GUID Guidance Software, Inc.

Table of Contents

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-K

x       ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES
EXCHANGE ACT OF 1934

FOR THE FISCAL YEAR ENDED DECEMBER 31, 2016

OR

o          TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES
EXCHANGE ACT OF 1934

For the transition period from                       to                      

Commission File Number 001-33197

Securities registered pursuant to Section 12(b) of the Act:

Securities registered pursuant to Section 12(g) of the Act:    None.

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act.  Yes  o   No  x

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act.  Yes  o   No  x

Indicate by check mark whether the registrant: (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days.  Yes  x   No  o

Indicate by check mark whether the registrant has submitted electronically and posted on its corporate Web site, if any, every Interactive Data File required to be submitted and posted pursuant to Rule 405 of Regulation S-T (232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit and post such files).  Yes  x   No  o

Indicate by check mark if disclosure of delinquent filers pursuant to Item 405 of Regulation of S-K is not contained herein, and will not be contained, to the best of the registrant’s knowledge, in definitive proxy or information statements incorporated by reference in Part III of this Form 10-K or any amendment to this Form 10-K.   x

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer or a smaller reporting company. See the definitions of “large accelerated filer,” “accelerated filer” and “smaller reporting company” in Rule 12b-2 of the Exchange Act.

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act).  Yes  o   No  x

As of June 30, 2016, the aggregate market value of the registrant’s common stock held by non-affiliates of the registrant was approximately $67,118,000* based on the closing sale price as reported on the Global Market tier of The NASDAQ Stock Market LLC. As of February 23, 2017 there were approximately 32,666,000 shares of the registrant’s Common Stock outstanding, net of treasury shares.

* Excludes shares of Common Stock held by executive officers, directors and stockholders whose ownership exceeds 5% of the shares outstanding on that date. This calculation does not reflect a determination that such persons are affiliates for any other purposes.

DOCUMENTS INCORPORATED BY REFERENCE

Portions of the registrant’s definitive proxy statement to be filed with the Commission pursuant to Regulation 14A in connection with the registrant’s 2016 Annual Meeting of Stockholders (the “Proxy Statement”) or portions of the registrant’s 10-K/A, to be filed subsequent to the date hereof, are incorporated by reference into Part III of this Report. Such Proxy Statement or 10-K/A will be filed with the Commission not later than 120 days after the conclusion of the registrant’s fiscal year ended December 31, 2016.

Table of Contents

GUIDANCE SOFTWARE, INC.

FORM 10-K

FOR THE FISCAL YEAR ENDED DECEMBER 31, 2016

Table of Con tents

2

Table of Contents

TRADEMARKS

The trademarks and/or registered trademarks of Guidance Software, Inc. and its subsidiaries referred to herein include, but are not limited to, EnCase®, EnScript®, FastBloc®, EnCE®, EnCEP®, Guidance Software®, LinkedReview™, EnPoint™, Tableau®, EnForce™ and EnFuse® and their respective logos. All other trademarks and copyrights referenced in this report are the property of their respective owners. We do not intend our use or display of other companies’ trade names, trademarks or service marks to imply a relationship with, or endorsement or sponsorship of us by, these other companies.

FORWARD-LOOKING STATEMENTS AND FACTORS THAT MAY AFFECT FUTURE RESULTS

This Annual Report, including the section entitled “Management’s Discussion and Analysis of Financial Condition and Results of Operations,” contains forward-looking statements regarding our vision and business strategy, financial condition, results of operations, products and technologies, expectation of competitive pressures and prospects. Such statements are based upon current expectations that involve risks and uncertainties. For example, words such as “may,” “will,” “should,” “expects,” “anticipates,” “intends,” “plans,” “believes,” “seeks,” “estimates” and similar expressions or variations of such words are intended to identify forward-looking statements. Additionally, any statements contained herein that are not statements of historical facts or that concern future matters such as the development of new products, sales levels, expense levels and other statements regarding similar matters may be deemed to be forward-looking statements.

Although forward-looking statements in this Annual Report reflect the good faith judgment of our management, such statements can only be based on facts and factors currently known by us. Consequently, forward-looking statements are inherently subject to risks and uncertainties and actual results and outcomes may differ materially from the results and outcomes discussed in or anticipated by the forward-looking statements. Factors that could cause or contribute to such differences in results and outcomes include, without limitation, those discussed under the heading “Risk Factors” below, as well as those discussed elsewhere in this Annual Report.  Readers are urged not to place undue reliance on these forward-looking statements, which speak only as of the date of this Annual Report. We undertake no obligation to revise or update any forward-looking statements in order to reflect any event or circumstance that may arise after the date of this Annual Report. Readers are urged to carefully review and consider the various disclosures made in this Annual Report, which attempt to advise interested parties of the risks and factors that may affect our business, financial condition, results of operations and prospects.

3

Table of Contents

Table of Contents

·     searching, collecting and processing litigation-related data, or responding to discovery requests for electronic data, or e-discovery requests, where a company must conduct a thorough, yet timely, review of electronic data in order to produce electronic documents or other digital evidence in connection with a particular civil or administrative proceeding; and

·     responding to regulatory data requests, where an organization must efficiently and rapidly produce electronic documents and digital evidence in connection with a project under regulatory review in a manner acceptable to the regulators.

Traditional forensic and cybersecurity investigations involve internal investigators or third-party consultants manually searching through multitudes of electronic data in an attempt to discover traces or “fingerprints” of electronic data-related incidents. Such investigators or third-party consultants typically use software applications, utilities, or processes, such as taking the affected servers, desktops, and laptops off-line, so that they can remove, image, or copy the hard drives, manually extract the data in question on each affected computer, and save the affected files to another hard drive for processing and analysis by consultants or other third-party experts. These traditional forensic investigations suffer from several distinct problems in that they are costly and time-consuming, they require significant expertise to conduct across complex enterprise network environments, they may not adequately combat attempts to conceal data, they often result in unwanted exposure of sensitive materials and disrupt business, and they are difficult to conduct in a forensically sound manner. Establishing a comprehensive forensic investigative software approach can help organizations address the inadequacies of traditional forensic investigations and cost-effectively mitigate the risk of electronic data-related threats.

We complement our product offerings with a comprehensive array of professional and training services, including technical support and maintenance services, to help our customers implement our solutions, conduct investigations, and train their IT and legal professionals to effectively and efficiently use our products.

For the year ended December 31, 2016, we reported total revenues of $110.5 million, and at year end, we employed approximately 350 employees and conducted business in 57 countries. We were incorporated in California in November 1997 and reincorporated in Delaware in December 2006.

Our Internet address is http://www.guidancesoftware.com. The following filings are posted to our Investor Relations web site, located at http://investors.guidancesoftware.com as soon as reasonably practical after submission to the United States (“U.S.”) Securities and Exchange Commission (“SEC”): annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, the proxy statements related to our most recent annual stockholders’ meetings and any amendments to those reports or statements filed or furnished pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of 1934, as amended. All such filings are available free of charge on our Investor Relations website. The contents of these websites are not intended to be incorporated by reference into this report or in any other report or document we file, and any reference to these websites is intended to be an inactive textual reference only.

Business Strategy

Our business strategy is to be a leader in forensic security markets by developing superior solutions that enable corporate, government, and law-enforcement organizations to conduct thorough and effective forensic security investigations of any kind, including cybersecurity incident response, intellectual property theft, compliance auditing, and responding to e-discovery requests. A key driver behind this strategy is the development and introduction of new products and improvements to our existing products to help win new business. In addition, we are focused on continuing our leadership in computer forensics technology with innovative software and hardware for a complete forensic solution.

5

Table of Contents

Our Board of Directors is composed of:

Our Products and Services

Our products and services give our customers the ability to conduct comprehensive, cost-effective, and precise forensic and cybersecurity investigations. Our EnCase software products provide the foundation to build an enterprise investigation infrastructure.  Furthermore, we believe our software products are the industry standard for searching, collecting, preserving, analyzing, and authenticating electronic computer forensic data for use in criminal and civil court proceedings. Our software and hardware products address the complete forensic process. We also offer a comprehensive array of investigative services and training to help our customers manage their internal forensic investigations and learn how to effectively and efficiently use our software.

Forensic Security Suite

EnCase Endpoint Security provides crucial IT cybersecurity functionality to enterprises and government agencies through its incident response and sensitive data discovery capabilities. Integrated with leading security alerting tools from Hewlett Packard Enterprises (“HP”), Cisco, Blue Coat Systems, and FireEye, EnCase Endpoint Security helps automate the critical first steps in cybersecurity incident response from the moment of a first alert. It rapidly delivers forensic-level visibility of the relevant endpoint data, capturing a snapshot of valuable information from active memory that might otherwise expire which may serve as evidence for potential criminal prosecution. It also enables the rapid launch of an enterprise-wide search for identical or similar cybersecurity threats. This solution is designed to derive insights from the vast amounts of data

6

Table of Contents

generated by endpoint activity and to spot signs of unusual or unauthorized behavior on any endpoint. It leverages its unique, kernel-level access to provide the industry’s most comprehensive endpoint data collection, providing a repository of critical data for insights into undetected cybersecurity risks and threats. Through its interactive visual interface, this product compares current activity to regularly updated baselines of “normal” behavior and exposes suspicious patterns, commonalities, and anomalies to proactively identify cybersecurity threats, arrest attempted data breaches earlier in the “kill chain,” and minimize damage. These capabilities enable a cybersecurity team to remediate any malicious code or processes running on the affected computers and to return the affected endpoints to a trusted state. As an invaluable proactive planning measure, the sensitive data discovery capabilities enable security teams to rapidly identify IT assets (servers, desktops, laptops, etc.) holding sensitive data (such as credit card numbers, social security numbers, patient health information, and other personally identifiable information) in violation of legally mandated regulations, industry standards, and corporate policies. Further, they allow an organization to quickly remediate any identified violations and thereby improve and provide evidence of compliance.

EnCase Endpoint Investigator provides an investigative platform that enables an organization to search, collect, preserve, and analyze data on the servers, desktops, and laptops across the network. EnCase Endpoint Investigator enables organizations to respond to electronic discovery requests and conduct internal investigations, including those related to human resources or those focused on compliance or fraud. Companies can also collect and preserve data in response to regulator requests or for civil litigation matters.

EnCase Endpoint Investigator serves as the platform for an enterprise investigative infrastructure, to which additional products can be added to enhance and automate the search, collection, preservation, and analysis of data in order to accomplish specific business tasks such as: responding to electronic discovery requests; performing proactive, enterprise-wide data audits for sensitive information, including personally identifiable information, classified data, and intellectual property; and detecting, responding to, and remediating network threats or intrusions. These products, which can be added to perform the functions above, include, EnCase Endpoint Security and EnCase eDiscovery.

EnForce Risk Manager , which was made available commercially in 2016, is a new data risk and privacy solution.  It allows organizations to implement a proactive approach to information governance, ensuring that sensitive data is identified, classified and remediated allowing organizations to reduce their cyber attack surface area, significantly mitigating potential damage from breaches and improving their ability to comply with global data protection mandates.

7

Table of Contents

EnCase Forensic

EnCase Forensic is the industry-standard forensic investigation solution that enables forensic practitioners to conduct efficient, forensically sound digital data collection and investigations. The EnCase Forensic solution lets examiners acquire data from a wide variety of devices, unearth potential evidence with disk-level forensic analysis, and craft comprehensive reports on their findings, all while maintaining the integrity of the evidence in a forensically sound and court-proven manner.

Tableau Forensic Appliances

Tableau forensic appliances include write blockers, forensic duplicators and storage devices. Write blockers and forensic duplicators are used to acquire forensically sound copies of digital storage devices such as hard disks and solid state drives.  Users will typically analyze this data with forensic software such as EnCase Forensic.

8

Table of Contents

EnCase eDiscovery

EnCase eDiscovery is our enterprise-wide e-discovery solution addressing the end-to-end e-discovery needs of corporations and government agencies. The e-discovery product portfolio includes capabilities such as: legal hold, identification, collection, preservation, processing, first-pass review, and early case assessment (“ECA”) review. The integrated offering deploys software intelligently, delivering the legal hold, identification, collection, preservation, and processing functions at the customer site, close to the sources of data and the data custodians, and the ECA, review, and production functions as subscription-as-a-service (“SaaS”) in the “cloud,” so that geographically dispersed inside and outside counsel can efficiently collaborate on the review of collected documents without special equipment or software other than a web browser and internet connectivity.

Once the initial search has been conducted and the information has been collected, EnCase eDiscovery culls and processes the data to further reduce the volume of irrelevant or duplicate information. The solution distributes processing in an organized fashion so that several dozen machines can process terabytes of data without disrupting business and degrading network performance. The collected and processed data can then seamlessly be uploaded onto the available attorney review and production platform to complete the e-discovery process.

EnCase eDiscovery Review is a powerful, highly secure, private cloud-hosted, multi-matter review platform with advanced analysis and technology assisted review (“TAR”) functionality, comprehensive production capabilities, and extensive project management and workflow features to enable efficient, effective, and defensible distributed review.

Professional Services and Training

Professional Services provides various consulting services to our clients, including cybersecurity incident response, e-discovery, civil/criminal forensic investigation, implementation services, and a software advisory program. In addition, we offer certain packaged services based on the specific needs of our customers, including our government customers.

Cybersecurity Incident Response Services.  Using EnCase Endpoint Security, consultants investigate and remediate security breaches in an organization’s network infrastructure.  Consultants determine which methods of entry were used to break into the system, the extent and duration of the intrusion, and exactly which data were compromised. They can also “kill” malware and/or rogue processes. In the event a breach draws the attention of regulatory agencies, results and reports can be processed into a court-approved, forensically sound file format to help an organization provide accurate, defensible evidence and information to regulators.

E-Discovery Services .  We offer complete, end-to-end e-discovery consulting and project management services, from litigation hold to the production of files for attorney review. Leveraging our industry-leading EnCase eDiscovery solution, our cost-effective e-discovery services teams automate operations that other service providers perform manually, and are able to conduct large scale e-discovery search, collection, and preservation from a central location, producing fast, accurate results with minimal business disruption.

Implementation Services.  We provide implementation and consulting services in connection with the deployment of our EnCase software.  Our implementation typically takes one to two weeks, during which we conduct performance tests to ensure full functionality and integration with existing systems in the organization, and provide on-site training to ensure our customers can maximize the use of the technology.

9

Table of Contents

Guidance Software Advisory Program (“GAP”). GAP provides a comprehensive review of current policies and procedures, including a gap analysis, which identifies risk areas that could impact the customer. Dedicated advisory consultants work with the customer to build and implement a customized plan to help automate procedures and eliminate wasted resources; establish a documented, defensible and repeatable e-discovery, investigation, or incident response workflow; and align procedures with industry best practices.

Cloud Review Services.   We provide expertise and project management for single or multiple case reviews for our EnCase eDiscovery Review cloud-based hosting platform. We have industry-leading experience in managing large cases with hundreds of reviewers, as well as managing clients with thousands of cases through data targeting, initial review, production, and trial preparation.

Training.  Training educates thousands of students per year in the use of our EnCase software products and methodology. We provide an array of training courses on topics such as computer forensics, incident response, endpoint security, forensic investigations and the proper use of our software products. We operate two training classrooms in Pasadena, California; two near Washington, D.C.; one near Chicago, Illinois; and two near London, England. In addition, through our training staff, our authorized training partners and our OnDemand training program, certain courses are offered at off-site locations throughout North, Central, and South America; Europe; Africa; the Middle East; and Asia/the Pacific Rim (as permitted by U.S. Export Regulations).

Customer Service and Technical Support

Customers typically purchase software maintenance services with each new product license for on-premise products.  Software maintenance services include software updates and upgrades, telephone and e-mail support, on a 24-hours-per-day, five-days-per-week basis, as well as customer self-service on our website. Customers are given an option to renew their maintenance agreements at expiration of their contract which can be for a term of one, two or three years. Our technical support organization provides support for our on-premise products to our current customers with multi-tiered offerings and includes support availability 24 hours per day, five days per week, in English, and is also available during normal business hours in several other languages, including German and Spanish. Customers utilizing the eDiscovery Review product offering receive support services on a 24x7 basis, in English.

Sales and Distribution

We currently market our software and services through a worldwide network of value added resellers, direct sales, and inside sales. Our direct sales force is located throughout the Americas, Europe, the Middle East and Africa.

Our revenues consist of product, services, and maintenance fees from our customers and distributors. Product revenue represented approximately 34%, 30% and 32% of our total revenue in fiscal years 2016, 2015 and 2014, respectively. Services revenue represented approximately 30% of our total revenue in fiscal year 2016, as compared to 33% in 2015, and 32% in 2014.  Revenues from maintenance represented approximately 36%, 37%, and 37% of our total revenue in fiscal years 2016, 2015, and 2014, respectively.

Sales to customers outside the United States totaled $26.8 million, representing 24% of our total revenue in fiscal year 2016. For a geographic breakdown of our revenue and property and equipment, see Note 16 to our Consolidated Financial Statements included in this Annual Report on Form 10-K.

10

Table of Contents

Marketing

We use a mix of market research, analyst updates, seminars, direct mail, print advertising, trade shows, speaking engagements, public relations, customer newsletters, and internet marketing in order to achieve our marketing goals. Our marketing department also produces collateral material for distribution to potential customers, including websites, presentation materials, white papers, brochures, magazines, and fact sheets. We also host user events for our customers and provide support to our channel partners with a variety of programs, training, and product marketing support materials.

In addition to our regional and vertical marketing initiatives, we also host the industry’s largest conference dedicated solely to the subject of digital investigations. The Enfuse Conference (formerly the Computer and Enterprise Investigation Conference, or CEIC) serves as our annual user conference and draws attendees from global law enforcement, government agencies, corporations, law firms, and the judicial bench. This event also draws industry analysts and experts and provides a valuable forum for users to connect, share information, and learn about important topics in the industry. Enfuse enables us to efficiently connect with a broad range of customers, communicate our product offerings (products, services, training, etc.), and launch new products in a captive environment while simultaneously driving add-on sales to customers who have implemented one or more of our core platform products.

Customers

Our customer list includes government agencies and global corporations in a wide variety of industries, such as financial and insurance services, technology, defense contracting, telecom, pharmaceutical, healthcare, manufacturing and retail. Our EnCase customer base currently includes 78 of the Fortune 100 and more than 49% of the Fortune 500 and many federal and international government agencies, and we have deployed our EnCase Forensic software to more than 1,000 government and law enforcement agencies and other customers worldwide. Our EnCase customers are primarily in North America, and also extend to Europe, Africa, the Middle East (as permitted by U.S. Export Regulations) and Asia/the Pacific Rim.  Sales to customers outside of the United States accounted for 24%, 25%, and 23% of our revenues for the fiscal years ended December 31, 2016, 2015, and 2014, respectively.

Research and Development

Our research and development effort is focused on the advancement of our core products and the development of new products, as well as the quality assurance of both core and new products.  The markets we serve have become increasingly competitive. As a result, we have accelerated cybersecurity software development.

We conduct research on existing or new computer hardware or software technology to develop solutions for our law-enforcement, government, or corporate markets. We conduct research on file-system support, search and analysis algorithms, hardware engineering and design, industry standards, technology integrations, and user productivity and performance features. Our research and development efforts are often aimed at creating new standards in our industry and streamlining current processes. Under our customer contracts, we typically obtain the rights to use any improvements to our technology developed or discovered on customer deployments. Our research and development expenses were $24.5 million, $21.2 million, and $23.0 million in 2016, 2015, and 2014, respectively.

11

Table of Contents

Competition

The market for our products is highly competitive, quickly evolving, and subject to rapidly changing technology. In the cybersecurity market, we believe our EnCase Endpoint Security product provides certain unique capabilities, but we nevertheless compete for budget dollars against established endpoint security vendors such as FireEye/Mandiant and CarbonBlack. We also compete with emerging vendors, which represent a variety of different and sometimes complementary approaches — none of which offers the depth of visibility into endpoint data provided by EnCase products. Gartner Research recently published a Competitive Landscape report for what it has named the Endpoint Detection and Response (“EDR”) market. It includes profiles of competitors such as Cisco AMP for Endpoints, Crowdstrike, Hexis Cyber, and Tanium. Noting the depth and breadth of data visibility as a competitive advantage, along with our key integrations with complementary technologies such as Cisco ThreatGRID, the Blue Coat Security Analytics Platform, FireEye MPS, and ThreatTrack Threat Analyzer, Gartner recognizes Guidance Software as a market leader for EDR tools.

The market for software for electronic discovery is highly fragmented, and our EnCase eDiscovery product competes against enterprise search and content management vendors such as HP and EMC, as well as e-discovery point solutions such as StoredIQ, Clearwell, and Nuix; information and content management vendors including HP, (which acquired Autonomy); Symantec (which acquired Clearwell); EMC (which acquired Kazeon); as well as other privately held companies.

In the computer forensics market we compete against a series of smaller, privately held companies, such as X-Ways Software, and Paraben. Additionally, in the broader enterprise market we compete with forensic vendors including Access Data and security software solution vendors including McAfee and Symantec.

We currently compete on the basis of the breadth and depth of our products’ functionality. Additionally, we compete on the basis of certain other factors, including forensic technology, forensic soundness and acceptance in court, time required to complete an investigation, ability to scale across large networks, and expertise of consulting personnel. We believe that we currently compete favorably with respect to these factors.  For further discussion of our competition, see “Risk Factors—We face direct and indirect competition from other software companies, as well as other companies that provide training, consulting, and certification services in computer forensics, which could limit our growth and market share” in Item 1A.

Seasonality

Our business is influenced by seasonal factors, largely due to customer buying patterns. In recent years, we have generally had weaker demand for our software products and services in the first and second quarters of the year and stronger demand in the third quarter due to the federal government fiscal year end, and in the fourth quarter due to commercial or corporate fiscal year end. Our consulting and education services have sometimes been negatively impacted in the third and fourth quarters of the year due to the summer and holiday seasons, which result in fewer billable hours for our consultants and fewer education classes.

Intellectual Property and Proprietary Rights

Our intellectual property rights are important to our business. We rely on a combination of copyrights, trade secrets, trademarks, and patents, as well as confidentiality procedures and contractual provisions to protect our proprietary technology, processes and intellectual property. We currently have 27 issued patents and 10 patent applications pending in the United States, the European Union or under the Patent Cooperation Treaty (often more than one pending application relates to a single invention). We own registered copyrights on various versions of our products and associated instructional documentation. We have registered trademarks or trademarks in the United States and in certain other jurisdictions, including the mark EnCase ®  in the United States, Japan and the European Union, and in the marks EnScript®, FastBloc®, EnCE®, EnCEP®, Guidance Software™, LinkedReview™, EnPoint™, Tableau™, EnForce™ and EnFuse SM  in the United States.

12

Table of Contents

Others may develop products that are similar to our technology. We generally enter into confidentiality and other written agreements with our employees and partners, and through these and other written agreements, we attempt to control access to and distribution of our software, documentation and other proprietary technology and other information. Despite our efforts to protect our proprietary rights, third parties may, in an unauthorized manner, attempt to use, copy or otherwise obtain and market or distribute our intellectual property rights or technology or otherwise develop a product with the same functionality as our software. Policing unauthorized use of our software and intellectual property rights is difficult, and nearly impossible on a worldwide basis. Therefore, we cannot be certain that the steps we have taken or will take in the future will prevent misappropriation of our technology or intellectual property rights, particularly in foreign countries where we do business or where our software is sold or used, where the laws may not protect proprietary rights as fully as do the laws of the United States or where the enforcement of such laws is not common or effective.

Substantial litigation regarding intellectual property rights exists in the software industry. From time to time, in the ordinary course of business, we may be subject to, or initiate, claims relating to our intellectual property rights or those of others, and we expect that third parties may commence legal proceedings or otherwise assert intellectual property claims against us in the future, particularly as we expand the complexity and scope of our business, the number of similar products increases and the functionality of these products further overlap. These claims and any resulting litigation could subject us to significant liability for damages. In addition, even if we prevail, litigation could be time-consuming and expensive to defend and could affect our business materially and adversely. Any claims or litigation from third parties may also limit our ability to use various business processes, software and hardware, other systems, technologies or intellectual property subject to these claims or litigation, unless we enter into license agreements with the third parties. However, these agreements may be unavailable on commercially reasonable terms, or not available at all. For a discussion of intellectual property claims that have recently been asserted against us, see “Item 3.  Legal Proceedings” and “Note 15 — Contractual Obligations, Commitments and Contingencies” in the notes to the consolidated financial statements included in Item 8.

In addition to our proprietary technology, we rely on technology that we license from third parties. (See Risk Factors: “Our success depends in part upon our ability to develop new products and enhance our existing products. Failure to successfully introduce new or enhanced products to the market may adversely affect our business, financial condition and results of operations” in Item 1A of this Annual Report on Form 10-K).

Employees

As of December 31, 2016, we employed approximately 350 full-time employees. We have never had any work stoppage and none of our employees are represented by a labor organization or are party to any collective bargaining arrangements. We consider our employee relations to be good.

Table of Contents

Global market and economic conditions may adversely affect our business, results of operation and financial condition.

We are subject to the risks arising from adverse changes in global economic conditions, especially those in the US, Europe and the Asia-Pacific region. Economic conditions in the United States and worldwide macroeconomic conditions remained challenging during much of 2014, 2015 and 2016. If this economic weakness continues or worsens, customers may delay, reduce or forego technology purchases, both directly and through our channel partners and resellers. Delays in customer purchases in the future could lead to reductions in sales of our products, longer sales cycles, slower adoption of new technologies and increased price competition.  Further, deteriorating economic conditions and uncertainty could adversely affect our customers and their ability to pay amounts owed to us. Any of these events would likely harm our business, results of operations and financial condition.

Our operating results may fluctuate from period to period and within each period, which makes our operating results difficult to predict and could cause our revenues, expenses and profitability to fall short of expectations during certain periods.

Our operating results may fluctuate from period to period or within certain periods as a result of a number of factors, many of which are outside of our control. You should not rely on our past results as an indication of future performance, as our operating results in the future may fall below expectations, expenses could increase and revenues could decrease. Each of the risks described in this section, as well as other factors, may affect our operating results. For example, our quarterly revenues and operating results may fluctuate as a result of a variety of factors, including, but not limited to, our lengthy sales cycle, the proportion of revenues attributable to license fees versus services and maintenance revenues, changes in the level of fixed operating expenses, demand for our products and services, the introduction of new products and product enhancements or upgrades by us or our competitors, changes in customer budgets and capital expenditure plans, competitive conditions in the industry and general economic conditions. In addition, many customers make major software acquisitions near the end of their fiscal years, which tends to cause our revenues to be higher in the third and fourth calendar quarters which coincide with the fiscal year ends of many government agencies and corporations, and lower in the first and second calendar quarters. In addition, many customers tend to make software acquisitions or purchases near the end of a particular quarter, which tends to make our revenues for a particular period unpredictable for a significant portion of the period in question until software purchase decisions have been made. Since certain of our software sales are large scale license agreements, a short delay in just one of these software sales from one quarter into a subsequent quarter or a loss of one of these potential sales could cause us to deliver results for a quarter that are below projections of securities analysts that follow our results. There can be no assurance that we will be able to successfully address these risks, and we may not be profitable in any future period.

If the corporate market for digital investigation software does not continue to develop, we will not be able to grow, and our revenues and results of operations will be adversely affected.

14

Table of Contents

The market for digital investigation software continues to evolve. Our growth is dependent upon, among other things, the size and pace at which the market for such software develops. Our ability to achieve our anticipated growth rate may be impacted by a contraction in the global economy. If the market for such digital investigation software decreases, remains constant, or grows more slowly than we anticipate, we will not be able to maintain historical growth rates. Continued growth in the demand for our products is uncertain because of, among other things:

·                            customers and potential customers may decide to use traditional methods of conducting enterprise investigations, such as reliance on in-house professionals or outside consultants to conduct manual investigations;

·                            customers may experience technical difficulty in utilizing digital investigation software or otherwise not achieve their expected return on their investment in such software; and

·                            marketing efforts and publicity related to digital investigation software may not be successful.

Even if digital investigation software gains wide market acceptance, our software may not adequately address market requirements and may not continue to gain market acceptance. If digital investigation software generally, or our software specifically, do not gain wide market acceptance, we may not be able to grow and our revenues and results of operations would be adversely affected.

If we are not able to effectively manage and support our growth or retain and attract highly skilled employees, our business strategy might not succeed.

In the past we have grown rapidly and we will need to continue to grow in all areas of our operations to execute our business strategy. Managing and sustaining our growth will place significant demands on management as well as on our administrative, operational, technical and financial systems and controls and other resources. We may not be able to expand our product offerings, our customer base and markets, or implement other features of our business strategy at the rate or to the extent presently planned. In addition, our traditionally high level of customer service may suffer as we grow, which could cause our software sales to suffer. If we are unable to successfully manage or support our future growth, we may not be able to maximize revenues or profitability.

In addition, in order to be able to effectively execute our growth plan, we must attract and retain highly qualified personnel. We may need to hire personnel in virtually all operational areas, but primarily in selling and marketing, research and development, professional services, training and customer service. Competition in our industry for experienced and qualified personnel in these areas is extremely intense, especially for software developers with high levels of experience in designing and developing software products and sophisticated technical sales people experienced in selling our complex type of software products and selling into government agencies. In order to expand sales of our products, we may need to continue to hire highly qualified commissioned sales personnel to directly target potential customers. These new commissioned sales personnel require extensive training and experience before being able to effectively market our software products, and, as a result of these hires, our sales and marketing expense may increase at a greater rate than our revenues, at least in the short term. The expense of hiring and training these commissioned sales personnel may never generate a corresponding increase in revenue. We may not be successful in attracting and retaining the necessary qualified personnel that our growth plan requires. In the past we have experienced, and we expect to continue to experience in the future, difficulty in hiring and retaining highly skilled employees with appropriate qualifications. Many of the companies with which we compete for experienced personnel have greater resources than we have. If we fail to attract new personnel or retain and motivate our current personnel, our business and future growth prospects could be severely harmed.

15

Table of Contents

We also believe that a critical contribution to our successful growth will be our corporate culture which fosters innovation, teamwork and excellence. As our organization grows and we are required to implement more complex organizational structures and institutional programs, we may find it difficult to maintain the beneficial aspects of our corporate culture, which could negatively affect our ability to attract and retain qualified and experienced personnel and therefore our future success in continuing to maintain our rapid growth.

Courts could reject the use of our products, which would harm our reputation and negatively affect future sales of our products and services.

Our software products and services are often used in connection with legal investigations, civil litigation and criminal prosecutions. The admissibility of results generated by our products as evidence in civil and criminal trials is a key component of our customer value proposition. Evidence and the manner used to collect evidence is regularly the subject of challenges in legal investigations and litigation, and our products or personnel may be the direct or indirect subject of such legal challenges. Persons involved in litigation may, for example, challenge the reliability of our products, the admissibility of evidence generated, discovered or collected using our products, and/or the expertise, credibility or reliability of our personnel. Other unpredictable legal challenges may be brought that could reflect upon the reputation of our products or personnel. To date, courts that have addressed challenges to our products or services have ruled against such challenges. If in the future a court were to find that our products are not reliable or that persons representing us or users of our product are not credible, reliable or lack the expertise necessary to serve as a witness or to authenticate evidence, or that our training and certification process does not adequately prepare individuals to conduct competent digital investigations, this could have a material adverse impact on our revenues and results of operations.

A failure to attract and retain managerial, technical, and other key personnel could reduce our revenues and our operational effectiveness.

Our future success depends in a large part upon the continued services of our executive officers and other key personnel, including without limitation, our existing research and development personnel. The loss of one or more of our key employees could seriously harm our business development, culture and strategic direction. The competition for attracting and retaining key employees is intense. Because of this competition, we may be unable to retain our existing personnel or attract additional qualified employees in the future to keep up with our business demands and changes, and our business, financial condition, results of operations, and cash flows could be materially adversely affected. The risks involved in recruiting and retaining these key personnel may be increased by the volatility of our stock price.

16

Table of Contents

Changes or reforms in the law or regulatory landscape could diminish the need for our solutions, and could have a negative impact on our business.

One factor that drives demand for our products and services is the legal and regulatory framework in which our customers operate. Laws and regulations are subject to changes that could either help or hurt the demand for our products. Thus, certain changes in the law and regulatory landscape, such as tort law or legislative reforms that limit the scope and size of electronic discovery requests or the admissibility of evidence generated by such requests, as well as court decisions, could significantly harm our business. Changes in domestic and international privacy laws could also affect the demand and acceptance of our products, and such changes could have a material impact on our revenues.

We face direct and indirect competition from other software companies, as well as other companies that provide incident response, consulting and certification services in computer forensics, which could limit our growth and market share.

The markets for our software products and services are competitive, highly fragmented and subject to rapidly changing technology, shifting customer needs and frequent introductions of new products and services. We expect the intensity of competition to increase in the future as new companies enter our markets, existing competitors develop stronger capabilities and we expand into other markets. Many of our current competitors have longer operating histories, greater name recognition, access to larger customer bases and substantially more extensive resources than we have. They may be able to devote greater resources to the development, promotion and sale of their products than we can to ours, which could allow them to respond more quickly than we can to new technologies and changes in customer needs and achieve wider market acceptance. Because the barriers to entry into software industry segments are generally low, we expect to continue to face competition from new entrants, particularly as we expand into other segments of the software industry.

Several competing companies provide digital investigation software and applications that directly compete or will compete with our products, or offer solutions our products do not address. In addition, if the market for digital investigation software develops as we anticipate, other companies could enter this market through their own software development or through the acquisition of one of our current competitors. If these companies are more successful in providing similar, better or less expensive digital investigation solutions compared to those that we offer, we could experience a decline in customers and revenues. These companies include computer forensic companies, managed security services companies and consulting companies, such as international consulting/accounting firms, many of which have substantially greater resources and customer bases than we do. If our competitors are more successful than we are at generating professional services engagements, our growth rate or revenues may decline.

We also compete with companies or organizations that have developed or are developing and marketing software and services that diminish the need for our solutions or the budget available to our customers to purchase our solutions. These companies include traditional security companies, data storage infrastructure and data archiving companies, information management, records management and internal IT organizations that develop their own solutions.

Computer hackers may damage our products, services and systems, which could cause interruptions in our service and harm to our business and hackers could gain access to our customers’ personal information which could result in the loss of existing clients, negative publicity and legal liability.

Computer hackers often attempt to access information, including personal information for purposes of identity theft and other criminal activity. In particular, due to the nature of our business, the products and services that we offer and the industry in which we operate, we are more likely to be the target of computer hackers who would like to undermine our ability to offer the products and services that we provide to our customers and possibly retaliate for the results or evidence that our products and services generate.

17

Table of Contents

For example, in December 2005, we became aware of a security breach of our electronic records which contained, among other things, credit card information of approximately 5,000 customers. We promptly notified law enforcement authorities as well as each of the customers whose information may have been compromised. We conducted a forensic examination of the incident and took a number of steps to both remediate the underlying cause and strengthen our internal security system, including enhancing our internal information technology security department and redesigning our network architecture.

In early January 2006, the Federal Trade Commission (the “FTC”) commenced an inquiry into the December 2005 security breach. In September 2006, we executed a consent decree proposed by the FTC that includes no monetary penalties. The consent decree found that we failed to implement proper security measures to protect consumers’ data, and requires us to provide the FTC with initial and biennial third-party assessments of our IT security for a period of 10 years. Additionally, the consent decree requires us to maintain a comprehensive IT security program, retain documentation of such program and provide notice of the consent decree to our executives and employees for a period of 20 years. The FTC formally approved the consent decree on November 15, 2006 and subsequently issued a press release announcing the investigation and its conclusion. In April 2007, we received formal notice and service of the decree from the FTC, effectively ending the inquiry. In 2007, we timely filed the first compliance report required by the consent decree. In 2011, 2013, and 2015, we timely complied with our biennial monitoring and reporting responsibilities required by the consent decree.

Given the incident, any subsequent breach of our security could be especially damaging to our reputation and business and may result in monetary penalties if the FTC were to find that the circumstances that lead to the breach constituted a violation of our obligations under the consent decree.

In addition, from time to time we may be the targets of computer hackers who, among other things, create viruses to sabotage or otherwise attack companies’ networks, products and services. For example, there was recently a spread of viruses, or worms that intentionally deleted anti-virus and firewall software. Our products, networks, websites and systems, may be the target of attacks by hackers. If successful, any of these events could damage our computer systems, force us to incur substantial costs to fix technical problems or result in hackers gaining access to our technical and other proprietary information, which could harm our business and results of operations.

The complexity of accounting regulations and related interpretations and policies, particularly those related to revenue recognition, could materially affect our financial results for a given period.

Although we use standardized sales agreements designed to meet current revenue recognition criteria under accounting principles generally accepted in the United States, we must often negotiate and revise terms and conditions of these standardized agreements, particularly in multi-product license and services transactions. As our transactions have increased in complexity, particularly with the sale of larger, multi-product licenses, negotiation of mutually acceptable terms and conditions may require us to defer recognition of revenue on such licenses. We believe that we are in compliance with Accounting Standards Codification (“ASC”) Software Industry—Revenue Recognition topic (ASC 985-605); however, more complex, multi-product license transactions require additional accounting analysis to account for them accurately. The professional technical guidance available regarding the application of software revenue recognition is very conceptual, and silent to specific implementation matters. As a consequence of this, we have been required to make assumptions and judgments, in certain circumstances, regarding the application of software revenue recognition. Incorrect assumptions or judgments as well as changes in, or clarification to accounting interpretations, could lead to unanticipated changes in our revenue accounting practices and may affect the timing of revenue recognition, which could adversely affect our financial results for any given period. If we discover that we have interpreted and applied revenue recognition rules differently than prescribed by accounting principles generally accepted in the United States, we could be required to devote significant management resources, and incur the expense resulting from an audit, restatement or other examination of our financial statements.

18

Table of Contents

New revenue recognition standards may also impact the company’s revenue recognition and financial results for a given period.  See Recent Accounting Pronouncements in Note 2 to the Financial Statements.

Our effective tax rate may fluctuate, which could increase our income tax expense and reduce our net income.

In preparing our quarterly and annual consolidated financial statements, we estimate our income tax liability in each of the foreign and domestic jurisdictions in which we operate by estimating our actual current tax exposure and assessing temporary differences resulting from differing treatment of items for tax and financial statement purposes. Our judgments, assumptions and estimates relative to the current provision for income tax take into account current tax laws and our interpretation of current tax laws. Although we believe our judgments, assumptions and estimates are reasonable, changes in tax laws or our interpretation of tax laws and the resolution of any future tax audits could significantly impact the amounts provided for income taxes in our consolidated financial statements.

We calculate our current and deferred tax provisions based on estimates and assumptions that could differ from the actual results reflected in income tax returns filed during the subsequent year. Adjustments based on filed returns are generally recorded in the period when the tax returns are filed and the global tax implications are known and could significantly impact the amounts provided for income taxes.

Due to uncertainty in the application and interpretation of applicable state sales tax laws, we may be exposed to additional sales tax liability.

The Company’s sales and use tax filings are subject to customary audits by authorities in the jurisdictions where it conducts business in the United States, which may result in assessments of additional taxes. In March 2011, we determined that additional sales taxes were probable of being assessed by a certain state as a result of the preliminary findings specific to a sales and use tax audit.  The assessment including interest is approximately $1.2 million as of December 31, 2016. The estimated incremental sales and use tax liability was based on a similar model that was being used by the state conducting the sales and use tax audit. Should other states where we have not imposed sales and use taxes determine that the sale of our products or services are subject to sales and use taxes, we could incur future assessments, which would require charges to operations

Our operating results and business would be seriously impaired if our revenues from our software product offerings, which include EnCase Endpoint Security and EnCase eDiscovery, were to decline.

Historically, we have derived substantially all of our license revenues from sales of our EnCase product offerings. Although we have introduced new software modules, we expect that our EnCase product offerings will account for the largest portion of our software product revenue for the foreseeable future. We believe that the degree of penetration for our EnCase Forensic product in the law enforcement market makes it unlikely that revenue from sales of EnCase Forensic will contribute dramatically to future revenue growth. For this reason, we are dependent on increased sales of our EnCase Endpoint Security and eDiscovery product offerings to drive future growth.

As a result, if for any reason revenue from our EnCase product offerings declines or does not increase as anticipated, our operating results and our prospects for growth will be significantly impaired. Further, if these products fail to meet the needs of our existing and target customers, or if they do not compare favorably in price and performance to competing products, our business will be adversely affected.

19

Table of Contents

We may be limited in our ability to utilize indirect sales channels, such as value-added resellers, corporate resellers, professional services firms and other third-party distributors for the sale and distribution of our products, which may limit our ability to expand our customer base and our revenues.

We may be limited in our ability to market and distribute our products through value-added resellers, corporate resellers, professional services firms and other third-party distributors, which we collectively refer to as third-party resellers, due to various factors. Due to the complex nature of our products, sales professionals generally require a significant amount of time and effort to become sufficiently familiar with our products in order to be able to market them effectively, which makes our products unattractive to third-party resellers. In addition, our competitors include professional services organizations, such as accounting, consulting and law firms, that would otherwise serve as a natural distribution channel for our products and related services.

Moreover, there is significant competition in our industry for qualified third-party resellers. Even if we were to succeed in attracting qualified and capable third-party resellers, agreements with such third-party resellers are generally renewable annually, are not exclusive and contain no minimum purchase commitments. Such agreements may be terminated by either party: (a) for U.S. and Canadian resellers, with 30 days written notice after the initial one-year period; and (b) for non-U.S. or Canadian resellers, within 30 days after the initial six-month period of the agreement, and with 30 days’ notice after the initial one-year period. If we are not able to recruit new qualified third-party resellers, our sales growth may be constrained and our results of operations would suffer.

Our intellectual property rights are valuable, and if we are unable to protect our proprietary technologies and defend infringement claims, we could lose our competitive advantage and our business could be adversely affected.

Our success depends in part on our ability to protect our proprietary products and services and to defend against infringement claims. If we are unable to do so, our business and financial results may be adversely affected. To protect our proprietary technology, we rely upon a combination of copyright, patent, trademark and trade secret law, confidentiality restrictions in contracts with employees, customers and other third parties, software security measures, and registered copyrights, trademarks and patents. If we fail to protect our intellectual property rights adequately, our competitors may gain access to our technology, and our business may be harmed. Any of our patents, trademarks, copyrights or other intellectual property rights may be challenged by others or invalidated through administrative process or litigation proceedings. In addition, we may be unable to obtain patent, copyright or trademark protection on products that we spend significant time and expense to develop in the future. Despite our efforts to protect our proprietary technology, unauthorized persons may be able to copy, reverse engineer or otherwise use some of our proprietary technology. Furthermore, existing patent and copyright laws may afford only limited protection, and the laws of certain countries in which we operate do not protect proprietary technology as well as established law in the United States. For these reasons, we may have difficulty protecting our proprietary technology against unauthorized copying or use. If any of these events happen, there could be a material adverse effect on the value of our proprietary technology and on our business and financial results. In addition, litigation may be necessary to protect our proprietary technology. This type of litigation is often costly and time-consuming, with no assurance of success.

Claims that we misuse the intellectual property of others could subject us to significant legal liability and disrupt our business, which could have a material adverse effect on our financial condition and results of operations.

20

Table of Contents

Because of the nature of our business, we may become subject to material claims of infringement by competitors and other third parties with respect to our current or future software applications, trademarks or other proprietary rights. The legal framework for software patents is rapidly evolving and we expect that software developers will increasingly be subject to infringement claims as the number of software applications and competitors in our industry segment grows. In certain circumstances, the owners of proprietary software could make copyright and/or patent infringement claims against us in connection with such activity. Any such claims, whether meritorious or not, could be time consuming and difficult to defend against, result in costly litigation, cause shipment delays or require us to enter into royalty or licensing agreements with third parties, which may not be available on terms that we deem acceptable, if at all. Any of these claims could disrupt our business, make it difficult to add or retain important features in our products and have a material adverse effect on our financial condition and results of operations.

Some of our products and technology may include software licensed under open source licenses. Some open source licenses could require us, under certain circumstances, to make available or grant licenses to any modifications or derivative works we create based on the open source software. Although we monitor and restrict our use of open source software, the risks resulting from open source usage may not be eliminated and may, if not properly addressed, result in unanticipated obligations that harm our business.

For a discussion of intellectual property claims that have recently been asserted against us, see “Item 3.  Legal Proceedings” and “Note 15 —  Contractual Obligations, Commitments and Contingencies” in the notes to the consolidated financial statements included in Item 8 of this Annual Report on Form 10-K.

If we are unable to continue to obtain government licenses, approvals or authorizations regarding the export of our products abroad, or if current or future export laws limit or otherwise restrict our business, we could be prohibited from shipping our products to certain countries, which could negatively impact our business, financial condition and results of operations.

We must comply with United States laws regulating the export of our products to other countries. Our products contain encryption and decryption technologies that require us to obtain certain licenses from the United States government in order to export certain of our products abroad. In addition, we are required to obtain licenses from foreign governments in order to import our products into these countries. We cannot guarantee that we will be successful in obtaining such licenses, approvals and other authorizations required from applicable governmental authorities to export our products. The export regimes and the governing policies applicable to our business are subject to change, and we cannot assure you that such export approvals or authorizations will be available to us or for our products in the future. Our failure to receive any required export license, approval or authorization would hinder our ability to sell our products and could negatively impact our business, financial condition and results of operations.

Our software applications may be perceived as, or determined by the courts to be, a violation of privacy rights. Any such perception or determination could adversely affect our revenues and results of operations.

Because of the nature of digital investigations, our potential customers and purchasers of our products or the public in general may perceive that use of our products for these investigations result in violations of individual privacy rights. In addition, certain courts, legislative and regulatory authorities could determine that the use of our software solutions or similar products is a violation of privacy rights, particularly in jurisdictions outside of the United States. Any such determination or perception by potential customers, the general public, government entities or the judicial system could harm our reputation and adversely affect the sales of our products and our results of operations.

Our business depends, in part, on sales to governments and governmental entities and significant changes in the contracting or fiscal policies of governments and governmental entities could have a material adverse effect on our business.

21

Table of Contents

We derive a significant portion of our revenues from contracts with federal, state, local and foreign governments and government agencies, and we believe that the success and growth of our business will continue to depend on our successful procurement of government contracts. For the year ended December 31, 2016, we derived approximately 14.3% of our revenues from the sales of products and services from the U.S. Government. In 2016, 2015 and 2014, our business was adversely affected by government budgeting constraints. Changes in government contracting policies or additional or continued government budgetary constraints could directly affect our business, financial condition and results of operations. Among the factors that could adversely affect our business, financial condition or results of operations are:

·                            changes in fiscal policies or decreases in available government funding;

·                            changes in government programs or applicable requirements;

·                            the adoption of new laws or regulations or changes to existing laws or regulations;

·                            changes in political or social attitudes with respect to security issues, computer crimes, discovery of computer files and digital investigations;

·                            potential delays or changes in the government appropriations process; and

·                            delays in the payment of our invoices by government payment offices.

These and other factors could cause governments and governmental agencies to refrain from purchasing the products and services that we offer in the future, the result of which could have an adverse effect on our business, financial condition and results of operations. In addition, many of our government customers are subject to stringent budgetary constraints. The award of additional contracts from government agencies could be adversely affected by spending reductions or budget cutbacks at government agencies that currently use or are likely to utilize our products and services.

22

Table of Contents

Our success depends in part upon our ability to develop new products and enhance our existing products. Failure to successfully introduce new or enhanced products to the market may adversely affect our business, financial condition and results of operations.

Our future success depends in part on our ability to develop enhancements to our existing products and to introduce new products that keep pace with rapid technological developments and changes in customers’ needs. Although our products are designed to operate on a variety of network hardware and software platforms, we must continue to modify and enhance our products to keep pace with changes in network platforms, operating systems, software technology and changing customer demands. We may not be successful in developing and documenting these modifications and enhancements or in bringing them to market in a timely manner. Any failure of our products to operate effectively with future network platforms and technologies could reduce the demand for our products and result in customer dissatisfaction.

Furthermore, any new products that we develop may not be released in a timely manner and may not achieve the market acceptance necessary to generate significant sales revenues. As a result, we may expend significant time and expense towards research and development for new or enhanced products, which may not gain market acceptance or generate sufficient sales to offset the costs of research and development. If we are unable to successfully develop new products or enhance and improve our existing products, or if we fail to position or price our products to meet market demand, our business, financial condition and results of operations will be adversely affected.

Errors in our products could adversely affect our reputation, result in significant costs to us, impair our ability to market our products and expose us to legal liability, any of which may adversely affect our operating results.

Products as complex as ours may contain undetected errors or failures. Despite extensive testing by us and by our customers, we have in the past discovered errors in our software applications and will likely continue to do so in the future. As a result of past discovered errors, we experienced delays and lost revenues while we corrected the problems in those software applications. In addition, customers in the past have brought to our attention “bugs” in our software exposed by the customers’ unique operating environments. Although we have been able to fix these software bugs in the past, we may not always be able to do so in the future. In addition, our products may also be subject to intentional attacks by viruses that seek to take advantage of these bugs, errors or other weaknesses. Any of these events may result in the loss of, or delay in, market acceptance of our products and services, which would seriously harm our sales, financial condition and results of operations.

Furthermore, we believe that our reputation and name recognition are critical factors in our ability to compete and generate additional sales of our products and services. Promotion and enhancement of our brand name will depend largely on our success in continuing to provide effective software applications and services. The occurrence of errors in our software applications or the detection of bugs by our customers may damage our reputation in the market as well as our relationships with existing customers, which may result in our inability to attract or retain customers.

In addition, because our products are used in security and forensic functions that are often critical to our customers, the licensing and support of our products makes us potentially subject to product liability claims. Any product liability insurance we carry may not be sufficient to cover our losses resulting from any such product liability claims. The successful assertion of one or more large product liability claims against us could have a material adverse effect on our financial condition.

23

Table of Contents

Incorrect or improper use of our products, our failure to properly train customers on how to utilize our software products or our failure to properly provide consulting and implementation services could result in negative publicity and legal liability.

Our products are complex and are deployed in a wide variety of network environments. The proper use of our software requires the end user to undergo extensive training and, if our software products are not used correctly or as intended, inaccurate results may be produced. Our customers or our professional services personnel may incorrectly implement or use our products. Our products may also be intentionally misused or abused by customers or non-customer third parties who obtain access and use of our products. Because our customers rely on our product and service offerings to manage a wide range of sensitive investigations and security functions, the incorrect or improper use of our products, our failure to properly train customers on how to efficiently and effectively use our products or our failure to properly provide consulting and implementation services to our customers may result in negative publicity or legal claims against us.

We cannot predict our future capital needs and we may be unable to obtain additional financing to develop new products, enhance existing products, offer additional services or fund strategic acquisitions, the failure of which could have a material adverse effect on our business, financial condition and results of operations.

We may need to raise additional funds in the future in order to develop new products, enhance existing products, offer additional services or make strategic acquisitions of complementary businesses, technologies, products or services. Any required additional financing may not be available on terms acceptable to us, or at all. If we raise additional funds by issuing equity securities, existing security holders will experience dilution of their ownership interest, which could be significant, and the newly-issued securities may have rights senior to those of the holders of our common stock. If we raise additional funds by obtaining loans from third parties, the terms of those financing arrangements may include negative covenants or other restrictions on our business that could impair our operational and financial flexibility and would also require us to incur additional interest expense.  If additional financing is not available when required or is not available on acceptable terms, we may be unable to successfully develop or enhance our software products and services through internal research and development or acquisitions in order to take advantage of business opportunities or respond to competitive pressures, which could negatively impact our software products and services offerings and sales revenues, the failure of which could have a material adverse effect on our business, financial condition and results of operations.

Acquisitions that we may undertake in the future involve risks that could adversely affect our business, financial condition and results of operations.

We may pursue strategic acquisitions of businesses, technologies, products or services that we believe complement or expand our existing business, products and services. Acquisitions involve numerous risks, including, but not limited to, the following:

·                            diversion of management’s attention during the acquisition and integration process;

·                            the possibility that acquisitions will not be completed successfully, or at all, and our potential exposure to termination fees and/or other costs associated therewith;

·                            the incurrence of substantial legal, accounting, financial advisory and/or other costs;

24

Table of Contents

·                            costs, delays and difficulties of integrating the acquired company’s operations, technologies and personnel into our existing operations and organization;

·                            adverse impact on earnings as a result of amortizing the acquired company’s intangible assets or impairment charges related to write-downs of goodwill related to any acquisition;

·                            issuance of equity securities to pay for acquisitions, which may be dilutive to existing stockholders;

·                            potential loss of customers or key employees of acquired companies;

·                            impact on our financial condition due to the timing of the acquisition or our failure to meet operating or synergy expectations for any acquired business; and

·                            assumption of unknown liabilities of the acquired company.

Any acquisitions of businesses, technologies, products or services that we may undertake in the future may not generate sufficient revenues or cost-saving synergies necessary to offset the associated costs of the acquisitions or may result in other material adverse effects.

Our international sales and operations are subject to factors that could have an adverse effect on our business, financial condition and results of operations.

We have significant sales and services operations outside the United States, and derive a substantial portion of our revenues from these operations. For the years ended December 31, 2016, 2015 and 2014, we derived approximately 24%, 25%, and 23%, respectively, of our revenues from sales of products and services outside the United States.

Our international operations are subject to risks related to the differing legal, political, social and regulatory requirements and economic conditions of many countries, which risks include, but are not limited to:

·                            difficulties in staffing and managing our international operations;

·                            the fact that foreign countries may impose additional withholding taxes or otherwise tax our foreign income, impose tariffs or adopt other restrictions on foreign trade or investment, including currency exchange controls;

·                            the general economic conditions in the countries in which we operate could have an adverse effect on our earnings from operations in those countries;

·                            the imposition of, or unexpected adverse changes in, foreign laws or regulatory requirements, including those pertaining to export duties and quotas, trade and employment restrictions;

·                            longer payment cycles for sales in foreign countries and difficulties in collecting accounts receivable;

·                            US and foreign import and export laws;

·                            difficulty in monitoring or effectively preventing business practices which may violate US laws including the Foreign Corrupt Practices Act;

25

Table of Contents

·                            costs and delays resulting from developing software, documentation and training materials in multiple languages; and

·                            political unrest, war or acts of terrorism occurring in the foreign countries in which we currently operate or intend to operate in the future.

We may not continue to succeed in developing and implementing policies and strategies that will be effective in each location where we currently do business or intend to do business in the future. Furthermore, the occurrence of any of the foregoing factors may have a material adverse effect on our business, financial condition and results of operations.

Current and former insiders control a substantial amount of our outstanding stock, and this may delay or prevent a change of control of our company or adversely affect our stock price.

As of February 28, 2017, our executive officers, directors and affiliated entities together beneficially own approximately 35% of our common stock outstanding, including approximately 28% of our outstanding common stock held by trusts affiliated with our founder and former Chairman of the Board and Chief Technology Officer, Shawn McCreight, and his wife. As a result, these stockholders may have control over matters that require approval by our stockholders, including the election of directors and approval of significant corporate transactions. Corporate actions favored by these stockholders might be taken even if other stockholders oppose them. This concentration of ownership might also have the effect of delaying or preventing a change of control that other stockholders may view as beneficial.

Our charter documents and Delaware law may deter potential acquirers of our business and may thus depress our stock price.

Our amended and restated certificate of incorporation and our bylaws contain provisions that could delay or prevent a change of control of our company that our stockholders might consider favorable. In addition, we are governed by the provisions of Section 203 of the Delaware General Corporation Law, which may discourage, delay or prevent certain business combinations with stockholders owning 15% or more of our outstanding voting stock. These and other provisions in our charter documents may make it more difficult for stockholders or potential acquirers to initiate actions that are opposed by the then-current board of directors, including delaying or impeding a merger, tender offer, or proxy contest or other change of control transaction involving our company. Any delay or prevention of a change of control transaction could cause stockholders to lose a substantial premium over the then current market price of their shares.

The trading price of our common stock is volatile.

The trading prices of the securities of technology companies have historically been highly volatile. Accordingly, the trading price of our common stock has been subject to wide fluctuations since our initial public offering in December 2006. Factors that may affect the trading price of our common stock include:

·                            variations in our financial results;

26

Table of Contents

·                            announcements of technological innovations, new solutions, pricing models, strategic alliances or significant agreements by us or by our competitors;

·                            market conditions in our industry, the industries of our customers and the economy as a whole.

In addition, if the market for software or other technology stocks or the stock market in general experiences continued or greater loss of investor confidence, the trading price of our common stock could decline for reasons unrelated to our business or financial results. The trading price of our common stock might also decline in reaction to events that affect other companies in our industry even if these events do not directly affect us.

Future sales of shares by existing stockholders could cause our stock price to decline.

All of our outstanding shares are eligible for sale in the public market, subject in certain cases to volume limitations under Rule 144 of the Securities Act of 1933, as amended. Also, shares subject to outstanding options and rights under our Second Amended and Restated 2004 Equity Incentive Plan are eligible for sale in the public market to the extent permitted by the provisions of various vesting agreements and Rules 144 and 701 under the Securities Act. If these shares are sold, or if it is perceived that they will be sold in the public market, the trading price of our common stock could decline.

In addition, our founder, Shawn McCreight, and his wife, continue to hold a substantial number of shares of our common stock. Sales by Mr. McCreight or his wife of a substantial number of shares, or the expectation that such sales may occur, could significantly reduce the market price of our common stock.

Disruption in component supplies or a breakdown in the manufacturing supply chain could adversely impact hardware revenues.

Tableau brand hardware products typically incorporate hundreds or more components from a wide range of manufacturing sources. In some cases these components are “sole source”, so it is possible for a disruption at a single supplier to constrain or entirely halt production of one of more Tableau brand products, perhaps for an extended period.

Additionally, we use offshore contract manufacturing facilities for most of the assembly work related to Tableau brand hardware products. A breakdown in international transportation or political or economic upheaval could negatively impact our ability to manufacture or transport products leading to a loss of hardware product revenue.

Our balance sheet contained finite-lived intangible assets and goodwill totaling $19.3 million at December 31, 2016 that are subject to impairment review annually, or whenever events or changes in circumstances indicate that the value may not be recoverable, resulting in write-downs or write-offs. Such write-downs or write-offs could adversely impact our future earnings and stock price, our ability to obtain financing and our customer relationships.

At December 31, 2016, we had $14.6 million in indefinite-lived intangible assets and goodwill on our balance sheet. Accounting Standards Codification Intangibles — Goodwill and Other (“ASC 350”) requires that goodwill and indefinite-lived intangible assets be tested for impairment annually, or whenever events or changes in circumstances indicate that the value may not be recoverable. Such testing could result in write-downs or write-offs to our goodwill and indefinite-lived intangible assets. Impairment is measured as the excess of the carrying value of the goodwill or intangible assets over the implied fair value of the underlying asset. Accordingly, we may, from time to time, incur impairment charges, which are recorded as operating expenses when they are incurred and would reduce our net income and adversely affect our operating results in the period in which they are incurred. One customer represents 70% of our subscription revenue for the year ended 2016.  If we were to lose this specific customer, our subscription operations would be adversely affected, and this might result in an impairment of the goodwill and intangible assets in this reporting unit.

27

Table of Contents

As of December 31, 2016, we had $4.7 million of other net intangible assets, consisting of core technology, existing and developed technology, customer relationships and tradenames that we amortize over time. Any material impairment to any of these items could adversely affect our results of operations and could affect the trading price of our common stock in the period in which they are incurred.

There are inherent limitations on the effectiveness of our internal controls and compliance programs.

Regardless of how well designed and operated it is, an internal control system can provide only reasonable assurance that its objectives will be met. Further, the design of an internal control system should reflect the fact that there are resource constraints, and the benefits of an internal control system must be considered relative to their costs. Because of the inherent limitations in all internal control systems, no evaluation of an internal control system can provide absolute assurance that all control issues and instances of fraud, if any, have been detected. Moreover, although we have implemented compliance programs and compliance training for employees, such measures may not prevent our employees, contractors or agents from breaching or circumventing our policies or violating applicable laws and regulations. Failure of our internal control systems and compliance programs to prevent error, fraud or violations of law could have a material adverse impact on our business.

Our restructuring and cost reduction activities could result in management distraction, operational disruptions and other adverse effects on our business.

In each of the last three years, we have implemented, and may in the future implement, certain restructuring and cost reduction activities with respect to our business. The restructuring efforts could divert the attention of our management away from our operations, harm our reputation, reduce our revenue and/or increase our expenses. There can be no assurance that the restructuring activities will be successful, including allowing the business to operate profitably within the current fiscal year or any later date.  See Realignment section in Note 2 to the Financial Statements.

Table of Contents

Table of Contents

From time to time, we may become involved in various other lawsuits and legal proceedings that arise in the ordinary course of business.  Litigation is subject to inherent uncertainties, and an adverse result in these or other matters may arise from time to time that may harm our business.  We are not currently aware of any such other legal proceedings or claims that are likely to have a material impact on our business.

Item 4.                                   Removed & Reserved

(not applicable)

30

Table of Contents

Table of Contents

32

Table of Contents

Table of Contents

(1)                   See Note 3 to our consolidated financial statements for an explanation of the determination of the number of shares used to compute basic and diluted per share amounts.

(2)                   Non-cash compensation recorded for each of the last five years ended December 31, 2016 relates to stock options and restricted stock granted to employees measured under the fair value method and includes costs related to nonvested share grants.

34

Table of Contents

Table of Contents

·                            Information technology budgets. Deployment of our solutions may require a substantial capital expenditure by our customers.  Budgets for information technology-related capital expenditures at corporations and all levels of government organizations are typically cyclical in nature, with generally higher budgets in times of improving economic conditions and lower budgets in times of economic slowdowns.

·                            Law enforcement agency budgets. We sell our EnCase Forensic products and training services primarily to law enforcement agencies.  Because of the limited nature of law enforcement budgets, funds are typically initially allocated toward solving issues perceived to be the most pressing.  Sales of our products could be impacted by changes in the budgets of law enforcement agencies or in the relative priority assigned to digital law enforcement investigations.

·                            Prevalence and impact of security breaches, hacking incidents and spread of malicious software. The increasing sophistication of security breaches and hacking attacks on government and private networks and the global spread of malicious software, such as viruses, worms and rootkits, have increased the focus of corporations and large government organizations on digital investigations and other aspects of network security, which has, in turn, increased demand for our products.  Future changes in the number and severity of such breaches, attacks or the spread of malicious software could have an effect on the demand for our products.

36

Table of Contents

·                            Seasonality in revenues. We experience seasonality in our revenues, with the third and fourth quarters typically having the highest revenues for the year.  We believe that this seasonality results primarily from our customers’ budgeting cycles.  The federal government budget year ends in the third calendar quarter of the year and a majority of corporate budget years end in the fourth calendar quarter of the year.  In addition, our customers also tend to make software purchases near the end of a particular quarter, which tends to make our revenues for a particular period unpredictable for a significant portion of that period.  We expect that this seasonality within particular years and unpredictability within particular quarterly periods will continue for the foreseeable future.

·                            Amount of commercial litigation. Because commercial litigation often involves e-discovery, an increase in commercial litigation could increase demand for our products and services, while a decrease in commercial litigation could decrease demand.

Summary of Results of Operations

Our total revenues for the year ended December 31, 2016 was $110.5 million, an increase of $3.5 million, or 3%, from $107.0 million for the year ended December 31, 2015.  Product revenue was $37.1 million for the year ended December 31, 2016, an increase of $5.2 million, or 16%, from $31.9 million for the year ended December 31, 2015.  Services revenue was $33.3 million for the year ended December 31, 2016, a decrease of $1.9 million, or 6%, from $35.3 million for the year ended December 31, 2015.  Maintenance revenue for the year ended December 31, 2016 increased $0.3 million, or 1%, to $40.1 million from $39.8 million for the year ended December 31, 2015.  The increase in our total revenue for the year ended December 31, 2016, compared to 2015 was primarily due to an increase in product revenue, partially offset by a decrease in services revenue.

Our net loss for the year ended December 31, 2016 was $20.7 million, or $0.72 per share, compared to a net loss of $14.4 million, or $0.51 per share, for 2015.  Our future profitability is primarily dependent upon revenue from the sale of our products and the reduction of our operating expenses.  The primary contributor to the increase in our net loss for 2016 was an increase in our general and administrative expenses.

Sources of Revenue

Our software product sales transactions typically include the following elements: (i) a software license fee paid for the use of our products under a perpetual license term, or for a specific term; (ii) an arrangement for first-year support and maintenance, which includes unspecified software updates, upgrades and post-contract support; (iii) and professional services for installation, implementation, consulting and training. We also generate revenues from cloud-based document review and production services sold on a subscription basis. We derive the majority of our revenues from sales of our software products. We sell our software products and services primarily through our direct sales force and increasingly through resellers. We sell our hardware products primarily through resellers.

37

Table of Contents

We generate product revenue principally from two product categories: enterprise products and forensic products.  Revenue from our enterprise products includes sales related to licenses from our Forensic Security Suite of products which are comprised of: EnCase Endpoint Security, EnCase Endpoint Investigator and EnForce Risk Manager, as well as sales of our EnCase eDiscovery product.  Revenue of our forensic products includes sales related to EnCase Forensic and forensic appliance sales.  During the first two quarters of each fiscal year, we typically experience lower levels of product sales due to the seasonal budgetary cycles of our customers.  The third quarter is typically the strongest quarter for sales to our federal government customers. Typically, sales to our corporate customers are highest in the fourth quarter.

Product revenue for the year ended December 31, 2016 increased $5.2 million, or 16%, to $37.1 million from $31.9 million for the year ended December 31, 2015.  The increase was primarily due to a $3.7 million increase, or 30%, to $16.4 million from $12.6 million for the year ended December 31, 2015 in enterprise products revenue due to pricing increases on our enterprise products and improved sales execution of our channel-focused sales model, and a $1.4 million increase, or 13%, to $11.7 million from $10.4 million for the year ended December 31, 2015 in forensic appliance sales due to new products released during 2015.

Product revenue for the year ended December 31, 2015 decreased $2.5 million, or 7%, to $31.9 million from $34.4 million for the year ended December 31, 2014.  The decrease was primarily due to $1.2 million decrease, or 8%, to $12.6 million from $13.8 million for the year ended December 31, 2014 in enterprise products due to the timing of our transition to a more channel-focused sales model for our enterprise products and a $1.0 million decrease, or 10%, to $8.9 million from $9.9 million for the year ended December 31, 2014 in forensic software sales due to weakness in government spending.

Services Revenue

We generate services revenue from professional services, training and our EnCase eDiscovery Review cloud-based document and production services.  Our professional services provides various consulting services to our clients, including network security incident response, e-discovery, civil/criminal digital investigation, implementation services, as well as a software advisory program. Our training services educate students in computer forensics principles and the use of our EnCase software products and methodology. EnCase eDiscovery Review service customers have the right to access our cloud-based document review and production software; however, they may not take possession of the software at any time during the term of the agreement. We generate subscription revenue primarily from corporate or large enterprise customers who typically use our cloud-based software to host multiple legal cases on an ongoing basis.

Services revenue for the year ended December 31, 2016 decreased $1.9 million, or 6%, to $33.3 million from $35.3 million for the year ended December 31, 2015.  The decrease in services revenue as compared to prior year is primarily due to our business strategy and focus on product revenue generation.

Services revenue for the year ended December 31, 2015 increased $1.0 million, or 3%, to $35.3 million from $34.3 million for the year ended December 31, 2014.  The increase is primarily due to a $2.0 million increase in our professional services revenue due to increased case work and incident response work, partially offset by a $1.0 million decrease in subscription revenue due to reductions in single-case law firm engagements.

Maintenance Revenue

Maintenance revenue is generated from customers who purchase software maintenance services with new product licenses and maintenance renewals for on-premise products. Software maintenance includes software updates and upgrades, telephone and e-mail support, as well as self-service on our website.

38

Table of Contents

Maintenance revenue for the year ended December 31, 2016 remained essentially flat year over year at $40.1 million, from $40.0 million for the year ended December 31, 2015.  The change is primarily due to revenue from additional maintenance contracts during the year being mostly offset by maintenance contract non-renewals.

Maintenance revenue for the year ended December 31, 2015 remained essentially flat year over year at $39.9 million as compared to the year ended December 31, 2014, primarily due to revenue from additional maintenance contracts during the year being offset by maintenance contract non-renewals.

39

Table of Contents

Cost of Product Revenue

Cost of product revenue consists principally of the cost of producing our software products, including third party software royalties, the cost of manufacturing our hardware appliances and product distribution costs, including the cost of packaging, shipping, customs duties, and, to a lesser extent, compensation and related overhead expenses.  While these costs are primarily variable with respect to sales volumes, they remain low in relation to the revenues generated and result in higher gross margins than our services businesses.  Our gross margins can be affected by product mix, as our enterprise products are generally higher margin products than our forensic products, which include software and hardware.

The cost of product revenue for the year ended December 31, 2016 increased $0.5 million, or 5%, to $9.3 million from $8.9 million for the year ended December 31, 2015.  The increase was primarily due to a $0.8 million increase in appliance costs resulting from increased sales of our appliance products, partially offset by a $0.3 million reduction in employee-related costs due to lower headcount during 2016 as compared to 2015.

The cost of product revenue for the year ended December 31, 2015 increased $0.5 million, or 5%, to $8.9 million from $8.4 million for the year ended December 31, 2014.  The increase was primarily due to a $0.4 million increase in appliance costs which resulted in a lower gross margin of 72.2% in 2015 as compared to 75.5% in 2014.

Cost of Services Revenue

C ost of services revenue consists principally of employee compensation costs, including share-based compensation and related overhead, travel, facilities cost, software maintenance paid to third party vendors, and SaaS hosting infrastructure costs resulting from professional services, training, and subscription services.

The cost of services revenue for the year ended December 31, 2016 decreased $2.9 million, or 12%, to $21.4 million from $24.3 million for the year ended December 31, 2015.  The decrease was due to a $1.2 million, or 8%, decrease in cost of consulting revenue, a $1.3 million, or 33%, decrease in cost of subscription revenue, and a $0.4 million, or 8%, decrease in cost of training revenue all primarily as a result of a decrease in compensation and employee-related costs resulting from a reduction in headcount that occurred during 2016.

The cost of services revenue for the year ended December 31, 2015 decreased $1.1 million, or 4%, to $24.3 million from $25.4 million for the year ended December 31, 2014.  The decrease was primarily due to a $0.8 million decrease in cost of subscription revenue and a $0.2 million decrease in cost of training, while cost of professional services remained essentially flat year over year.  The $0.8 million decrease in the cost of subscription revenue is primarily due to a $0.5 million reduction in employee related costs resulting from a reduction in headcount that occurred in 2014, as well as a $0.2 million decrease in rent expense due to the relocation of our data center to a less expensive location in the second quarter of 2014.  The decrease in the cost of training was primarily related to a $0.1 million decrease in compensation and employee related costs

40

Table of Contents

resulting from a reduction in headcount that occurred in 2014 and a $45,000 reduction in realignment expense that occurred in 2014 that did not reoccur in 2015.

Services gross margin increased to 31.0% in 2015 from 26.1% in 2014, primarily due to a higher utilization rates in our professional services business.

Cost of Maintenance Revenue

Cost of maintenance revenue includes third-party outsourcing fees, employee compensation costs for customer technical support and related overhead costs.

The cost of maintenance revenue for the year ended December 31, 2016 remained essentially flat year over year at $2.4 million as compared to the year ended December 31, 2015.

The cost of maintenance revenue for the year ended December 31, 2015 increased $0.2 million, or 11%, to $2.4 million from $2.2 million for the year ended December 31, 2014.  The increase was primarily due to $0.2 million increase in compensation and employee-related costs due to annual merit increases and an increase in headcount.

Selling and Marketing Expenses

Selling and marketing expenses consist primarily of personnel costs and costs related to our sales force and marketing staff. Selling and marketing expenses also include expenses relating to advertising, brand building, marketing promotions and trade show events (net of amounts received from sponsors and participants), product management, and travel and allocated overhead.

41

Table of Contents

Selling and marketing expenses for the year ended December 31, 2016 increased $4.6 million, or 12%, to $43.3 million from $38.7 million for the year ended December 31, 2015.  The increase was primarily due to an increase of $2.8 million of compensation and employee-related costs and $1.7 million of realignment expense due to the investment in our sales and channel-focused leadership.

Selling and marketing expenses for the year ended December 31, 2015 decreased $0.3 million, or 1%, to $38.7 million from $39.0 million for the year ended December 31, 2014.  The decrease was primarily due to $1.0 million realignment expense resulting from our reduction in headcount that occurred in 2014 that was not as large in 2015, partially offset by a $0.6 million increase in compensation and other employee-related costs due to a focused investment in our selling and marketing leadership.

Research and Development Expenses

Research and development expenses consist primarily of compensation, including share-based compensation and related overhead expenses.

Research and development expenses for the year ended December 31, 2016 increased $3.4 million, or 16%, to $24.5 million from $21.2 million for the year ended December 31, 2015.  The increase is primarily related to a $2.7 million increase in compensation and other employee-related expenses due to higher headcount during the year, as well as a $0.7 million increase in realignment expense resulting from a leadership change in the first quarter of 2016 and a reduction in headcount during the fourth quarter of 2016.  The costs savings resulting from the reduction in headcount during the fourth quarter of 2016 will be realized during 2017.

Research and development expenses for the year ended December 31, 2015 decreased $1.8 million, or 8%, to $21.2 million from $23.0 million for the year ended December 31, 2014.  The decrease is primarily related to a $1.2 million decrease in compensation and other employee-related expenses due to lower headcount and $0.8 million in realignment expense resulting from our reduction in headcount that occurred in 2014 that was not as large in 2015, partially offset by an increase of $0.2 million of software maintenance related to increased usage of third-party licenses.

General and Administrative Expenses

General and administrative expenses consist of personnel and related costs for accounting, legal, information systems, human resources and other administrative functions.  In addition, general and administrative expenses include professional service fees, bad debt expense, and other corporate expenses and related overhead.

General and administrative expenses for the year ended December 31, 2016 increased $5.8 million, or 30%, to $24.9 million from $19.1 million for the year ended December 31, 2015.  The increase in general and administrative expenses was primarily attributable to $2.2 million in various consulting and legal fees related to the proxy contest with the Company’s founder, former Chief Technology Officer and former Chairman of the Board of Directors, $1.3 million in realignment expense resulting from the closure of certain of our facilities and reduction in headcount, $1.1 million net expense related to our patent infringement litigation settlements, a $0.5 million increase in employee-related costs primarily due to an increase in share-based compensation expense related to our performance-based restricted stock awards, and a $0.5 million increase in bad debt expense.

42

Table of Contents

General and administrative expenses for the year ended December 31, 2015 increased $0.7 million, or 4%, to $19.1 million from $18.4 million for the year ended December 31, 2014.  The increase in general and administrative expenses was primarily attributable to $2.1 million in compensation and employee-related costs due to merit increases that occurred during the second quarter of 2015 and the recruiting and hiring of our new CEO partially offset by a $1.2 million decrease in realignment expense resulting from our reduction in headcount that occurred in 2014.

Depreciation and Amortization Expenses

Depreciation and amortization expenses consist of depreciation and amortization of our leasehold improvements, furniture, computer hardware and software and intangible assets.  In 2016, 2015 and 2014, we invested $2.0 million, $3.8 million and $1.9 million, respectively, in capital equipment and leasehold improvements.

Depreciation and amortization expense for the year ended December 31, 2016 decreased $1.3  million, or 20%, to $5.1 million from $6.4 million for the year ended December 31, 2015.  The decrease was primarily due to certain assets being fully depreciated or disposed of and not replaced.

Depreciation and amortization expense for the year ended December 31, 2015 decreased $1.0  million, or 14%, to $6.4 million from $7.4 million for the year ended December 31, 2014.  The decrease was primarily due to a decrease of $0.3 million in amortization expenses as a result of certain of our acquired intangible assets being fully amortized and a decrease of $0.5 million due to fixed assets being fully depreciated.

Other Income (Expense)

Total other income (expense) consists of interest earned on cash balances, interest paid and other miscellaneous income and expense items.  For the year ended December 31, 2016, we recorded other expense, net of $27,000 as compared with other income, net of $29,000 for 2015.  The increase in other expense, net, was primarily due to an increase in interest expense of $45,000.

For the year ended December 31, 2015, we recorded income of $29,000 as compared with income of $0.7 million for the same period in 2014.  The decrease was primarily due to a $0.6 million gain related to the sale of a domain name in 2014 that did not reoccur in 2015.

Income Tax Provision

Our income tax provision in years 2016, 2015, and 2014 was $146,000, $360,000, and $264,000, respectively. Our income tax provision for 2016, 2015 and 2014 differed from the federal statutory rate of 34% primarily due to certain share-based compensation and the impact of providing a valuation allowance against federal and California research and development tax credits and deferred tax assets. See Note 9 to our Consolidated Financial Statements for additional information.

Table of Contents

Changes in Cash Flow

We generate cash from operating activities primarily from cash collections related to the sale of our products and services.  Net cash used in operating activities was $7.8 million in 2016, compared with $2.8 million of cash provided by operating activities in 2015. The net cash used in operating activities in 2016 included a net loss of $20.7 million, $9.4 million of share-based compensation, $5.1 million in depreciation and amortization, a decrease in deferred revenues of $3.7 million, a decrease of $2.0 million in prepaid expenses and other assets, offset by an increase of $2.1 million in accrued liabilities.  The decrease in deferred revenues was primarily due to the timing of software maintenance contract renewals and a lower concentration of new maintenance contracts with three-year terms being sold during 2016 as well as lower renewal rates year over year. This compares to cash provided by operating activities in 2015 which included a $14.4 million net loss, 6.4 million in depreciation and amortization, a decrease of $2.6 million in accounts payable, a decrease of $2.2 million in prepaid expenses and other assets, and an increase of $0.7 million in accrued liabilities.

Net cash provided by operating activities was $2.8 million in 2015, compared with $0.6 million of cash used in operating activities in 2014. The net cash provided by operating activities in 2015 included a net loss of $14.4 million, $6.4 million in depreciation and amortization, a decrease of $2.6 million in accounts payable, a decrease of $2.2 million in prepaid expenses and other assets, and increases of $4.4 million in deferred revenues and $0.7 million in accrued liabilities.  The increase in deferred revenues was primarily due to the timing of software maintenance contract renewals and a higher concentration of new maintenance contracts with three-year terms being sold during 2015. This compares to cash used in operating activities in 2014 which included a $14.7 million net loss, an increase of $1.2 million in trade receivables, an increase of $1.5 million in prepaid expenses and other assets and an increase of $3.7 million in deferred revenues in 2014.

Net cash used in investing activities was $2.0 million in 2016 compared to $3.8 million in 2015 and $1.9 million in 2014.  The increase in cash used in investing activities during 2016 and 2015 was primarily due to the purchase of new technology equipment.

Net cash provided by financing activities was $3.4 million in 2016, $1.6 million in 2015 and $1.0 million in 2014.   Cash provided by financing activities in 2016 is primarily due to $8.0 million of borrowings on the bank line of credit, partially offset by $4.5 million of repayments made on the borrowings. Cash provided by financing activities in 2015 included $1.7 million in proceeds from the exercise of our stock options, partially offset by $80,000 in principal payments on capital leases and other obligations. Cash provided by financing activities in 2014 included $1.2 million in proceeds from the exercise of our stock options, partially offset by $0.2 million in principal payments on capital leases and other obligations.

On August 29, 2014, we entered into a three year, Senior Secured Revolving Line of Credit (“Revolver”) with a bank. We are obligated to pay a commitment fee of $0.2 million over the three-year term of the Revolver.

The maximum principal amount that may be outstanding at any given time under the Revolver, which includes up to $3.0 million of standby letters of credit, is $10.0 million. Borrowing availability is calculated as 80% of eligible accounts receivable, with a maximum of $10.0 million.  Any borrowings under the Revolver would be collateralized by substantially all of our assets, as well as pledges of capital stock.

The Revolver requires that, if we suffer an event of default or have borrowed more than 75% of the maximum principal amount permitted to be outstanding, the Company maintains an adjusted quick ratio of at least 1.15:1.  The adjusted quick ratio is calculated by dividing quick assets (cash less restricted cash plus accounts receivable) by current liabilities (current liabilities plus outstanding standby letter of credit less the current portion of deferred revenue).  Borrowings under the Revolver bear interest at a floating rate ranging from 1.25% to 3.25% above the prime rate depending on the Company’s adjusted quick ratio.

44

Table of Contents

As of December 31, 2016, the Company was in compliance with all the covenants of the Revolver.  The Company had letters of credit outstanding against the Revolver in the amount of $1.2 million, resulting in the maximum available borrowing under the Revolver to be $8.6 million.  As of December 31, 2016, the balance outstanding under the Revolver was $3.5 million, remaining borrowing availability was $5.1 million and the Company’s adjusted quick ratio was 1.62:1.  During periods when the adjusted quick ratio is below 1.5:1, any collections received by  the Company in its collateral account will be applied to outstanding loan balances before being remitted to the Company’s operating account.    Amounts in the collateral account are transferred to the Company’s operating account after the loan balance has been paid in full.

Our future capital requirements will depend on many factors, including our rate of revenue growth, the expansion of our selling and marketing activities, the timing and extent of research and development spending to support product development and enhancement efforts, costs resulting from expansion into new territories or markets, the timing of the introduction of new products and services, the enhancement of existing products and the continuing market acceptance of our products and services.  To the extent that our existing cash, cash from operations or the availability of cash under our line of credit are insufficient to fund our future activities and planned growth, we may need to raise additional funds through public or private equity or debt financings.  Additional funds may not be available on terms favorable to us or at all.  Furthermore, although we cannot accurately anticipate the effect of inflation or foreign exchange markets on our operations, we do not believe these external economic forces have had, or are likely in the foreseeable future to have, a material impact on our results of operations.  We have omitted unrecognized tax benefits from this table due to the inherent uncertainty regarding the timing and recognition related to these unrecognized tax benefits. See “Note 9—Income Taxes” in the notes to the consolidated financial statements included in Item 8 for further information regarding the unrecognized tax benefits.

Effective April 1, 2014, we entered into a Colocation Lease Agreement (the “Colocation Lease”) to rent space in a building located in Chandler, Arizona.  The Colocation Lease expires on June 30, 2018.  The Colocation Lease will serve as our new data center, replacing our former San Francisco location obtained in the CaseCentral acquisition.  Rent is based on power allocation and ranges from approximately $236,000 for the first year to approximately $265,000 for the final year.

45

Table of Contents

On July 3, 2014, we entered into an Office Lease Agreement (the “San Francisco Lease”) to lease approximately 6,000 rentable square feet of an office building located in San Francisco, California.  The San Francisco Lease commenced on January 1, 2015 and expires in January 2020.  The total annual rent under the San Francisco Lease ranges from approximately $295,000 for the first year to approximately $332,000 for the final year.  As of December 31, 2016 we ceased operations out of this facility and are actively looking for a subtenant.

On November 13, 2014, the Company entered into a $1.5 million third-party software license agreement authorizing the Company to integrate software as a component of its products through March 2018.  The agreement also provides for maintenance and support over a three-year period, which may be renewed by the Company at the expiration of the three-year period ending March 2018.  The $1.5 million is payable in three annual installments of $492,000, with the final installment due in November 2016.  The license, maintenance and remaining liability have been recorded on the accompanying Consolidated Balance Sheets.

On March 31, 2015, we amended our Office Lease Agreement (the “Pasadena Lease”) dated July 26, 2012 to expand our headquarters by approximately 3,600 rentable square feet. The amendment commenced on June 1, 2016 and the Pasadena Lease expires on May 31, 2024. Total annual rent under the Pasadena Lease ranges from approximately $2.5 million for the first year to approximately $3.4 million for the final year of the lease. The expansion increases the annual base rent by a range of approximately $110,000 for the first year to approximately $140,000 for the final year.

Effective July 7, 2015, we entered into a renewal of our Office Lease Agreement (the “UK Lease”) to lease approximately 8,000 rentable square feet of an office building located in Slough, United Kingdom, which is used primarily as a training center. The UK Lease commenced on January 9, 2016 and expires on January 8, 2021, with an option to exit the lease on January 9, 2019. The total annual rent under the UK Lease is approximately $267,000.

In February 2016, the Company entered into a $1.7 million third-party software license agreement authorizing the Company to integrate third-party software as a component of its products through February 2020.  The agreement also required payment of $0.3 million by the Company for two years of maintenance and support.  As of December 31, 2016 the outstanding balance was $ 0.9 million.

Other than the items stated above, we currently have no other material cash commitments, except our normal recurring trade payables, expense accruals, leases and license obligations, all of which are currently expected to be funded through existing working capital and future cash flows from operations.

Off-Balance Sheet Arrangements

As of December 31, 2016, we had no off-balance sheet arrangements as defined in Item 303(a)(4) of the SEC’s Regulation S-K.  We do not have material relationships or transactions with persons or entities that derive benefits from their non-independent relationship with us or our related parties except as disclosed in this report.

Critical Accounting Policies and Estimates

In preparing our financial statements, we make estimates, assumptions and judgments that can have a significant impact on our net revenue, operating income or loss and net income or loss, as well as on the value of certain assets and liabilities on our balance sheet.  We believe that the estimates, assumptions and judgments involved in the accounting policies described below and in Note 2 to our Consolidated Financial Statements, included herein at Item 8, have the greatest potential impact on our financial statements, so we consider them to be our critical accounting policies and estimates.

46

Table of Contents

Revenue Recognition

We generate revenues principally from the sale of our EnCase software products. Our software products include perpetual licenses and are related to our Forensic Security Suite (EnCase Endpoint Security, EnCase Endpoint Investigator and EnForce Risk Manager), EnCase eDiscovery, EnCase Forensic and forensic appliance sales. Revenue resulting from the sale of software licenses and revenue resulting from forensic appliance sales are referred to as product revenue. Revenues are also generated from training courses and consulting services in which we assist customers with the performance of digital investigations and train their IT and legal professionals in the use of our software products, as well as subscription revenues resulting from cloud-based document review and production SaaS, which we collectively refer to as services revenue. Our proprietary software products are generally sold with one year of maintenance, which can be renewed at a stated renewal rate and is referred to as maintenance revenues.

We recognize revenue in accordance with ASU 2009-13 , Multiple-Deliverable Revenue Arrangements , (amendment to ASC Topic 605, Revenue Recognition ), Revenue Recognition - Software topic (“ASC 985-605”) and Revenue Recognition (“ASC 605”). While the standards govern the basis for revenue recognition, significant judgment and the use of estimates are required in connection with the allocation of revenue between product, services and maintenance revenues, as well as the amount of deferred revenue to be recognized in each accounting period.

Revenue Recognition Criteria: We recognize revenue when the following criteria have been met:

·            Persuasive evidence of an arrangement: When we either enter into contracts or receive written purchase orders issued by a customer that legally bind us and the customer.

·            Delivery : We deem delivery of products to have occurred when the title and risk of ownership have passed to the buyer. Services revenues are considered delivered as they are performed.

·            Fixed or determinable fee: We consider the fee to be fixed or determinable if the fee is not subject to refund or adjustment and the payment terms are within normal established practices. If the fee is not fixed or determinable, we recognize revenues as amounts become due and payable with respect to transactions with extended payment terms, or as refund rights lapse with respect to transactions containing such provisions, provided all other revenue recognition criteria have been met.

·            Collection is deemed probable: We conduct a credit review for all significant transactions at the time of the arrangement to determine the credit-worthiness of the customer. Collection is deemed probable if we have a reasonable basis to expect that the customer will pay amounts under the arrangement as payments become due.

We report our revenues in three categories: product revenue, services revenue, and maintenance revenue. Product revenue includes revenues from the sale of our software products and hardware products. Services revenue includes revenue from the sale of our professional services, training, and subscriptions. Maintenance revenue includes revenue associated with the sale of maintenance support related to our hardware and software products. Accounting treatment for each category of revenue and our most significant contract structures is further described below.

47

Table of Contents

Revenue Recognition for Software Products and Software-Related Services (Software Elements)

Software product revenue. The timing of software product revenue recognition is dependent on the nature of the product sold or the structure of the license.

EnCase Software Products : Revenue resulting from these arrangements, exclusive of amounts allocated to maintenance and other undelivered elements, for which we have vendor-specific objective evidence of fair value (“VSOE”), is recognized upon delivery, provided that all other criteria for revenue recognition have been met. Revenue resulting from term licenses are recognized ratably over the term of the license because we have not established VSOE for post-contract customer support in term license arrangements.

Services revenue. The majority of our consulting and implementation services are performed under per hour or fixed fee arrangements. Revenue from such services is recognized as the services are provided or upon expiration of the contractual service period.

Training revenue is either recognized on a per-class basis upon a participant’s attendance or, for those customers who have subscribed to our Annual Training Passport program, revenue is recognized ratably over the annual period.

Maintenance revenue. Maintenance revenue includes technical support and software updates on a when-and-if-available basis. We recognize maintenance revenue ratably over the applicable maintenance period. We determine the amount of maintenance revenue to be allocated through reference to substantive maintenance renewal provisions contained in multiple element arrangements. We consider substantive maintenance provisions to be provisions where the cost of the maintenance renewal is stated in the contract with our customer as a percentage of the net license fee, provided the rate is substantive.

Revenue Recognition for Multiple-Element Arrangements — Software Products and Software-Related Services (Software Arrangements)

We often enter into arrangements with customers that purchase both software products and software-related services from us at the same time, or within close proximity of one another (referred to as software-related multiple-element arrangements). Such software-related multiple-element arrangements may include the sale of our software products, software maintenance services, which include license updates and product support, consulting/implementation services and training whereby the software license delivery is followed by the subsequent delivery of the other elements. For those software-related multiple-element arrangements, we have applied the residual method to determine the amount of software license revenues to be recognized pursuant to ASC 985-605. Under the residual method, if VSOE exists for the undelivered elements, this amount is deferred with the remaining, or residual, portion of the arrangement consideration recognized upon delivery of the software license, provided all other revenue recognition criteria are met.

Revenue Recognition for Hardware and Subscription Revenues (Nonsoftware Elements)

Hardware product revenue. Revenue resulting from the sale of forensic appliances is recognized upon shipment to the customers, which include certain resellers, provided that all other criteria for revenue recognition have been met.

Subscription services revenue. Customers pay subscription fees to access our cloud-based document review and production software; however, they may not take possession of the software at any time during the term of the agreement. In general, we recognize revenue for subscription fees on a straight-line basis over the contract period commencing on the date the subscription is made available to the customer. Usage-based fees, which are determined monthly, are recognized when incurred.

48

Table of Contents

Revenue Recognition for Multiple-Element Arrangements — Hardware, Subscription, and Nonsoftware-Related Services (Nonsoftware Arrangements)

We enter into arrangements with customers that purchase both nonsoftware-related subscription services and nonsoftware-related services, such as consulting services, at the same time or within close proximity of one another (referred to as nonsoftware multiple-element arrangements). Each element within a nonsoftware multiple-element arrangement is accounted for as a separate unit of accounting provided the following criteria are met: the delivered products or services have value to the customer on a standalone basis; and for an arrangement that includes a general right of return relative to the delivered products or services, delivery or performance of the undelivered product or service is considered probable and is substantially controlled by us. We consider a deliverable to have standalone value if the product or service is sold separately by us or another vendor, or could be resold by the customer. Further, our revenue arrangements generally do not include a general right of return relative to the delivered products. Where the aforementioned criteria for a separate unit of accounting are not met, the deliverable is combined with the undelivered element and treated as a single unit of accounting for the purposes of allocation of the arrangement consideration and revenue recognition. For those units of accounting that include more than one deliverable but are treated as a single unit of accounting, we generally recognize revenues ratably over the delivery period. For the purposes of revenue classification of the elements that are accounted for as a single unit of accounting, we allocate revenue to the respective revenue line items within our consolidated statements of operations based on a rational and consistent methodology utilizing our best estimate of relative selling prices of such elements.

For our nonsoftware multiple-element arrangements, we allocate revenue to each element based on a selling price hierarchy at the arrangement’s inception. The selling price for each element is based upon the following selling price hierarchy: VSOE, if available; third party evidence (“TPE”) if VSOE is not available; or best estimate of selling price (“BESP”) if neither VSOE nor TPE are available. A description as to how we determine VSOE, TPE and BESP is provided below:

· VSOE . VSOE is determined based on its historical pricing and discounting practices for the specific product or service when sold separately. In determining VSOE, we require that a substantial majority of the selling prices for these services fall within a reasonably narrow pricing range.

· TPE . When VSOE cannot be established for deliverables in a multiple element arrangement, judgment is applied with respect to whether we can establish a selling price based on TPE. TPE is determined based on competitor prices for similar deliverables when sold separately. Generally, our go-to-market strategy differs from that of our peers, and our offerings contain a significant level of differentiation such that comparable pricing of services with similar functionality has not been obtained. Furthermore, we have been unable to reliably determine selling prices of similar competitive services on a stand-alone basis. As a result, we have not been able to establish selling prices based on TPE.

· BESP . When VSOE or TPE cannot be established, we use BESP in our allocation of arrangement consideration. The objective of BESP is to determine the price at which we would transact a sale if the service were sold on a stand-alone basis. We determine BESP for deliverables by considering multiple factors including but not limited to prices we charge for similar offerings, market conditions, competitive landscape and pricing practices.

49

Table of Contents

Revenue Recognition for Multiple-Element Arrangements — Arrangements with Software and Nonsoftware Elements

We also enter into multiple-element arrangements that may include a combination of our various software-related and nonsoftware-related products and services. In such arrangements, we first allocate the total arrangement consideration based on the relative selling prices to the software group of elements as a whole and to the nonsoftware group of elements. We then further allocate consideration allocated to the software group and nonsoftware group to the respective elements within that group following the guidance in ASC 985-605, ASC 605-25, and our policies described above. After the arrangement consideration has been allocated to the elements, we recognize revenue for each respective element in the arrangement as described above.

Goodwill and indefinite-lived intangibles

We account for our goodwill and indefinite-lived intangible assets in accordance with Intangibles — Goodwill and Other (“ASC 350”).  Goodwill represents the excess of purchase price over fair value of net assets acquired and is assigned to a reporting unit at the date the goodwill is initially recorded.  Goodwill and indefinite-lived intangible assets are not amortized but evaluated for impairment annually, or whenever events or changes in circumstances indicate that the value may not be recoverable.  The Company has the option to choose whether it will apply the qualitative assessment first before the quantitative assessment.  We performed a quantitative assessment for our goodwill and indefinite-lived assets as of October 1, 2016, and determined they were not impaired.

Our goodwill impairment analysis for the year ended December 31, 2016 indicated that the estimated fair value of all but one of our reporting units with goodwill was in excess of the carrying value by approximately 140% to over 600%, and are not considered by management to be at risk of failing step one of the impairment test. The estimated fair value of the subscription reporting unit, with $6.9 million of goodwill, exceeded its carrying value by 22%. The significant assumptions that drive the estimated fair value are projected future cash flows, growth rates, and weighted average cost of capital and market multiples. Due to the subjectivity of these assumptions, the subscription reporting unit may be at greater risk for goodwill impairment if actual results differ from our projections or there are significant changes in market and economic factors affecting fair value.  Deterioration in estimated future cash flows in this reporting unit could result in future goodwill impairment. Additionally, one customer represents approximately 70% of our subscription revenue for the year ended December 31, 2016.  If we were to lose this specific customer, our subscription operations and therefore future cash flows would be adversely affected.

If a quantitative assessment is necessary a two-step test is performed at the reporting unit level to assess goodwill and indefinite-lived intangible assets for impairment.  First, the fair value of the reporting unit is compared to its carrying value.  If the fair value exceeds the carrying value, the reporting unit is not impaired and no further testing is performed.  The second step is performed if the carrying value exceeds the fair value.  If the carrying value of the reporting unit exceeds its implied fair value, an impairment loss equal to the difference will be recorded.  Indefinite-lived intangible assets are assessed for impairment by comparing the carrying value of the assets with their fair values.  If the carrying value of an indefinite-lived intangible asset exceeds its implied fair value, an impairment loss equal to the difference will be recorded.  Application of the impairment test requires significant judgment to estimate the fair value.  Changes in estimates and assumptions could materially affect the determination of fair value and/or impairment.

We primarily use the income approach and the market approach valuation methods, which include the discounted cash flow method, the guideline company method, as well as other generally accepted valuation methodologies to determine the fair value of our reporting units. Upon completion of our annual impairment assessments, we determined that no impairment was indicated as the estimated fair value of each of our reporting units exceeded its respective carrying value. The Company will continue to monitor events and circumstances which may affect the fair values of its reporting units prior to its next annual assessment date.

50

Table of Contents

Significant management judgment is required in the forecasts of future operating results that are used in our impairment evaluations. The estimates we have used are consistent with the plans and estimates that we use to manage our business. It is possible, however, that the plans may change and estimates used may prove to be inaccurate. If our actual results, or the plans and estimates used in future impairment analyses, are lower than the original estimates used to assess the recoverability of these assets, we could incur future impairment charges.

Share-Based Compensation

We account for share-based payments to employees, including grants of employee stock options and restricted stock-based awards in accordance with ASC 718, Compensation—Stock Compensation , which requires that share-based payments be recognized in our consolidated statements of operations based on their fair values.  We recognize stock-based compensation expense, net of an estimated forfeiture rate, on a straight-line basis over the service period of the award, which is generally four years.

We use the Black-Scholes option pricing model to determine the grant date fair value of stock option awards and use the closing price on the date of grant for the grant date fair value for our restricted stock awards.  The determination of the grant date fair value of stock option awards using the Black-Scholes model is affected by our stock price as well as assumptions regarding a number of complex and subjective variables. These variables include the estimated number of years that we expect employees to hold their stock options (the option “term”) and our expected stock price volatility, risk-free interest rates and dividends to be paid on our stock over that term.

If we change the terms of our employee share-based compensation programs, refine future assumptions or if we change to other acceptable valuation models, the stock-based compensation expense that we record in future periods may differ significantly from historical trends and could materially affect our results of operations.  During the year-ended December 31, 2016, we recorded a reversal of $0.2 million in stock compensation expense for modified terms related to certain terminated employees’ restricted stock awards.

As of December 31, 2016, there was approximately $2.2 million of total unrecognized share-based compensation cost related to stock options that is expected to be recognized over a weighted-average period of 2.8 years and approximately $11.1 million of total unrecognized share-based compensation cost related to restricted stock awards that is expected to be recognized over a weighted-average period of 2.3 years.  See Note 12 to our Consolidated Financial Statements for further information regarding share-based compensation.

Allowance for Doubtful Accounts

We maintain an allowance for doubtful accounts for estimated losses resulting from the inability of our customers to make required payments. The allowance is established through a provision for bad debt expense.  We determine the adequacy of this allowance by evaluating individual customer accounts receivable, through consideration of the customer’s financial condition, credit history and current economic conditions.  In addition, we analyze our historical credit loss history and apply these loss rates to our current accounts receivable balances to verify the reasonableness of our allowance.  If the financial condition of our customers were to deteriorate, resulting in an impairment of their ability to make payments, additional allowances may be required in the future, which would result in increased general and administrative expense.

51

Table of Contents

Accounting for Income Taxes

In preparing our consolidated financial statements, we estimate our income tax liability in each of the foreign and domestic jurisdictions in which we operate by estimating our actual current tax exposure and assessing temporary differences resulting from differing treatment of items for tax and financial statement purposes.  Our judgments, assumptions and estimates relative to the current provision for income tax take into account current tax laws, our interpretation of current tax laws and possible outcomes of audits conducted by foreign and domestic tax authorities.  Reserves for income taxes to address potential exposures involving tax positions that could be challenged by tax authorities will be established if necessary.  Although we believe our judgments, assumptions and estimates are reasonable, changes in tax laws or our interpretation of tax laws and the resolution of any future tax audits could significantly impact the amounts provided for income taxes in our consolidated financial statements.

We calculate our current and deferred tax provisions based on estimates and assumptions that could differ from the actual results reflected in income tax returns filed during the subsequent year.  Adjustments based on filed returns are generally recorded in the period when the tax returns are filed and the global tax implications are known.  Such adjustments have not had a significant impact on our effective tax rate in any of the years presented.  Tax law and rate changes are reflected in the income tax provision in the period in which such changes are enacted.

We record a valuation allowance to reduce our deferred tax assets to the amount that is more likely than not to be realized.  We consider all available evidence, both positive and negative, including historical levels of income, expectations and risks associated with estimates of future taxable income and ongoing prudent and feasible tax planning strategies in assessing the need for a valuation allowance.  In the event we were to determine that we would not be able to realize all or part of our net deferred tax assets in the future, an adjustment to the deferred tax assets would be charged to earnings in the period in which we make such a determination. Likewise, if we later determine that it is more likely than not that the net deferred tax assets would be realized, we would reverse the applicable portion of the previously provided valuation allowance.

We account for uncertainty in income taxes which contains a two-step approach to recognizing and measuring uncertain tax positions taken or expected to be taken in a tax return by determining if the weight of available evidence indicates that it is more likely than not that the tax position will be sustained on audit, including resolution of any related appeals or litigation processes.  The second step is to measure the tax benefit as the largest amount that is more than 50% likely to be realized upon ultimate settlement.  The standard also provides guidance on de-recognition, classification, accounting in interim periods and disclosure requirements for tax contingencies.

Commitments and Contingencies

We are subject to certain legal proceedings, as well as demands, claims and threatened litigation that arise in the normal course of our business.  We periodically evaluate all pending or threatened contingencies and commitments, if any, that are reasonably likely to have a material adverse effect on our operations or financial position.  We assess the probability of an adverse outcome and determine if it is remote, reasonably possible or probable as defined in accordance with the provisions of Contingencies (“ASC 450”).  If management determines that it is probable that an asset had been impaired or a liability had been incurred at the date of our financial statements, and the amount of the loss, or the range of probable loss can be reasonably estimated, we record an accrued liability and an expense for the estimated loss.  If no accrual is made for a loss contingency because one or both of the conditions pursuant to Contingencies are not met, but the probability of an adverse outcome is at least reasonably possible, we would disclose the nature of the contingency, if material, and provide an estimate of the possible loss or range of loss, or state that such an estimate cannot be made.

52

Table of Contents

Significant judgment is required in both the determination of probability and the determination of whether an exposure is reasonably estimable.  Because of uncertainties related to these matters, any accruals recorded are based on the best information available at the time.  As additional information becomes available, we would reassess the potential liability related to our pending claims and litigation and may revise our estimates favorably or unfavorably.  Potential legal liabilities and the revision of estimates of potential legal liabilities could have a material impact on our financial position and results of operations.

Recent Accounting Pronouncements

In May 2014, the FASB issued ASU 2014-09, Revenue from Contracts with Customers: Topic 606  and issued subsequent amendments to the initial guidance in August 2015, March 2016, April 2016 and May 2016 within ASU 2015-04, ASU 2016-08, ASU 2016-10 and ASU 2016-12, respectively (ASU 2014-09, ASU 2015-04, ASU 2016-08, ASU 2016-10 and ASU 2016-12 collectively, “Topic 606”). Topic 606 supersedes nearly all existing revenue recognition guidance under GAAP. The core principle of Topic 606 is to recognize revenues when promised goods or services are transferred to customers in an amount that reflects the consideration that is expected to be received for those goods or services. Topic 606 defines a five-step process to achieve this core principle and, in doing so, it is possible more judgment and estimates may be required within the revenue recognition process than are required under existing GAAP, including identifying performance obligations in the contract, estimating the amount of variable consideration to include in the transaction price and allocating the transaction price to each separate performance obligation, among others.

Topic 606 is effective for us at the beginning of our first quarter of fiscal 2018 and permits adoption either by using (i) a full retrospective approach for all periods presented in the period of adoption or (ii) a modified retrospective approach with the cumulative effect of initially applying Topic 606 recognized at the date of initial application and providing certain additional disclosures as defined per Topic 606.

We plan to adopt Topic 606 using the full retrospective approach described above in the first quarter of fiscal 2018. However, a decision regarding the adoption method has not been finalized at this time. Our final determination will depend on a number of factors, such as the significance of the impact of the new standard on our financial results, system readiness, including that of software systems procured from third-party providers, and our ability to accumulate and analyze the information necessary to assess the impact on prior period financial statements, as necessary.

We are in the initial stages of our evaluation of the impact of the new standard on our accounting policies, processes, and system requirements. We have developed a project plan and have assigned internal resources to assist in the evaluation of the impact of the standard and the implementation of software systems from third-party providers to enable timely and accurate reporting under the new standard.

As part of our evaluation, we have also considered the impact of the guidance in ASC 340-40, Other Assets and Deferred Costs: Contracts with Customers , and the interpretations of the FASB Transition Resource Group for Revenue Recognition (“TRG”) from their November 7, 2016 meeting with respect to capitalization and amortization of incremental costs of obtaining a contract.  As a result of this new guidance, we preliminarily believe that we will capitalize additional costs of obtaining the contract, including sales commissions.  The new cost guidance, as interpreted by the TRG, requires the capitalization of all incremental costs that are incurred to obtain a contract with a customer that would not have been incurred if the contract had not been obtained, provided the costs are expected to be recovered.  Under our current accounting policy, we expense costs in the period we invoice the customer.  Additionally, we preliminarily believe that the amortization period for our deferred commission costs will be longer than the contract term, as the new cost guidance requires entities to determine whether the costs relate to specific anticipated contracts.  Therefore, we believe that the period of benefit, as interpreted by the TRG, for deferred commission costs will likely be longer than the initial contract period.   We are continuing to evaluate the impact of our adoption of Topic 606 and our preliminary assessments are subject to change.

53

Table of Contents

While we continue to assess the potential impacts of the new standard, including the areas described above, and anticipate this standard would not have a material impact on our consolidated financial statements, we do not know or cannot reasonably estimate quantitative information related to the impact of the new standard on our financial statements at this time.

In February 2016, the FASB issued ASU No. 2016-02, Leases (“Topic 842”), which requires lessees to recognize on the balance sheet a right-of-use asset, representing their right to use the underlying asset for the lease term, and a lease liability for all leases with terms greater than 12 months. The guidance also requires qualitative and quantitative disclosures designed to assess the amount, timing and uncertainty of cash flows arising from leases. The standard requires the use of a modified retrospective transition approach, which includes a number of optional practical expedients that entities may elect to apply. ASU 2016-02 is effective for the Company beginning January 1, 2019 and we are currently evaluating the impact that ASU 2016-02 will have on our consolidated financial statements.

In March 2016, the FASB issued ASU No. 2016-09, Compensation - Stock Compensation (“Topic 718”),  Improvements to the Employee Share-Based Payment Accounting.   The standard is intended to simplify several areas of accounting for share-based compensation arrangements, including the income tax impact, classification on the statement of cash flows and forfeitures. ASU 2016-09 is effective for the Company on January 1, 2017.  We are currently evaluating the impact that ASU 2016-09 and do not expect the update to have a significant impact on our consolidated financial statements.

Non-Audit Services of Independent Registered Public Accounting Firm

Our Audit Committee of the Board of Directors has pre-approved all non-audit services including tax compliance services.

54

Table of Contents

Table of Contents

control over financial reporting is designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles.  Our internal control over financial reporting includes those policies and procedures that:

(i)                       pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of our assets;

(ii)                    provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that our receipts and expenditures are being made only in accordance with authorizations of our management and directors; and

(iii)                 provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of our assets that could have a material effect on the financial statements.

There are inherent limitations in the effectiveness of any system of internal control, including the possibility of human error and the circumvention or overriding of controls.  Accordingly, even an effective internal control system may not prevent or detect misstatements and can provide only reasonable assurance with respect to financial statement preparation.  Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions or that the degree of compliance with the policies or procedures may deteriorate.

Management assessed the effectiveness of our internal control over financial reporting as of December 31, 2016, utilizing the criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission (2013 framework) (“COSO”) in Internal Controls—Integrated Framework .   Based on the results of this assessment, management (including our Chief Executive Officer and our Chief Operating and Financial Officer) has concluded that, as of that date, our internal control over financial reporting was effective.

The attestation report concerning the effectiveness of our internal control over financial reporting as of December 31, 2016, issued by our independent registered public accounting firm, Ernst and Young, LLP, is included under Item 9B.

Changes in Internal Control over Financial Reporting

There have been no changes in our internal control over financial reporting during the fourth quarter of fiscal 2016 that have materially affected, or are reasonably likely to materially affect, our internal controls over financial reporting.

Table of Contents

We conducted our audit in accordance with the standards of the Public Company Accounting Oversight Board (United States). Those standards require that we plan and perform the audit to obtain reasonable assurance about whether effective internal control over financial reporting was maintained in all material respects. Our audit included obtaining an understanding of internal control over financial reporting, assessing the risk that a material weakness exists, testing and evaluating the design and operating effectiveness of internal control based on the assessed risk, and performing such other procedures as we considered necessary in the circumstances. We believe that our audit provides a reasonable basis for our opinion.

A company’s internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. A company’s internal control over financial reporting includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of the company’s assets that could have a material effect on the financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

In our opinion, Guidance Software, Inc. maintained, in all material respects, effective internal control over financial reporting as of December 31, 2016, based on the COSO criteria .

We also have audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States), the consolidated balance sheets of Guidance Software, Inc. as of December 31, 2016 and 2015, and the related consolidated statements of operations, stockholders’ (deficit) equity and cash flows for each of the three years in the period ended December 31, 2016 of Guidance Software, Inc. and our report dated March 1, 2017 expressed an unqualified opinion thereon.

57

Table of Contents

Table of Contents