        On August 14, 2015, the Company acquired substantially all of the assets of VisiTrend, Inc. ("VisiTrend"), a security analytics and visualization company. The principal reason for this acquisition was the hiring of employees for their technical expertise. The purchase consideration paid at closing consisted of $112 in cash and equity with an aggregate fair value of $848, consisting of 182,370 shares of the

F-32

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

3. Business Combinations (Continued)

Company's Series E preferred stock with a fair value of $4.65 per share. Additionally, the former shareholders of VisiTrend were entitled to receive future purchase consideration of up to 220,365 shares of Series E preferred stock, the issuance of which was contingent upon the continuing employment of two former VisiTrend employees for six and twelve months after the closing date. Of that amount of shares contingently issuable, 189,970 shares of Series E preferred stock were issued in February 2016 and the remaining 30,395 shares of Series E preferred stock were issued in August 2016.

        The Company allocated the $1,025 acquisition-date fair value of the 220,365 shares of Series E preferred stock that are contingently issuable upon the continuing employment of the two former VisiTrend employees between the portion for which the recipient of the shares does not have a continuing service obligation to the Company of $507 and the portion for which the recipient of the shares has a continuing service obligation to the Company $518. The value of shares for which the recipient does not have a continuing service obligation to the Company of $507 was recorded by the Company as the fair value of the contingent purchase consideration on the acquisition date, which increased the aggregate purchase consideration for the acquisition to $1,467. The remaining fair value of the contingently issuable shares for which the recipient of the shares has a continuing service obligation to the Company of $518 will be recognized by the Company as stock-based compensation expense over the respective six- and twelve-month periods of required continuing employee service. Of that amount, $364 and $154, respectively, was recognized as stock-based compensation expense during the years ended December 31, 2015 and 2016.

        The acquisition was accounted for in accordance with the acquisition method of accounting for business combinations. Under the acquisition method of accounting, the total purchase consideration is allocated to the tangible and identifiable intangible assets acquired and liabilities assumed based on their estimated fair values as of the acquisition date. The allocation of the total purchase price was as follows:

        The identifiable assets acquired consisted of intellectual property and computer equipment. The intellectual property acquired in the transaction covered the analytics and visualization algorithms developed by VisiTrend. At the time of the transaction, the technology had not yet been commercialized into a product and required significant enhancements to maximize its value upon potential commercialization. The Company intends to use the developed algorithms and software codes internally, rather than incorporate them into existing or future product offerings. The estimated fair value of the developed technology on the date of the acquisition was $701, and the developed technology is expected to have a useful life of five years.

        The goodwill recorded as part of the acquisition of VisiTrend is deductible for U.S. federal income tax purposes.

        The results of operations of VisiTrend have been included in the Company's consolidated statements of operations and comprehensive loss from the acquisition date. Actual revenue and earnings of VisiTrend since the acquisition date as well as pro forma combined results of operations for the VisiTrend acquisition have not been presented because the effect of the acquisition was not material to the Company's consolidated financial results for the periods presented.

F-33

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

4. Fair Value of Financial Instruments

        The following tables present information about the Company's financial assets and liabilities measured at fair value on a recurring basis and indicate the level of the fair value hierarchy utilized to determine such fair values:

 

        As of December 31, 2016 and 2017, the Company's cash equivalents, which were invested in money market funds, were valued based on Level 1 inputs. During the years ended December 31, 2016 and 2017, there were no transfers between Level 1, Level 2 and Level 3.

        The warrant liabilities in the tables above consisted of the fair values of warrants for the purchase of preferred stock and common stock (see Note 12) and are based on significant inputs not observable in the market, which represents a Level 3 measurement within the fair value hierarchy. The Company's valuation of the liabilities for preferred stock warrants and the common stock warrant utilized the Black-Scholes option-pricing model, which incorporates assumptions and estimates to value the preferred stock warrants and the common stock warrant. The Company assesses these assumptions and estimates on a quarterly basis as additional information impacting the assumptions is obtained. Changes in the fair value of the preferred stock warrants and the common stock warrant are recognized in the consolidated statements of operations and comprehensive loss.

F-34

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

4. Fair Value of Financial Instruments (Continued)

        Changes in the fair values of the Company's preferred stock warrant liabilities and common stock warrant liability for the periods presented were as follows:

5. Allowance for Doubtful Accounts

        Changes in the allowance for doubtful accounts were as follows:

6. Property and Equipment, Net

        Property and equipment, net consisted of the following:

        Depreciation and amortization expense related to property and equipment, including internal-use software, was $2,728, $4,152 and $5,526 for the years ended December 31, 2015, 2016 and 2017,

F-35

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

6. Property and Equipment, Net (Continued)

respectively. For the year ended December 31, 2015, depreciation expense related to equipment under capital leases was $75. During the years ended December 31, 2015, 2016 and 2017, the Company disposed of fully depreciated assets with an original cost of $673, $722 and $541, respectively.

        During the years ended December 31, 2015, 2016 and 2017, the Company capitalized $646, $411 and $922, respectively, of costs related to the development of internal-use software and recorded amortization expense of capitalized internal-use software of $121, $226 and $447 respectively.

7. Goodwill and Intangible Assets

        As of January 1, 2015, goodwill of $29,218 associated with the Company's acquisition of Carbon Black, Inc. in 2014 was recorded on the consolidated balance sheet. During the year ended December 31, 2015, the Company recorded $1,892 of goodwill associated with the acquisition of Objective Logistics (see Note 3) and $762 of goodwill associated with the acquisition of VisiTrend (see Note 3). During the year ended December 31, 2016, the Company recorded $87,785 of goodwill associated with the acquisition of Confer (see Note 3). During the year ended December 31, 2017, there were no additions to goodwill. Goodwill totaled $119,656 as of December 31, 2016 and 2017. There were no impairments recorded against goodwill during the years ended December 31, 2015, 2016 or 2017.

        Identifiable intangible assets consisted of the following:

        Amortization expense related to intangible assets for the years ended December 31, 2015, 2016 and 2017 was $595, $3,780 and $1,563, respectively.

        Estimated future amortization expense of the identifiable intangible assets as of December 31, 2017 is as follows:

F-36

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

8. Accrued Expenses

        Accrued expenses consisted of the following:

9. Debt

        Debt consisted of the following:

Line of Credit

        In August 2013, the Company entered into a senior loan and security agreement (the "Line of Credit") with a financial institution that provides for maximum borrowings in one or more advances of an amount equal to the lesser of $5,000 or 80% of eligible accounts receivable. Borrowings under the Line of Credit accrue interest at the financial institution's prime rate plus 1.50% (resulting in an interest rate of 5.25% as of December 31, 2016) and had an original maturity date of August 22, 2014. In July 2014, the Line of Credit was amended to extend the maturity date to August 31, 2016. In February 2015, the Line of Credit was further amended to increase the borrowing limit to the lesser of $10,000 or 80% of eligible accounts receivable. During 2016, the Line of Credit was amended to extend the maturity date to March 29, 2017. In September 2016, the Company borrowed $5,500 under the Line of Credit and used the proceeds to repay the outstanding $5,500 principal balance on the Mezzanine Term Loan, further discussed below. Through December 31, 2016, the Company paid $60 in fees to the financial institution related to the Line of Credit. These fees were recorded as debt issuance costs and were fully amortized to interest expense using the effective interest method as of August 31, 2016.

        In March 2017, the Line of Credit was amended to increase the maximum borrowings to $40,000, without consideration of the Company's eligible accounts receivable. Borrowings under the Line of Credit accrue interest at the financial institution's prime rate. Amounts borrowed under the Line of Credit may be repaid and reborrowed until its maturity date on March 21, 2020, at which time all amounts outstanding must be repaid. The Company paid $47 in fees to the financial institution related to this amendment and agreed to pay a non-refundable fee of $47 on the first and second anniversary of the effective date of the amendment. The Company deemed the amendment to be a modification of the debt for accounting purposes, and the fees were recorded as debt issuance costs and will be amortized to interest expense using the effective interest method through the maturity date of the Line of Credit. The Company also agreed to pay an unused revolving line facility fee, which is payable quarterly in arrears in an amount equal to fifteen one-hundredths of one percent (0.15%) per annum of the average unused portion of the Line of Credit, as

F-37

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

9. Debt (Continued)

determined by the financial institution. In April 2017, the Company repaid all principal amounts outstanding under the Line of Credit, which totaled $5,500.

        As of December 31, 2016 and 2017, the Company had $5,500 and $0 of outstanding borrowings under the Line of Credit, respectively. During the years ended December 31, 2015, 2016 and 2017, the Company recorded interest expense of $6, $79 and $119, respectively, on the Line of Credit. In addition, during the years ended December 31, 2015, 2016 and 2017, $18, $13 and $22, respectively, of the debt issuance cost was amortized to interest expense.

        Borrowings under the Line of Credit are collateralized by substantially all of the assets of the Company, excluding intellectual property. In connection with the Line of Credit, the Company is subject to various financial reporting requirements and a financial covenant, which involves maintaining a specified liquidity measurement. The Company was in compliance with all covenants of the Line of Credit as of and for the years ended December 31, 2015, 2016 and 2017. In addition, there are negative covenants restricting the Company's activities, including limitations on dispositions, mergers or acquisitions; encumbering intellectual property; incurring indebtedness or liens; paying dividends and redeeming or repurchasing capital stock; making certain investments; and engaging in certain other business transactions. The obligations under the Line of Credit are subject to acceleration upon the occurrence of specified events of default, including a material adverse change in the Company's business, operations or financial or other condition.

Mezzanine Term Loan

        In August 2013, the Company entered into a subordinated loan and security agreement (the "Mezzanine Term Loan") that, as amended, provided for three advances of up to an aggregate of $6,000, with each advance equal to at least $2,000, through January 31, 2015. In June 2014, the Company borrowed $3,000 under the Mezzanine Term Loan, and in January 2015, the Company borrowed the remaining $3,000. Borrowings under the Mezzanine Term Loan accrued interest at a rate of 10% per annum and were payable in monthly, interest-only payments through July 31, 2016 and in fixed monthly installments of principal and interest thereafter through July 1, 2018. The Mezzanine Term Loan was junior to the Line of Credit but was senior to all other debt and equity. In August 2016, the Company began paying fixed monthly installments of principal and interest. In September 2016, using the proceeds from borrowings under the Line of Credit, the Company repaid the outstanding principal balance of $5,500 under the Mezzanine Term Loan, which then terminated with no additional borrowings available to the Company.

        In August 2013, the Company paid $60 in fees to the lender in connection with entering into the Mezzanine Term Loan. These fees were recorded as debt issuance costs, which were included in other long-term assets in the consolidated balance sheets, and were amortized to interest expense using the effective interest method through June 30, 2014 over the original loan commitment term of the agreement. In July 2014, the Company paid an additional $60 in fees the lender in connection with the amendment to the Mezzanine Term Loan. These fees were recorded as debt issuance costs, which were included in other long-term assets in the consolidated balance sheet as of December 31, 2015 and were being amortized to interest expense using the effective interest method through July 1, 2018 over the original term of the related loan. In September 2016, upon the repayment and termination of the Mezzanine Term Loan, the unamortized debt issuance costs of $10 related to the lender fees were recorded by the Company as a loss on extinguishment of debt.

        During the years ended December 31, 2015 and 2016, the Company recorded interest of $590 and $437, respectively, on the Mezzanine Term Loan. In addition, during the years ended December 31, 2015 and 2016, aggregate debt issuance costs of $203 and $151, respectively, were amortized to interest expense.

F-38

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

10. Preferred Stock

        As of December 31, 2016 and 2017, the Company's certificate of incorporation, as amended and restated, authorized the Company to issue 102,901,207 shares of $0.001 par value preferred stock.

        The Company has issued Series A convertible preferred stock ("Series A preferred stock"), Series B redeemable convertible preferred stock ("Series B preferred stock"), Series C redeemable convertible preferred stock ("Series C preferred stock"), Series D redeemable convertible preferred stock ("Series D preferred stock"), Series E redeemable convertible preferred stock ("Series E preferred stock"), Series E-1 redeemable convertible preferred stock ("Series E-1 preferred stock") and Series F preferred stock, collectively the "Preferred Stock." The holders of Preferred Stock have either mandatory redemption rights or liquidation rights in the event of a deemed liquidation that, in certain situations, is not solely within the control of the Company. Therefore, the Preferred Stock is classified outside of stockholders' equity (deficit).

        In June 2015, in connection with funding its acquisition of Objective Logistics (see Notes 3 and 19), the Company issued 286,560 shares of Series E preferred stock at a price of $6.60 per share to the controlling stockholder of Objective Logistics, which was also the Company's largest stockholder, and received gross proceeds of $1,892. The Company recorded the Series E preferred stock on the date of issuance at its fair value of $1,333, or $4.65 per share. The excess of the cash paid for such shares over their aggregate fair value was recorded as additional paid-in capital of $559.

        In August 2015, the Company issued 182,370 shares of Series E preferred stock in connection with its acquisition of VisiTrend (see Notes 3 and 19). The Company recorded the Series E preferred stock on the date of issuance at its fair value of $848, or $4.65 per share. Per the terms of the purchase agreement, the former shareholders of VisiTrend are also entitled to receive up to 220,365 shares of Series E preferred stock, contingent upon the continued employment of two former VisiTrend employees for periods of six and twelve months after the acquisition date.

        In September and October 2015, the Company issued an aggregate of 9,196,288 shares of Series F preferred stock at an issuance price of $5.93 and received gross proceeds of $54,534. In connection with this financing, the Company paid total issuance costs of $664. In addition, the redemption dates of the Series A, B, C, D, E and E-1 preferred stock were extended to September 30, 2021.

        In January 2016, the Company issued 1,517,706 shares of Series F preferred stock at a price of $5.93 per share for gross proceeds of $9,000 in a third closing of the Series F preferred stock and 801,011 shares of Series F preferred stock at a price of $5.93 per share for gross proceeds of $4,750 in a fourth closing of the Series F preferred stock. In connection with the financing, the Company paid total issuance costs of $365.

        In February and August 2016, the Company issued 220,365 shares of Series E preferred stock as payment for the contingent consideration then earned in connection with the VisiTrend acquisition (see Note 3).

        In June 2016, in connection with funding its acquisition of Confer (see Note 3), the Company issued 13,026,145 shares of Series F preferred stock to the selling stockholders. The Company recorded the Series F preferred stock on the date of issuance at its fair value of $76,724, or $5.89 per share (see Note 3).

        In August 2016, upon the exercise of the Customer Option under the Confer acquisition (see Note 3), the Company issued 699,720 shares of Series F preferred stock at an issue price of $2.86 per share and

F-39

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

10. Preferred Stock (Continued)

received gross proceeds of $2,000, which the Company then remitted to the former stockholders of Confer, as required by the Merger Agreement.

        In June 2017, the Company issued 228,715 shares of Series F preferred stock to the former stockholders of Confer in settlement of the Customer Warrant (see Note 3).

        In June 2017, the Company issued 62,197 shares of Series B preferred stock at an exercise price of $0.415266 per share upon the net exercise of the Series B Warrant (see Note 12).

        During the years ended December 31, 2015, 2016 and 2017, certain employees exercised options to purchase 785,593, 776,787 and 569,884 shares, respectively, of Series A preferred stock in exchange for cash proceeds of $390, $410 and $448, respectively.

        As of each balance sheet date, Preferred Stock consisted of the following:

 

F-40

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

10. Preferred Stock (Continued)

        The holders of the Preferred Stock have the following rights and preferences:

Voting Rights

        The holders of Series A preferred stock are not entitled to vote. The holders of Series B, C, D, E, E-1 and F preferred stock are entitled to the number of votes equal to the number of shares of common stock into which such shares of Series B, C, D, E, E-1 and F preferred stock could convert on the record date for determination of stockholders entitled to vote. In addition, the holders of Series B preferred stock, voting as a single class, are entitled to elect three directors of the Company. The holders of Series B, C, D, E, E-1 and F preferred stock as well as common stock, voting together as a single class and on an as-converted to common stock basis, are entitled to elect all remaining directors of the Company.

Dividends

        The holders of Series A preferred stock are entitled to receive noncumulative dividends when, as and if declared on common stock by the board of directors. The holders of Series B, C, D, E, E-1 and F preferred stock are entitled to receive noncumulative dividends when, as and if declared by the board of directors. The Company may not declare, pay or set aside any dividends on shares of any other class or series of capital stock of the Company unless the holders of Series B, C, D, E, E-1 and F preferred stock shall first receive, or simultaneously receive, a dividend on each outstanding share of Series B, C, D, E, E-1 and F preferred stock in an amount at least equal to (i) in the case of a dividend on common stock or any class or series that is convertible to common stock, that amount per share of Series B, C, D, E, E-1 and F preferred stock as would equal the product of the dividend payable on an as-converted into common stock basis multiplied by the number of shares of common stock issuable upon conversion of all Series B, C, D, E, E-1 and F preferred stock or (ii) in the case of a dividend on any class or series that is not convertible into common stock, at a rate per share of Series B, C, D, E, E-1 and F preferred stock that is determined by dividing the amount of dividend payable on each share of such class or series of capital stock by the Original Issue Price (as described below) of such class or series of capital stock (subject to appropriate adjustment in the event of any stock dividend, stock split, combination or other similar recapitalization affecting such shares) and multiplying such fraction by an amount equal to the Series B, C, D, E, E-1 and F preferred stock Original Issue Price. If the Company declares, pays or sets aside, on the same date, a dividend on shares of more than one class or series of capital stock of the Company, the dividend payable to the holders of Series B, C, D, E, E-1 and F preferred stock will be calculated based upon the dividend on the class or series of capital stock that would result in the highest Series B, C, D, E, E-1 and F preferred stock dividend. No dividends have been declared through December 31, 2017.

        The Original Issue Price per share is $0.415266 for Series B preferred stock, $0.944 for Series C preferred stock, $2.9891 for Series D preferred stock, $4.01 for Series E preferred stock, $4.01 for Series E-1 preferred stock and $5.93 for Series F preferred stock, subject to appropriate adjustment in the event of any stock dividend, stock split, combination or other similar recapitalization with respect to the Series B, C, D, E, E-1 or F preferred stock.

Liquidation

        In the event of a liquidation, voluntary or involuntary, dissolution or winding up of the Company, (i) the holders of Series B, C, D, E, E-1 and F preferred stock will be entitled to receive, on a pari passu

F-41

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

10. Preferred Stock (Continued)

basis, an amount per share equal to the applicable Original Issue Price multiplied by a factor of 2.2, 1.2, 1.0, 1.0, 0.21 and 1.0, respectively, plus any dividends declared but unpaid and (ii) the holders of Series A preferred stock will be entitled to receive a contingent payment amount based upon the gross proceeds from a Deemed Liquidation Event (as defined below) multiplied by the Series A Target Percentage, as that term is defined in the Company's certificate of incorporation, as amended and restated, which is a maximum 4.4%.

        After such payments, then, to the extent available, remaining assets available for distribution will be used to fund the Founder Bonus Plan (see Note 14). After funding of the Founder Bonus Plan, any remaining assets will be distributed among the holders of Series B, C, D, E, E-1 and F preferred stock and common stock, pro rata based on the number of shares held by each stockholder, treating for this purpose all such securities as if they had been converted into common stock immediately prior to such liquidation, dissolution or winding up of the Company.

        Unless the holders of at least 55% of the outstanding shares of Series B, C, D, E, E-1 and F preferred stock, voting together as a single class and on an as-converted to common stock basis, elect otherwise, a Deemed Liquidation Event shall include a merger or consolidation (other than one in which stockholders of the Company own a majority by voting power of the outstanding shares of the surviving or acquiring corporation) or a sale, lease, license, transfer or other disposition of all or substantially all of the assets of the Company and its subsidiaries.

Conversion

        The holders of Series A preferred stock have no conversion rights, except upon the closing of an IPO. Upon the closing of an IPO, each share of Series A preferred stock will automatically be converted into the number of shares of common stock equal to the result obtained by dividing (i) the product of (a) the Series A Target Percentage (which is not to exceed 4.4%) and (b) the number of shares of the Company's common stock outstanding on an as-converted into common stock and fully diluted basis by (ii) the number of shares of Series A preferred stock then-outstanding and underlying then-outstanding vested and unvested Series A preferred stock options.

        Each share of Series B, C, D, E, E-1 and F preferred stock is convertible, at the option of the holder at any time, or will automatically be converted into shares of common stock at the applicable conversion ratio then in effect (i) upon the closing of a qualifying IPO at a price per share to the public of at least $11.9564, subject to appropriate adjustments, and with aggregate gross proceeds of at least $50,000 or (ii) upon the vote or written consent of the holders at least 55% of the outstanding shares of Series B and C preferred stock, voting together as a single class and on an as-converted to common stock basis, and of a majority of the outstanding shares of Series D, E, E-1 and F preferred stock, voting together as a single class and on an as-converted to common stock basis.

        The conversion ratio of each series of preferred stock is determined by dividing the Original Issue Price of each series by the Conversion Price of each series. The Conversion Price is $0.830532 for Series B, $1.888 for Series C, $5.9782 for Series D, $8.02 for Series E, $8.02 for Series E-1 and $11.86 for Series F preferred stock. The Conversion Price is subject to appropriate adjustment in the event of any deemed issuance of additional shares, stock dividend, stock split, combination or other similar recapitalization and other adjustments as set forth in the Company's certificate of incorporation, as amended and restated.

F-42

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

10. Preferred Stock (Continued)

Redemption

        The holders of Series A preferred stock have no redemption rights.

        At the written election of at least 55% of the holders of the outstanding shares of Series B and C preferred stock, voting together as a single class and on an as-converted to common stock basis, the shares of Series B and C preferred stock outstanding are redeemable, at any time on or after September 30, 2021, in three equal annual installments commencing 60 days after receipt of the required vote, in an amount equal to the Original Issue Price per share of each series plus all declared but unpaid dividends thereon.

        At the written election of a majority of the holders of the outstanding shares of Series D, E, E-1 and F preferred stock, voting together as a single class and on an as-converted to common stock basis, the shares of Series D, E, E-1 and F preferred stock outstanding are redeemable, at any time on or after September 30, 2021, in three equal installments commencing 60 days after receipt of the required vote. Shares of Series D, E and F preferred stock are redeemable in an amount equal to the greater of (i) the Original Issue Price per share of each series plus all declared but unpaid dividends thereon or (ii) the estimated fair value of the Series D, E or F preferred stock at the date of the redemption request. Shares of Series E-1 preferred stock are redeemable in an amount equal to the estimated fair value of the Series E-1 preferred stock at the date of the redemption request.

        The Company recognizes changes in the redemption values of its Series B, C, D, E, E-1 and F redeemable convertible preferred stock immediately as they occur and adjusts the carrying value of each series of redeemable convertible preferred stock to equal the redemption value at the end of each reporting period as if the end of each reporting period were the redemption date. During the years ended December 31, 2015, 2016 and 2017, the Company recorded adjustments to increase the carrying values of the Series B, C, D, E, E-1 and F redeemable convertible preferred stock by an aggregate of $24,979, $3,569 and $28,056, respectively, which resulted in an increase in redeemable convertible preferred stock by those amounts, offset by decreases to additional paid-in capital and an increase to accumulated deficit.

11. Common Stock

        As of December 31, 2016 and 2017, the Company's certificate of incorporation, as amended and restated, authorized the Company to issue 152,000,000 shares and 156,650,000 shares, respectively, of $0.001 par value common stock.

        Each share of common stock entitles the holder to one vote on all matters submitted to a vote of the Company's stockholders. Common stockholders are entitled to receive dividends, as may be declared by the board of directors, if any, subject to the preferential dividend rights of the preferred stockholders. No dividends have been declared through December 31, 2017.

F-43

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

12. Preferred Stock Warrants and Common Stock Warrants

        As of each balance sheet date, warrants outstanding consisted of the following:

 

Series B Preferred Stock Warrants

        In June 2010, in connection with an amendment to a loan agreement, the Company issued to the lender warrants to purchase 70,258 shares of Series B preferred stock at an exercise price of $0.415266 per share (the "Series B Warrant"). The Series B Warrant was immediately exercisable and was set to expire in June 2017. The Series B Warrant was classified as a liability and recorded at its fair value on the date of issuance, which was estimated to be $8, using a Black-Scholes option-pricing model with the following assumptions: 23% volatility; 1.89% risk-free interest rate; 7-year expected term; and no dividend yield.

        The warrant liability has been remeasured at each subsequent reporting date. In June 2017, the Series B Warrant was net exercised at an exercise price of $0.415266 per share and the Company issued 62,197 shares of Series B preferred stock. For the years ended December 31, 2015, 2016 and 2017, the Company recorded (gains) losses of $71, $(11) and $0 respectively, to reflect the change in fair value of the Series B Warrant. As of December 31, 2016, the fair value of the Series B Warrant liability was $225.

F-44

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

12. Preferred Stock Warrants and Common Stock Warrants (Continued)

Series D Preferred Stock Warrants

        In August 2013, in conjunction with the Mezzanine Term Loan, the Company issued a warrant to the lenders to purchase 167,500 shares of Series D preferred stock at an exercise price of $2.9891 per share. The warrant was immediately exercisable and expires in August 2023. The warrant was classified as a liability and recorded at its fair value on the date of issuance, which was estimated to be $306 using the Black-Scholes option-pricing model with the following assumptions: 56.90% volatility; 2.34% risk-free interest rate; 10-year expected term; and no dividend yield. The issuance-date fair value of the warrant was recorded as a debt issuance cost within other long-term assets and as a warrant liability. The debt issuance cost was amortized to interest expense using the effective interest method through June 30, 2014 over the original loan commitment term of the agreement. As of December 31, 2017, this warrant to purchase 167,500 shares of Series D preferred stock remained exercisable.

        In June 2014, upon the first draw down on the Mezzanine Term Loan, the Company issued to the lender a warrant to purchase 167,500 shares of the Company's Series D preferred stock at an exercise price of $2.9891. The warrant was immediately exercisable and expires in August 2023. The warrant was classified as a liability and recorded at its fair value on the date of issuance, which was estimated to be $333 using the Black-Scholes option-pricing model with the following assumptions: 40.00% volatility; 2.39% risk-free interest rate; 9.2-year expected term; and no dividend yield. The issuance-date fair value of the warrant was recorded as a debt issuance cost within other long-term assets and as a warrant liability. This debt issuance cost was being amortized to interest expense using the effective interest method through July 1, 2018 over the term of the related loan. In September 2016, using the proceeds from borrowings under the Line of Credit, the Company repaid the outstanding principal balance of $5,500 under the Mezzanine Term Loan, which then terminated with no additional borrowings available to the Company. The unamortized debt issuance cost of $90 related to the warrant was recorded by the Company as a loss on extinguishment of debt during the year ended December 31, 2016. As of December 31, 2017, this warrant to purchase 167,500 shares of Series D preferred stock remained exercisable.

        The warrant liability for these two warrants has been remeasured at each subsequent reporting date. For the years ended December 31, 2015, 2016 and 2017, the Company recorded (gains) losses of $217, $(54) and $140, respectively, to reflect the change in fair value of these preferred stock warrants. As of December 31, 2016 and 2017, the aggregate fair value of the Series D warrant liability was $852 and $992, respectively. As of December 31, 2017, no Series D preferred stock warrants had been exercised.

Common Stock Warrants

        In July 2012, in conjunction with its issuance of Series D preferred stock, the Company issued to an investor a contingent warrant to purchase shares of the Company's common stock. The warrant is contingently exercisable upon an IPO at an exercise price of $0.002 per share into the number of shares of common stock equal to 12.5% of the sum of (a) the number of shares into which the shares of Series A preferred stock, including shares issuable upon the exercise of outstanding options to purchase shares of Series A preferred stock, convert upon an IPO and (b) the number of shares of common stock underlying the warrant. The warrant was classified as a liability, as it meets the definition of a derivate instrument under the relevant accounting guidance, and was recorded at its fair value on the date of issuance, which was estimated to be $133 using the probability-weighted expected return method. The Company recorded the issuance-date fair value of the warrant as a reduction to the carrying value of the Series D preferred

F-45

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

12. Preferred Stock Warrants and Common Stock Warrants (Continued)

stock and as a warrant liability in the amount of $133. The warrant liability has been remeasured at each subsequent reporting date utilizing the Black-Scholes option-pricing model to determine the fair value of the warrant. For the years ended December 31, 2015, 2016 and 2017, the Company recorded losses for the change in the fair value of the warrant liability of $602, $54 and $670, respectively. As of December 31, 2016 and 2017, the fair value of the common stock warrant liability was $1,104 and $1,774, respectively.

        In July 2014, in conjunction with an amendment to the Mezzanine Term Loan, the Company issued to the lenders warrants to purchase up to an aggregate of 212,500 shares of the Company's common stock at an exercise price of $3.02 per share. Warrants for the purchase of 106,250 shares of common stock were immediately exercisable upon issuance and expire in July 2024. Pursuant to the terms of the warrants and the Mezzanine Term Loan, the right to acquire the additional 106,250 shares of common stock expired on September 30, 2015. The warrants were classified as equity and recorded at their fair values on the date of issuance, which was estimated to be an aggregate of $226 using the Black-Scholes option-pricing model with the following assumptions: 40.0% volatility; 2.58% risk-free interest rate; 10-year expected term; and no dividend yield. The issuance-date fair value of the warrants was recorded as a debt issuance cost, which was included in other long-term assets in the Company's consolidated balance sheet, and as additional paid-in capital as of December 31, 2015. The debt issuance cost was being amortized to interest expense over the term of the original term of the debt using the effective interest method. In September 2016, using the proceeds from borrowings under the Line of Credit, the Company repaid the outstanding principal balance of $5,500 under the Mezzanine Term Loan, which then terminated with no additional borrowings available to the Company. The unamortized debt issuance cost related to the common stock warrant of $61 was recorded by the Company as a loss on extinguishment of debt during the year ended December 31, 2016. As of December 31, 2017, the warrant to purchase 106,250 shares of common stock remained exercisable.

Valuation Assumptions

        Inputs used in the Black-Scholes option-pricing model to estimate the fair value of the Company's common stock, Series B preferred stock and Series D preferred stock warrant liabilities include unobservable inputs and assumptions, such as expected volatility, expected term, and the value of the underlying common or preferred stock.

        The following tables summarize the Company's valuation assumptions used in determining the fair value of the common and preferred stock warrants at December 31, 2016 and 2017:

F-46

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

12. Preferred Stock Warrants and Common Stock Warrants (Continued)

13. Equity Award Plans

Equity Incentive Plan

        The Company's Equity Incentive Plan, as amended and restated (the "Equity Incentive Plan"), provides for the Company to issue restricted common stock or to grant incentive stock options, non-qualified stock options or other stock-based awards to employees, officers, directors, consultants and advisors of the Company. The Equity Incentive Plan is administered by the board of directors, or at the discretion of the board of directors, by a committee of the board. The exercise prices, vesting and other restrictions are determined at the discretion of the board of directors, or their committee if so delegated, except that the exercise price per share of stock options may not be less than 100% of the fair market value of the Company's common stock on the date of grant and the term of stock option may not be greater than ten years. Stock options granted under the Equity Incentive Plan typically vest as to 25% of the award upon the first anniversary of the grant date and as to 2.08% of the award each month thereafter over a three-year period and expire ten years after the grant date.

        As of December 31, 2017, the total number of shares that may be issued under the Equity Incentive Plan was 1,490,011 shares, of which no shares were available for future grants. During the years ended December 31, 2015, 2016 and 2017, no stock options were granted under the Equity Incentive Plan.

2010 Series A Option Plan

        The Company's 2010 Series A Option Plan, as amended and restated (the "Series A Plan"), provides for the Company to grant incentive stock options and non-qualified stock options to purchase shares of the Company's Series A preferred stock to employees, officers, directors, consultants and advisors of the Company. The Series A Plan is administered by the board of directors, or at the discretion of the board of directors, by a committee of the board. The exercise prices, vesting and other restrictions are determined at the discretion of the board of directors, or their committee if so delegated, except that the exercise price per share of stock options may not be less than 100% of the fair market value of the share of Series A preferred stock on the date of grant and the term of stock option may not be greater than ten years. Stock options granted under the Series A Plan typically vest as to 25% of the award upon the first anniversary of the grant date and as to 2.08% of the award each month thereafter over a three-year period and expire ten years after the grant date.

        As of December 31, 2017, the total number of shares that may be issued under the Series A Plan was 8,800,000 shares, of which 258,618 shares were available for future grants.

F-47

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

13. Equity Award Plans (Continued)

2012 Stock Option and Grant Plan

        The Company's 2012 Stock Option and Grant Plan, as amended and restated (the "2012 Stock Option Plan"), provides for the Company to sell or issue common stock or restricted common stock or to grant incentive stock options, non-qualified options or other stock-based awards to employees, officers, directors, consultants and advisors of the Company. The 2012 Stock Option Plan is administered by the Company's board of directors, or at the discretion of the board of directors, by a committee of the board. The exercise prices, vesting and other restrictions are determined at the discretion of the board of directors, or their committee if so delegated, except that the exercise price per share of stock options may not be less than 100% of the fair market value of the Company's common stock on the date of grant and the term of stock option may not be greater than ten years. Stock options granted under the 2012 Stock Option Plan typically vest as to 25% of the award upon the first anniversary of the grant date and as to 2.08% of the award each month thereafter over a three-year period and expire ten years after the grant date.

        In January 2016, the Company issued 960,900 shares of common stock to partially settle the Management Incentive Plan liability (see Note 15). These common stock shares were issued under the 2012 Stock Option Plan.

        As of December 31, 2017, the total number of shares that may be issued under the 2012 Stock Option Plan was 17,323,741 shares, of which 1,082,406 shares were available for future grants.

Carbon Black, Inc. Amended and Restated 2012 Equity Incentive Plan

        In February 2014, in connection with the Company's acquisition of Carbon Black, Inc. on February 10, 2014, the Company assumed the Carbon Black, Inc. Amended and Restated 2012 Equity Incentive Plan (the "Carbon Black Plan") and replaced all vested and then outstanding options held by former employees of Carbon Black with options to purchase 1,675,683 shares of the Company's Series E-1 preferred stock. These options were fully exercisable upon issuance at a weighted-average exercise price of $0.43 per share. The Company reserved an aggregate of 6,415,146 shares of Series E-1 preferred stock for issuance upon exercise of options under the Carbon Black Plan. Effective as of February 10, 2014, the Company's board of directors determined not to grant any further awards under the Carbon Black Plan, but all outstanding awards under the Carbon Black Plan continue to be governed by their existing terms. During the years ended December 31, 2015, 2016 and 2017, no options to purchase shares were granted, exercised or forfeited under the Carbon Black Plan. As of December 31, 2015, 2016 and 2017, options to purchase 1,675,683 shares of Series E-1 preferred stock remained outstanding.

Confer Technologies, Inc. 2013 Stock Plan

        In June 2016, in connection with its acquisition of Confer, the Company assumed the Confer Technologies, Inc. 2013 Stock Plan (the "Confer Plan") and replaced all outstanding options held by former employees of Confer with options to purchase 796,817 shares of the Company's common stock (see Note 3). These replacement options had a weighted-average exercise price of $2.19 per share. Effective as of June 3, 2016, the Company's board of directors determined not to grant any further awards under the Confer Plan, but all outstanding awards under the Confer Plan continue to be governed by their existing terms. During the period from June 3, 2016 to December 31, 2016, no options to purchase shares were

F-48

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

13. Equity Award Plans (Continued)

granted, 89,956 shares were exercised and 44,732 shares were forfeited under the Confer Plan. During the year ended December 31, 2017, no options to purchase shares were granted, 108,229 shares were exercised and 98,540 shares were forfeited under the Confer Plan. As of December 31, 2017, options to purchase 455,357 shares of common stock remained outstanding.

Options to Purchase Series A Preferred Stock

        The following table summarizes the Company's Series A preferred stock option activity since December 31, 2016:

        The aggregate intrinsic value of Series A preferred stock options is calculated as the difference between the exercise price of the stock options and the fair value of the Company's Series A preferred stock for those stock options that had exercise prices lower than the fair value of the Company's Series A preferred stock. The aggregate intrinsic value of Series A preferred stock options exercised during the years ended December 31, 2015, 2016 and 2017, was $763, $1,694 and $1,343, respectively.

        The Company received cash proceeds from the exercise of Series A preferred stock options of $390, $410 and $448 during the years ended December 31, 2015, 2016 and 2017, respectively.

        No Series A preferred stock options were granted during the year ended December 31, 2015. The weighted-average grant-date fair value of Series A preferred stock options granted during the years ended December 31, 2016 and 2017 was $1.23 and $1.50 per share, respectively.

        The ranges of assumptions that the Company used to determine the fair value of the Series A preferred stock options granted to employees and directors were as follows:

F-49

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

13. Equity Award Plans (Continued)

Options to Purchase Common Stock

        The following table summarizes the Company's common stock option activity since December 31, 2016 under all common stock option plans:

        The aggregate intrinsic value of common stock options is calculated as the difference between the exercise price of the stock options and the fair value of the Company's common stock for those stock options that had exercise prices lower than the fair value of the Company's common stock. The aggregate intrinsic value of stock options exercised during the years ended December 31, 2015, 2016 and 2017 was $155, $4,644 and $3,389, respectively.

        The Company received cash proceeds from the exercise of common stock options of $228, $2,057 and $3,454 during the years ended December 31, 2015, 2016 and 2017, respectively.

        The weighted-average grant-date fair value of common stock options granted during the years ended December 31, 2015, 2016 and 2017 was $2.66, $3.06 and $2.82, respectively.

        The range of assumptions that the Company used to determine the fair value of the common stock options granted to employees and directors were as follows:

        On October 29, 2014, the Company granted to an employee restricted stock units ("RSUs") for 115,500 shares of common stock. The RSUs were to vest over four years, with 25% of the award vesting upon the first anniversary of the vesting date and as to 2.08% of the award vesting each month thereafter. However, the award would become fully vested upon an IPO or a qualified change of control event if such events occur within seven years of the grant date. The grant-date fair value of the award was $3.02 per unit, which equaled the fair value of the Company's common stock on the date of grant. The fair value of the

F-50

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

13. Equity Award Plans (Continued)

award was being recognized on a straight-line basis over the four-year vesting term. During the year ended December 31, 2015, the employee was terminated and the award was forfeited. The expense recorded related to the unvested portion of the award was reversed during the year ended December 31, 2015. As of December 31, 2015, 2016 and 2017, there were no RSUs outstanding.

Stock-Based Compensation

        Stock-based compensation expense was classified in the consolidated statements of operations and comprehensive loss as follows:

        During the years ended December 31, 2015, 2016 and 2017, the Company recorded stock-based compensation expense for options granted to non-employees of $63, $115 and $87, respectively.

        As of December 31, 2015, 2016 and 2017, total unrecognized compensation cost related to the unvested Series A preferred stock-based awards was $1,083, $840 and $871, respectively, which is expected to be recognized over weighted-average periods of 1.84 years, 1.94 years and 2.21 years, respectively.

        As of December 31, 2015, 2016 and 2017, total unrecognized compensation cost related to the unvested common stock-based awards was $14,064, $19,846 and $20,705, respectively, which is expected to be recognized over weighted-average periods of 2.92 years, 2.79 years and 2.57 years, respectively.

14. Commitments and Contingencies

Operating Leases

        The Company leases office facilities under various non-cancelable operating leases that expire at various dates between February 2018 and June 2027. Rent expense for non-cancelable operating leases with free rental periods or scheduled rent increases is recognized using the straight-line method over the term of the lease. Improvement reimbursements from landlords are amortized on a straight-line basis into rent expense over the terms of the leases. The difference between required lease payments and straight-lined rent expense is recorded as deferred rent. Rent expense related to the Company's leased office space was $2,297, $2,824 and $3,488 for the years ended December 31, 2015, 2016 and 2017, respectively.

        In December 2014, the Company entered into a lease agreement for office space located in Waltham, Massachusetts, which has a term expiring in April 2022. The lease includes provisions for increasing monthly payments and leasehold improvement reimbursements from the landlord totaling $3,382. In

F-51

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

14. Commitments and Contingencies (Continued)

connection with the lease, the Company issued an unconditional and irrevocable standby letter of credit in the amount of $1,441 as a security deposit. The irrevocable standby letter of credit was initially secured by a certificate of deposit, which renewed annually automatically. The Company recorded the certificate of deposit purchase as restricted cash in its consolidated financial statements upon its issuance and as of December 31, 2015. During the year ended December 31, 2016, the Company's financial institution no longer required the Company to maintain a certificate of deposit collateralizing the letter of credit and the $1,441 of restricted cash was released.

        In December 2015, the Company entered into an amendment to the facility lease to expand the leased space. The Company did not obtain control of the newly leased office space until May 1, 2016. The amendment included a provision for leasehold improvement reimbursements from the landlord totaling $935. The amendment did not change the April 2022 expiration date of the lease.

        During the year ended December 31, 2015, the Company also leased certain computer equipment under non-cancelable lease agreements requiring monthly rental payments. The lease agreements expired prior to the end of December 31, 2015. Rent expense incurred under these equipment lease agreements was $210 during the year ended December 31, 2015.

        The following table summarizes the future minimum lease payments due under operating leases as of December 31, 2017:

Hosting Services Agreement

        In September 2017, the Company entered a non-cancelable contractual agreement related to the hosting of our data processing, storage and other computing services. The agreement, as amended, expires in November 2020. The following table summarizes the future minimum payments committed under the hosting agreement as of December 31, 2017:

F-52

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

14. Commitments and Contingencies (Continued)

Founder Bonus Plan

        During 2010, the Company established the Founder Bonus Plan, which provides for the payment to participants of the plan of an aggregate amount not to exceed an aggregate of $400 upon a Deemed Liquidation Event. Such payments are subject to the preference rights upon a Deemed Liquidation Event of the holders of the Company's Preferred Stock and shall be payable before any payments are made to the holders of common stock.

Indemnifications

        Under the indemnification provisions of the Company's standard sales-related contracts, the Company agreed to defend end-customers against third-party claims asserting infringement of certain intellectual property rights, which may include patents, copyrights, trademarks, or trade secrets, and to pay judgments entered on such claims. The Company's exposure under these indemnification provisions is generally limited to the total amount paid by the end-customer under the agreement. However, certain agreements include indemnification provisions that could potentially expose the Company to losses in excess of the amount received under the agreement. In addition, the Company indemnifies its officers, directors and certain key employees while they are serving in good faith in their capacities. Through December 31, 2017, there have been no claims under any indemnification provisions. The Company does not believe that the outcome of any claims under indemnification arrangements will have a material effect on its financial position, results of operations or cash flows, and it has not accrued any liabilities related to such obligations in its consolidated financial statements as of December 31, 2016 or 2017.

Litigation

        From time to time, and in the ordinary course of business, the Company may be subject to various claims, charges and litigation. As of December 31, 2017, the Company did not have any pending claims, charges or litigation that it expects would have a material adverse effect on its consolidated financial position, results of operations or cash flows.

15. Management Incentive Plan

        In August 2009, the Company established the Management Incentive Plan, which provided for incentive payments to be made to certain employees in the event of a Deemed Liquidation Event for their efforts towards enhancing the Company's value. The Management Incentive Plan, which was amended and restated three times between June 2010 and July 2012, allowed for the issuance of vesting units to participants in the Management Incentive Plan at the discretion of the compensation committee of the Company's board of directors. At the time of a Deemed Liquidation Event, participants in the Management Incentive Plan were to be paid an amount calculated based upon the number of vested units held at the time of the event multiplied by a target management percentage, which was to be determined based upon the total gross proceeds received in the qualifying event. The July 2012 amendment established that the Company's maximum obligation under the Management Incentive Plan was $20,000. On December 31, 2014, the Company's board of directors terminated the Management Incentive Plan and agreed to pay the participants the maximum amount of $20,000 no earlier than January 1, 2016 and no later than January 1, 2017. The obligation was permitted to be settled in cash, stock, or a combination of

F-53

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

15. Management Incentive Plan (Continued)

both at the Company's discretion. As a result, on December 31, 2014, the Company recorded an expense of $20,000 in its consolidated statement of operations and comprehensive loss and recorded a liability of $20,000 in its consolidated balance sheet related to the committed obligation.

        In January 2016, the Company's board of the directors voted to settle the outstanding obligation of $20,000 associated with the Management Incentive Plan by issuing a combination of cash and shares of the Company's common stock. In February 2016, the Company issued common stock with an aggregate fair value of $6,015, consisting of 960,900 shares of common stock with a fair value of $6.26 per share, and paid $13,985 in cash to settle the obligation in full. As a result of this payment, the Company had no further obligations under the Management Incentive Plan.

16. Employee Benefit Plan

        The Company has established a defined contribution savings plan under Section 401(k) of the Internal Revenue Code. The plan covers substantially all employees who meet minimum age and service requirements and allows participants to defer a portion of their annual compensation on a pre-tax basis, subject to legal limitations. Company contributions to the plan may be made at the discretion of the Company's board of directors. To date, no contributions have been made to the plan by the Company.

17. Income Taxes

        The following table presents the components of income (loss) before income taxes:

        The following table summarizes the provision for (benefit from) income taxes:

F-54

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

17. Income Taxes (Continued)

        During the years ended December 31, 2016 and 2017, the Company recorded an income tax benefit of $2,191 and an income tax provision of $78, respectively. During the years ended December 31, 2015, 2016 and 2017, the Company recorded no income tax benefits for the net losses incurred and the tax credits earned in each year, due to its uncertainty of realizing a benefit from those items. During the year ended December 31, 2016, an income tax benefit of $2,429 was recognized due to the release of a portion of the Company's deferred tax asset valuation allowance in connection with the acquisition of Confer (see Note 3). Of that tax benefit amount, $2,207 related to federal taxes and $222 related to state taxes. As a result of the Confer acquisition, $2,429 of the Company's pre-acquisition deferred tax assets were expected to become realizable in the post-acquisition period due to the reversal of acquired temporary differences. In this circumstance, the reduction in the Company's valuation allowance is recognized as an income tax benefit rather than as part of the accounting for the business combination.

        A reconciliation of the federal statutory income tax rate to the effective tax rate is as follows:

        The significant reconciling items between the reported amounts of income tax expense for the year to the amount of income tax expense that would result from applying the U.S. statutory tax rate to pre-tax income include the impact of the U.S. corporate tax rate reduction enacted during the fourth quarter of 2017, state taxes, non-deductible expenses, tax credits, tax reserves for uncertain tax positions and the valuation allowance maintained against the Company's net deferred tax assets.

        On December 22, 2017, the Tax Cuts and Jobs Act of 2017 (the "Act") was signed into law, making significant changes to the Internal Revenue Code. Changes include, but are not limited to, a corporate tax rate decrease from 35% to 21% effective for tax years beginning after December 31, 2017, the transition of U.S international taxation from a worldwide tax system to a territorial system, and a one-time transition tax on the mandatory deemed repatriation of cumulative deferred foreign earnings as of December 31, 2017. On December 22, 2017, Staff Accounting Bulletin No. 118 ("SAB 118") was issued, which directs taxpayers to consider the impact of the Act as "provisional" when a registrant does not have the necessary information available, prepared or analyzed (including computations) in reasonable detail to complete the accounting for certain income tax effects of the Act.

        As of December 31, 2017, the Company has not completed its accounting for the tax effects of enactment of the Act; however, the Company has made provisional estimates of the effects of the Act on

F-55

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

17. Income Taxes (Continued)

its existing deferred tax balances and the one-time transition tax. The Act did not have a significant impact on the Company's consolidated financial statements for the year ended December 31, 2017 as a result of the valuation allowance maintained against the Company's U.S. deferred tax assets. However, the Company's provisional estimate associated with the reduction in the U.S. federal corporate tax rate from 35% to 21% impacted the change in valuation allowance and tax rate change components of the Company's effective tax rate reconciliation as well as its ending deferred tax assets, deferred tax liabilities and valuation allowance in the deferred tax footnote disclosure. The Company has an accumulated deficit from its foreign operations and does not have a transition tax associated with deferred foreign earnings related to the Act. The ultimate impact of the Act may differ from these provisional amounts due to, among other things, additional analysis, changes in interpretations and assumptions the Company has made and additional regulatory guidance that may be issued. The Company's accounting treatment is expected to be complete in the fourth quarter of 2018.

        A valuation allowance is provided when it is more likely than not that all or a portion of the deferred tax asset will not be realized. Realization of deferred tax assets is dependent upon future taxable income, if any, the amount and timing of which are uncertain. The Company maintains a valuation allowance against its net U.S. and foreign deferred tax assets as a result of the negative evidence associated with its history of operating losses.

        Deferred tax assets and liabilities reflect the net tax effects of net operating loss carryovers and temporary differences between the carrying amount of assets and liabilities for financial reporting and the amounts used for income tax purposes. Significant components of the Company's deferred tax assets and liabilities were as follows:

F-56

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

17. Income Taxes (Continued)

        As of December 31, 2017, the Company had federal and state net operating loss carryforwards of $231,012 and $153,816, respectively. These carryforwards begin to expire in 2023 and 2018, respectively. As of December 31, 2017, the Company had federal and state research and development credit carryforwards of $4,244 and $2,380, respectively. These carryforwards begin to expire in 2026 and 2021, respectively. As of December 31, 2017, the Company had foreign net operating loss carryforwards of $4,741. Of this amount, carryforwards of $1,100 expire in 2036 and carryforwards of $3,641 do not expire.

        As of January 1, 2017, the Company adopted ASU 2016-09, Improvements to Employee Share-Based Payment Accounting ("ASU 2016-09") pursuant to which previously unrecognized excess tax benefits are recognized on a modified retrospective basis. Upon adoption of ASU 2016-19 on January 1, 2017, the Company recorded a $491 deferred tax asset related to unrecognized excess tax benefits and a corresponding reduction to accumulated deficit. In addition, due to the Company's full valuation allowance, the Company also recorded a $491 increase to its valuation allowance and a corresponding increase to accumulated deficit.

        The Company recognizes a deferred tax asset for the future benefit of tax loss carryforwards, tax credit carryforwards, and other deductible temporary differences to the extent that it is more likely than not that these assets will be realized. In evaluating the Company's ability to recover these deferred tax assets, the Company considers all available positive and negative evidence, including its past operating results, taxable income in carryback years, the projected reversal of existing deferred tax liabilities, the availability of tax planning strategies and its forecast of future taxable income. Based on the significant negative evidence, including the three-year cumulative loss position, the Company concluded that its net deferred tax assets were not more likely than not realizable and maintained a valuation allowance against the full amount of its net deferred tax assets at December 31, 2016 and 2017.

        Changes in the valuation allowance for deferred tax assets during the years ended December 31, 2015, 2016 and 2017 were as follows:

        The valuation allowance decreased by $11,784 during the year ended December 31, 2017. The decrease in valuation allowance was primarily the result of the impact of the U.S. corporate tax rate reduction enacted during 2017, which resulted in the Company remeasuring its deferred tax assets and liabilities at the lower 21% U.S. federal corporate tax rate and a corresponding reduction in the valuation allowance. This reduction was partially offset by the valuation allowance established in 2017 related to U.S. and foreign operating losses incurred and tax credits generated during the year.

        The valuation allowance increased by $19,542 during the year ended December 31, 2016, primarily as a result of the U.S. and foreign operating losses incurred and research and development tax credit

F-57

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

17. Income Taxes (Continued)

carryforwards generated during the year. As a component of that net increase, the Company released $2,429 of valuation allowance during the year ended December 31, 2016 as a result of taxable temporary differences acquired in the Confer acquisition, which were a source of income to support the realization of the deferred tax assets in future years. In addition, the Company recorded a valuation allowance of $6,221 in purchase accounting against acquired Confer deferred tax assets.

        Under Sections 382 and 383 of the U.S. Internal Revenue Code, if a corporation undergoes an ownership change, the corporation's ability to use its pre-change net operating loss carryforwards and other pre-change tax attributes, such as research tax credits, to offset its post-change income and taxes may be limited. In general, an ownership change generally occurs if there is a cumulative change in its ownership by 5% stockholders that exceeds 50 percentage points over a rolling three-year period. Similar rules may apply under U.S. state tax laws. The Company may have experienced an ownership change in the past and may experience ownership changes in the future as a result of future transactions in its share capital, some of which may be outside of the control of the Company. As a result, if the Company earns net taxable income, its ability to use its pre-change net operating loss carryforwards, or other pre-change tax attributes, to offset U.S. federal and state taxable income and taxes may be subject to significant limitations.

        In the ordinary course of business, there is inherent uncertainty in quantifying the Company's income tax positions. The Company assesses income tax positions and records tax benefits for all years subject to examination based upon management's evaluation of the facts, circumstances, and information available at the reporting date. For those tax positions for which it is more likely than not that a tax benefit will be sustained, the Company recorded the largest amount of tax benefit with a greater than 50% likelihood of being realized upon ultimate settlement with a taxing authority that has full knowledge of all relevant information. For those income tax positions for which it is not more likely than not that a tax benefit will be sustained, no tax benefit has been recognized in the consolidated financial statements.

        At December 31, 2016, the Company had $2,025 of gross unrecognized tax benefits, none of which, if recognized, would impact the Company's tax rate or tax provision. At December 31, 2017, the Company had $2,754 of gross unrecognized tax benefits, none of which, if recognized, would impact the Company's tax rate or tax provision.

        A reconciliation of gross unrecognized tax benefit is as follows:

        The Company accounted for uncertain tax positions using a more likely than not threshold for recognizing and resolving uncertain tax positions. The evaluation of uncertain tax positions is based on factors that include, but are not limited to, changes in tax law, the measurement of tax positions taken or expected to be taken in tax returns, the effective settlement of matters subject to audit, new audit activity and changes in facts or circumstances related to a tax position. The Company evaluates uncertain tax

F-58

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

17. Income Taxes (Continued)

positions on an annual basis and adjusts the level of the liability to reflect any subsequent changes in the relevant facts surrounding the uncertain positions. The Company accounts for interest and penalties related to uncertain tax positions as part of its provision for income taxes. For the years ended December 31, 2015, 2016 and 2017, there were no accrued interest or penalties in the consolidated statements of operations and comprehensive loss. The Company does not anticipate any significant changes in the next twelve months associated with its liability for unrecognized tax benefits.

        The Company is subject to taxation in the United States as well as multiple foreign jurisdictions. At December 31, 2017, the Company is generally no longer subject to examination by taxing authorities in the United States for years prior to 2014. However, net operating loss carryforwards in the United States may be subject to adjustments by taxing authorities in future years in which they are utilized. The Company's foreign subsidiaries remain open to examination by taxing authorities in each such country from 2015 onward.

        The Company's significant foreign subsidiaries have incurred losses since inception, and the Company had immaterial undistributed earnings as of December 31, 2017.

18. Net Loss per Share and Unaudited Pro Forma Net Loss per Share

Net Loss per Share

        Basic and diluted net loss per share attributable to common stockholders was calculated as follows:

        The Company's potential dilutive securities, which include stock options, redeemable convertible and convertible preferred stock, and warrants to purchase common stock and preferred stock, have been excluded from the computation of diluted net loss per share as the effect would be to reduce the net loss per share. Therefore, the weighted-average number of common shares outstanding used to calculate both basic and diluted net loss per share attributable to common stockholders is the same. The Company excluded the following potential common shares, presented based on amounts outstanding at each period

F-59

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

18. Net Loss per Share and Unaudited Pro Forma Net Loss per Share (Continued)

end, from the computation of diluted net loss per share attributable to common stockholders for the periods indicated because including them would have had an anti-dilutive effect:

        The table above excludes shares of common stock issuable upon the conversion of Series A preferred stock and upon the exercise of options to purchase shares of Series A preferred stock as such shares are only convertible into common stock upon the closing of a qualified IPO (see Note 10). The table also excludes shares of common stock issuable upon the exercise of the Company's liability-classified common stock warrant as the warrant is only exercisable upon the closing of an IPO (see Note 12).

Unaudited Pro Forma Net Loss per Share

        Unaudited pro forma basic and diluted net loss per share attributable to common stockholders for the year ended December 31, 2017 has been prepared to give effect to the following events as if the proposed IPO had occurred on the later of January 1, 2017 or the issuance date of the redeemable convertible or convertible preferred stock: (i) the automatic conversion of all outstanding shares of redeemable convertible and convertible preferred stock into 45,849,708 shares of common stock; (ii) the outstanding warrants to purchase preferred stock becoming warrants to purchase 167,500 shares of common stock and (iii) the assumed exercise of an outstanding warrant to purchase 468,587 shares of common stock, which will become exercisable upon the closing of an IPO at an exercise price of $0.002 per share (see Note 12).

F-60

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

18. Net Loss per Share and Unaudited Pro Forma Net Loss per Share (Continued)

        Unaudited pro forma basic and diluted net loss per share attributable to common stockholders was calculated as follows:

19. Related Party Transactions

Service Agreements with Red Canary, Kyrus Tech and Disruptive Solutions

        In August 2014, the Company entered into a partner alliance agreement and a managed security service provider addendum (the "MSSP agreement") with Red Canary, Inc. ("Red Canary") pursuant to which Red Canary agreed to market and resell the Company's products. In addition, in June 2015, the Company entered into a technical services agreement with Red Canary pursuant to which Red Canary provides managed threat detection services. One of the Company's executive officers is a member of the board of directors and a stockholder of Kyrus Holdings, Inc., an entity that controls Legion Capital, LLC, a stockholder of the Company that controls Red Canary. For the years ended December 31, 2015, 2016 and 2017, the Company recognized revenue of $84, $314 and $808, respectively, in connection with the MSSP agreement. For the year ended December 31, 2015, the Company received invoices totaling $61 and recorded general and administrative expenses of $35 in connection with the technical services agreement. For the year ended December 31, 2016, the Company received invoices totaling $104 and recorded general and administrative expenses of $80 in connection with the technical services agreement. For the year ended December 31, 2017, the Company received invoices totaling $105 and recorded general and administrative expenses of $105 in connection with the technical services agreement. As of December 31, 2016 and 2017, amounts due from Red Canary totaled $112 and $183, respectively, and no amounts were due to Red Canary. During the years ended December 31, 2015, 2016 and 2017, amounts received by the Company from Red Canary totaled $75, $321 and $872, respectively. During the years ended December 31, 2015, 2016 and 2017, amounts paid by the Company to Red Canary totaled $61, $104 and $105, respectively.

F-61

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

19. Related Party Transactions (Continued)

        In September 2014, the Company entered into a technical services agreement with Kyrus Tech, Inc. ("Kyrus Tech") for consulting services. One of the Company's executive officers is a member of the board of directors and a stockholder of Kyrus Holdings, Inc., an entity that controls Legion Capital, LLC, a stockholder of the Company that controls Kyrus Tech. For the years ended December 31, 2015, 2016 and 2017, the Company recorded general and administrative expenses of $45, $103 and $1, respectively, and research and development expenses of $40, $0 and $0, respectively, in connection with this agreement. For the year ended December 31, 2017, the Company recorded sales and marketing expenses of $7. As of December 31, 2016 and 2017, amounts due to Kyrus Tech totaled $50 and $1, respectively. During the years ended December 31, 2015, 2016 and 2017, amounts paid by the Company to Kyrus Tech totaled $188, $53 and $58, respectively.

        In February 2016, the Company entered into a technical services agreement with Disruptive Solutions LLC ("Disruptive Solutions") pursuant to which Disruptive Solutions provides various managed threat detection services on some of the Company's computer systems. One of the Company's executive officers is a member of the board of directors and a stockholder of Kyrus Holdings, Inc., an entity that controls Legion Capital, LLC, a stockholder of the Company that controls Disruptive Solutions. The Company recorded general and administrative expenses of $31 and $29 cost of subscription, license and support of $40 and $0 in connection with this agreement for the years ended December 31, 2016 and 2017, respectively. As of December 31, 2016 and 2017, amounts due to Disruptive Solutions totaled $40 and $0, respectively. During the years ended December 31, 2016 and 2017, amounts paid by the Company to Disruptive Solutions totaled $31 and $68, respectively.

Subscription Agreement with Jive Software

        In March 2014, the Company entered into a subscription agreement with Jive Software, Inc. ("Jive Software") pursuant to which Jive Software provides cloud-based subscriptions for software products. A member of the Company's board of directors, who was appointed in December 2015, served as the Executive Chairman of Jive Software from 2014 to June 2017. For the year ended December 31, 2016, the Company received invoices totaling $391 and recorded general and administrative expenses of $139 and cost of subscription, license and support of $203 in connection with this agreement. For the year ended December 31, 2017, the Company received invoices totaling $386 and recorded general and administrative expenses of $172 and cost of subscription, license and support of $254 in connection with this agreement. During the years ended December 31, 2016 and 2017, amounts paid by the Company to Jive Software totaled $378 and $398, respectively. As of December 31, 2016 and 2017, amounts due to Jive Software totaled $13 and $0, respectively.

Objective Logistics and VisiTrend Acquisitions

        During the year ended December 31, 2015, the Company acquired substantially all of the assets of Objective Logistics and VisiTrend (see Notes 3 and 10). A principal stockholder of each acquired company was the Company's largest stockholder at the time of each acquisition. These acquisitions were approved by the Company's board of directors, with the board member representing the controlling stockholder of each acquired company abstaining from the vote to approve each transaction.

F-62

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

20. Subsequent Events

        The Company considers events or transactions that occur after the balance sheet date but prior to the issuance of the consolidated financial statements to provide additional evidence relative to certain estimates or to identify matters that require additional disclosure. For its consolidated financial statements as of December 31, 2017 and for the year then ended, the Company evaluated subsequent events through March 16, 2018, the date on which those financial statements were issued, and, with respect to the reverse stock split described below, through April 23, 2018.

Increase to Shares Reserved for Issuance under the 2012 Stock Option Plan

        In January 2018, the Company effected an increase in the number of shares of common stock reserved for issuance under the 2012 Stock Option Plan from 17,015,543 shares to 18,890,543 shares (see Note 13).

Grants of Stock Options and Restricted Stock Units

        In January 2018, the Company granted options to purchase an aggregate of 1,804,105 shares of common stock, at an exercise price of $7.46 per share, and options to purchase an aggregate of 195,312 shares of Series A preferred stock, at an exercise price of $3.60 per share, to employees as compensation for future services to the Company. The options vest over a term of four years.

        In January 2018, the Company granted restricted stock units that may be settled for an aggregate of 394,500 shares of common stock to employees and directors as compensation for future services to the Company. The restricted stock units vest over terms of one to four years from date of grant, subject to the closing of an initial public offering of the Company's common stock.

Reverse Stock Split

        On April 20, 2018, the Company effected a 1-for-2 reverse stock split of its issued and outstanding shares of common stock and a proportional adjustment to the existing conversion ratios of Company's Series B, Series C, Series D, Series E, Series E-1 and Series F preferred stock (see Note 10). Accordingly, all share and per share amounts for all periods presented in the accompanying consolidated financial statements and notes thereto have been adjusted retroactively, where applicable, to reflect this reverse stock split and adjustment of the preferred stock conversion ratios.

21. Subsequent Events (Unaudited)

Grants of Stock Options and Restricted Stock Units

        The aggregate grant-date fair value of the options and restricted stock units granted by the Company in January 2018 (see Note 20) was $9,541, which is expected to be recognized as stock-based compensation expense over a weighted-average period of 3.57 years.

Litigation

        On March 21, 2018, Finjan, Inc. ("Finjan") filed a complaint in the U.S. District Court for the Northern District of California alleging that the Company's products and services infringe at least four U.S. patents purportedly owned by Finjan, seeking, among other things, a judgment holding that the Company has infringed four asserted patents, a preliminary and permanent injunction preventing alleged

F-63

---

Table of Contents

CARBON BLACK, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Amounts in thousands, except share and per share amounts)

21. Subsequent Events (Unaudited) (Continued)

continued infringement of one of the asserted patents, past damages not less than a reasonable royalty, enhanced damages for alleged willful infringement, costs and reasonable attorneys' fees, and pre- and post-judgment interest. While the Company does not believe the complaint has merit, on April 6, 2018, the Company entered into a settlement agreement with Finjan, resolving all claims made pursuant to the complaint. In connection with the settlement agreement, the Company accrued a liability of $3,900, reflecting the aggregate amount of payments to be made to Finjan pursuant to the settlement, all of which will be paid in 2018.

2018 Stock Option and Incentive Plan

        On April 17, 2018, the Company's board of directors adopted, and on April 19, 2018, the Company's stockholders approved, the 2018 Stock Option and Incentive Plan (the "2018 Plan"), which will become effective on the date immediately preceding the effectiveness of the registration statement for the Company's initial public offering. The 2018 Plan provides for the grant of incentive stock options, nonqualified stock options, stock appreciation rights, restricted stock units, restricted stock awards, unrestricted stock awards and dividend equivalent rights. The number of shares initially reserved for issuance under the 2018 Plan is 6,075,051, plus the shares of common stock remaining available for issuance under the 2012 Plan, which will be automatically increased on January 1, 2019 and each January 1 thereafter by 5% of the number of shares of the Company's common stock outstanding on the immediately preceding December 31 or a lesser number of shares determined by the Company's board of directors or the compensation committee of the board of directors. The shares of common stock underlying any awards that are forfeited, canceled, held back upon exercise or settlement of an award to satisfy the exercise price or tax withholding, reacquired by the Company prior to vesting, satisfied without any issuance of stock, expire or are otherwise terminated by the Company under the 2018 Plan, the 2012 Plan and the Equity Incentive Plan will be added back to the shares of common stock available for issuance under the 2018 Plan.

2018 Employee Stock Purchase Plan

        On April 17, 2018, the Company's board of directors adopted, and on April 19, 2018, the Company's stockholders approved, the 2018 Employee Stock Purchase Plan (the "ESPP"), which will become effective on the date immediately preceding the effectiveness of the registration statement for the Company's initial public offering. A total of 1,735,729 shares of common stock were reserved for issuance under this plan. In addition, the number of shares of common stock that may be issued under the ESPP will be cumulatively increased on January 1, 2019 and each January 1 thereafter through January 1, 2028, by the lesser of (i) 1% of the number of shares of the Company's common stock outstanding on the immediately preceding December 31, (ii) 1,735,729 shares of common stock or (iii) such lesser number of shares as determined by the compensation committee of the board of directors.

F-64

---

Table of Contents

INDEPENDENT AUDITOR'S REPORT

Board of Directors
Confer Technologies, Inc.
Southborough, Massachusetts

Report on the Financial Statements

        We have audited the accompanying consolidated financial statements of Confer Technologies, Inc. (the Company), which comprise the consolidated balance sheets as of December 31, 2015 and 2014, and the related consolidated statements of operations, changes in stockholders' equity and cash flows for the years then ended and the related notes to the consolidated financial statements, (collectively, financial statements).

Management's Responsibility for the Financial Statements

        Management is responsible for the preparation and fair presentation of these financial statements in accordance with accounting principles generally accepted in the United States of America; this includes the design, implementation, and maintenance of internal control relevant to the preparation and fair presentation of financial statements that are free from material misstatement, whether due to fraud or error.

Auditor's Responsibility

        Our responsibility is to express an opinion on these financial statements based on our audits. We conducted our audits in accordance with auditing standards generally accepted in the United States of America. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether the financial statements are free from material misstatement.

        An audit involves performing procedures to obtain audit evidence about the amounts and disclosures in the financial statements. The procedures selected depend on the auditor's judgment, including the assessment of the risks of material misstatement of the financial statements, whether due to fraud or error. In making those risk assessments, the auditor considers internal control relevant to the entity's preparation and fair presentation of the financial statements in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of the entity's internal control. Accordingly, we express no such opinion. An audit also includes evaluating the appropriateness of accounting policies used and the reasonableness of significant accounting estimates made by management, as well as evaluating the overall presentation of the financial statements.

        We believe that the audit evidence we have obtained is sufficient and appropriate to provide a basis for our audit opinion.

Opinion

        In our opinion, the financial statements referred to above present fairly, in all material respects, the financial position of Confer Technologies, Inc. as of December 31, 2015 and 2014, and the results of its operations and its cash flows for the years then ended in accordance with accounting principles generally accepted in the United States of America.

/s/ RSM US LLP

Boston, Massachusetts
July 13, 2016

F-65

---

Table of Contents

CONFER TECHNOLOGIES, INC.

CONSOLIDATED BALANCE SHEETS

   

See notes to consolidated financial statements.

F-66

---

Table of Contents

CONFER TECHNOLOGIES, INC.

CONSOLIDATED STATEMENTS OF OPERATIONS

   

See notes to consolidated financial statements.

F-67

---

Table of Contents

CONFER TECHNOLOGIES, INC.

CONSOLIDATED STATEMENTS OF STOCKHOLDERS' EQUITY

   

See notes to consolidated financial statements.

F-68

---

Table of Contents

CONFER TECHNOLOGIES, INC.

CONSOLIDATED STATEMENTS OF CASH FLOWS

   

See notes to consolidated financial statements.

F-69

---

Table of Contents

CONFER TECHNOLOGIES, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS

(Information as of March 31, 2016 and for the three
months ended March 31, 2015 and 2016 is unaudited)

Note 1. Nature of Business

        Overview:    Confer Technologies, Inc. (the "Company") is a provider of next-generation endpoint detection and response through its cloud-based converged endpoint security platform, an adaptive defense that integrates prevention, detection and incident response for endpoints, servers and cloud workloads. The patented technology disrupts cyber-attacks while collecting a rich history of endpoint behavior to support post-incident response and remediation. The Company's software-as-a-service offering is sold primarily to enterprise customers which enables them to proactively detect, prevent and investigate attacks on the endpoint with a simple-to-use, integrated solution.

        The Company was incorporated under the laws of the state of Delaware in November 2011 as Scargo, Inc. and in December 2013 changed its name to Confer Technologies, Inc. The Company is headquartered in Southborough, Massachusetts and also maintains a sales office in Boston, Massachusetts. The Company has a wholly owned subsidiary in Malaysia, which was incorporated in October 2015 and commenced operations in January 2016. No intercompany transactions or operational activities were recorded on the accounts of the wholly owned subsidiary through December 2015. All intercompany transactions as of March 31, 2016 have been eliminated in consolidation.

        The Company is subject to a number of risks similar to other companies in the high technology industry, including, but not limited to, protection of proprietary technology, dependence on key personnel, lack of marketing and sales history and the need for additional funding.

        On May 31, 2016, the Company entered into an Agreement and Plan of Merger and Reorganization in which the Company was acquired by Carbon Black, Inc. (Note 14).

Note 2. Summary of Significant Accounting Policies

        Basis of presentation:    The accompanying financial statements have been prepared in accordance with accounting standards set by the Financial Accounting Standards Board ("FASB"). The FASB sets generally accepted accounting principles ("GAAP") that the Company follows to ensure its financial condition, results of operations, and cash flows are consistently reported. References to GAAP issued by FASB in these notes to the financial statements are to the FASB Accounting Standards Codification ("ASC").

        The accompanying balance sheet as of March 31, 2016, statements of operations, cash flows and statement of changes in stockholders' equity for the three months ended March 31, 2015 and 2016, are unaudited. The interim unaudited consolidated financial statements have been prepared on the same basis as the annual audited consolidated financial statements and, in the opinion of management, reflect all adjustments, which include normal recurring adjustments, necessary for the fair presentation of the Company's financial position as of March 31, 2016, and the results of its operations and its cash flows for the three months ended March 31, 2015 and 2016. The financial data and other information disclosed in these notes related to the three months ended March 31, 2015 and 2016 and as of March 31, 2016, are unaudited. The results for the three months ended March 31, 2016, are not indicative of results to be expected for any other interim periods or any future year or period.

        Fiscal year:    The Company's fiscal year ends on December 31^st of each calendar year.

        Use of estimates:    The preparation of financial statements in conformity with GAAP requires management to make estimates and assumptions that affect the reported amounts of assets and liabilities

F-70

---

Table of Contents

CONFER TECHNOLOGIES, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Information as of March 31, 2016 and for the three
months ended March 31, 2015 and 2016 is unaudited)

Note 2. Summary of Significant Accounting Policies (Continued)

and disclosure of contingent assets and liabilities at the date of the financial statements and the reported amounts of revenue, cost of revenue, and expenses during the reporting period. Significant estimates and assumptions reflected in these consolidated financial statements include, but are not limited to, revenue recognition, the valuation of stock based awards, the valuation allowances for deferred tax assets, the valuation of common stock, and the useful lives of capitalized assets. Estimates are periodically reviewed in light of changes in circumstances. Actual results could differ from those estimates.

        Cash equivalents:    The Company considers all highly liquid investments maturing within 90 days from the date of purchase to be the equivalent of cash for the purpose of balance sheet and statement of cash flows presentation. Cash equivalents, consisting of money market accounts, are stated at fair value (see Note 3).

        Fair value measurements:    Certain assets and liabilities are carried at fair value under GAAP. Fair value is defined as the exchange price that would be received for an asset or paid to transfer a liability (an exit price) in the principal or most advantageous market for the asset or liability in an orderly transaction between market participants on the measurement date. Valuation techniques used to measure fair value must maximize the use of observable inputs and minimize the use of unobservable inputs. Financial assets and liabilities carried at fair value are to be classified and disclosed in one of the following three levels of the fair value hierarchy, of which the first two are considered observable and the last is considered unobservable:

        The Company's cash equivalents are carried at fair value according to the fair value hierarchy described above. The carrying values of the Company's accounts receivable, accounts payable and accrued expenses approximate their fair value due to their short-term nature.

        Accounts receivable:    Accounts receivable represent trade receivables from customers when the Company has invoiced for software subscriptions and/or services and it has not yet received payment.

        Concentrations of credit risk and significant customers:    Financial instruments that potentially expose the Company to concentrations of credit risk include cash, cash equivalents and accounts receivable. The Company maintains substantially all of its cash and cash equivalents with a single financial institution that management believes is of high credit quality. To manage credit risk related to accounts receivable, the Company evaluates the creditworthiness of its customers and maintains allowances, to the extent necessary, for potential credit losses based upon the aging of its accounts receivable balances and known collection issues. The Company has not experienced any significant credit losses to date and no

F-71

---

Table of Contents

CONFER TECHNOLOGIES, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Information as of March 31, 2016 and for the three
months ended March 31, 2015 and 2016 is unaudited)

Note 2. Summary of Significant Accounting Policies (Continued)

allowance for doubtful accounts has been recorded as of December 31, 2014 and 2015 and as of March 31, 2016.

        For the year ended December 31, 2014, two customers comprised 74% and 17% of the Company's revenue, respectively. As of December 31, 2015 and March 31, 2016, one customer comprised 93% and 86% of accounts receivable, respectively. For the year ended December 31, 2015, three customers comprised 17%, 13% and 10% of the Company's revenue, respectively. For the three months ended March 31, 2015, three customers comprised 30%, 21% and 11% of the Company's revenue, respectively. For the three months ended March 31, 2016, two customers comprised 44% and 16% of the Company's revenue, respectively.

        Property and equipment:    Property and equipment are recorded at cost and depreciated using the straight-line method over the estimated useful lives of the related assets, which range from two to five years. Leasehold improvements are amortized over the lesser of the term of the lease or the useful life of the asset. When assets are retired or disposed of, the assets and related accumulated depreciation are eliminated from the accounts and any resulting gain or loss is included in the determination of net income or loss. To date, there have been no disposals or retirements of capitalized assets. Maintenance and repair expenditures are charged to expense as incurred.

        Research and development and internal-use software:    Research and development costs are expensed as incurred, except for certain costs which are capitalized in connection with the development of the Company's internal-use software related to its converged endpoint security platform. The Company capitalizes certain costs incurred to develop significant functionality for this software as well as certain upgrades and enhancements that are expected to result in increased functionality. Costs incurred in the preliminary stages of development are expensed as incurred. Once an application has reached the development stage, internal and external costs, if direct and incremental, are capitalized until the software is substantially complete and ready for its intended use. Capitalization ceases upon completion of all substantial testing performed to ensure the product is ready for its intended use. Maintenance and training costs are expensed as incurred. Capitalized internal-use software costs are amortized on a straight-line basis over an estimated useful life of two years. Amortization expense for internal-use software is included in cost of revenue in the consolidated statements of operations.

        Impairment of long-lived assets:    Long-lived assets include property and equipment and capitalized internal-use software development costs. The Company evaluates long-lived assets for impairment whenever events or changes in circumstances indicate the carrying value of an asset or asset group may not be recoverable. If such indicators are present, the Company determines whether the aggregate of the estimated undiscounted future cash flows attributable to such assets is less than their carrying amount, and if so, the Company recognizes an impairment loss based on the excess of the carrying amount of the assets over their fair value. To date, no such impairment has occurred.

        Advertising costs:    Advertising costs are expensed as incurred and are included in sales and marketing expense in the consolidated statements of operations. During the years ended December 31, 2014 and 2015, advertising costs were $16,139 and $47,120, respectively. During the three months ended March 31, 2015 and 2016, advertising costs were $1,620 and $21,034, respectively.

F-72

---

Table of Contents

CONFER TECHNOLOGIES, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Information as of March 31, 2016 and for the three
months ended March 31, 2015 and 2016 is unaudited)

Note 2. Summary of Significant Accounting Policies (Continued)

        Revenue recognition:    The Company generates revenue from subscription sales of its advanced threat detection and incident response software (collectively "subscription services"), paid trials and, to a much lesser extent, related professional services including deployment, consulting, and training services (collectively, "professional services"). Subscription services include access to the Company's cloud-based user interface and analytics platform and endpoint protection for a designated number of users or devices deployed through a downloadable sensor, as well as related support.

        The Company's hosting arrangements do not provide the customer the right to take possession of the software and it is not feasible for customers to run the software without further utilization of the hosting services offered by the Company. Accordingly, arrangement are outside the scope of revenue recognition guidance under ASC Topic 985-605 Software Revenue Recognition and the entire arrangement is accounted for as a service contract in accordance with the provisions of the multiple-element arrangements guidance in ASC 605-25, Revenue Recognition Multi Element Arrangements. The Company recognizes revenue from the sale of subscription services ratably over the subscription term, provided that persuasive evidence of an arrangement exists, delivery to the customer has occurred, the fee is fixed or determinable, and collectability is reasonably assured. The Company does not recognize revenue in excess of the amounts which it has the right to invoice in an annual subscription year. Subscription terms are generally one to three years, and payment is generally due in advance of the subscription term, and for some multi-year subscriptions, annually in advance.

        Revenues from paid trials are recognized at the conclusion of the trial, provided that persuasive evidence of an arrangement exists, delivery to customers has occurred, the fee is fixed or determinable, and collectability is reasonably assured. Trial period terms for paid trials are generally less than one year and payment is due in advance of the trial term.

        In some instances, revenue is generated under sales agreements with multiple elements, comprised of subscription services and related professional services. The Company evaluates each element in a multiple-element arrangement to determine whether it represents a separate unit of accounting. An element constitutes a separate unit of accounting when the delivered item has standalone value and delivery of the undelivered element is probable and within the Company's control. Subscription services have standalone value because they are routinely sold separately by the Company. The Company has determined that certain professional services lack standalone value because they are not sold on a standalone basis and can only be provided by the Company in conjunction with the sale of its subscription services; however, certain professional services which can be provided by other vendors have standalone value. As a result, the consideration allocated to both the subscription services and the professional services without standalone value is recognized ratably on a straight-line basis over the subscription term upon completion of the professional services and once a customer's subscription period has commenced. There were no such arrangements in 2014 or 2015 or in the three months ended March 31, 2016. Consideration allocated to those professional services determined to have standalone value is recognized as the services are performed.

        Sales taxes collected from customers and remitted to government authorities are excluded from revenue. Deferred revenue primarily consists of the unearned portion of billed subscription services for which the subscription period has commenced, paid trials and professional services. Deferred revenue not expected to be recognized within the next twelve months is reported as long-term deferred revenue.

F-73

---

Table of Contents

CONFER TECHNOLOGIES, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Information as of March 31, 2016 and for the three
months ended March 31, 2015 and 2016 is unaudited)

Note 2. Summary of Significant Accounting Policies (Continued)

Amounts that have not been invoiced for certain multi-year contracts are not reflected in the Company's consolidated financial statements.

        Deferred commissions:    The Company capitalizes commission costs that are incremental and directly related to the acquisition of customer agreements. Commissions are earned by the Company's sales force upon the receipt of customer orders for new arrangements or renewals and are paid in full upon the receipt of customer payments. Commission costs are capitalized when earned and are amortized as expense over the same period that the revenue is recognized for the related non-cancelable customer agreement in proportion to the recognition of the revenue. Commission costs capitalized as deferred commissions as of December 31, 2014 and 2015 were $39,681 and $442,468, respectively, and as of March 31, 2016 was $411,580, and are included in prepaid expenses and other current assets in the consolidated balance sheets. Amortization of deferred commissions during the years ended December 31, 2014 and 2015 totaled $6,485 and $85,204, respectively, and during the three months ended March 31, 2015 and 2016 totaled $9,852 and $109,218, respectively, and is included in sales and marketing expense in the consolidated statements of operations.

        Income taxes:    Deferred tax assets and liabilities are recognized based on temporary differences between the financial reporting and income tax bases of assets and liabilities using rates anticipated to be in effect when such temporary differences reverse. A valuation allowance against deferred tax assets is recorded, based upon the available evidence, if it is more likely than not that some or all of the deferred tax assets will not be realized.

        The Company assesses its income tax positions and records tax benefits based upon management's evaluation of the facts, circumstances, and information available at the reporting date. For those tax positions where it is more likely than not that a tax benefit will be sustained, the Company records the largest amount of tax benefit with a greater than 50 percent likelihood of being realized upon ultimate settlement with a taxing authority having full knowledge of all relevant information. For those income tax positions for which it is not more likely than not that a tax benefit will be sustained, no tax benefit is recognized in the financial statements. The unrecognized tax benefits are currently presented as a reduction to the deferred tax assets in the financial statements, unless the uncertainty is expected to be resolved within one year. Potential interest and penalties associated with such uncertain tax positions are recorded as a component of income tax expense.

        To date, the Company has yet to recognize any tax benefits and has provided a full valuation allowance against its deferred tax assets.

        The Company has early adopted the provisions within Accounting Standards Update ("ASU") 2015-17, Balance Sheet Classification of Deferred Taxes ("ASU 2015-17") for all periods presented. This ASU requires entities to present deferred tax assets and deferred tax liabilities as noncurrent in a classified balance sheet. As a result of a full valuation allowance, the adoption had no effect on the accompanying consolidated balance sheets.

        Foreign currency translation:    The functional currency of the Company's subsidiary in Malaysia is the United States dollar. The assets and liabilities of the Company's subsidiary are translated at period-end rates of exchange, and the consolidated statement of operations accounts are translated at weighted-

F-74

---

Table of Contents

CONFER TECHNOLOGIES, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Information as of March 31, 2016 and for the three
months ended March 31, 2015 and 2016 is unaudited)

Note 2. Summary of Significant Accounting Policies (Continued)

average rates of exchange for the period. Foreign currency transaction gains and losses are included in gain or loss on foreign currency transactions in the period in which the transaction occurs and were immaterial during the three months ended March 31, 2016.

        Stock-based compensation:    The Company measures all stock options granted to employees and directors based on the fair value on the date of the grant and recognizes compensation expense of those awards, net of estimated forfeitures, over the requisite service period, which is generally the vesting period of the respective award. Generally, the Company issues stock options with only service based vesting conditions and records the expense for these awards using the straight-line method. The Company measures stock-based awards granted to consultants and non-employees based on the fair value of the award on the date on which the related service is complete. Compensation expense is recognized over the period during which services are rendered by such consultants and non-employees until completed. At the end of each financial reporting period prior to completion of the service, the fair value of these awards is remeasured using the then-current fair value of the Company's common stock and updated assumption inputs in the Black-Scholes option-pricing model.

        The fair value of each stock option grant is estimated on the date of grant using the Black-Scholes option pricing model, which uses volatility, expected term, risk-free interest rate and dividend yield as input assumptions. As the Company is a private company and lacks company-specific historical and implied volatility information for its stock, it estimates its expected stock volatility based on the historical volatility of a publicly traded set of peer. The expected term of the Company's stock options has been determined utilizing the "simplified" method for awards that qualify as "plain-vanilla" options. The expected term of stock options granted to non-employees is equal to the contractual term of the option award. The risk-free interest rate is determined by reference to the U.S. Treasury yield curve in effect at the time of grant of the award for time periods approximately equal to the expected term of the award. Expected dividend yield is based on the fact that the Company has never paid cash dividends and does not expect to pay any cash dividends in the foreseeable future.

        Recently issued accounting pronouncements:    In May 2014, the Financial Accounting Standards Board ("FASB") issued ASU No. 2014-09, Revenue from Contracts with Customers. The comprehensive new standard will supersede existing revenue recognition guidance and require revenue to be recognized when promised goods or services are transferred to customers in amounts that reflect the consideration to which the Company expects to be entitled in exchange for those goods or services. The guidance will also require that certain contract costs incurred to obtain or fulfill a contract, such as sales commissions, be capitalized as an asset and amortized as revenue is recognized. Adoption of the new rules could affect the timing of both revenue recognition and recognition of contract costs for certain transactions. The guidance permits two implementation approaches, one requiring retrospective application of the new standard with restatement of prior years and one requiring prospective application of the new standard with disclosure of results under old standards. In August 2015, the FASB issued ASU 2015-14, Revenue from Contracts with Customers (Topic 606): Deferral of the Effective Date, which delays the effective date of ASU 2014-09. For the Company, the new standard will be effective January 1, 2019, with early adoption permitted on January 1, 2017. The Company is currently evaluating the impact of adoption and the implementation approach to be used.

F-75

---

Table of Contents

CONFER TECHNOLOGIES, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Information as of March 31, 2016 and for the three
months ended March 31, 2015 and 2016 is unaudited)

Note 2. Summary of Significant Accounting Policies (Continued)

        In August 2014, the FASB issued ASU No. 2014-15, Disclosure of Uncertainties about an Entity's Ability to Continue as a Going Concern. The amendments in this update will explicitly require a company's management to assess an entity's ability to continue as a going concern, and to provide related footnote disclosures in certain circumstances. The new standard will be effective in the first annual period ending after December 15, 2016. Early application is permitted. The Company is currently evaluating the impact of adoption of this standard on its consolidated financial statements.

        In April 2015, the FASB issued ASU No. 2015-05, Intangibles—Goodwill and Other Internal-Use Software (Subtopic 350-40): Customer's Accounting for Fees Paid in a Cloud Computing Arrangement. This ASU provides guidance about whether a cloud computing arrangement includes a software license and how to account for the license under each scenario. The guidance is effective for annual periods beginning after December 15, 2015 and interim periods within those annual periods. A reporting entity may apply the guidance prospectively to all arrangements entered into or materially modified after the effective date, or retrospectively to all prior periods presented in the financial statements. Early adoption is permitted. The Company does not believe that the adoption of this standard will have a material impact on its consolidated financial statements.

        In February 2016, the FASB issued ASU 2016-02, Leases (Topic 842). The guidance in this ASU supersedes the leasing guidance in Topic 840, Leases. Under the new guidance, lessees are required to recognize lease assets and lease liabilities on the balance sheet for all leases with terms longer than 12 months. Leases will be classified as either finance or operating, with classification affecting the pattern of expense recognition in the income statement. This ASU is effective for fiscal years beginning after December 15, 2018, including interim periods within those fiscal years. The Company is currently evaluating the impact of adoption of the new standard on its consolidated financial statements.

Note 3. Fair Value Measurements

        The following tables present information about the Company's financial assets measured at fair value on a recurring basis and indicate the level of the fair value hierarchy utilized to determine such fair values:

 

F-76

---

Table of Contents

CONFER TECHNOLOGIES, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Information as of March 31, 2016 and for the three
months ended March 31, 2015 and 2016 is unaudited)

Note 3. Fair Value Measurements (Continued)

        As of December 31, 2014, December 31, 2015, and March 31, 2016, the Company's cash equivalents, which were invested in money market funds, were valued based on Level 1 inputs. During the years ended December 31, 2014 and 2015, and during the three months ended March 31, 2016, there were no transfers between Level 1, Level 2, and Level 3.

Note 4. Property and Equipment

        Property and equipment consisted of the following:

        Depreciation expense for the years ended December 31, 2014 and 2015 was $0 and $2,762, respectively, and $0 and $8,590 for the three months ended March 31, 2015 and 2016, respectively.

Note 5. Software Development Costs

        Software development costs consisted of the following:

        The Company capitalized software development costs totaling $238,462 during the year ended December 31, 2013. Amortization expense associated with capitalized internal-use software was $119,231 for each of the years ended December 31, 2014 and 2015 and $29,808 and $0 for the three months ended March 31, 2015 and 2016, respectively. During the three months ended March 31, 2016, the Company capitalized software development costs totaling $56,800 for projects that have not yet been placed in service.

F-77

---

Table of Contents

CONFER TECHNOLOGIES, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Information as of March 31, 2016 and for the three
months ended March 31, 2015 and 2016 is unaudited)

Note 6. Accrued Expenses and Other Liabilities

        Accrued expenses and other liabilities consisted of the following:

Note 7. Debt

        In August 2015, the Company entered into several promissory bridge notes (collectively, the 2015 Notes) with existing investors for a total principal amount of $1,600,000. The 2015 notes accrued interest at 5% which may be paid in cash or converted pursuant to settlement provisions (2) and (3) discussed below, at the Company's option. The 2015 Notes had the following settlement provisions: (1) due on demand on or after February 7, 2016; (2) if at any time prior to repayment the Company closed an equity financing yielding at least $5,000,000 in gross proceeds, the 2015 Notes were automatically convertible into shares sold in such financing at 80% of the per-share purchase price; (3) if less than $5,000,000 in gross proceeds were received, the conversion was optional upon a majority vote of the note holders; and, (4) upon a corporate transaction (as defined in the 2015 Note agreement) prior to conversion or full payment of the 2015 Notes, 150% of the outstanding principal and unpaid accrued interest was due and payable. The Company evaluated the settlement provisions of the 2015 Notes and concluded that the two conversion features should be accounted for as in substance redemption features which resulted in accretion of the 2015 Notes being to redemption value. As a result, the beneficial conversion feature guidance is not applicable. The Company also assessed the embedded 150% repayment feature under ASC 815-15, Derivatives and Hedging—Embedded Derivatives, and concluded that this was an embedded derivative which was required to be bifurcated from the 2015 Notes and accounted for separately. Given the Company's assessment that a corporate transaction prior to conversion or payment of the 2015 Notes was unlikely to occur, this derivative resulted in a de minimis fair value.

        In October 2015, in connection with the authorization and sale Series B convertible preferred stock (Series B Preferred Stock) (Note 8), the principal amount of the 2015 Notes was automatically converted into Series B Preferred Stock and the holders of the 2015 Notes waived the right to the 20% discounted purchase price. During 2015, the Company recognized accrued interest of $15,342 and additional interest expense of $177,676 for accretion of the notes to redemption value from issuance through the conversion date.

        Upon conversion, a $177,676 gain on extinguishment of the 2015 Notes was recognized in additional paid-in capital as the noteholders were shareholders of the Company. The accrued interest of $15,342 was paid in cash to the holders in 2015.

F-78

---

Table of Contents

CONFER TECHNOLOGIES, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Information as of March 31, 2016 and for the three
months ended March 31, 2015 and 2016 is unaudited)

Note 8. Preferred Stock

        In October 2015, the Company issued and sold 6,029,865 shares of Series B Preferred Stock at $2.8193 per share for aggregate proceeds of $16,911,983, including the conversion of $1,600,000 in convertible notes (Note 7), net of issuance costs of $88,020.

        In June 2013, the Company issued and sold 7,176,370 shares of Series A Preferred Stock at $1.11477 per share for aggregate proceeds of $8,000,002, including the conversion of $1,000,000 in convertible notes, net of issuance costs of $55,758.

        The holders of Series A convertible preferred stock (Series A Preferred Stock) and Series B Preferred Stock (collectively, the Preferred Stock) have the following rights and preferences:

        Voting rights:    The holders of Preferred Stock are entitled to vote, together with the holders of common stock, on all matters submitted to stockholders for a vote. Holders of all Preferred Stock have the right to vote the number shares equal to the number of shares of common stock into which such Preferred Stock could convert on the record date for determination of stockholders entitled to vote. So long as at least 300,000 shares of Series A Preferred Stock are outstanding, the holders of Series A Preferred Stock are entitled to elect two directors of the Company. So long as at least 300,000 shares of Series B Preferred Stock are outstanding, the holders of Series B Preferred Stock are entitled to elect one director of the Company.

        Dividends:    The holders of Preferred Stock are entitled to receive any dividends when, as and if declared by the board of directors. These dividends shall be in preference of the holders of common stock. As of December 31, 2015 and 2014, no dividends had been declared by the Company's board of directors.

        Liquidation preference:    In the event of any Liquidation Event (as defined below), voluntary or involuntary, the holders of Preferred Stock, on a pari passu basis, are entitled to receive, prior and in preference to any distribution to the holders of common stock, an amount equal to the greater of the original issue price of $1.11477 and $2.8193 per share of each series of Series A and B Preferred Stock, respectively, plus any dividends declared but unpaid thereon or the amount that would have been payable had the shares been converted to common stock immediately prior to the Liquidation Event. In the event that proceeds are not sufficient to permit payment in full to these holders, the proceeds will be ratably distributed among these holders of Preferred Stock in proportion to the full preferential amount each such holder is otherwise entitled to receive.

        After payments have been made in full to the holders of Preferred Stock, the remaining assets of the Company available for distribution shall be distributed among the holders of common stock, on a pro-rata basis, based on the number of shares held by each holder.

        Unless the holders of at least 50% of the then outstanding shares of each series of Preferred Stock, each voting as separate class, elect otherwise, a Liquidation Event shall include (i) a merger or consolidation (other than one in which stockholders of the Company own a majority by voting power of the outstanding shares of the surviving or acquiring Company), (ii) a liquidation, dissolution or winding up of the company, (iii) a grant of exclusive, irrevocable license to substantially all of the Company's intellectual property or (iv) a sale, lease, transfer, exclusive license or other disposition of all or substantially all of the assets of the Company. The holders of Preferred Stock do not have the unilateral right to approve a

F-79

---

Table of Contents

CONFER TECHNOLOGIES, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Information as of March 31, 2016 and for the three
months ended March 31, 2015 and 2016 is unaudited)

Note 8. Preferred Stock (Continued)

Liquidation Event which would result in the redemption of their shares. In any Liquidation Event, if proceeds received by the Company is other than cash, their value will be deemed their fair market value.

        Redemption:    The Preferred Stock is not redeemable at the option of the holder thereof.

        Conversion:    Each share of Preferred Stock is convertible into common stock at the option of the holder at any time after the date of issuance, at a rate determined by dividing the Original Issue Price for per share of each series of Preferred Stock by the applicable Conversion Price (the conversion rate for each series of Preferred Stock is referred to herein as the Conversion Rate). The Conversion Price for each series of Preferred Stock, subject to adjustment for certain dilutive issuances, splits and combinations, is (i) $1.11477 for Series A Preferred Stock and (ii) $2.8193 for Series B Preferred Stock.

        Each share of Preferred Stock shall automatically convert into shares of Common Stock, at the applicable Conversion Rate for each series of Preferred Stock then in effect, upon (i) a qualified public offering with net proceeds of at least $20,000,000 and a price of at least $5.57385 per share, subject to appropriate adjustment for any stock dividend, stock split, stock dividends, combinations, subdivisions, recapitalizations or the like or (ii) the date, or the occurrence of an event, specified by vote or written consent or agreement of the Requisite Preferred Holders, defined as at least 50% of the then outstanding shares of Preferred Stock voting together as a single class and on an as-converted basis.

        Protective provisions:    So long as at least 20% of the Preferred Stock originally issued remains outstanding (as adjusted for stock splits, stock dividends, combinations, subdivisions, recapitalizations or the like) the Company shall not, without prior approval by the requisite preferred holders, (i) consummate a Liquidation Event, (ii) alter the Amended and Restated Certification of Incorporation or Bylaws of the Company, (iii) alter the total number of authorized shares of Preferred Stock or Common Stock, (iv) authorize or issue any equity security with senior preference over the Preferred Stock (v) redeem, purchase or otherwise acquire any shares of Preferred Stock or Common Stock unless pursuant to a right of first refusal (vi) declare or pay dividends, (vii) change the authorized number of directors of the Company, (viii) effect any material change to the nature of the Company (ix) create or hold stock in a subsidiary Company that is not wholly owned or sell stock in any subsidiary of the Company or (x) incur indebtedness exceeding $250,000 individually or in the aggregate.

        Reissuance:    Shares of any series of Preferred Stock that are redeemed or converted will be retired or canceled and cannot be reissued by the Company.

Note 9. Common Stock

        Each share of common stock entitles the holder to one vote on all matters submitted to a vote of all the Company's stockholders. Common stockholders are entitled to receive dividends, subject to the preferences of holders of any shares of Preferred Stock outstanding, when, as and if declared by the board of directors.

        As of December 31, 2014 and 2015 and March 31, 2016, the Company had reserved 9,313,967, 15,998,208 and 15,998,208 shares, respectively, of common stock for the conversion of the outstanding shares of Preferred Stock, the exercise of outstanding stock options and the number of shares remaining available for grant under the Company's 2013 Stock Plan.

F-80

---

Table of Contents

CONFER TECHNOLOGIES, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Information as of March 31, 2016 and for the three
months ended March 31, 2015 and 2016 is unaudited)

Note 9. Common Stock (Continued)

        Restricted common stock:    In August 2012, the Company issued 4,725,494 shares of common stock at a fair value of $0.0125 per share to the founders of the Company (the Founders' Shares). The Founders' Shares were subject to a repurchase right held by the Company at the lower of the then fair market value or the original purchase price in the event the founders' employment is terminated either voluntarily or involuntarily; the original purchase price was equal to $.001 per share. The repurchase right of the Founders' Shares lapses as to 20% of the shares on the issuance date and the remaining 80% of the shares monthly thereafter over the next five years.

        As of December 31, 2014 and 2015 and March 31, 2016, there were 2,079,218, 1,323,138 and 1,012,179 shares outstanding subject to repurchase under these agreements, respectively. At December 31, 2014 and 2015 and March 31, 2016, the remaining vesting period for the Founders' Shares was 2.64, 1.64 and 1.42 years, respectively.

        The Company has recorded stock-based compensation expense based upon the fair value of the awards at grant date. Compensation expense related to the Founders' Shares was $8,931 in each of the years ended December 31, 2014 and 2015 and $2,233 in each of the three months ended March 31, 2015 and 2016.

        Early exercise of employee options:    Stock options granted under the Company's 2013 Stock Plan provide certain employee option holders the right to exercise unvested options for shares of restricted common stock. Shares of restricted common stock, in the amounts of 258,292, 305,469 and 253,390 at December 31, 2014 and 2015 and March 31, 2016, respectively, were subject to a repurchase right held by the Company at the lower of the then fair market value or the original issue price in the event the optionees' employment is terminated either voluntarily or involuntarily. For early exercises of employee options, this repurchase right generally lapses as to 1/5^th of the shares subject to the option on the first anniversary of the vesting start date and as to 1/60^th of the shares monthly thereafter.

        These repurchase terms are considered to be a forfeiture provision and do not result in variable accounting or liability classification. The restricted shares issued upon early exercise of stock options are legally issued and outstanding. The Company includes cash received from employees for the exercise of unvested options as a refundable deposit shown within accrued expenses and other liabilities on its consolidated balance sheets (see Note 5). The Company continues to recognize compensation expense associated with early exercised stock options over the requisite service period, which is included in stock -based compensation in the consolidated statement of operations.

Note 10. Stock-Based Awards

        2013 stock plan:    In June 2013 the Company's Board of Directors approved and the Company adopted the 2013 Stock Plan ("the Plan"). The Plan provides both for the direct award or sale of common stock and for the grant of options to purchase common stock including incentive stock options to the Company's employees and non-statutory stock options to the Company's employees, directors and consultants. All awards under the Plan as of March 31, 2016 have consisted of incentive stock options and non-statutory stock options.

F-81

---

Table of Contents

CONFER TECHNOLOGIES, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Information as of March 31, 2016 and for the three
months ended March 31, 2015 and 2016 is unaudited)

Note 10. Stock-Based Awards (Continued)

        As of December 31, 2015, the Company may issue up to 3,350,148 shares of common stock pursuant to stock options and stock awards under the Plan. As of December 31, 2015, 1,638,432 shares of common stock remain available for grant under the Plan.

        As of March 31, 2016, the Company may issue up to 3,350,148 shares of common stock pursuant to stock options and stock awards under the Plan. As of March 31, 2016, 1,452,061 shares of common stock remain available for grant under the Plan.

        Under the Plan, stock options may be granted at an exercise price not less than the fair market value of the Company's common stock on the date of grant. All employee stock options currently outstanding under the Plan vest over a period of five years. Employee options are immediately exercisable upon grant with unvested shares subject to repurchase at the exercise price upon termination of employment (see Note 9).

        The Company uses the Black-Scholes option-pricing model to estimate the fair value of stock options awards and determine the related compensation expense. The fair value of the stock options granted was calculated using the following weighted-average assumptions:

F-82

---

Table of Contents

CONFER TECHNOLOGIES, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Information as of March 31, 2016 and for the three
months ended March 31, 2015 and 2016 is unaudited)

Note 10. Stock-Based Awards (Continued)

        The following table summarizes the Company's common stock option activity since December 31, 2013 under the Plan:

        The following table summarizes information relating to stock options granted and exercised:

        The aggregate intrinsic value represents the difference between the fair value at exercise and the exercise price paid by the employee. The total number of unvested exercised shares subject to repurchase at December 31, 2015 was 305,469 at an aggregate repurchase amount of $59,648. The total number of unvested exercised shares subject to repurchase at March 31, 2016 was 253,390 at an aggregate repurchase amount of $58,436.

F-83

---

Table of Contents

CONFER TECHNOLOGIES, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Information as of March 31, 2016 and for the three
months ended March 31, 2015 and 2016 is unaudited)

Note 10. Stock-Based Awards (Continued)

        The following table presents stock-based compensation expense related to stock options and restricted stock included in the Company's statements of operations for the periods presented:

        As of December 31, 2015 and March 31, 2016, total compensation cost not yet recognized related to stock option awards was $1,110,043 and $1,787,696, respectively, which is expected to be recognized over weighted-average periods of 3.6 years and 3.5 years, respectively.

Note 11. Income Taxes

        The Company has historically incurred operating losses, and given the cumulative losses, the Company has recorded a full valuation allowance against its current and deferred tax benefit for all periods to date.

        The differences in total provision for income taxes that would result from applying the 35% federal statutory rate to loss before income taxes and the reported provision for income taxes are as follows:

        Components of the net deferred tax assets as of December 31, 2014 and 2015 are as follows:

        During the years ended December 31, 2014 and 2015, the valuation allowance increased by $1,461,056 and $2,244,518, respectively, due to the increase in deferred tax asset associated with the net operating loss, research and development credits, deferred revenue and the full valuation allowance against these assets.

F-84

---

Table of Contents

CONFER TECHNOLOGIES, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Information as of March 31, 2016 and for the three
months ended March 31, 2015 and 2016 is unaudited)

Note 11. Income Taxes (Continued)

        At December 31, 2015, the Company had federal and state net operating loss carryforwards of approximately $8,405,000 and $8,390,000, respectively. At December 31, 2015, the Company also had federal and state research and development tax credit carryforwards of approximately $449,000 and $144,000, respectively. The net operating loss carryforwards and tax credits expire at various dates through 2035.

        The Company files federal and state tax returns in jurisdictions with varying statutes of limitations. All tax years 2012 through 2015 remain subject to examination by federal and state tax authorities due to the Company's net operating loss carryforwards. The Company has not, as yet, conducted a study of its research and development credit carryforwards. This study may result in an adjustment to the Company's research and development credit carryforwards; however, until a study is completed and any adjustment is known, no amounts are being presented as an uncertain tax position. Additionally, the future utilization of the Company's net operating loss and research and development credit carryforwards may be subject to limitation in the event of a change in ownership as described in Internal Revenue Code Section 382. The Company has not performed an analysis to determine if they have experienced an ownership change.

Note 12. Employee Benefits

        The Company has established a 401(k) defined contribution plan that covers all U.S.-based employees of the Company. The plan allows employees to contribute gross salary through payroll deductions up to the legally mandated limit. The Company contributed $25,090 and $24,012 in matching contributions to its 401(k) Plan for the years ended December 31, 2014 and 2015, respectively. In January 2016, the Company amended the plan adoption agreement and matching contributions are no longer required; however, discretionary contributions may be made upon approval of the Board of Directors.

Note 13. Commitments

        Operating leases:    The Company has several operating leases for its office space that expire on various dates through 2021, including the lease for its corporate headquarters in Southborough, Massachusetts, which was executed in October 2015 with a commencement date of January 15, 2016. In connection with the corporate headquarters lease agreement, the Company entered into a letter of credit agreement ("the Letter of Credit") in the amount of $116,400. The Letter of Credit has an expiration date of November 17, 2016 and as of December 31, 2015, the landlord had not drawn on this balance. Rent expense for noncancelable operating leases with free rental periods or scheduled rent increases is recognized on a straight-line basis over the terms of the leases. The difference between required lease payments and straight-lined rent expense is recorded as deferred rent. As of December 31, 2014 and 2015, no amounts of deferred rent were recorded.

        In December 2013, the Company entered into a sublease agreement to rent a portion of its office space in Boston, Massachusetts to a tenant beginning in January, 2014 with an initial term of six months with an option to extend the sublease for an additional twelve months. As of December 31, 2015, the sublease has expired and the Company has retaken possession of the subleased space. During the years ended December 31, 2014 and 2015, the Company recorded $12,000 and $11,000 of sublease rental income, respectively, which was recorded as an offset to rent expense.

F-85

---

Table of Contents

CONFER TECHNOLOGIES, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS (Continued)

(Information as of March 31, 2016 and for the three
months ended March 31, 2015 and 2016 is unaudited)

Note 13. Commitments (Continued)

        During the years ended December 31, 2014 and 2015, rent expense, net of sublease rental income discussed above, was $26,400 and $35,400, respectively. The Company's obligation for lease payments is as follows at December 31, 2015:

Note 14. Subsequent Events

        The Company has evaluated events through July 13, 2016, the date which the financial statements were available to be issued, and did not note any additional subsequent events requiring recording or disclosure in the financial statements, other than the subsequent events discussed below.

        Merger agreement:    On May 31, 2016, the Company entered into an Agreement and Plan of Merger and Reorganization (the "Merger Agreement") by and among the Company, Carbon Black, Inc., a Delaware corporation ("Parent") and Confer Acquisition Corp., a Delaware corporation and a wholly-owned subsidiary of Parent ("Merger Sub"). The merger closed on June 3, 2016 and pursuant to the terms of the Merger Agreement, the Merger Sub acquired the Company, and as a result the Company continued as the surviving corporation and a wholly owned subsidiary of the Parent (the "Merger).

        Pursuant to the Merger, all of the issued and outstanding shares of the Company's Common Stock were terminated and converted into shares of the Parent's Common Stock at a ratio of 0.986 per share, all of the issued and outstanding shares of Series A Preferred Stock and Series B Preferred Stock were terminated and converted into shares of the Parent's Series F Preferred Stock at a ratio of 0.986 per share, and all Company Options were assumed by Parent for options to acquire Parent Common stock at a ratio of 0.986 per share. Additionally, any cash held by the Company in excess of $9,000,000 at the closing date was held by the Stockholder Representative to be distributed proportionally among the shareholders 60 days subsequent to the closing date with consideration for any adjustments to the balance sheet and net working capital of the Company on the closing date. In addition, shareholders have the right to a pro rata share of up to approximately $5,000,000 in future cash payments contemplated pursuant to the Merger Agreement.

F-86

---

Table of Contents

---

Table of Contents

---

Table of Contents

PART II
INFORMATION NOT REQUIRED IN PROSPECTUS

Item 13.    Other Expenses of Issuance and Distribution

        The following table sets forth the costs and expenses, other than the underwriting discounts and commissions, payable by the registrant in connection with the sale of common stock being registered. All amounts are estimates except for the Securities and Exchange Commission, or SEC, registration fee, the FINRA filing fee and the The Nasdaq Global Select Market listing fee.

Item 14.    Indemnification of Directors and Officers

        Section 145(a) of the Delaware General Corporation Law provides, in general, that a corporation may indemnify any person who was or is a party or is threatened to be made a party to any threatened, pending or completed action, suit or proceeding, whether civil, criminal, administrative or investigative (other than an action by or in the right of the corporation), because he or she is or was a director, officer, employee or agent of the corporation, or is or was serving at the request of the corporation as a director, officer, employee or agent of another corporation, partnership, joint venture, trust or other enterprise, against expenses (including attorneys' fees), judgments, fines and amounts paid in settlement actually and reasonably incurred by the person in connection with such action, suit or proceeding, if he or she acted in good faith and in a manner he or she reasonably believed to be in or not opposed to the best interests of the corporation and, with respect to any criminal action or proceeding, had no reasonable cause to believe his or her conduct was unlawful.

        Section 145(b) of the Delaware General Corporation Law provides, in general, that a corporation may indemnify any person who was or is a party or is threatened to be made a party to any threatened, pending or completed action or suit by or in the right of the corporation to procure a judgment in its favor because the person is or was a director, officer, employee or agent of the corporation, or is or was serving at the request of the corporation as a director, officer, employee or agent of another corporation, partnership, joint venture, trust or other enterprise, against expenses (including attorneys' fees) actually and reasonably incurred by the person in connection with the defense or settlement of such action or suit if he or she acted in good faith and in a manner he or she reasonably believed to be in or not opposed to the best interests of the corporation, except that no indemnification shall be made with respect to any claim, issue or matter as to which he or she shall have been adjudged to be liable to the corporation unless and only to the extent that the Court of Chancery or other adjudicating court determines that, despite the adjudication of liability but in view of all of the circumstances of the case, he or she is fairly and reasonably entitled to indemnity for such expenses which the Court of Chancery or other adjudicating court shall deem proper.

        Section 145(g) of the Delaware General Corporation Law provides, in general, that a corporation may purchase and maintain insurance on behalf of any person who is or was a director, officer, employee or

II-1

---

Table of Contents

agent of the corporation, or is or was serving at the request of the corporation as a director, officer, employee or agent of another corporation, partnership, joint venture, trust or other enterprise against any liability asserted against such person and incurred by such person in any such capacity, or arising out of his or her status as such, whether or not the corporation would have the power to indemnify the person against such liability under Section 145 of the Delaware General Corporation Law.

        In connection with the sale of common stock being registered hereby, we have entered into indemnification agreements with each of our directors and our executive officers. These agreements will provide that we will indemnify each of our directors and such officers to the fullest extent permitted by law and our amended and restated certificate of incorporation and bylaws.

        We also maintain a general liability insurance policy which covers certain liabilities of directors and officers of our company arising out of claims based on acts or omissions in their capacities as directors or officers.

        In any underwriting agreement we enter into in connection with the sale of common stock being registered hereby, the underwriters will agree to indemnify, under certain conditions, us, our directors, our officers and persons who control us within the meaning of the Securities Act of 1933, as amended, against certain liabilities.

Item 15.    Recent Sales of Unregistered Securities

        During the last three years, we sold the following securities on an unregistered basis:

        (1)   In June 2016, in connection with our acquisition of Confer Technologies, Inc., or Confer, and as consideration to individuals and entities who were former service providers and/or stockholders of Confer, we issued 2,652,957 shares of our common stock (of which 607,569 shares were placed into an escrow account and 303,784 shares were subsequently released therefrom pursuant to the purchase agreement), and 13,026,145 shares of our Series F preferred stock (of which 2,983,187 shares were placed into an escrow account and, to date 1,491,594 shares were subsequently released therefrom pursuant to the purchase agreement).

        (2)   In August 2016, in connection with our acquisition of Confer and as consideration to an entity that was a former service provider of Confer, we sold and issued an aggregate of 699,720 shares of Series F preferred stock for an aggregate purchase price of $2.0 million upon the occurrence of certain conditions pursuant to the purchase agreement.

        (3)   In June 2017, in connection with our acquisition of Confer and as consideration to individuals and entities who were former service providers and/or stockholders of Confer, we issued 228,715 shares of our Series F preferred stock, 46,576 shares of our common stock and 13,985 options to purchase shares of our common stock upon the occurrence of certain conditions pursuant to the purchase agreement.

        (4)   In September and October 2015 and January 2016, we sold and issued an aggregate of 11,515,005 shares of our Series F preferred stock at a per share price of $5.93, for an aggregate purchase price of approximately $68.3 million, to 20 accredited investors.

        (5)   In June 2015, in connection with an asset purchase agreement entered into with Objective Logistics Inc., we sold and issued 286,560 shares of our Series E preferred stock at a per share price of $6.60, for an aggregate purchase price of approximately $1.9 million, to one accredited investor.

        (6)   In August 2015, in connection with our acquisition of VisiTrend, Inc. and as consideration to individuals and entities who were former service providers and/or stockholders of VisiTrend, Inc. we issued 113,981 shares of our Series E preferred stock, and issued and placed in trust an additional 68,389 shares of our Series E preferred stock that were subsequently released therefrom as provided in the purchase agreement.

II-2

---

Table of Contents

        (7)   In February 2016, in connection with our acquisition of VisiTrend, Inc. and as consideration to individuals who were former service providers and/or stockholders of VisiTrend, Inc., we issued 189,970 shares of our Series E preferred stock upon the satisfaction of certain conditions pursuant to the purchase agreement.

        (8)   In August 2016, in connection with our acquisition of VisiTrend, Inc. and as consideration to individuals who were former service providers and/or stockholders of VisiTrend, Inc., we issued 30,395 shares of our Series E preferred stock upon the satisfaction of certain conditions pursuant to the purchase agreement.

        (9)   In February 2016, we issued 960,900 shares of our common stock to four employees in connection with the termination of our Management Incentive Plan.

        (10) Since March 31, 2015, we have granted options under our 2012 Stock Option and Grant Plan to purchase an aggregate of 13,608,784 shares of common stock to our employees, directors and consultants, having exercise prices ranging from $4.38 to $7.46 per share, for an aggregate exercise price of $80,009,024. Since March 31, 2015, we have issued an aggregate of 1,823,399 shares of common stock upon the exercise of stock options, at exercise prices between $2.94 and $7.46, for an aggregate exercise price of $6,174,253. Since March 31, 2015, we have granted Restricted Stock Units ("RSUs") to issue common stock in the amount of 394,500 shares to our employees and directors.

        (11) Since March 31, 2015, we have granted options under our Amended and Restated 2010 Series A Stock Option and Incentive Plan to purchase an aggregate of 408,248 shares of Series A preferred stock to our employees, directors and consultants, having exercise prices ranging from $6.49 to $9.31 per share, for an aggregate exercise price of $3,123,925. Since March 31, 2015, we have issued an aggregate of 884,187 shares of Series A preferred stock upon the exercise of stock options, at exercise prices between $0.10 and $2.66, for an aggregate exercise price of $1,346,852.

        (12) Since March 31, 2015, we have issued, under our Amended and Restated Equity Incentive Plan, an aggregate of 559,352 shares of common stock upon the exercise of stock options, at exercise prices between $0.49 and $1.18, for an aggregate exercise price of $622,211.

        (13) In June 2016, in connection with our acquisition of Confer, we assumed options outstanding under the Confer 2013 Stock Plan, which represent options to purchase an aggregate of 796,817 shares of our common stock, having exercise prices ranging from $0.44 to $6.36 per share, for an aggregate exercise price of $1,745,430. Since our acquisition of Confer, we have issued, under our Confer 2013 Stock Plan, an aggregate of 235,776 shares of common stock upon the exercise of stock options, at exercise prices between $0.44 and $6.36, for an aggregate exercise price of $268,409.

        (14) In May and June 2017, we issued 17,437 and 44,760 shares, respectively, of our Series B preferred stock to two accredited investors pursuant to the cashless net exercise of outstanding warrants.

        None of the foregoing transactions involved any underwriters, underwriting discounts or commissions, or any public offering, and the Registrant believes each transaction was exempt from the registration requirements of the Securities Act as stated below.

        We deemed the offer, sale and issuance of the securities described in paragraphs (1), (2), (3), (4), (5), (6), (7) and (14) above to be exempt from registration under the Securities Act, in reliance on Section 4(a)(2) of the Securities Act, including Regulation D and Rule 506 promulgated thereunder, regarding transactions by an issuer not involving a public offering. All purchasers of securities in transactions exempt from registration pursuant to Regulation D represented to us that they were accredited investors and were acquiring the shares for investment purposes only and not with a view to, or for sale in connection with, any distribution thereof and that they could bear the risks of the investment and could hold the securities for an indefinite period of time. The purchasers received written disclosures

II-3

---

Table of Contents

that the securities had not been registered under the Securities Act and that any resale must be made pursuant to a registration statement or an available exemption from such registration.

        We deemed the grants and exercises of stock options described in paragraphs (8), (9), (10), (11), (12) and (13) above as exempt pursuant to Section 4(a)(2) of the Securities Act or to be exempt from registration under the Securities Act in reliance on Rule 701 of the Securities Act as offers and sales of securities under compensatory benefit plans and contracts relating to compensation in compliance with Rule 701. Each of the recipients of securities in any transaction exempt from registration either received or had adequate access, through employment, business or other relationships, to information about us.

        Furthermore, we affixed appropriate legends to the share certificates and instruments issued in each foregoing transaction setting forth that the securities had not been registered and the applicable restrictions on transfer.

Item 16.    Exhibits and Financial Statement Schedules

(a) Exhibits.

II-4

---

Table of Contents

(b) Financial Statement Schedules.

        Schedules not listed above have been omitted because the information required to be set forth therein is not applicable or is shown in the financial statements or notes thereto.

Item 17.    Undertakings

        The undersigned Registrant hereby undertakes to provide to the underwriters at the closing specified in the underwriting agreement certificates in such denominations and registered in such names as required by the underwriters to permit prompt delivery to each purchaser.

        Insofar as indemnification for liabilities arising under the Securities Act may be permitted to directors, officers and controlling persons of the Registrant pursuant to the foregoing provisions, or otherwise, the Registrant has been advised that in the opinion of the SEC such indemnification is against public policy as expressed in the Securities Act, and is, therefore, unenforceable. In the event that a claim for indemnification against such liabilities (other than the payment by the Registrant of expenses incurred or paid by a director, officer, or controlling person of the Registrant in the successful defense of any action, suit or proceeding) is asserted by such director, officer or controlling person in connection with the securities being registered, the Registrant will, unless in the opinion of its counsel the matter has been settled by controlling precedent, submit to a court of appropriate jurisdiction the question of whether such indemnification by it is against public policy as expressed in the Securities Act and will be governed by the final adjudication of such issue.

        The undersigned Registrant hereby undertakes that:

(1)

For purposes of determining any liability under the Securities Act, the information omitted from the form of prospectus filed as part of this Registration Statement in reliance upon Rule 430A and contained in a form of prospectus filed by the Registrant pursuant to Rule 424(b)(1) or (4) or 497(h) under the Securities Act shall be deemed to be part of this Registration Statement as of the time it was declared effective.



(2)

For the purpose of determining any liability under the Securities Act, each post-effective amendment that contains a form of prospectus shall be deemed to be a new registration statement relating to the securities offered therein, and the offering of such securities at that time shall be deemed to be the initial bona fide offering thereof.

II-5

---

Table of Contents

SIGNATURES

        Pursuant to the requirements of the Securities Act of 1933, as amended, the Registrant has duly caused this Amendment No. 1 to the Registration Statement on Form S-1 to be signed on its behalf by the undersigned, thereunto duly authorized, in Waltham, Massachusetts, on the 23^rd day of April, 2018.

        Pursuant to the requirements of the Securities Act, this Amendment No. 1 to the Registration Statement on Form S-1 has been signed by the following persons in the capacities and on the dates indicated.

II-6

---

Table of Contents

II-7

---