ZIXI Zix Corp

NOTE ON FORWARD-LOOKING STATEMENTS AND RISK FACTORS

Statements in this report which are not purely historical facts or which necessarily depend upon future events, including statements about trends, uncertainties, hopes, beliefs, anticipations, expectations, plans, intentions or strategies for the future, may be forward-looking statements within the meaning of Section 21E of the Securities Exchange Act of 1934. Forward-looking statements involve risks and uncertainties that could cause actual events or results to differ materially from the events or results described in the forward-looking statements, including risks and uncertainties described in our Annual Report on Form 10-K for the fiscal year ended December 31, 2016. Any of these risk factors could have a material adverse effect on our business, financial condition or financial results and reduce the value of an investment in our securities. We may not succeed in addressing these and other risks associated with an investment in our securities, with our business and with our achieving any forward-looking statements. Readers are cautioned not to place undue reliance on forward-looking statements. All forward-looking statements are based upon information available to us on the date the statements are made. We undertake no obligation to publicly update or revise any forward-looking statements, whether as a result of new information, future events or otherwise.

Overview

Zix ^® is a leader in email security. Trusted by the nation’s most influential institutions in healthcare, finance and government, Zix delivers a superior experience and easy-to-use solutions for email encryption and data loss prevention (“DLP”), advanced threat protection, archiving, and bring your own device (“BYOD”) mobile security. Focusing on the protection of business communication, Zix enables its customers to better secure data and meet compliance needs. We primarily serve organizations in the healthcare, financial services, insurance and government sectors, including U.S. federal financial regulators— such as members of the Federal Financial Institutions Examination Council (FFIEC), divisions of the U.S. Treasury, the U.S. Securities and Exchange Commission (SEC), 30% of U.S. banks, more than 30% of Blue Cross Blue Shield plans and more than 1,200 U.S. hospitals.

ZixEncrypt ^SM (formerly ZixGateway ^® and ZixQuarantine ^® ) bundles email encryption and DLP capabilities to enable the secure exchange of email that includes sensitive information. Through a comprehensive secure messaging service, ZixEncrypt allows an enterprise to use policy-driven rules to determine which email messages should be sent securely or quarantined for review to comply with regulations or company-defined policies.

The main differentiation for ZixEncrypt in the marketplace is our exceptional ease of use. The best example of this is our ability to provide transparent delivery of encrypted email. Most email encryption solutions are focused on the sender. They typically introduce an added burden on recipients, often requiring additional user authentication with creation of a new user identity and password. We designed our solution to alleviate the recipient’s burden by enabling the delivery of encrypted email automatically and

14

transparently. Zix enables transparent delivery by (1) ZixDirectory ^® , the world’s largest email encryption community which is designed to share identities of our tens of mill ions of members (growing by approximately 170,000 members per week), (2) Zix’s patented Best Method of Delivery ^® , which is designed to deliver email in the most secure, most convenient method possible for the recipient, and (3) ZixEncrypt, which automatica lly encrypts and decrypts messages with sensitive content. The result is secure, transparent encrypted email, such that secure email can be exchanged without any impact to administrators or extra steps for both senders and recipients. Zix delivers more tha n 1,400,000 encrypted messages on a typical business day. Of those messages, approximately 70% are exchanged transparently between senders and recipients.

ZixEncrypt also addresses business’s greatest source of data loss – corporate email– with an easy, straightforward DLP approach. By focusing strictly on the risks of email, ZixEncrypt simplifies DLP in comparison to other DLP solutions by decreasing complexity and cost, reducing deployment time from months to hours and minimizing impact on customer resources and workflow. In addition, Zix offers a convenient experience for both employees interacting with our solution and administrators managing the system.

ZixEcrypt enables DLP capabilities for email by combining proven policy and content scanning capabilities with quarantine functionality. The quarantine system and its intuitive interface allow administrators to (1) easily define policies and create custom lexicons for quarantining email messages, (2) conveniently manage quarantined messages using flexible searching and filtering options, (3) release or delete individual or multiple quarantined messages with one click, (4) review reports that monitor quarantine activities and trends and (5) automate custom notifications informing employees of quarantined messages.

ZixEncrypt also provides greater visibility into an organization’s data risks in email by capturing data in outbound emails and highlighting violations that trigger policy filters to encrypt or quarantine. Through our interactive, real-time interface, companies can monitor their greatest vulnerabilities, generate reports for business executives and train employees about the sensitivity of their company’s data.

ZixEncrypt is available as a physical or virtual on-premises appliance or as a hosted solution.

ZixOne ^® is a unique mobile email app that solves the key IT challenge created by the BYOD trend in the workplace. BYOD describes employee’s use of personal devices to conduct work. ZixOne provides mobile access to corporate email while never allowing that data to be persistently stored on an employee’s device where it is vulnerable to loss or theft. If the device is lost or stolen, an administrator can simply disable access to corporate email from that device through ZixOne.

Unlike other BYOD solutions, ZixOne meets employee demands of convenience, control and privacy while giving companies the ability to secure corporate data and meet compliance needs. With seamless access to work email in a secure, simple-to-use environment, employees can stay productive while preserving device independence. A BYOD solution that is acceptable to employees and yet provides strong data protection for corporate data solves one of today’s greatest IT management challenges.

ZixOne is available as a standalone solution and easily integrates with ZixEncrypt as an add-on solution. A feature in ZixOne is the ability to encrypt an email from your mobile device with the simple slide of an “Encrypt” button, ensuring that sensitive information is secured either by the user or through automatic policies of ZixEncrypt.

In March 2017, Zix acquired Greenview Data Inc. (“Greenview”), an email security company. Zix’s acquisition of Greenview addresses increasing buyer demand for email security bundles by adding advanced threat protection, antivirus, anti-spam and archiving capabilities to its industry-leading email encryption. Greenview is a good fit for Zix’s business based on its employees’ expertise in email security and its emphasis on customer success, which align with Zix’s reputation for delivering industry-leading solutions and a superior experience.

Through the acquisition of Greenview, Zix launched two new solutions in April 2017 – ZixProtect ^SM and ZixArchive ^SM .  ZixProtect defends organizations from zero-day malware, ransomware, phishing, CEO fraud, W-2 phishing attacks, spam and viruses in email with multi-layer filtering techniques. Accuracy in protecting organizations from email threats is increased further with automated traffic analysis, machine learning and real-time threat analysts.

ZixProtect is available as a cloud-based service in three bundles. ZixProtect Essentials includes email threat protection and business email continuity to enable access to emails during service disruption; ZixProtect Plus combines email threat protection and business email continuity with automatic email encryption; and ZixProtect Premium delivers a comprehensive email security solution with email threat protection, business email continuity, email encryption and data loss prevention.

ZixArchive is a low-cost, cloud-based email retention solution that easily enables user retrieval, compliance and eDiscovery. Available as a standalone or add-on solution for ZixEncrypt or ZixProtect bundles, ZixArchive includes policy-based retention, automatic indexing and flexible search capabilities for audit and legal requirements. With on-demand access through the cloud,

15

organizations can conveniently share messages with employees, auditors and outside consultants or legal counsel, as well as revoke access when needed.

Our business operations and service offerings are supported by the ZixData Center™, a PCI DSS 3.2 certified, SOC2 accredited and SOC 3 certified facility. The operations of the ZixData Center are independently audited annually to maintain SOC3 certification in the areas of security, confidentiality, integrity and availability. Auditors also produce a SOC2 report on the effectiveness of operational controls used over the audit period. The ZixData Center is staffed 24 hours a day and has a track record that exceeds 99.99% availability.

Critical Accounting Policies and Estimates

The preparation of financial statements and related disclosures in accordance with accounting principles generally accepted in the United States requires the Company’s management to make estimates and assumptions that affect the amounts reported in the Company’s condensed consolidated financial statements and accompanying notes. Actual results could differ from these estimates and assumptions. Critical accounting policies and estimates are defined as those that are both most important to the portrayal of the Company’s financial condition and results and require management’s most subjective judgments.

We describe our significant accounting policies in Note 2, Summary of Significant Accounting Policies , of the Notes to Consolidated Financial Statements included in our Annual Report on Form 10-K for the year ended December 31, 2016. We discuss our Critical Accounting Policies and Estimates in Management’s Discussion and Analysis of Financial Condition and Results of Operations in our Annual Report on Form 10-K for the year ended December 31, 2016.

Results of Operations

Third Quarter 2017 Summary of Operations

Financial

Operations

16

The increase in revenue was due to the growth inherent in a successful subscription-based business model with both steady additions to the subscriber base and new sales attributable to our Greenview acquisition, coupled with a high rate of existing customer renewals and the realization of previously contracted revenue in our backlog. In the first nine months of 2017, excluding our Greenview sales, we categorized our revenue in the following core industry verticals: 50% healthcare, 28% financial services, 7% government sector, and 15% as other.  In the first nine months of 2016, we categorized our revenue in the following core industry verticals: 52% healthcare, 28% financial services, 7% government sector, and 13% as other.    

Revenue Indicators — Backlog and Orders

Backlog — Our end-user order backlog is comprised of contractually binding agreements that we expect to amortize into revenue as the services are performed. The timing of revenue is affected by both the length of time required to deploy a service and the length of the service contract.

As of September 30, 2017, total backlog was $75.0 million and we expect approximately 61% of the total backlog, or approximately $46.0 million, to be recognized as revenue during the next twelve months. As of September 30, 2017, the backlog was comprised of the following elements: $30.4 million of deferred revenue that has been billed and paid, $7.9 million billed but unpaid, and approximately $36.6 million of unbilled contracts. The backlog at September 30, 2017, was 8% lower than the $81.6 million backlog at the end of the third quarter 2016, and 8% lower than the ending backlog of $81.7 million at December 31, 2016. Our decrease in backlog reflects the shorter term contractual commitment generally associated with our new customer pricing as a component of a higher touch strategy, which contributed a 7% decrease in term length in the quarter. We also had the loss of a large customer in the first quarter 2017, further contributing to the lower backlog.

Orders — Total orders were $14.3 million and $16.5 million for the three-month periods ended September 30, 2017 and 2016, respectively, representing a 14% decrease year-over-year. Total orders include contract renewals, NFYOs, and in the case of new multi-year contracts, amounts attributable to the years beyond the first year of service. As noted above, our decrease in total orders is reflective of our move away from such multi-year contracts in our selling approach. NFYOs were $2.1 million and $1.9 million for the three-month periods ended September 30, 2017 and 2016, respectively, representing an 11% increase year-over-year.

Cost of revenues is comprised of costs related to operating and maintaining the ZixData Center, a field deployment team, customer service and support and the amortization of Company-owned, customer-based computer appliances. The increases in 2017 compared to 2016 reflected in the table above resulted primarily from increases in average headcount expense, which now include our ZixProtect support team gained in the Greenview acquisition in March 2017. We are also incurring costs associated with leased equipment currently supporting Greenview customers and we are amortizing expense resulting from the acquisition of Greenview’s internally developed software. Additional increases relate to standard software maintenance and license support, and depreciation and other expense relating to investments in networking equipment.

17

Research and development expenses consist primarily of salary, benefits, and stock-based compensation for our development staff, independent development contractor expenses, and other direct and indirect costs associated with enhancing our existing products and services and developing new products and services. The increase in 2017 compared to 2016 reflected in the table above resulted primarily from an increase in average headcount, which now includes ZixProtect R&D employees gained in the Greenview acquisition in March 2017.

Selling and marketing expenses consist primarily of salary, commissions, travel, stock-based compensation and employee benefits for selling and marketing personnel as well as costs associated with promotional activities and advertising. The increase in the three months ended September 30, 2017, compared to the same period in 2016, resulted primarily from higher stock-based compensation costs, additional credit card processing fees on customer payments, an increase in bad debt expense, and amortization expense resulting from the acquisition of Greenview’s customer base and brand. These costs were offset by decreased advertising and promotional expense.

In addition to the expenses noted above, the nine month variance in selling and marketing expense includes higher payroll costs related to the enhancement of our product management team, and increased travel.  

General and Administrative Expenses

The following table sets forth the quarter-over-quarter comparison of our general and administrative expenses:

General and administrative expenses consist primarily of salary and bonuses, travel, stock-based compensation and benefits for administrative and executive personnel as well as fees for professional services and other general corporate activities. The decrease in the three months ended September 30, 2017, compared to the same period in 2016 resulted primarily from a $650 thousand reduction in legal fees specific to intellectual property litigation. This decrease was offset by increased headcount and stock-based compensation expenses, the addition of the Greenview office, and investment in an ERP solution.

In addition to the expenses noted above, the nine month variance in general and administrative expense includes a $2.4 million reduction in legal fees specific to intellectual property litigation, decreases in expenses related to the separation of our CFO in 2016, as well as decreases in broker and other professional fees.

18

Provision for Income Taxes

The provision for income taxes was $1.1 million and $858 thousand for the three-month periods ended September 30, 2017 and 2016, respectively, and $3.6 million and $2.3 million for each of the nine months ended September 30, 2017 and 2016. The operating losses incurred by the Company’s U.S. operations in past years and the resulting net operating losses for U.S. Federal income tax purposes are subject to a $46.5 million reserve because of the uncertainty of future taxable income levels sufficient to utilize our net operating losses and credits. Our September 30, 2017, provision of $3.6 million includes $3.2 million in deferred taxes, $150 thousand in state taxes currently payable based on gross revenues, $141 thousand related to the federal Alternative Minimum Tax, and $95 thousand in taxes related to our Canadian operations. Our September 30, 2016, provision of $2.3 million included $1.9 million in deferred taxes, $189 thousand in state taxes then payable based on gross revenues, $105 thousand related to the federal Alternative Minimum Tax, and $100 thousand in taxes related to our Canadian operations.

Our deferred taxes at September 30, 2017, include the recognition of a $495 thousand excess tax deficiency related to stock options exercised during this period. As required by our 2017 implementation of ASU 2016-09, all excess tax benefits and deficiencies are recognized in the period they become deductible on our income tax return. They are not anticipated when determining our annual estimated effective tax rate, but are instead discrete items in the reporting period in which they occur.

No tax penalty-related charges were accrued or recognized for the three month periods ended September 30, 2017 and 2016. Additionally, we have not taken a tax position that would have a material effect on our financial statements or our effective tax rate for the three-month period ended September 30, 2017. We are currently subject to a three-year statute of limitations by major tax jurisdictions.

At September 30, 2017, the Company partially reserved its U.S. net deferred tax assets due to the uncertainty of future taxable income being sufficient to utilize net loss carryforwards prior to their expiration, as noted above. The Company did not reserve $40.9 million of its U.S. net deferred tax assets. The majority of this unreserved portion related to $36.1 million in U.S. net operating losses (“NOLs”) because we believe the Company will generate sufficient taxable income in future years to utilize these NOLs prior to their expiration. The remaining balance consists of $1.6 million relating to temporary differences between GAAP and tax-related expense, $1.8 million relating to U.S. state income tax credits and net operating loss carryovers, and $1.4 million related to Alternative Minimum Tax credits.

Any reduction to the $46.5 million valuation allowance related to our deferred tax asset would be based on an assessment of future utilization following accounting guidance, which relies largely on historical earnings. Using this methodology, and updating the future taxable earnings estimates based on first, second, and third quarter 2017 actual earnings, the Company believes the deferred tax asset allowance as of December 31, 2016, will remain unchanged at December 31, 2017. For this reason, the Company has recognized its first, second, and third quarter 2017 federal deferred tax provision in full. If in future periods we conclude our future U.S. federal taxable estimate established at the end of the year will exceed the prior year estimate, the Company will offset its federal deferred tax provision by reducing its valuation allowance by an equal amount, thereby eliminating from its deferred tax provision federal taxes in excess of the estimated Alternative Minimum Tax from the Company’s financial statements. Significant judgment is required in determining any valuation allowance recorded against the deferred tax asset. In assessing the need for such an allowance, we consider all available evidence, including past operating results, estimates of future taxable income, and the feasibility of tax planning strategies. The Company will continue to reevaluate the need for its valuation allowance each quarter, following the same assessment methodology described above. Adjusting our valuation allowance could have a significant impact on operating results for each period during which it becomes more likely than not that an additional portion of our deferred tax assets will or will not be realized.

We have determined that utilization of existing net operating losses against future taxable income is not currently subject to limitation by Section 382 of the Internal Revenue Code. Future ownership changes, however, may limit the Company’s ability to fully utilize its existing net operating loss carryforwards against future taxable income.

Net Income

Our net income for the three months ended September 30, 2017, of $1.9 million was an increase of $0.1 million compared to our net income of $1.8 million for the same period last year, representing an 8% increase. The increase in our net income was due to our increase in revenue, offset by corresponding increase in cost of sales and higher research and development and selling and marketing expenses, as discussed above.

19

Liquidity and Capital Resources

Overview

Based on our performance over the last four quarters and current expectations, we believe our cash and cash equivalents and cash generated from operations will satisfy our working capital needs, capital expenditure requirements, investment requirements, contractual obligations, commitments, future customer financings, and other liquidity requirements associated with our operations through at least the next twelve months. We plan for and measure our liquidity and capital resources through an annual budgeting process.  During the first nine months of 2017, net cash provided by operations was $14.0 million, an increase of 6% compared to the $13.2 million of net cash provided by operations in the first nine months of 2016. At September 30, 2017, our cash and cash equivalents totaled $32.8 million, an increase of $6.3 million from the December 31, 2016 balance, and we had no debt. This $6.3 million increase in our cash position included our expenditure of $8.2 million, net of cash acquired, in the first nine months of 2017 related to our Greenview and EMS technology acquisitions, as discussed elsewhere herein.

Our primary source of liquidity from our operations is the collection of revenue in advance from our customers and collection of accounts receivable from our customers, net of the timing of payments to our vendors and service providers.

Our investing activities in the first nine months of 2017 consisted of $8.2 million, net of cash acquired, used in the acquisition of Greenview and EMS technology. We additionally purchased $1.8 million of computer and networking equipment, including Greenview equipment with a provisional fair value of $228 thousand. In the first nine months of 2016, our spending was primarily computer and networking equipment purchases to improve our capacity to provide hosting services.

Financing activities in the first nine months of 2017 include the receipt of $4.2 million from the exercise of stock options offset by $1.3 million used in a $10.0 million share repurchase program authorized by our board of directors in April 2017, and $543 thousand used in the repurchase of common stock related to the tax impact of vesting restricted awards. Cash received from financing activities in the first nine months of 2016 included the receipt of $155 thousand from the exercise of stock options offset by $15.0 million used in a $15.0 million share repurchase program authorized by our board of directors in January 2016, and $499 thousand used in the repurchase of common stock related to the tax impact of vesting restricted awards.

Options of Zix Common Stock

We have significant stock options outstanding that are currently vested. There is no assurance that any of these options will be exercised; therefore, the extent of future cash inflow from additional option activity is not certain. The following table summarizes the options that were outstanding as of September 30, 2017. The vested shares are a subset of the outstanding shares. The value of the shares is the number of shares multiplied by the exercise price for each share.

Off-Balance Sheet Arrangements

None.

20

Contractual Obligations, Contingent Liabilities and Commitments  

A summary of our fixed contractual obligations and commitments at September 30, 2017, is as follows:

We have not entered into any material, non-cancelable purchase commitments at September 30, 2017.

We have severance agreements with certain employees which would require the Company to pay approximately $6.1 million if all such employees were separated from employment with our Company following a triggering event (e.g., change of control) as defined in the severance agreements.