Form S-1 Registration Statement

Title of Each Class of

Securities to be Registered

Proposed Maximum

Aggregate

Offering Price ⁽¹⁾

Amount of
Registration Fee

Common Stock $0.001 par value

(Address, including zip code, and telephone number, including area code, of Registrant’s principal executive offices)

(Name, address, including zip code, and telephone number, including area code, of agent for service)

Approximate date of commencement of proposed sale to the public: As soon as practicable after the effective date of this Registration Statement.

If any of the securities being registered on this Form are to be offered on a delayed or continuous basis pursuant to Rule 415 under the Securities Act of 1933, as amended (the “Securities Act”), check the following box. ¨

If this Form is filed to register additional securities for an offering pursuant to Rule 462(b) under the Securities Act, please check the following box and list the Securities Act registration statement number of the earlier effective registration statement for the same offering. ¨

If this Form is a post-effective amendment filed pursuant to Rule 462(c) under the Securities Act, check the following box and list the Securities Act registration statement number of the earlier effective registration statement for the same offering. ¨

If this Form is a post-effective amendment filed pursuant to Rule 462(d) under the Securities Act, check the following box and list the Securities Act registration statement number of the earlier effective registration statement for the same offering. ¨

If delivery of the prospectus is expected to be made pursuant to Rule 434, please check the following box. ¨

The Registrant hereby amends this Registration Statement on such date or dates as may be necessary to delay its effective date until the Registrant shall file a further amendment which specifically states that this Registration Statement shall thereafter become effective in accordance with Section 8(a) of the Securities Act of 1933 or until the Registration Statement shall become effective on such date as the Commission acting pursuant to said Section 8(a) may determine.

The information in this prospectus is not complete and may be changed. We may not sell these securities until the registration statement filed with the Securities and Exchange Commission is effective. This prospectus is not an offer to sell securities and it is not soliciting an offer to buy these securities in any state where the offer or sale is not permitted.

This is an initial public offering of shares of common stock by Brightmail Incorporated. Brightmail is selling shares of common stock. The estimated initial public offering price is between $ and $ per share.

We have applied for quotation of our common stock on the Nasdaq National Market under the symbol BRML.

Brightmail has granted the underwriters an option for a period of 30 days to purchase up to additional shares of common stock.

Investing in our common stock involves a high degree of risk. See “ Risk factors” beginning on page 7.

Neither the Securities and Exchange Commission nor any state securities commission has approved or disapproved of these securities or determined if this prospectus is truthful or complete. Any representation to the contrary is a criminal offense.

You should rely only on the information contained in this prospectus. We have not authorized anyone to provide you with different information. We are not making an offer of these securities in any state where the offer is not permitted. You should not assume that the information contained in this prospectus is accurate as of any date other than the date on the front of this prospectus.

You should read the following summary together with the entire prospectus, including the more detailed information in our consolidated financial statements and related notes appearing in the back of this prospectus. You should carefully consider, among other things, the matters discussed in “Risk Factors.” Throughout this prospectus, we refer to Brightmail Incorporated as the “company,” “we,” “our” and “us,” unless otherwise indicated.

Brightmail is a leading provider of electronic messaging security software and services to enterprises and messaging service providers worldwide, currently protecting approximately 25% of all mailboxes globally. Our proprietary software platform provides flexible, scalable and dynamic anti-spam, anti-virus and related messaging security solutions to protect our customers’ email and electronic messaging infrastructure by effectively identifying and disposing of unwanted or malicious messages while accurately allowing delivery of legitimate messages. Our software installs easily and quickly and provides administration, customization and policy management capabilities. As a result, we provide our customers with a secure and improved messaging environment, allowing them to realize workforce productivity gains and more efficiently utilize their technology infrastructure.

We market our products and services through the combination of our indirect sales channels, including distributors, resellers, business outsourcing and hosted service providers, large global systems integrators, original equipment manufacturers and appliance vendors, as well as through the efforts of our direct sales organization. We provide our customers with software updates approximately every ten minutes drawing upon our proprietary Probe Network, which monitors evolving messaging threats in real-time. Our software, which is available solely on a subscription basis, can support numerous hardware configurations, operating systems and messaging applications and infrastructure, and is delivered as stand-alone software, integrated into third party appliance solutions or as a hosted service. From 1999, when we first introduced our products and services, through March , 2004, our customer base has grown to over 2,000 customers, with an aggregate over 300 million end-user mailboxes under subscription.

• Brightmail Anti-Spam. Brightmail Anti-Spam is our flagship product and is typically deployed at the Internet gateway, where email enters a customer’s core network. It effectively identifies and filters unsolicited or unwanted electronic messages while reducing the number of blocked legitimate emails, or false positives, to less than one message in one million. Our core anti-spam engine uses multiple proprietary technologies, a globally deployed detection network and a dynamic rule delivery mechanism. Brightmail Anti-Spam incorporates a multi-faceted approach to spam detection, including filtering based on the message source, content or embedded directives, which attempt to induce recipients to visit specific website addresses or dial phone numbers embedded within the message.

• Brightmail Anti-Virus. Brightmail Anti-Virus is a module that customers may license in conjunction with Brightmail Anti-Spam. This anti-virus module, which incorporates certain anti- virus technology from Symantec Corporation, scans message attachments for viruses and other malicious code and delivers anti-virus signature updates to customers automatically and securely.

• Brightmail Reputation Service. Brightmail Reputation Service provides businesses with an additional level of security against messaging security threats and is currently offered in conjunction with our anti-spam product. Using data from our Probe Network, this service tracks message and spam flow in real time from hundreds of thousands of email sources and automatically creates profiles for each email source, permitting customers to block messages from identified sources.

• Brightmail Anti-Fraud. Brightmail Anti-Fraud is designed to protect established businesses from fraudulent emails that mimic legitimate corporate communications for the purposes of stealing financial or personal information. Brightmail Anti-Fraud acts as an early detection system by utilizing the information collected by our Probe Network to proactively monitor whether an anti-fraud customer’s brand is being fraudulently used in messages.

• Customer service and support. With each subscription, customers receive support and maintenance services, including access to customer service professionals, technical support, software upgrades and updates, delivery of filtering rules and rules updates and an online repository of information about our products and services.

We believe that the following industry factors are important in order to understand the growth potential for our business:

• Electronic messaging has become a ubiquitous communication tool and a mission critical application for the conduct of business.

• The existing electronic messaging infrastructure is susceptible to security attacks that threaten the utility of electronic messaging.

• The proliferation of spam is one of the most severe and challenging electronic messaging security threats faced by businesses today, as hackers and spammers increasingly use spam to advertise, introduce viruses into business networks and steal confidential information. According to International Data Corporation, spam as a percentage of overall Internet email traffic will grow from 35% in 2002 to 67% in 2007.

• Spam is a dynamic problem because spammers rapidly evolve techniques to circumvent efforts aimed at stopping them.

• Spam inflicts costs and harm to businesses through lost productivity, false positives, strain on IT resources, damage to corporate brands, increased risk of workplace liabilities and increased customer churn for service providers.

• The international portability of spam operations and the ability of spammers to remain anonymous, in addition to the fact that governments have difficulty prosecuting across jurisdictions, means that an effective technology solution, in addition to legislation, is necessary to address the spam problem.

• High effectiveness. Our messaging security technologies employ multiple proprietary techniques that enable us to quickly and dynamically identify, analyze and address messaging threats in real-time.

• High accuracy (low false positives). Our low false positive rate enables customers to elect to have Brightmail automatically delete potentially unwanted or malicious messages, providing cost savings in bandwidth, network, storage and personnel.

• Low total cost of ownership. Our software requires minimal consulting or in-house resources to install and implement. Once implemented, our automated processes analyze the latest threat trends and provide updates to filters, rules and definitions in real-time.

• Cross-platform flexibility. Our software can support numerous operating systems, messaging applications and messaging protocols. We also deliver our solution as stand-alone software or integrated as an appliance or hosted service through our distribution channels.

• High performance and scalability. Brightmail Anti-Spam is scalable to a virtually unlimited number of mailboxes and is built to efficiently meet the high volume messaging demands of large messaging service providers as well as the requirements of small businesses. Furthermore, our filtering technology has only a minimal impact on message transmission time regardless of total volume.

• Customizable filtering and administration. Our software is customizable to the customer’s preferences with respect to the treatment of unwanted or malicious messages. Rules can be written or modified to customize the software for individual groups, departments or divisions.

Our strategy is to become the leading provider of messaging security products and services to businesses worldwide. In order to execute on this strategy, we endeavor to:

• Extend product and technology leadership. We plan to continue improving our products, services and technology and expanding our solution offerings through internal development, third party solution providers and, potentially, strategic acquisitions.

• Expand geographic coverage. We seek to broaden our existing customer base in international markets where spam growth is high but solution adoption is low. In particular, we will pursue large messaging service providers and Global 2000 accounts in Asia Pacific and Europe, Middle East and Africa.

• Extend leveraged sales channel. We intend to expand sales coverage through the indirect sales channel of distributors, resellers, business outsourcing and hosted service providers, large global systems integrators, original equipment manufacturers and appliance vendors, as well as through our direct sales professionals.

• Leverage installed base of existing customers. We plan to leverage our large and diverse customer base by cross-selling additional products. We believe there is a significant opportunity to market new messaging security products and services to our existing customers.

• Encourage development of third-party applications for our software platform. We will continue to offer our Software Development Kit to enable the integration of third-party products and services and to foster the development of new applications.

• We plan to invest substantially in the expansion of our operations and may incur significant operating losses in the future.

• Our products may become obsolete due to rapid technological change in the messaging security market.

• If we become unable to utilize our Probe Network of decoy email accounts or if the security of the Probe Network is compromised, the effectiveness of our product would be adversely affected.

• We rely upon third parties, such as Symantec Corporation, for technology that is critical to our products. If we are unable to continue to use these technologies, our ability to sell or continue to support subscriptions to our products and services would be limited and our operating results could be harmed.

• We depend on a small number of customers for a significant portion of our revenues. If we fail to retain or expand customer relationships, our revenues could decline.

• Because we generate substantially all of our revenue from two product lines, a reduction in sales from those product line would harm our business and operating results.

• System failures, power outages, interruptions or delays in Internet and data center services from our third party providers could impair the delivery of our products and services and harm our business.

• We are dependent upon our distribution channels for a substantial portion of sales of our products, and we would be adversely affected if these relationships are terminated or diminished.

We were incorporated in California as BrightLight Technologies Inc. in 1998, and changed our name to Brightmail in 2000. Prior to the completion of the offering, we will reincorporate as a Delaware corporation. Unless the context indicates otherwise, as used in this prospectus, the terms “we,” “us,” “our,” “Company,” and “Brightmail” refer to Brightmail Incorporated, a Delaware corporation, and its subsidiaries and, prior to our reincorporation in Delaware, Brightmail Incorporated, a California corporation, and its subsidiaries. Our principal executive offices are located at 301 Howard Street, Suite 1800, San Francisco, California 94105. Our telephone number at that location is (415) 905-5595. Our website address is www.brightmail.com. This is a textual reference only. We do not incorporate the information on our website into this prospectus, and you should not consider any information on, or that can be accessed through, our website as part of this prospectus.

BRIGHTMAIL is our registered trademark and EMAIL YOU CAN TRUST is our registered service mark. Probe Network, BLOC, Messaging You Can Trust, BrightSig and The Anti-Spam Leader are our trademarks, and Messaging You Can Trust is our service mark. Trade names, trademarks and service marks of other companies appearing in this prospectus are the property of the respective holders.

We intend to use the net proceeds of this offering for general corporate purposes, including working capital and capital expenditures, and potential investments and acquisitions.

The number of shares of our common stock to be outstanding immediately after this offering is based on shares of common stock outstanding as of February 29, 2004. This information excludes:

• 6,822,718 shares of common stock issuable upon the exercise of outstanding stock options as of February 29, 2004, with exercise prices ranging from $0.05 to $0.95 per share and a weighted average exercise price of $0.78 per share;

• 73,099 shares of common stock issuable upon the exercise of warrants outstanding as of February 29, 2004, with exercise prices ranging from $1.50 to $5.02 per share and a weighted average exercise price of $2.82 per share;

• shares of common stock to be available for issuance under our 2004 Equity Incentive Plan, and shares of common stock to be available for issuance under our 2004 Employee Stock Purchase Plan, each plan to be effective upon the completion of this offering. The 2004 Equity Incentive Plan and the 2004 Employee Stock Purchase Plan each contain a provision that automatically increase their share reserve each year, as more fully described in “Management—Benefit plans.”

Except as otherwise indicated in this prospectus, the number of shares of common stock to be outstanding after the offering assumes the following:

• the conversion of all outstanding convertible preferred stock into 20,939,375 shares of common stock upon the closing of the offering;

• the underwriters’ over-allotment option will not be exercised to purchase additional shares in this offering; and

We expect to effect a reverse stock split prior to completion of this offering. Share and per share numbers in this registration statement do not give effect to such reverse stock split.

The following tables summarize consolidated financial data regarding our business and should be read together with “Management’s discussion and analysis of financial condition and results of operations” and our consolidated financial statements and the related notes included elsewhere in this prospectus.

Pro forma balance sheet data reflect the conversion of all of the convertible preferred stock into common stock, which will occur if all criteria described in note 4 to our consolidated financial statements are met, upon the closing of this offering.

Pro forma as adjusted balance sheet data reflect our sale of shares in this offering and the receipt of the estimated net proceeds from this offering at an assumed initial public offering price of $ per share, after deducting estimated underwriting discounts and commissions and estimated offering expenses payable by us.

Investing in our common stock involves a high degree of risk. You should carefully consider the following risk factors, as well as all other information in this prospectus, before deciding whether to invest in shares of our common stock. If any of the following risks actually occurs, our business and operating results could suffer and you might lose all or part of your investment in our common stock. The risks described below are not the only ones we face. Additional risks that we currently do not know about or that we currently believe to be immaterial may also impair our business operations.

Although we have reported net income for a limited period of time, we plan to invest substantially in expansion of our operations and may incur significant operating losses in the future, which makes our business difficult to evaluate and predict.

We experienced substantial operating losses from our inception in February 1998 through the third quarter of our fiscal year ended January 2003 and only achieved profitability on an annual basis in fiscal 2004. In fiscal 2002 and 2003, we reported net losses of approximately $10.8 million and $5.0 million, respectively, and we had an accumulated deficit of $38.8 million at January 31, 2004. In the future, we expect to increase our operating expenses as we invest to expand our operations, and based upon the amount of deferred stock-based compensation as of January 31, 2004, we expect to amortize approximately $1.4 million in deferred stock-based compensation over the next four years. We expect these expenses and amortization charges to result in a net loss in fiscal 2005 and potentially in future periods, and future losses could be substantial. Our ability to sustain profitability is dependent on a number of factors, including:

• our ability to develop, upgrade and maintain new and existing products and services and to effectively respond to the rapid technology change in the messaging security market;

• the growth, if any, in enterprise and service provider purchases and use of our products and services and the growth of the messaging security market generally;

• the volume of sales of our products and services by our strategic partners, distribution partners and resellers;

• our ability to successfully manage the expansion of our operations, including the hiring of additional employees both in the United States and internationally and the expansion of our international distribution channels; and

You should not consider recent quarterly revenue growth as indicative of our future performance. In fact, in future quarters we may not have any revenue growth, and our revenues could decline. Furthermore, if our operating expenses exceed our expectations, our financial performance will be adversely affected.

If we experience significant fluctuations in our operating results or fail to meet revenue and earnings expectations, our stock price may fall.

Due to our limited operating history and the unpredictability of the developing messaging security industry, we may not be able to accurately forecast our future operating results. We base

our current and future expense levels on estimates of future revenues. Our expenses are to a large extent fixed in the short term, and we expect that these expenses will increase in the future. We may not be able to adjust our spending quickly enough if our revenues fall short of our expectations.

• releases of new versions of our products and product upgrades, and the effect those new product releases will have on our ability to retain existing customers and to win new customers;

• reduced demand for our anti-spam, anti-virus and other products and services;

• significant increases in expenses to drive the growth of our business and international expansion, which may not yield corresponding increases in revenue;

• the concentration of annual year-end renewal dates of our customers’ subscription contracts, at which point our customers may elect not to renew;

• fluctuations in currency exchange rates, particularly as we expand our international operations.

As a result, revenue growth may not be sustainable and may decrease in the future, and our earnings may be harmed. We believe that period-to-period comparisons of our historical operating results may not be meaningful, and you should not rely on them as an indication of future performance.

Our products may become obsolete due to rapid technological change in the messaging security market.

• the proliferation of new and changing methods of distributing spam and other messaging threats;

These characteristics of our market create significant risks and uncertainties for our business success. Our competitors might introduce products with better performance, higher effectiveness and better accuracy. Numerous service providers and vendors have also announced that they are developing or considering developing an email authentication system to enhance the effectiveness of their spam filtering products by blocking emails that obscure the identify of the sender of an email. Additionally, new software operating systems, hardware or messaging security industry standards could emerge. We may not be successful in either developing appropriate modifications and enhancements to our products and services or in timely bringing them to market. Furthermore, uncertainties about the timing and nature of new network platforms or technologies, or modifications to existing platforms or technologies, could increase our product development expenses. Our existing products might be incompatible with some or all of such standards or if such new standards are successful in eliminating messaging threats, the

demand for our products could significantly decrease. Our business and operating results could materially suffer unless we are able to respond quickly and effectively to these developments.

If we become unable to utilize our Probe Network of decoy email accounts or if the security of the Probe Network is compromised, the effectiveness of our products and services would be adversely affected.

The effectiveness of our messaging security products and services depends on the continued operation and expansion of our Probe Network, which collects data from over a million decoy email addresses and enables us to identify, analyze and provide filter updates as spam attacks occur. We have relationships with third parties pursuant to which we deploy decoy email accounts in our Probe Network, which represent a major source of our decoy email accounts. Our product development efforts and the creation of filtering rules and other proprietary technology are dependent upon the information we obtain from the Probe Network. Despite the efforts we take to maintain and protect the security of the Probe Network, if originators of spam, virus or other messaging threats were to obtain access to the identities of, or other information regarding, our decoy email addresses, the value of our Probe Network would be compromised. In this event, the effectiveness of our products would likely decrease and we could lose customers and sales, thereby causing our revenues to decline and our operating results to suffer.

The market in which we participate is intensely competitive, and if we do not compete effectively, our operating results could be harmed.

The market for network security solutions, including messaging security products and services, is intensely competitive and rapidly changing. Barriers to entry into this market are relatively low, many of our competitors are larger and have more resources than we do, and with the introduction of new technologies and market entrants, we expect competition to intensify in the future. Many of our current and potential competitors enjoy substantial competitive advantages, such as greater name recognition, longer operating histories, larger research, development and marketing budgets as well as substantially greater financial, technical and other resources. In addition, many of our current and potential competitors have access to larger customer bases and have more extensive marketing and distribution arrangements with resellers, distributors and original equipment manufacturers, or OEMs, than we do. As a result, our competitors may be able to respond more quickly and effectively than we can to new or changing opportunities, technologies, standards or customer requirements. Furthermore, because of these advantages, even if our products are more effective than the products that our competitors offer, potential customers might accept competitive products in lieu of purchasing our products.

We face competition from businesses that develop their own anti-spam and other messaging security technology, as well as from enterprise software vendors and online service providers who develop or bundle anti-spam, anti-virus and other messaging security technology with their other products. Our current and potential principal competitors include:

• pure-play messaging security vendors such as CipherTrust, Inc. and Postini Corporation;

• IT security and anti-virus vendors such as Network Associates, Inc., Symantec Corporation and Trend Micro Inc.; and

In addition, we may face competition from large enterprise network infrastructure and software vendors such as Cisco Systems and Microsoft as they diversify their product offerings.

We believe that we compete principally on the basis of solution effectiveness, a low false positive rate, total cost of ownership and flexibility. In particular, we view our low false positive rate as a critical competitive factor. If we are unable to maintain our low false positive rate and continue to block a high percentage of spam, we may lose customers and be unable to maintain our market share.

Major vendors of enterprise software or hardware may decide to bundle anti-spam, anti-virus or other messaging security products as components or standard features of their broader product offerings, which could enable these competitors to provide their anti-spam, anti-virus or other messaging security products at deep discounts or at no additional cost. Some of our principal competitors offer their products at a lower price, which has resulted in pricing pressures on our products. This could render our products obsolete or unmarketable, particularly if the products offered by these vendors were comparable or superior to our products. If we are unable to maintain our current market share or pricing, our business and operating results would be negatively impacted. In addition, pricing pressures and increased competition generally could result in reduced sales, reduced margins or the failure of our products and services to achieve or maintain more widespread market acceptance, any of which could harm our business.

We depend on a small number of customers for a significant portion of our revenues. If we fail to retain or expand customer relationships, our revenues could decline.

We derive a significant portion of our revenues from a small number of customers, and we anticipate that we will continue to do so in the foreseeable future. The top 5% of our customers comprised 85% of our total revenues in fiscal 2004. These customers may decide not to renew their subscriptions of our products and services, to terminate their agreements prior to the end of the subscription period or to reduce the size of their subscriptions. In addition, because we price our products on a sliding scale based on the number of mailboxes or users a customer has, consolidation within our customer base could adversely affect our revenues.

We also depend on our relationship with Microsoft Corporation, which is our largest customer, representing over 10% of our total revenues for the fiscal year ended January 31, 2004. Microsoft announced in November 2003 that it developed an anti-spam technology that it will sell as part of its Exchange Server 2003. Our primary agreement with Microsoft expires in December 2005, subject to interim non-renewal rights. If this agreement is terminated or if we are unable to extend the term of this agreement, our business and operating results could be materially and adversely affected. Because of the large amount of revenues we derived from this agreement and our model of amortizing our revenues over the applicable subscription term, it will be difficult for us to rapidly increase our revenues through additional sales in any period to replace any lost revenues from Microsoft.

We rely upon third parties, such as Symantec Corporation, for technology that is critical to our products. If we are unable to continue to use these technologies, our ability to sell or continue to support subscriptions to our products and services would be limited and our operating results could be harmed.

Our products and services rely on software and technology that we license from third parties and are integrated with internally developed software. For example, we rely upon certain of

Symantec’s anti-virus technology as the engine for our anti-virus product, and we estimate that sales of our anti-virus module under this agreement represented approximately 20% of our total revenues for the fiscal year ended January 31, 2004. In addition, prior to this offering, Symantec owned approximately 13% of our common stock, and one of Symantec’s officers is on our board of directors. Our agreement with Symantec relating to certain of its anti-virus technology has a three-year term expiring in July 2005. In addition, Symantec has the right to terminate this agreement upon the occurrence of certain events, including if we are subject to a change in control transaction, or if we transfer more than 25% of our voting control or substantially all of our assets to a Symantec competitor. If our agreement with Symantec were to terminate, we would be required to license an anti-virus technology from another third party in order to sell an integrated anti-spam and anti-virus product. If we are unable to do so in a timely manner, our business and operating results would be harmed.

Our loss of license to or the inability to support, maintain and enhance software products we license from third parties could result in a requirement that our customers upgrade their Brightmail products, in increased costs and delays or reductions in our product sales and support until we are able to develop functionally equivalent software or identify and obtain licenses to alternative third party software with comparable functionality, which we may be unable to do. As a result, our margins, market share and operating results could be significantly harmed. If any of these events occur, our business and operating results could be materially and adversely affected.

We also incorporate open source code software into our products. Open source code imposes additional limitations on our ability to commercialize our products because, among other reasons:

• open source license terms may be ambiguous and may result in unanticipated obligations regarding our products;

• it may be difficult for us to accurately determine the developers of the open source code and whether the acquired software infringes third party intellectual property rights.

Because we generate substantially all of our revenues from two product lines, a reduction in sales from those product lines would harm our business and operating results.

Historically, we have derived substantially all of our revenues from subscriptions to our anti-spam and anti-virus product offerings. Although we have begun to offer more comprehensive messaging security software and services, we expect our anti-spam and anti-virus products will continue to account for the largest portion of our sales for the foreseeable future. Because of this revenue concentration, our business would be harmed by a decline in demand for, or in the prices of, these products. Factors that could affect demand or prices include any change in our pricing model, increased competition, technological change, lower growth or a contraction in the worldwide demand for anti-spam or anti-virus software technology, maturation in the markets for these products or other risks described in this document. The occurrence of any of these events could have a material adverse effect on our business and operating results. In addition, any efforts to expand beyond our existing products may never result in significant revenue growth for us and may divert management resources from existing operations and require us to commit significant financial resources to an unproven business, which may harm our business and operating results.

Defects in our products could diminish demand for our products and services and cause us to lose customers.

Because our products and services are complex, they may have errors or defects that users identify after they begin using them, which could harm our reputation and our business. In particular, our anti-spam products may identify some legitimate emails as unwanted or unsolicited spam, or we may not be able to filter out a sufficiently high percentage of unsolicited or unwanted messages sent to the email accounts of our customers. Complex software products like ours frequently contain undetected errors when first introduced or when new versions or enhancements are released. In addition, we may be unable to respond in a prompt manner, or at all, to new methods of attacking a messaging system, such as new spamming techniques or virus attacks. We have from time to time found defects in our products and errors in our existing products may be detected in the future. Any such errors, defects or other performance problems could impact the perceived reliability of our products and services and hurt our reputation. If that occurs, customers could elect not to renew or terminate their subscriptions and we could lose future sales. In addition, while our subscription agreements typically contain provisions that limit our liability to our customers, these limitations may not be enforced in certain circumstances and we may be liable for lost business or other claims by our customers if our products do not perform as expected.

System failures, power outages, interruptions or delays in Internet and data center services from our third party providers could impair the delivery of our products and services and harm our business.

Our corporate headquarters, out-sourced data center and other third party service providers are located in northern California, a region known for seismic activity. Consequently, Internet and data center services we receive are subject to damage or interruption from earthquakes, as well as from floods, fires, power loss, telecommunications failures and similar events. Our back-up operations center in Sacramento has not yet been established and may be inadequate once it is established, and our business interruption insurance may not be enough to compensate us for any losses that may occur. The Internet and data center services are also subject to sabotage, intentional acts of malfeasance and similar misconduct. Despite precautions taken by Internet service providers and data centers, the occurrence of a natural disaster or other unanticipated problems at the facilities of our third party providers or our headquarters could result in unanticipated interruptions in Internet and data center services and consequently cause delays in our customers’ access to the products and services we provide. Interruptions in our products and services may reduce our revenue, cause customers to terminate their subscriptions, adversely affect our renewal rates and delay product sales. Our business will be harmed if our customers and potential customers believe our products and services are unreliable.

Because we recognize revenues from subscriptions for our products and services over the term of the subscription, downturns or upturns in sales may not be immediately reflected in our operating results, which makes our business more difficult to evaluate. In addition, our ability to renew our contracts with our customers will have an important impact on our business.

Our customers subscribe to use our products and services for a limited duration of time with all version, software and filtering rules updates included, as opposed to purchasing a single version of traditional software with perpetual access to only one version. We recognize revenues from our customers monthly over the terms of their subscription agreements, which are typically 12 to

24 months. As a result, much of the revenues we report in each quarter are deferred revenue from subscription agreements entered into during previous quarters. Consequently, a decline in new or renewed subscriptions in any one quarter will not necessarily be fully reflected in the revenues recognized in that quarter and will negatively affect our revenues recognized in future quarters. In addition, we may be unable to adjust our cost structure to reflect these reduced revenues. Accordingly, the effect of significant downturns in sales and market acceptance of our products and services may not be fully reflected in our results of operations until future periods. Our subscription model also makes it difficult for us to rapidly increase our revenues through additional sales in any period, as revenues from new customers must be amortized over the applicable subscription term.

In addition, historically, a high percentage of our customer contracts are executed and have their subscription terms end at the end of each calendar year. As a result, we expect a substantial portion or our customer contracts to come up for renewal at the end of each calendar year, so any material increase in our non-renewal rates would first be apparent in our fourth fiscal quarter. We have limited historical data with respect to rates of customer subscription renewals and terminations, so we cannot accurately predict customer renewal or termination rates.

We are dependent upon our distribution channels for a substantial portion of sales of our products, and we would be adversely affected if these relationships are terminated or diminished.

A substantial portion of our product sales is made through value-added resellers, systems integrators, OEMs and other partners. Our operating plan assumes that the percentage of our total revenues generated by our resellers and distributors will increase over time. Because we have limited visibility into demand changes in the market segments in which our channel partners operate, reliance on these channels causes more uncertainties in our business and increases the risk that we may not plan effectively for the future, which could result in adverse operating results in future periods. When our channel partners sell our products and services, these partners are responsible for most aspects of the relationship with the end customer. As such, we may not become aware of issues or dissatisfaction with our products and services, which could result in lost business and damage to our reputation.

Our channel partners may also offer our competitors’ products, and our agreements with our channel partners may be terminated by them or by us without cause on the anniversary of the agreement. Their decisions to sell our products are partly a function of pricing, terms and special promotions offered by us and our competitors and other factors that we do not control and cannot predict. We would be adversely affected if our partners chose to sell greater amounts of competitive offerings relative to the amount they sell of our offerings. In addition, we sell our products through OEMs who bundle our products with other products in a hardware device. We continuously seek to establish new OEM relationships and, conversely, may encounter OEMs that decide to replace our messaging security anti-spam software with a competitor’s product. If we lose an OEM relationship, our sales could be adversely affected. In addition, some of our distribution partners have experienced financial difficulties in the past, and others may experience financial difficulties in the future. If these partners do experience financial difficulties, we may experience reduced sales or increased write-offs, which would adversely affect our operating results.

If we acquire companies or technologies in the future, they could prove difficult to integrate, disrupt our business, dilute stockholder value and adversely affect our operating results.

We may acquire or make investments in complementary companies, services and technologies in the future. We have not made any acquisitions or investments to date, and therefore our ability as an organization to make acquisitions or investments is unproven. Acquisitions and investments involve numerous risks, including:

• difficulties in integrating operations, technologies, services and personnel;

• inability to generate sufficient revenues to offset acquisition or investment costs; and

Acquisitions could also require us to record substantial amounts of goodwill and other intangible assets. Any future impairment of such goodwill, and the amortization of other intangible assets, would adversely affect our operating results. In addition, if we finance acquisitions by issuing convertible debt or equity securities, our existing stockholders may be diluted which could affect the market price of our stock. If we finance such acquisitions with bank debt or high yield debt, these arrangements would impose substantial operating covenants and result in interest expense that could adversely affect our business and operating results. As a result, if we fail to properly evaluate and execute acquisitions or investments, our business and operating results may be seriously harmed.

International sales expose us to additional risks that have potential to adversely affect our business and operating results.

During fiscal 2003 and 2004, approximately 8% and 14%, respectively, of our recognized revenues were derived from sales to customers outside the United States, and in the future, we plan to invest aggressively to expand our international sales efforts. International operations and sales subject us to risks and challenges that we would otherwise not face if we conducted our business only in the United States. The risks and challenges associated with operations and sales to customers outside the United States include:

• localization of our products and services, including translation of the interface of our products into foreign languages, development of technology to identify, assess and analyze messages written in foreign languages, creation of localized agreements and associated expenses;

• a largely unproven market for our products and services outside of the United States;

• compliance with multiple, conflicting and changing governmental laws and regulations, including employment, tax, privacy and data protection laws and regulations;

• our ability to adapt sales practices and customer requirements in different cultures;

• longer accounts receivable payment cycles and other collection difficulties; and

Most of our international subscription fees are currently payable to us in U.S. dollars. If we successfully expand our international sales, we expect that the percentage of subscription fees payable in foreign currencies will increase. Consequently, our potential exposure from fluctuations in the value of the U.S. dollar and foreign currencies could increase. Currently, we do not hedge our exposure to currency fluctuations. Fluctuations in the value of the U.S. dollar and foreign currencies may make our products more expensive for international customers, which could harm our business. If we fail to realize increased sales from our investment in expanded international operations, our business and operating results will be adversely affected.

Computer hackers may damage our products, services and systems, which could cause interruptions in our service and harm to our business.

From time to time we and our customers may be targets of computer hackers who, among other things, create viruses to sabotage or otherwise attack companies’ products and services. For example, there was recently a spread of viruses, or worms, that intentionally deleted anti-virus and firewall software. Also, a number of websites and systems have been subject to denial of service attacks, where a website is bombarded with information requests eventually causing the website and system to overload, resulting in a delay or disruption of services. Our website, system, products and services, as well as our customers’ websites and systems, may be the subject of attacks by hackers. If successful, any of these events could damage users’ or our computer systems and result in an interruption of the provisioning of our products and services, force us to incur substantial costs to fix technical problems or result in hackers gaining access to our technical and other proprietary information, which could harm our business and operating results.

Failure to protect our intellectual property rights could adversely affect our business.

If we fail to protect our intellectual property rights adequately, our competitors might gain access to our technology, and our business might be harmed. In addition, defending our intellectual property rights might entail significant expense. Any of our patents, trademarks or other intellectual property rights may be challenged by others or invalidated through administrative process or litigation. We currently have three issued patents. Although we also have filed several pending or provisional patents, we may be unable to obtain additional patent protection in the future. Our current or any future patents may not provide us with any competitive advantages, or may be challenged by third parties. Furthermore, legal standards relating to the validity, enforceability and scope of protection of intellectual property rights are uncertain. Effective patent, trademark, copyright and trade secret protection may not be available to us in every country in which our products and services are available. The laws of some foreign countries may not be as protective of intellectual property rights as those in the United States, and mechanisms for enforcement of intellectual property rights may be inadequate. Accordingly, despite our efforts, we may be unable to prevent third parties from infringing upon or misappropriating our intellectual property.

We might be required to spend significant resources to monitor and protect our intellectual property rights. We may initiate claims or litigation against third parties for infringement of our proprietary rights or to establish the validity of our proprietary rights. Any litigation, whether or not it is resolved in our favor, could result in significant expense to us and divert the efforts of our technical and management personnel.

If we are sued by third parties for alleged infringement of proprietary rights, our business and operating results could be harmed.

The software and Internet markets are characterized by the existence of a large number of patents, trademarks and copyrights and by frequent litigation based on allegations of infringement or other violations of intellectual property rights. As the number of entrants into our market increases, the possibility of an intellectual property claim against us grows. Our patents, trademarks, copyrights and other intellectual property rights may not withstand third-party claims or rights against their use. Any intellectual property claims, with or without merit, could be time-consuming and expensive to litigate or settle and could divert management attention from executing our business plan. In addition, almost all of our subscription agreements with customers and other agreements with reseller, distributors and other partners require us to indemnify our customers and partners for third-party intellectual property infringement claims, which would increase the cost to us of an adverse ruling in such a claim. An adverse determination could also prevent us from offering our products to others, cause the sales of our products to decrease or require us to pay substantial license fees or royalties in connection with sales of our products.

We may become involved in litigation, which could be costly and time consuming to defend.

We may become involved in litigation such as securities class actions, intellectual property, employment (unfair hiring or terminations) and product liability claims, among others. For example, we routinely receive communications from parties who claim that we intentionally blocked the intended recipient from receiving their emails. Parties whose emails are blocked by our products may also seek redress against us for labeling them as spammers or for interfering with their business. In particular, our reputation services identify certain email sources that we determine are generating spam or viruses, and our customers for this service have blocked all email from those sources. Any of these sources could claim we are interfering with the lawful conduct of their business. Although we believe we have the authority under applicable law to block unwanted emails and none of these claims have ever resulted in any liability to us, we cannot guarantee this or another favorable outcome for any such claims that may be brought against us in the future. Litigation involves costs in defending the action and the risk of an adverse judgment. Any resulting litigation, with or without merit, could result in substantial costs and divert management’s attention and resources, which could seriously harm our business and operating results.

Our growth could strain our personnel and infrastructure resources, and if we are unable to implement appropriate controls and procedures to manage our growth, we may not be able to successfully implement our business plan.

We are currently experiencing a period of rapid growth in our headcount, operations and product development, which has placed, and will continue to place, a significant strain on our

management, administrative, operational and financial infrastructure. For example, during fiscal 2004, we increased our headcount from 81 employees to 127 employees and have expanded our operations into a number of countries. We anticipate that further growth will be required to achieve increases in our customer base and development of additional product lines, as well as our expansion into new geographic areas.

Our success will depend in part upon the ability of our senior management to manage this growth effectively. To do so, we must continue to hire, train and manage new employees as needed. If our new hires perform poorly, or if we are unsuccessful in hiring, training, managing and integrating these new employees, or if we are not successful in retaining our existing employees, our business may be harmed. To manage the expected growth of our operations and personnel, we will need to continue to improve our operational, financial and management controls and our reporting systems and procedures. The additional headcount and capital investments we are adding will increase our cost base, which will make it more difficult for us to offset any future revenue shortfalls by offsetting expense reductions in the short term. If we fail to successfully manage our growth, we will be unable to execute our business plan.

We are dependent on our management team, and the loss of any key member of this team may prevent us from implementing our business plan in a timely manner.

Our success depends largely upon the continued services of our executive officers and other key personnel. We are also substantially dependent on the continued service of our existing development personnel because of the complexity of our service and technologies. The employment arrangements we have with our executive officers, key management and development personnel are at-will agreements that do not require these individuals to remain our employees. Therefore, such employees could terminate their employment with us at any time without penalty and may go to work for one or more of our competitors. We do not maintain key person life insurance policies on any of our employees. The loss of one or more of our key employees could seriously harm our business.

Because competition for our target employees is intense, we may not be able to attract and retain the highly skilled employees we need to support our planned growth.

To execute our growth plan, we must attract and retain highly qualified personnel. Competition for these employees is intense, especially for engineers with high levels of experience in developing messaging security solutions. We may not be successful in attracting and retaining qualified personnel. We have from time to time in the past experienced, and we expect to continue to experience in the future, difficulty in hiring and retaining highly skilled employees with appropriate qualifications. Many of the companies with which we compete for experienced personnel have greater resources than we have. If we fail to attract new personnel or fail to retain and motivate our current personnel, our business and future growth prospects could be severely harmed.

Evolving regulation of the Internet and unregulated commercial email may affect us adversely.

As Internet commerce continues to evolve, increasing regulation by federal, state or foreign agencies becomes more likely. Strict legal prohibitions on the transmission of unsolicited commercial email, coupled with aggressive enforcement, could result in the transmission of less unsolicited commercial email and, thus, a corresponding decrease in demand for our products

and services. If legal developments alone prove effective in eliminating or sharply reducing spam, the market for our products and services would be adversely affected.

In addition, taxation of products and services provided over the Internet or other charges imposed by government agencies or by private organizations for accessing the Internet may also be imposed. Any regulation imposing greater fees for Internet use or restricting information exchange over the Internet could result in a decline in the use of the Internet and the viability of Internet-based products and services, which could harm our business and operating results.

There has been no prior market for our common stock. The trading price of our common stock is likely to be volatile, and you might not be able to sell your shares at or above the initial public offering price.

Prior to this offering, there has been no public market for our common stock. An active trading market for our common stock may never develop or be sustained, which would depress the value of our common stock. In addition, the initial public offering price of our common stock has been determined through negotiations between us and the representatives of the underwriters, and may not bear any relationship to the price at which our common stock will trade upon completion of this offering. The trading prices of the securities of technology companies have historically been highly volatile. Accordingly, the trading price of our common stock is likely to be subject to wide fluctuations. Factors affecting the trading price of our common stock will include:

• announcements of technological innovations, new products or product enhancements, strategic alliances or significant agreements by us or by our competitors;

• changes in the estimates of our operating results or changes in recommendations by any securities analysts that elect to follow our common stock; and

• market conditions in our industry, the industries of our customers and the economy as a whole.

In addition, the trading price of our common stock could decline for reasons unrelated to our business, operating results or financial condition. The trading price of our common stock might also decline in reaction to events that affect other companies in our industry even if these events do not directly affect us. Because we do not intend to pay any dividends, you will not receive any proceeds from our common stock until you sell it. As a result of the foregoing considerations, we cannot assure you that you will receive any return on your investment when you do sell your shares, or that you will not lose your entire investment.

Future sales of shares by existing stockholders could cause our stock price to decline.

If our existing stockholders sell, or indicate an intention to sell, substantial amounts of our common stock in the public market after the 180-day contractual lock-up and other legal restrictions on resale discussed in this prospectus lapse, the trading price of our common stock could decline below the initial public offering price. Based on shares outstanding as of February 29, 2004, upon completion of this offering, we will have outstanding shares of common

stock, assuming no exercise of outstanding options and warrants. Of these shares, only shares of common stock sold in this offering will be freely tradable, without restriction, in the public market. J.P. Morgan Securities Inc. may, in its sole discretion, permit our stockholders to sell shares prior to the expiration of the lock-up agreements.

After the lock-up agreements pertaining to this offering expire 180 days from the date of this prospectus, an additional shares will be eligible for sale in the public market, of which are held by directors, executive officers and other affiliates and will be subject to volume limitations under Rule 144 under the Securities Act of 1933, as amended, and various vesting agreements. In addition, the shares subject to outstanding warrants and the shares subject to outstanding options and reserved for future issuance under our 1998 Stock Option Plan, 2004 Equity Incentive Plan and 2004 Employee Stock Purchase Plan will become eligible for sale in the public market to the extent permitted by the provisions of various vesting agreements, the lock-up agreements and Rules 144 and 701 under the Securities Act of 1933, as amended. If these additional shares are sold, or if it is perceived that they will be sold, in the public market, the trading price of our common stock could decline.

The concentration of our capital stock ownership with insiders upon the completion of this offering will likely limit your ability to influence corporate matters.

We anticipate that our executive officers, directors and affiliated entities will together beneficially own approximately percent of our common stock outstanding after this offering. As a result, these stockholders, acting together, will have control over most matters that require approval by our stockholders, including the election of directors and approval of significant corporate transactions. Corporate action might be taken even if other stockholders, including those who purchase shares in this offering, oppose them. This concentration of ownership might also have the effect of delaying or preventing a change of control of our company that other stockholders may view as beneficial.

Our management will have broad discretion over the use of the proceeds to us from this offering and might not apply the proceeds of this offering in ways that increase the value of your investment.

Our management will have broad discretion to use the net proceeds from this offering, and you will be relying on the judgment of our management regarding the application of these proceeds. Our management might not apply the net proceeds of this offering in ways that increase the value of your investment. We expect to use the net proceeds from this offering for general corporate purposes, including working capital and capital expenditures, and for possible investments in, or acquisitions of, complementary services or technologies. We have not allocated these net proceeds for any specific purposes. Our management might not be able to yield a significant return, if any, on any investment of these net proceeds.

You will experience immediate and substantial dilution in the net tangible book value of the shares you purchase in this offering.

The initial public offering price of our common stock will be substantially higher than the book value per share of the outstanding common stock after this offering. Therefore, based on an assumed offering price of $ per share, investors in this offering will suffer immediate and

substantial dilution of approximately $ per share. If outstanding options and warrants to purchase our common stock are exercised, investors in this offering will experience additional dilution.

Provisions in our amended and restated certificate of incorporation and bylaws or Delaware law might discourage, delay or prevent a change of control of our company or changes in our management and, therefore, depress the trading price of our common stock.

Our amended and restated certificate of incorporation and bylaws contain provisions that could depress the trading price of our common stock by acting to discourage, delay or prevent a change of control of our company or changes in our management that the stockholders of our company may deem advantageous. These provisions:

• establish a classified board of directors so that not all members of our board are elected at one time;

• provide that directors may only be removed “for cause” and only with the approval of 66²/3 percent of our stockholders;

• require super-majority voting to amend some provisions in our amended and restated certificate of incorporation and bylaws;

• authorize the issuance of “blank check” preferred stock that our board could issue to increase the number of outstanding shares and to discourage a takeover attempt;

• limit the ability of our stockholders to call special meetings of stockholders;

• prohibit stockholder action by written consent, which requires all stockholder actions to be taken at a meeting of our stockholders;

• provide that the board of directors is expressly authorized to make, alter or repeal our bylaws; and

• and establish advance notice requirements for nominations for election to our board or for proposing matters that can be acted upon by stockholders at stockholder meetings.

We also will be subject to provisions of the Delaware General Corporation Law that, in general, prohibit any business combination with a beneficial owner of 15% or more of our common stock for three years after the point in time that such stockholder acquired shares constituting 15% or more of our shares, unless the holder’s acquisition of our stock was approved in advance by our board of directors.

This prospectus, including the sections entitled “Prospectus summary,” “Risk factors,” “Management’s discussion and analysis of financial condition and results of operations” and “Business,” contains forward-looking statements that involve substantial risks and uncertainties. All statements other than statements of historical facts contained in this prospectus, including statements regarding our future financial position, business strategy and plans and objectives of management for future operations, are forward-looking statements. In some cases, you can identify forward-looking statements by terminology such as “believe,” “may,” “will,” “estimate,” “continue,” “anticipate,” “intend,” “should,” “plan,” “expect,” “predict,” “potential,” or the negative of these terms or other similar expressions. We have based these forward-looking statements on our current expectations and projections about future events and financial trends that we believe may affect our financial condition, results of operations, business strategy and financial needs. These forward-looking statements are subject to a number of risks, uncertainties and assumptions described in “Risk factors” and elsewhere in this prospectus, regarding, among other things:

These risks are not exhaustive. Other sections of this prospectus include additional factors that could adversely impact our business and operating results. Moreover, we operate in a very competitive and rapidly changing environment. New risk factors emerge from time to time and it is not possible for our management to predict all risk factors, nor can we assess the impact of all factors on our business or the extent to which any factor, or combination of factors, may cause actual results to differ materially from those contained in any forward-looking statements.

You should not rely upon forward-looking statements as predictions of future events. We cannot assure you that the events and circumstances reflected in the forward-looking statements will be achieved or occur. Although we believe that the expectations reflected in the forward-looking statements are reasonable, we cannot guarantee future results, levels of activity, performance or achievements. Moreover, neither we nor any other person assume responsibility for the accuracy and completeness of the forward-looking statements. Except as required by law, we undertake no obligation to update publicly any forward-looking statements for any reason after the date of this prospectus to conform these statements to actual results or to changes in our expectations.

You should read this prospectus and the documents that we reference in this prospectus and have filed as exhibits to the registration statement on Form S-1, of which this prospectus is a part, that we have filed with the Securities and Exchange Commission, completely and with the understanding that our actual future results, levels of activity, performance and achievements may be materially different from what we expect. We qualify all of our forward-looking statements by these cautionary statements.

We estimate that the net proceeds we will receive from this offering will be approximately $ million, at an assumed initial public offering price of $ per share, after deducting estimated offering expenses and estimated underwriting discounts and commissions payable by us. If the underwriters exercise their over-allotment option in full, we estimate that our net proceeds will be approximately $ million.

The principal purposes of this offering are to create a public market for our common stock, to obtain additional capital and to facilitate our future access to the public equity markets.

We intend to use the net proceeds from this offering for general corporate purposes, including working capital and capital expenditures, but we have not designated any specific uses. We may also use a portion of the net proceeds to fund possible investments in, or acquisitions of, complementary businesses, products or technologies or establishing joint ventures. We have no current agreements or commitments with respect to any investment, acquisition or joint venture, and we currently are not engaged in negotiations with respect to any investment, acquisition or joint venture. Accordingly, our management will have broad discretion in applying the net proceeds of this offering. Pending these uses, we intend to invest the net proceeds in short-term interest-bearing, investment grade securities.

The amount and timing of what we actually spend for these purposes may vary significantly and will depend on a number of factors, including our future revenues and cash generated by operations and the other factors described in “Risk factors.” We may find it necessary or advisable to use portions of the proceeds for other purposes.

We have never declared or paid any cash dividends on our common stock or other securities. We currently anticipate that we will retain all of our future earnings for use in the expansion and operation of our business and do not anticipate paying any cash dividends in the foreseeable future. We also may incur indebtedness in the future that may prohibit or effectively restrict the payment of dividends on our common stock. Any future determination related to our dividend policy will be made at the discretion of the board.

The following table summarizes our cash, cash equivalents and short-term investments and capitalization as of January 31, 2004,

• on a pro forma basis to reflect the conversion of all outstanding shares of convertible preferred stock into common stock upon the closing of this offering and to give effect to changes in our authorized shares as a result of our Delaware reincorporation; and

• on a pro forma as adjusted basis to reflect of the foregoing and our receipt of estimated net proceeds from the sale of our shares of common stock in this offering (at an assumed initial public offering price of $ per share and after deducting estimated underwriting discounts and commissions and estimated offering expenses).

You should read this table in conjunction with “Use of proceeds,” “Selected consolidated financial data,” “Management’s discussion and analysis of financial condition and results of operations” and our consolidated financial statements and related notes included elsewhere in this prospectus.

The number of shares of our common stock shown above to be outstanding after this offering is based on shares outstanding as of January 31, 2004 and gives effect to Delaware reincorporation that will occur prior to the completion of this offering. This information excludes:

• 6,151,184 shares of common stock issuable upon the exercise of outstanding stock options as of January 31, 2004, with exercise prices ranging from $0.05 to $0.95 per share and a weighted average exercise price of $0.76 per share;

• 73,099 shares of common stock issuable upon the exercise of warrants outstanding as of January 31, 2004, with exercise prices ranging from $1.50 to $5.02 and a weighted average exercise price of $2.82 per share; and

If you invest in our common stock, your interest will be diluted to the extent of the difference between the public offering price per share of our common stock and the pro forma as adjusted net tangible book value per share of our common stock immediately after this offering. Pro forma net tangible book value per share represents the amount of our total tangible assets less total liabilities, divided by the pro forma number of shares of our common stock outstanding assuming the conversion of all shares of convertible preferred stock outstanding as of January 31, 2004, into 20,939,375 shares of common stock.

Investors participating in this offering will incur immediate, substantial dilution. Our pro forma net tangible book value was $17.7 million, or $0.66 per share of common stock, after giving effect to the conversion of all outstanding shares of our convertible preferred stock into shares of our common stock upon the completion of this offering. Assuming the sale by us of shares of common stock offered in this offering at an assumed initial public offering price of $ per share, and after deducting the underwriting discount and estimated offering expenses, our pro forma as adjusted net tangible book value as of , 2004, would have been $ million, or $ per share of common stock. This represents an immediate increase in pro forma net tangible book value of $ per share of common stock to our existing stockholders and an immediate dilution of $ per share to the new investors purchasing shares in this offering.

The following table sets forth, on a pro forma as adjusted basis as of , 2004, the difference between the number of shares of common stock purchased from us, the total consideration paid, and the average price per share paid by existing stockholders and by new public investors before deducting estimated underwriting discounts and commissions and estimated offering expenses payable by us, using an assumed initial public offering price of $ per share:

If the underwriters’ over-allotment option is exercised in full, the number of shares of common stock held by existing stockholders will be reduced to % of the total number of shares of common stock to be outstanding after this offering; and the number of shares of common stock held by the new investors will be increased to shares or % of the total number of shares of common stock outstanding after this offering. See “Principal Stockholders.”

The discussion and tables above assume no exercise of the underwriters’ over-allotment option, and the conversion of all our outstanding shares of convertible preferred stock into 20,939,375 shares of common stock, and excludes:

• shares of common stock issuable upon the exercise of outstanding stock options as of , with exercise prices ranging from to per share and a weighted average exercise price of $0.78 per share;

• shares of common stock issuable upon the exercise of warrants outstanding as of , with exercise prices ranging from to and a weighted average exercise price of $2.82 per share; and

• shares of common stock to be available for issuance under our 2004 Equity Incentive Plan, and shares of common stock to be available for issuance under our 2004 Employee Stock Purchase Plan, each plan to be effective upon the completion of this offering. The 2004 Equity Incentive Plan and the 2004 Employee Stock Purchase Plan each contain a provision that automatically increases their share reserve each year, as more fully described in “Management—Employee benefit plans.”

To the extent that these options and warrants are exercised, there will be further dilution to new investors. In addition, we may choose to raise additional capital due to market conditions or strategic considerations even if we believe we have sufficient funds for our current or future operating plans. To the extent that additional capital is raised through the sale of equity or convertible debt securities, the issuance of these securities could result in further dilution to our stockholders.

The following table sets forth our selected consolidated financial data. The data should be read in conjunction with “Management’s discussion and analysis of financial condition and results of operations” following this section and the consolidated financial statements, related notes, and other financial information included herein. The following selected consolidated statement of operations data for the three years ended January 31, 2004, and the selected consolidated balance sheet data as of January 31, 2003 and 2004, are derived from the audited consolidated financial statements of the company. The consolidated statement of operations data for the two years ended January 31, 2001 and the selected consolidated balance sheet data as of January 31, 2000, 2001 and 2002 are derived from unaudited consolidated financial statements not included in this prospectus. The historical results are not necessarily indicative of results to be expected in any future period.

The following discussion and analysis of our financial condition and results of operations should be read in conjunction with our consolidated financial statements and related notes that appear in this prospectus. In addition to historical consolidated financial information, the following discussion contains forward-looking statements that reflect our plans, estimates and beliefs. Our actual results could differ materially from those discussed in the forward-looking statements. Factors that could cause or contribute to these differences include those discussed below and elsewhere in this prospectus, particularly in “Risk factors.”

Brightmail is a leading provider of electronic messaging security software and services to enterprises and messaging service providers worldwide. We provide a comprehensive suite of products and services focused on securing the messaging infrastructure of businesses of all sizes and industries worldwide. Our proprietary products and services help customers protect their electronic messaging infrastructure by effectively identifying and disposing of unwanted or malicious messages while accurately allowing delivery of legitimate messages. These integrated products and services help our customers protect their systems from spam, viruses and fraudulent emails, as well as other security threats while allowing legitimate mail to be reliably and securely delivered.

We were founded in February 1998 and began offering our messaging security solutions in 1999. Our revenues have grown from $93,000 in fiscal 2000, the first full year in which we sold our products and services, to $26.0 million in fiscal 2004. We experienced our first profitable quarter in the fourth quarter of fiscal 2003, and we had net income of $1.2 million in fiscal 2004. Based on stock-based compensation we recorded as of January 31, 2004, we expect to amortize approximately $1.4 million in stock-based compensation over the next four years. Consequently, we expect these amortization charges to result in net losses on a quarterly and annual basis in fiscal 2005. In addition, we first achieved positive cash flows from operations in the third quarter of fiscal 2003, prior to which time we financed our operations primarily through equity financing. Since inception, we have raised a total of $53.2 million, primarily through issuances of convertible preferred stock. As of January 31, 2004, we had cash, cash equivalents and short-term investments totaling $26.8 million and an accumulated deficit of $38.8 million, and our customer base consisted of over 2,000 customers with an aggregate of over 300 million end-user mailboxes under subscription.

We believe the principal driver behind the development of the market for our products is the need for a technological solution to the continued proliferation of spam and new and emerging messaging security threats. We further believe that our success in penetrating our target markets depends on the effectiveness and accuracy of our products and services, compared to those of our competitors, in addressing spam and related threats, as well as the success of our distribution strategy in gaining and sustaining market share in the United States and internationally. As such, if messaging security technology that is superior to ours becomes available or if an alternative solution gains greater market acceptance, our business and operating results will be adversely affected.

Our fiscal year ends on January 31. References to fiscal 2004, for example, refer to the 12 months ended January 31, 2004.

Subscription revenue model. We derive all of our revenues from providing our products and services on a subscription basis. We sell our products and services through the combination of our indirect sales channels, including distributors, resellers, business outsourcing and hosted service providers, large global systems integrators, OEMs and appliance vendors, as well as through the efforts of our direct sales organization. We recognize our revenues from indirect sales net of reseller discounts on a sell-through basis. The typical subscription term of our contracts is 12 to 24 months, and these contracts are generally non-cancelable.

Deferred revenue. We typically invoice our customers for the entire contract term in advance of the subscription period. Amounts that have been invoiced are recorded in accounts receivable and deferred revenue, which we then amortize into revenues ratably over the period during which our products and services have been prepaid. We believe deferred revenue is generally a good indicator of future revenues and provides visibility to a significant percentage of our quarterly revenues.

Cost of revenues. Cost of revenues consists primarily of expenses associated with the deployment and management of our filtering rule production infrastructure, royalties paid to our anti-virus provider, expenses related to providing customer support and allocated overhead. Over the next several months, we intend to establish a Sacramento data center to implement redundant filter update delivery systems. In connection with establishing this data center, we expect our costs of revenues to increase over the course of fiscal 2005.

Product development. Product development expenses consist primarily of salaries and related expenses for our product development staff, the cost of outside contractors and allocated overhead. Our product development efforts are focused on improving and enhancing our existing product and service offerings as well as developing new proprietary technology. We expect that research and development expenses will increase in absolute dollars as we seek to expand our technology and product offerings.

Sales and marketing. Sales and marketing expenses consist primarily of salaries and related expenses for our sales and marketing staff, including commissions, bonuses, marketing events, corporate communications, advertising, other brand building and product marketing expenses and allocated overhead. Commissions are based on the total amount of the subscription contract and are fully expensed in the period they are earned, which is typically the period the contract is executed. We expect sales and marketing expenses to increase in absolute dollars, as we plan to invest in international expansion, increase the number of indirect and direct sales personnel in order to add new customers and increase penetration within our existing customer base, build brand awareness and sponsor additional marketing events.

General and administrative. General and administrative expenses consist of salaries and related expenses for executive, finance and accounting, legal and human resources departments, professional fees, other corporate expenses and allocated overhead. We expect general and administrative expenses to increase in absolute dollars as we add personnel and incur additional professional fees and insurance costs related to the growth of our business and to our operations as a public company.

Our accounting policies are more fully described in Note 1 of the consolidated financial statements. As disclosed in Note 1, the preparation of financial statements in conformity with accounting principles generally accepted in the United States requires management to make estimates and assumptions about future events that affect the amounts reported in the financial statements and accompanying notes. Actual results could differ significantly from those estimates.

We believe that the following discussion addresses our most critical accounting policies, which are those that are most important to the portrayal of our financial condition and results of operations and require management’s most difficult, subjective and complex judgments.

Revenue recognition. We recognize revenue pursuant to the requirements of Statement of Position 97-2 “Software Revenue Recognition”, or SOP 97-2, issued by the American Institute of Certified Public Accountants, as amended by SOP 98-9 “Modification of SOP 97-2, Software Revenue Recognition, With Respect to Certain Transactions.”

We sell our products and services on a subscription basis. Our subscription contracts are generally non-cancelable with a term of 12 to 24 months. Because the support component of our products require continuous delivery and is not separable from the products, we recognize revenues from subscription contracts ratably over the term of the contracts. We generate substantially all of our revenue from two products. In accordance with SOP 97-2, we begin to recognize revenue from the licensing and support of our products when all of the following criteria are met: (1) we have entered into a legally binding agreement with a customer; (2) we deliver the products; (3) subscription agreement terms are deemed fixed or determinable; and (4) collection is probable. We generally invoice our customers in advance, either bi-annually, annually or quarterly. Amounts that have been invoiced are recorded in accounts receivable and in deferred revenue and are amortized into revenue ratably over the term of the subscription contract as described above. Our subscription contracts do not contain general rights of return.

Revenue from sales made through our indirect sales channels are recognized as the product and support are delivered to the end users provided that all four of the SOP 97-2 revenue recognition criteria noted above are met. This is commonly referred to as the sell-through method.

When a subscription contract includes an acceptance provision, we do not recognize revenue until the earlier of the receipt of a written customer acceptance or, if not notified by the customer to cancel the subscription contract, the expiration of the acceptance period.

Allowance for doubtful accounts. We maintain an allowance for doubtful accounts for estimated losses resulting from the inability of our customers to make required payments. Estimated reserves are determined based upon the number of days that billings are past due and an evaluation of the potential risk of loss associated with specific problem accounts. The use of different estimates or assumptions could produce different allowance balances. While we believe our existing allowance for doubtful accounts is adequate, additional allowances may be required should the financial condition of our customers deteriorate or as unusual circumstances arise. Historically our losses from uncollectible accounts have not been material and at January 31, 2004, our allowance was $58,000.

Deferred income tax assets. At January 31, 2004, we had net operating loss carryforwards for federal income tax purposes of approximately $32.5 million, which will begin to expire in 2018

and federal research and development tax credits of approximately $808,000, which will begin to expire in 2018. We also have state net operating loss carryforwards of approximately $25.5 million which expire beginning in 2006 and state research and development tax credits of approximately $602,000 which have no expiration date. These net operating loss carryforwards and day credits are carried on our balance sheet as a deferred tax asset. However due to uncertainty surrounding when or if we will realize the benefits of this deferred tax asset, we have recorded a 100% valuation allowance against our deferred tax asset. Statement of Financial Accounting Standards No. 109, ‘‘Accounting for Income Taxes’’ or SFAS 109 requires that a valuation allowance be set up to reduce a deferred tax asset to the extent it is more likely than not that the related tax benefits will not be realized. In order for a company to realize the tax benefits associated with a net operating loss, it must have taxable income within the applicable carryback or carryfoward periods. Sources of taxable income that may allow for the realization of those tax benefits include taxable income in the current year or prior years that is available though a carryback claim; future taxable income that will result from the reversal of existing taxable temporary differences, (i.e., the reversal of deferred tax liabilities) and future taxable income generated by future operations.

SFAS 109 indicates that all available evidence, both positive and negative, should be identified and considered in making a determination as to whether it is more likely than not that all or some portion of the deferred tax asset will not be realized. Examples of positive evidence include: strong earnings history; existing contracts or backlog; and assets with net built in gains for tax purposes. Examples of negative evidence include: a pretax loss for financial reporting purposes for the current year or a recent preceding year; a deficit in stockholders’ equity; a history of operating loss or tax credit carryforwards expiring unused; and cumulative losses in recent years.

We believe that our losses in recent years and deficit in stockholder’s equity present negative evidence that require a valuation allowance to be recorded to reduce to zero the deferred tax asset associated with the net operating loss carryforwards and temporary differences. Accordingly, we have not taken a benefit for that asset.

Accounting for stock-based awards. We record deferred stock-based compensation charges in the amount by which the exercise price of an option is less than the deemed fair value of our common stock at the date of grant. We amortize the deferred compensation charges using the accelerated method over the vesting period of the underlying option awards. As of January 31, 2004, we have recorded an aggregate of $1.4 million of deferred stock-based compensation. We currently expect this deferred stock-based compensation balance to be amortized as follows: $861,000 during fiscal 2005; $345,000 during fiscal 2006; $150,000 during fiscal 2007; and $24,000 during fiscal 2008. We have elected to use the intrinsic value method of accounting for stock option grants. The impact of expensing employee stock awards based on grant date fair value using the Black-Scholes option-pricing model is further described in Note 1 of the notes to our consolidated financial statements.

The following table sets forth consolidated statement of operations data expressed as a percentage of total revenues for the periods indicated.

Fiscal year ended January 31, 2004 compared to fiscal year ended January 31, 2003

Revenues. Revenues were $26.0 million in fiscal 2004 compared to $12.2 million in fiscal 2003, an increase of $13.9 million, or 114%. The increase was primarily the result of a full year of revenues from subscription customers engaged in fiscal 2003, and also a significant increase in customer penetration achieved through the use of resellers and other partners to distribute our products and services.

Revenues in Europe, Middle East and Africa and Asia Pacific accounted for $3.6 million, or 14% of total revenues in fiscal 2004, compared to $1.0 million or 8% of total revenues, in fiscal 2003, an increase of $2.6 million or 260%.

Cost of revenues. Cost of revenues was $5.5 million, or 21% of total revenues, in fiscal 2004, compared to $3.6 million, or 29% of total revenues, in fiscal 2003, an increase of $2.0 million. The increase was primarily due to a combined incremental $1.1 million in compensation and related employee costs, including allocated overhead, for our production environment and customer support teams; $370,000 in increased royalties due to sales of our anti-virus product; additional depreciation and equipment expense of $272,000; and additional costs of

collocation and bandwidth of $243,000. Cost of revenues as a percent of total revenues has declined as a result of achieving economies of scale through our production environment across our growing customer base.

Product development. Product development expenses were $7.4 million, or 29% of total revenues, in fiscal 2004, compared to $6.4 million, or 52% of total revenues in fiscal 2003, an increase of $1.0 million. The absolute dollar increase was primarily due to increased headcount-related expenses devoted to product development efforts.

Sales and marketing. Sales and marketing expenses were $8.0 million, or 30% of total revenues, in fiscal 2004, compared to $4.3 million, or 35% of revenues in fiscal 2003, an increase of $3.7 million. The absolute dollar increase was primarily due to an additional $2.4 million in employee-related costs and commission expense and an increase in public relations and customer outreach programs of $890,000.

General and administrative. General and administrative expenses were $3.6 million, or 14% of revenues, in fiscal 2004, compared to $3.0 million, or 26% of revenues in fiscal 2003, an increase of $518,000. The absolute dollar increase was primarily due to increased expenditures for insurance, taxes and general office expense of $204,000, an additional $193,000 in employee-related costs, and an additional $139,000 in professional fees.

Stock-based compensation. Amortization of deferred stock-based compensation was $472,000, or 2% of revenues, in fiscal 2004, compared to $149,000, or 1% of revenues in fiscal 2003, an increase of $323,000. The increase was due to additional deferred compensation charges recorded in fiscal 2004.

Other income (expense). Other income was $36,000, or less than 1% of revenues in fiscal 2004, compared to $5,000, or less than 1% of revenues in fiscal 2003, an increase of $31,000. The increase was due to a gain realized on the early extinguishment of capital leases during fiscal 2004.

Interest income. Interest income was $243,000, or 1% of revenues in fiscal 2004, compared to $352,000, or 3% of revenues in fiscal 2003, a decrease of $109,000. The decrease was due to declining interest rates in 2004, partially offset by an increase in cash and cash equivalent balances.

Interest expense. Interest expense was $38,000, or less than 1% of revenues in fiscal 2004, compared to $88,000, or 1% of revenues in fiscal 2003, a decrease of $50,000. The decrease was due to declining debt balances and the early extinguishment of several capital leases in fiscal 2004.

Fiscal year ended January 31, 2003 compared to fiscal year ended January 31, 2002

Revenues. Revenues were $12.2 million in fiscal 2003 compared to $6.4 million in fiscal 2002, an increase of $5.8 million, or 90%. The increase was primarily the result of an increase in subscription customers in fiscal 2003 and the effect of a full year of revenues from subscription customers engaged in the fiscal 2002, including increased revenues from sales of our anti-virus product.

Revenues in Europe, Middle East and Africa and Asia Pacific accounted for $1.0 million, or 8% of total revenues in fiscal 2003, compared to $105,000 or 2% of total revenues, in fiscal 2002, an increase of $896,000.

Cost of revenues. Cost of revenues was $3.6 million, or 29% of total revenues, in fiscal 2003, compared to $3.0 million, or 47% of total revenues, in fiscal 2002, an increase of $536,000. The absolute dollar increase was primarily a result of increased royalties due to sales of our anti-virus product of $383,000 and $100,000 of increased headcount related expenses.

Product development. Product development expenses were $6.4 million, or 52% of total revenues, in fiscal 2003, compared to $6.6 million, or 102% of total revenues in fiscal 2002, a decrease of $182,000. The decrease was primarily due to the annualized impact of $327,000 as stated with a reduction in force of our product development personnel, which occurred at the end of fiscal 2002.

Sales and marketing. Sales and marketing expenses were $4.3 million, or 35% of total revenues, in fiscal 2003, compared to $5.4 million, or 83% of revenues in fiscal 2002, a decrease of $1.0 million. The decrease was primarily due to reduced marketing expenses of $698,000 during fiscal 2003, to the annualized impact of $139,000 of a reduction in force in our marketing department which occurred at the end of fiscal 2002 and to reduction in the amount of travel expenses incurred of $236,000.

General and administrative. General and administrative expenses were $2.8 million, or 26% of revenues, in fiscal 2003, compared to $2.6 million, or 42% of revenues in fiscal 2002, an increase of $405,000. The absolute dollar increase was primarily due to cash-based severance charges of approximately $108,000 and non-cash based severance charges of $243,000 for a former executive.

Stock-based compensation. Stock-based compensation was $149,000, or 1% of revenues, in fiscal 2003, compared to $595,000, or 9% of revenues in fiscal 2002, a decrease of $446,000. The decrease was due to declining balance amortization expense on deferred stock-based compensation.

Other income (expense). Other income was $5,000 in fiscal 2003, compared to zero in fiscal 2002, an increase of $5,000.

Interest income. Interest income was $352,000, or 3% of revenues, in fiscal 2003, compared to $1.0 million, or 16% of revenues in fiscal 2002, a decrease of $673,000. The decrease was due to declining cash and investment balances during fiscal 2003 as we use cash to fund our operations.

Interest expense. Interest expense was $88,000, or 1% of revenues, in fiscal 2003, compared to $114,000, or 2% of revenues in fiscal 2002, a decrease of $26,000. The decrease was due to reducing debt principal balances during fiscal 2003.

The following tables set forth selected unaudited quarterly consolidated statement of operations data for our eight most recent quarters, as well as the percentage of revenues for each line item shown. The information for each of these quarters has been prepared on substantially the same basis as the audited consolidated financial statements included in the back of this prospectus and, in the opinion of management, includes all normal recurring adjustments necessary for the fair presentation of the results of operations for such periods. This data should be read in conjunction with the audited consolidated financial statements and the related notes included in the back of this prospectus. These quarterly operating results are not necessarily indicative of our operating results for any future period.

The following table presents our quarterly historical results for the periods indicated as a percentage of revenues:

Revenues increased sequentially in each of the quarters presented due to increases in the number of customers, driven by an increased use of indirect sales channels and an international expansion. The 45% increase in revenues for the quarter ended January 31, 2003 over the preceding quarter reflects the addition of a major customer.

Gross profit in absolute dollars also increased sequentially for the quarters presented due primarily to revenue growth. As a percentage of revenues, gross margins have been between 78% and 79% for the four most recent quarters. The 26% increase of cost of revenues for the quarter ended January 31, 2004 over the preceding quarter was primarily due to investments made to improve the scalability and reliability of our anti-spam rule delivery service.

Operating expenses have increased over the four most recent quarters as we have continued to invest in product development to both enhance our existing products and services and to develop new messaging security products and services. We have also continued to invest in our sales and marketing efforts over the most recent four quarters and have expanded our sales force both domestically and internationally. We also increased investment in marketing efforts targeted at adding new customers and increasing penetration within our existing customer base. An increase in amortization of deferred stock-based compensation in the quarter ended January 31, 2004 resulted in a net loss for that period.

At January 31, 2004, our principal sources of liquidity were cash, cash equivalents and short-term investments totaling $26.8 million and accounts receivable of $8.9 million.

From our inception in May 1998 through the quarter ended July 31, 2002, we funded our operations primarily through issuances of convertible preferred stock, which provided aggregate net proceeds of $53.2 million. Since the quarter ended July 31, 2002, we have funded our operations with cash flow generated by operating activities.

Operating activities. Net cash provided by operating activities was $6.8 million during fiscal 2004, compared to $0.5 million of cash used during fiscal 2003 and $6.6 million used during fiscal 2002. Sources of cash from operating activities in fiscal 2004 were primarily net income of $1.2 million and deferred revenue of $7.8 million, partially offset by $4.3 million in accounts receivable, which represents amounts recorded as deferred revenue and revenue that have been invoiced but not yet collected. Cash used in operating activities in prior years resulted from our historical operating losses, partially offset by changes in working capital accounts and add-backs of non-cash expense items, such as depreciation and amortization and the expense associated with stock-based awards.

Investing activities. Net cash used in investing activities was $4.3 million during fiscal 2004, compared to $11.9 million used during fiscal 2003, and $11.5 million provided during fiscal 2002. The net cash used and provided by investing activities primarily reflects offsetting inflows and outflows related to the investment of excess cash in high-quality, investment grade fixed income securities and the redemption of those investments. In addition, in fiscal 2004, 2003 and 2002, we used $1.8 million, $660,000 and $280,000 for capital expenditures associated with computer equipment used to support the expansion of our infrastructure and work force.

Financing activities. Net cash used in financing activities was $0.4 million during fiscal 2004, which primarily consisted of principal payments on capital lease obligations and bank debt, offset by proceeds from employee stock option exercises and the release of restricted cash from a letter of credit with our principal office landlord. Net cash provided by financing activities was $14,000 in fiscal 2003, and included the principal payments on capital lease obligations and bank debt, offset by proceeds from stock option exercises, borrowings under a bank loan and the release of restricted cash from a letter of credit in favor of our principal office landlord. Net cash used in financing activities was $0.3 million in fiscal 2002, consisting of the establishment of a letter of credit in favor of our principal office landlord and principal repayments of capital lease obligations and bank debt, partially offset by additional borrowings under capital lease obligations and bank debt, and proceeds from employee stock option exercises.

During fiscal 2002, we established a $480,000 letter of credit in favor of our principal office landlord. This letter of credit was collateralized by a certificate of deposit maintained at the granting financial institution for the same amount and is reflected as restricted cash on our consolidated balance sheet. As of January 31, 2004, $120,000 of the letter of credit was outstanding, and no amounts had been drawn against it. The letter of credit renews annually through January 1, 2005, and the balance declines by $120,000 each year on January 1 in accordance with the lease.

We do not have any special purpose entities, and other than operating leases for office space, we do not engage in off-balance sheet financing arrangements. Additionally, we currently do not have a bank line of credit.

We generally do not enter into binding purchase commitments. Our principal commitments consist of obligations under leases for office space and office equipment. At January 31, 2004, the future minimum lease payments, net of minimum sublease obligations of $182,000 for 2005, under these commitments were as follows:

We are currently cash flow positive and fund our business with cash from operations. Our future capital requirements will depend on many factors, including our rate of revenue growth, the expansion of our marketing and sales activities, the timing and extent of spending on product development and expansion into new territories, the timing of introductions of new products and services and enhancements to existing products and services, and the continuing market acceptance of our products and services. In addition, to the extent that our customer base grows, we intend to continue to invest additional resources in customer support and our production infrastructure.

To date, substantially all of our international sales have been denominated in U.S. dollars, although we anticipate an increasing proportion of those sales will be denominated in foreign currencies. Accordingly, our results of operations and cash flows may become subject to fluctuations in foreign currency exchange rates, particularly changes in the Euro, Australian dollar and British pound. We have a risk management policy that allows us to utilize foreign currency forward and option contracts to manage our currency exposures as part of our ongoing business operations. To date, we have not entered into any hedging contracts since exchange rate fluctuations have had little impact on our operating results and cash flows. As we expand our international sales, however, we may decide to enter into hedging contracts. If we were to enter into hedging contracts, the contracts by policy would have maturities of less than three months and settle before the end of each quarterly period. Additionally, by policy we would not enter into any hedging contracts for trading or speculative purposes.

We had cash, cash equivalents and short-term investments totaling $26.8 million at January 31, 2004. These amounts were invested primarily in money market funds and high quality investment grade, variable-rate municipal bonds and are held for working capital purposes. We do not enter into investments for trading or speculative purposes. Due to the short-term nature of these investments, we believe that we do not have any material exposure to changes in the fair value of our investment portfolio as a result of changes in interest rates.

We market our products and services through the combination of our indirect sales channels, including distributors, resellers, business outsourcing and hosted service providers, large global systems integrators, original equipment manufacturers and appliance vendors, as well as through the efforts of our direct sales organization. We provide our subscribers with software updates approximately every ten minutes drawing upon our proprietary Probe Network, which monitors evolving messaging threats in real-time. Our software, which is available solely on a subscription basis, can support numerous hardware configurations, operating systems and messaging applications and infrastructure, and is delivered as stand-alone software, integrated into third party appliance solutions, or as a hosted service. From 1999, when we first introduced our products and services, our customer base has grown to over 2,000 customers, with an aggregate of over 300 million end-user mailboxes under subscription.

Emergence of electronic messaging as a mission critical business application

With the global adoption of the Internet, the use of electronic messaging has become a ubiquitous communication tool and a mission critical application for the conduct of business. According to estimates by International Data Corporation, or IDC, by 2007 the number of worldwide email boxes will be 1.6 billion, and the number of person-to-person email messages sent worldwide will be more than 9.1 trillion. Surveys by market research firm META Group estimate that 80% of business people believe email is more valuable than the telephone for business communication. In addition to email, a wide variety of other forms of electronic messaging have emerged and are increasingly embraced by businesses, including instant messaging, or real-time messaging through the Internet, and Short Messaging Service (SMS), or short text messaging through mobile phones, two-way pagers, personal digital assistants and other mobile devices.

The widespread adoption of electronic messaging has made securing and managing the messaging infrastructure increasingly important, complex and costly. The messaging standards originally adopted by the public Internet were not optimized to address concerns for security, privacy and fraud. As a result, the existing infrastructure is susceptible to security attacks, which

compromise and threaten the utility of electronic messaging. Frequently encountered messaging security threats include:

• spam, or unsolicited or unwanted bulk email, generally sent by individuals or organizations that send mass emails to a specified list of email addresses;

• viruses, or malicious code designed to disrupt computer systems or steal confidential information; and

• fraudulent email, or email that mimics legitimate corporate communications for the purpose of stealing personal or financial information.

We believe the proliferation of spam is one of the most severe and challenging electronic messaging security threats faced by businesses today. Spammers rapidly evolve techniques to circumvent efforts aimed at stopping them. The proliferation of spam is driven largely by its potential to generate attractive profits for spammers. Email allows a spammer to reach individuals and businesses for a fraction of the cost of using any other communication vehicle because the spam market has almost no barriers to entry and the marginal cost of sending additional emails is almost zero. In addition, hackers and spammers increasingly use spam to introduce viruses into business networks and steal confidential information from businesses. According to IDC, in 2003 spammers sent an average of 13.5 billion emails per day, and spam as a percentage of overall Internet email traffic will grow from 35% in 2002 to 67% in 2007. Based on our own filtering operations, we estimate that spam, as a percentage of overall Internet email traffic, was 62% in January 2004.

Spam is a dynamic problem. Techniques frequently used by spammers include deliberately obscuring the identity of the email sender, implementing false “unsubscribe” mechanisms to validate an email address and harvesting email addresses published on the Internet. Spammers target virtually anyone with a valid email address, across any geography or industry. Moreover, spam campaigns often involve large volumes of emails sent repeatedly, which tax network and server bandwidth and allow the perpetrators to rapidly evolve the form and content of the message traffic to evade new spam filtering techniques. As a result, successfully addressing the spam problem requires a dynamic approach to spam identification and analysis, as well as real-time generation, updating and deployment of filters in the network, particularly at the gateway or the mail server, where message traffic can be filtered in the aggregate.

Many jurisdictions in the United States and abroad have enacted legislation attempting to solve the spam problem. While legislation has been an important driver toward raising public awareness of spam and may act as a deterrent, legislation alone will not solve the spam problem. Governments have difficulty prosecuting across jurisdictions and have typically placed enforcing spam laws at a lower priority. In addition, the international portability of spam operations and the ability of spammers to remain anonymous has meant that an effective technology solution in addition to legislation is necessary to address the spam problem.

The proliferation of spam and the need to block it has created a number of significant challenges for businesses, including:

• Lost productivity. The productivity loss caused by the time employees spend separating legitimate email from spam or responding to spam is growing increasingly significant.

• False positives. The cost of false positives, or the inappropriate blocking of legitimate messages by spam filtering systems, may result in loss of sales or critical information.

• Strain on IT resources. Spam taxes the technology infrastructure by utilizing network, server and storage resources, potentially requiring organizations to purchase additional systems and devote more personnel to manage them.

• Damage to corporate brands. Techniques have emerged, such as “phishing,” where spammers create messages designed to resemble a message from a legitimate business, which not only places the recipient at risk, but also damages the trust in the business’ corporate brand.

• Increased risk of workplace liabilities. Spam often contains or directs users to offensive content, which may create an uncomfortable or hostile work environment and result in greater liability risks for businesses.

• Increased customer churn for messaging service providers. If email accounts become flooded with spam, customers may become dissatisfied with the messaging service provider, thereby increasing customer support costs and risk of service termination.

These challenges result in significant costs for businesses. According to Ferris Research, a consulting firm, the aggregate cost due to these spam threats for American corporations exceeded $10 billion in 2003. These costs do not take into account spam techniques used as a delivery mechanism for other threats, such as viruses and fraud.

The proliferation of spam, compounded by the severity of email related security threats, presents a formidable challenge for businesses as they look to maintain a secure environment, contain costs and realize the benefits of a messaging platform. As a result, businesses require a messaging security solution that can address these challenges. An effective solution must:

• identify and prevent spam, viruses and fraudulent email from entering the core network;

• limit the management and administrative cost required to maintain control over the rapidly evolving spam tactics and messaging threats;

• support the wide variety of hardware, software and messaging applications and protocols typical of the technology infrastructure; and

• process hundreds of millions of emails each day across multiple locations, without delaying message delivery.

Given the growth of complex messaging threats, we believe that businesses of all sizes require a dynamic messaging security solution to ensure a safe, secure and stable messaging system. Combating spam and related messaging threats has required increasing financial investment in security technology. IDC estimates that the messaging security software market will grow from $364 million in 2003 to $1.1 billion in 2007, representing a compound annual growth rate of 31%. Today, the market for enterprise anti-spam solutions remains largely unpenetrated. According to Ferris Research, approximately 10% of corporate mailboxes have some level of anti-spam protection.

We are a leading provider of electronic messaging security software and services to enterprises and messaging service providers worldwide, currently protecting approximately 25% of all mailboxes globally based upon IDC’s estimates of currently active global mailboxes as of January 2004. Our flagship software platform, Brightmail Anti-Spam, provides businesses with a flexible, scalable and dynamic anti-spam solution that affords industry-leading filtering effectiveness and accuracy. Our software installs easily and quickly and provides administration, customization and policy management capabilities. In addition to our core anti-spam functionality, our solution provides our customers with an extensible platform and complementary application modules for reducing risks associated with their electronic messaging infrastructure. For example, we also offer a tightly integrated anti-virus product that provides protection against email-borne viruses and worms. We sell our solution on a subscription basis and provide our customers with updates approximately every ten minutes by drawing upon our proprietary Probe Network to monitor evolving spam attacks in real-time. Our software can support numerous hardware configurations, operating systems, messaging applications and infrastructure, and is delivered as stand-alone software, integrated into third party appliance solutions or as a hosted service.

• High effectiveness. Our messaging security technologies employ multiple proprietary techniques to identify and block spam. We continuously update our filtering system based on real-time data from our Probe Network, which collects data from over a million decoy email addresses and enables us to quickly and dynamically identify, analyze and provide filter updates as spam attacks occur.

• High accuracy (low false positives). According to a comparative product analysis conducted for us by Veritest, an independent testing company, Brightmail Anti-Spam delivers an industry leading accuracy rate of 99.9999%, with fewer than one false positive in every one million messages identified as spam. We maintain extensive quality assurance processes through our operation centers, and we test all filter, rule and definition updates against a large test database of messages to safeguard against inadvertent filtering of legitimate messages. We also collect and analyze sample messages submitted by our customers that they believe were identified incorrectly and use this intelligence for the benefit of all customers. Because of our low false positive rate, some customers elect to have our software automatically delete potentially unwanted or malicious messages, rather than quarantining these messages for subsequent review. This provides significant cost savings in bandwidth, network and storage infrastructure investment, as well as personnel costs.

• Low total cost of ownership. Our software can typically be deployed within hours for a small enterprise and days for a large enterprise customer and consequently requires minimal consulting or in-house resources to install and implement. Once implemented, our automated processes analyze the latest threat trends, generating updates to filters, rules and definitions, which are provided in real-time to our customers.

• Cross-platform flexibility. Our software can support numerous operating systems, messaging applications and messaging protocols. For example, our software integrates with operating systems such as Microsoft Windows, Solaris, Linux and FreeBSD; messaging systems such as Microsoft Windows SMTP Service, Sendmail, Critical Path Messaging Server, Sun Java System Messaging Server and IBM Lotus Notes Domino Server; and messaging protocols such as SMTP and various wireless messaging protocols. We also deliver our solution as stand-alone software or integrated as an appliance or hosted service through our distribution channels.

• High performance and scalability. Brightmail Anti-Spam is scalable to a virtually unlimited number of mailboxes and is currently deployed at enterprises and messaging service providers with mailboxes ranging from less than 50 to well over 100 million. Our solution is built to efficiently meet the high volume messaging demands of large messaging service providers as well as the requirements of small businesses. Furthermore, it has only a minimal impact on the transmission time of messages, regardless of total volume.

• Customizable filtering and administration. Our software allows subscribers to customize the treatment of unwanted or malicious messages such as the option to selectively delete, quarantine or cleanse a message. Rules and policies can be written or modified by the IT administrator through our centralized management console to customize the software for individual workgroups, departments or divisions. Also, because each individual may have a different definition of what constitutes spam, we offer the ability to customize end-user preferences at the desktop level.

Our objective is to become the leading provider of messaging security products and services to businesses worldwide. The key elements of our strategy to achieve this objective include:

• Extend product and technology leadership. We will continue to invest in product development to expand and improve our products, services and technology in order to build a more complete messaging security platform that provides value-added messaging security capabilities to our customers. We intend to enhance our solution offerings through internal development, third party solution providers and, potentially, strategic acquisitions. We also will continue to focus on enhancing the functionality of our core technologies in existing products and operations.

• Expand geographic coverage. We plan to broaden our existing customer base in both Asia Pacific and Europe, Middle East and Africa. These markets are experiencing similar spam growth trends to those in the United States but to date have a lower rate of adoption of messaging security solutions. We intend to follow our North American strategy of pursuing the large messaging service providers and Global 2000 accounts directly and through our distribution channels.

• Extend leveraged sales channel. We intend to expand our sales coverage through agreements with our indirect channel of distributors, resellers, business outsourcing and hosted service providers, large global systems integrators, OEMs and appliance vendors. In addition, we have focused more of our direct sales professionals on Global 2000 businesses to increase large marquee account penetration.

• Leverage installed base of existing customers. We seek to leverage our large and diverse customer base by cross-selling additional products, such as our Anti-Virus and Anti-Fraud services. We believe there is a significant opportunity to market these and other services to our existing customer base.

• Encourage the development of third-party applications for our software platform. Our software platform enables third-party software developers to write application modules, which will complement our core solution. We provide a Software Development Kit, or SDK, to enable the integration of third-party products and services and to foster the development of new applications.

We provide the Brightmail server platform, which comprises a suite of software products and services that help our customers protect their systems from spam, viruses, fraudulent messages, as well as other security threats while allowing legitimate email to be reliably and securely delivered. We provide our products and services in both enterprise and messaging service provider versions, which we sell exclusively on a subscription basis. We provide an administration and management console that enables customers to modify the policies and preferences of our software at the departmental or end-user level. In addition, we provide our SDK and open application programming interfaces and are working with third-party software vendors to facilitate their introduction of messaging infrastructure applications that will be complementary to and integrate with our Brightmail server platform.

Brightmail Anti-Spam, which we launched in 1999, is our flagship product and is typically deployed at the Internet gateway, where email enters a customer’s core network. Combining several proprietary techniques, Brightmail Anti-Spam helps customers effectively and accurately identify and filter unsolicited or unwanted electronic messages, and ensures that legitimate messages are reliably delivered while maintaining a low on-going administration cost.

According to a comparative product analysis conducted for us by Veritest, an independent testing company, Brightmail Anti-Spam delivers an effectiveness rate typically higher than 95%, as well as an industry leading accuracy rate of 99.9999%, with fewer than one false positive in every one million messages identified as spam. Our core anti-spam engine uses multiple proprietary technologies, a globally-deployed detection network and a dynamic rule delivery mechanism in order to achieve accuracy and effectiveness. Brightmail Anti-Spam incorporates a multi-faceted approach to spam detection, providing a balanced mix of the following types of filters:

• Source filters: identify and block spam based on the source of the originating sender;

• Content filters: identify and block spam based on the content of the message; and

• Call-to-action filters: identify and block spam based on the inclusion of information in spam that directs or requests recipients to perform specific actions, such as visiting targeted website addresses or calling particular telephone numbers.

Brightmail Anti-Spam is easy to install and dynamically updated and does not require any tuning or training of filters by administrators. Filter updates that provide protection from new spam attacks are made available approximately every ten minutes automatically, securely, reliably and timely, 24 hours a day, 365 days a year. In addition, Brightmail Anti-Spam provides IT managers with a powerful set of management and reporting features such as flexible spam disposition, tolerance level settings and centralized and per-user web quarantine options. IT managers can add custom filters and enforce email policies using a graphical interface.

Brightmail Anti-Spam runs on Microsoft Windows, Linux, Solaris and FreeBSD operating systems and integrates with most leading enterprise messaging systems, including Windows SMTP service, Microsoft Exchange Server, IBM/Lotus Notes, Sendmail, Openwave Email MX, Critical Path Messaging Server and Sun Java System Messaging Server.

Brightmail Anti-Virus, which we launched in 2000, is a module that customers may license in conjunction with Brightmail Anti-Spam. This anti-virus module, which incorporates certain anti-virus technology from Symantec Corporation, scans message attachments for viruses and worms and delivers anti-virus signature updates to customers automatically and securely together with anti-spam filters generated by Brightmail Anti-Spam. “Worm auto-delete” is a key feature that removes messages associated with worms. The speed at which recent worms, such as MimeMail or MyDoom, have spread has been increasing, potentially leaving end-users’ systems unprotected even if they regularly download client anti-virus updates. Our anti-virus software module is a fast, reliable and high-performance solution for detecting and eliminating email-borne viruses at the gateway before they invade our customers’ core networks.

The Brightmail Reputation Service, which we launched in 2004, provides businesses with an additional level of security against messaging security threats. Using data from our Probe Network, the Brightmail Reputation Service evaluates message sources globally to determine the degree to which they are being used to send spam. This service tracks message and spam flow in real-time from hundreds of thousands of email sources and automatically creates profiles for each email source, including the history, quality and quantity of the email sent. By receiving profiles of the email sources, our customers can customize their email policies by blocking or allowing email based on the profile of the source itself. This service is currently offered to our customers in conjunction with Brightmail Anti-Spam.

Brightmail Anti-Fraud, which we launched in 2003, is designed to protect established businesses from “phishing” attacks, or fraudulent emails sent to the businesses’ clients that mimic their logo and domain name for the purposes of stealing financial or personal information of their clients and prospective clients. By mimicking the businesses’ legitimate messages, the sender tries to deceive the recipient to disclose personal or financial information. Brightmail Anti-Fraud acts as an early detection system for the abuse and mimicking of our customers’ brands and domains by utilizing the information collected by our Probe Network to proactively monitor whether an anti-fraud customer’s brand is being fraudulently used in messages.

We believe that superior customer support is critical to retaining and expanding our customer base. We offer a number of services to customers through our services and support organization. Our key customer service offerings include:

• Standard support services. Included as part of our subscription fee, we provide our customers standard support and maintenance services. These services include access to customer service professionals, technical support, software upgrades and updates and delivery of filtering rules and rule updates. Our support program assists our customers in the use of our products and services and identifies, analyzes and solves problems or issues with our services. Customer support services are available to customers by telephone, email or over the Internet during business hours. We also offer an online repository of helpful information about our products and services, as well as shared best practices for product use and upgrade implementation.

• Premium support services. We provide our customers with a variety of specialized support and maintenance programs including dedicated support account managers, 24 hours a day, 365 days a year.

We have developed a proprietary process and platform to deliver messaging security. The technology incorporated in our products and services is designed to provide our customers with reliability, quality of service, security and scalability. Key elements include our proprietary Probe Network, the Brightmail Logistics and Operation Centers, or BLOCs, advanced filtering technology, flexible technology architecture and advanced management tools.

1. Our Probe Network is comprised of a distributed system of over a million decoy electronic addresses. This network of decoy addresses enables us to collect millions of unsolicited messages every day and is designed to provide us with real-time visibility into the latest messaging threats impacting our customers.

2. Our BLOCs process messages received from our Probe Network and messages submitted by our customers that they believe should have been filtered or were filtered incorrectly, as well as anti-virus signature updates from Symantec. The combination of our automated technology and the ability of our BLOC specialists to analyze trends in messaging threats allows our BLOCs to generate and validate filters, rules and definition updates to block spam and related threats.

3. The filters, rules and definition updates are automatically deployed over a secure connection to customers who subscribe to the Brightmail solution. IT administrators are not involved in the update process, thereby reducing the burden and cost of maintaining the system.

4. Updates are generally available to our customers every ten minutes and, once installed, effectively and accurately protect our customers’ messaging infrastructure from new messaging attacks.

We have designed our proprietary Probe Network, comprised of over a million decoy electronic addresses (email and SMS in particular), to capture a large volume of unsolicited or unwanted messages that provide us with significant visibility into the latest messaging threats in real-time. In addition to inactive addresses obtained from our customers, we use a suite of proprietary tools and processes to automate the strategic placement of decoy addresses across the Internet, monitor unsubscribe features, track addresses targeted by spammers and evaluate emerging technologies employed by hackers, virus writers and identity theft criminals. We also collect sample messages submitted by our customers that they believe should have been filtered and those that were filtered incorrectly such that we can add this intelligence to our engine for the benefit of all customers. Data collected by our Probe Network also supports our Brightmail Reputation and Anti-Fraud Services. We believe that the scale and scope of our Probe Network, together with our proprietary tools and processes, create a competitive advantage for our business and makes the replication of our Probe Network by third parties difficult.

Our Brightmail Logistics and Operation Centers employ a suite of tools for analyzing the data collected by our Probe Network and sample messages submitted by our customers for purposes of generating testing and reporting filtering rules. We developed sophisticated grouping algorithms designed to aggregate similar messages to pinpoint a spam attack. Once the characteristics of a spam attack have been identified, we design and update rules to filter them. We also deploy various translation and other technologies intended to remove randomization, such as inserting random text in a message, and obfuscation, such as inserting text in the same color as the background color—techniques used by spammers to circumvent anti-spam filters. We plan to continue to develop or enhance our technology in the following areas:

• increase automation of rules generation to improve the scalability of our operations as the volume of spam attacks increase;

• improve quality control methods and processes to maintain or increase the effectiveness and accuracy of our filtering rules.

We make available new filters and filter updates to our customers approximately every ten minutes to respond to new and evolving electronic messaging threats in real-time. We have focused substantial development resources on enhancing our software with core anti-spam filtering technologies including:

• proprietary web address, or URL, filter technology that identifies and filters messages based on the presence of addresses linked to spammers’ websites embedded in messages;

• proprietary spam signatures technology, BrightSig, which removes the random HTML code included in spam messages to evade spam-filtering software. This technology allows us to group seemingly random spam messages into a common attack that can be filtered efficiently;

• a dynamic database of IP addresses of open proxy servers that identifies and blocks messages that are sent from these sources;

• an intelligent engine that filters messages written in foreign languages and based on user profile and personal options; and

• heuristic technology that assigns a score and weight to each spam characteristic in a message. Leveraging the vast amount of data we collect from our Probe Network, we update our heuristic technology and fine tune each spam characteristic’s score and weight continuously. If a message exceeds a specified score, it is considered spam.

Currently, our software is capable of filtering up to 20 email messages per second, or a total of over 1.7 million messages per day, for each processor on which our software is installed. We monitor the filtering activities of our installed base remotely through our BLOCs, and continually adjust the deployed filter sets to maintain these performance levels and thereby minimize latency in message delivery. This monitoring activity also provides additional information on trends in email and messaging security threats that augments the data collected through our Probe Network.

We designed our software and services to provide our customers with a high performance and flexible architecture. Key elements of our architecture are:

• Cross-platform support. Our architecture works with industry-leading platforms to reduce the need for customization and implementation time. Our products and services work across multiple mail servers, such as Microsoft Exchange, IBM Lotus Domino and Sendmail and integrate with many existing, well-known messaging systems.

• Robust failover capability. Our software allows multiple clients to failover to multiple servers. If our software fails, our architecture permits our customer’s email messaging system to continue to deliver email.

• Highly scalable solution. Leveraging best of breed messaging technologies, our products can scale to more than 100 million mailboxes per customer.

We have designed our products and services to include advanced management tools that allow customers to customize their email security policies. We developed a custom rules editor to allow

IT managers to use a graphical interface to write custom filters using several types of filtering techniques, such as keyword-based filters, sender-based filters and source-based filters using IP addresses or third-party black lists or custom white lists to bypass filtering rules. We also provide client plug-ins for industry leading email clients, which allow users to create personal safe lists automatically populated from sent items and contact lists, as well as personal block lists.

Our product development efforts are focused on improving and enhancing our existing product and service offerings as well as developing new proprietary technology. To date, we have spent over $30.3 million on product development and have approximately 60 people currently working on product development. We have two primary product development teams. Our anti-spam technology group, which is part of our engineering team, focuses on possible ways spammers might circumvent filters designed to block their messages and on developing technology that could minimize the amount of false positives generated by our product. Our BLOC engineering team is focused on enhancing the tools used by our operation centers to increase the effectiveness and scalability of our operations, including improved methods of automation to help us analyze and evaluate spam attacks and generate new filtering rules more quickly and effectively.

Our operations to support the monitoring of spam threats and delivery of filter updates involve both in-house and outsourced capabilities. Our BLOCs are operated by us and are based in San Francisco, California; Dublin, Ireland; Taipei, Taiwan; and Sydney, Australia. These centers, which have centralized performance consoles, automated load distribution and various self-diagnostic tools and programs, provide the backbone for monitoring our Probe Network on a 24 hour a day, 365 days a year basis.

To deliver filter updates to customers and provide data storage, we rely on a third-party data center facility located in San Francisco. This facility is designed to withstand an earthquake of magnitude up to 7.9 on the Richter scale and has extensive security measures, including around-the-clock security and escort-controlled access. This facility is supported by on-site backup generators in the event of a power failure. We regularly backup our production tools and database, as well as our development environment to ensure smooth transition in case disaster recovery becomes necessary. In addition, we have implemented redundant filter update delivery systems in our San Francisco headquarters and are in the process of implementing such systems in a third-party data center facility located in Sacramento, California for use in the event that our current third-party data center facilities in San Francisco become unavailable.

We market and sell subscriptions to our products and services indirectly through our resellers, distributors and business outsourcing providers and large global systems integrators, as well as through the efforts of our direct sales organization. Our sales organization is divided into regional account teams, which include regional vice presidents, sales directors, channel managers, inside sales representatives and sales engineers. We maintain a sales office in San Francisco and, outside the United States, in Australia, Taiwan, Ireland, The Netherlands and

Germany. As of January 31, 2004, our sales organization was comprised of 31 individuals in North America, four individuals in Asia Pacific and four individuals in Europe. We intend to increase the size of our sales organization and establish additional sales offices.

Our channel partners primarily include resellers, distributors, hosted service providers and large global systems integrators. A channel partner typically signs a one or two-year agreement to become a nonexclusive distributor or reseller. Channel partners are responsible for most aspects of the relationship with the customer, including billing, implementation and promotional activities. Some of our channel partners also sell or implement related messaging security products and bundle our products and services with their core offerings. We have also established indirect sales channels with messaging security appliance vendors. These vendors typically sign a one or two-year agreement to market and resell our products and services together with their messaging security appliance solutions. As with channel partners, these vendors are responsible for maintaining the customer relationship. Under some agreements, we are the exclusive third-party commercial anti-spam technology provider for the appliance vendors, subject to some exceptions.

We have multi-disciplinary sales teams that consist of sales as well as technical and support professionals. Our senior and regional sales management take an active role in our sales efforts as needed. Our technical and support sales professionals work with our customers to ensure successful implementation of our products and services. As our direct sales efforts focus primarily on business-wide deployments, our sales efforts are typically directed to senior executives at our potential customers’ businesses, including the chief information officer, vice presidents and directors of the information technology departments.

For the fiscal year ended January 31, 2004, we generated approximately 14% of our total revenues through direct and indirect sales from customers outside of the United States. We expect international markets to provide increased opportunities for our products and services in the future. Our current international efforts are focused on strengthening our direct sales and marketing presence in Asia Pacific and in Europe, Middle East and Africa and generating more revenues from these regions.

We focus our marketing efforts on creating awareness for our products and services, educating potential customers, generating new qualified sales opportunities, and raising the awareness of Brightmail as a leading provider of messaging security solutions. Our marketing programs include a variety of events including public relations activities, telemarketing, direct marketing, seminars and trade shows targeted at key executives and decision-makers within our target markets. We also maintain an active public relations program and actively participate in discussions with governmental authorities, agencies and the press to contribute our expertise and provide insights with respect to messaging security solutions.

From 1999, when we first introduced our products and services, through March 2004, our customer base has grown to over 2,000 customers, with an aggregate over 300 million end-user mailboxes under subscription.

We sell our products to many enterprises, including Fortune 500 companies with up to 350,000 mailboxes per enterprise, as well as smaller enterprises with fewer than 20 mailboxes. These enterprise customers encompass a variety of different industries, including computer hardware and components, computer software, consumer products, telecommunications, financial services, industrial products and services. Our customers currently include eight of the top twelve Internet service providers in the United States who use our software to provide spam and virus protection to their users. Our customers also include hosted service providers, which provide IT infrastructuring software and services to businesses.

For the fiscal year ended January 31, 2004, sales to Microsoft Corporation represented over 10% of our revenues.

We believe that we compete principally on the basis of solution effectiveness, accuracy, total cost of ownership and flexibility. Our current and potential principal competition includes:

• pure-play messaging security vendors such as Postini Corporation and CipherTrust, Inc.;

• IT security and anti-virus vendors such as Trend Micro Inc., Network Associates, Inc. and Symantec Corporation; and

In addition, we may face competition from large enterprise network infrastructure and software vendors such as Cisco Systems and Microsoft as they diversify their product offerings.

We believe that we have the lowest false positive rate in the industry, achieving a one-message-in-one million false positive rate by leveraging multiple technologies. We believe that our competitive strengths, in addition to our low false positive rate, include our high effective rate in blocking spam, low total cost of ownership, cross-platform flexibility and scalability to meet the needs of virtually all sizes of businesses.

We believe that our continued success will depend primarily on our ability to develop and maintain the proprietary aspects of our technology and operate without infringing upon the proprietary rights of others, our technical expertise, speed of technology implementation and the creative skills and management abilities of our officers and employees. We primarily rely on a combination of patent, trademark, license, trade secret and copyright laws, nondisclosure agreements with our employees, consultants and suppliers and other contractual restrictions to establish, maintain and protect our proprietary rights. We hold three U.S. issued patents and one utility pending patent application and three provisional patent applications, including one issued patent relating to our proprietary Probe Network. We intend to actively pursue the filing of

additional patent applications in both the U.S. and foreign jurisdictions. Our domestic patents and applications have expiration dates ranging from December 23, 2017 through December 31, 2018.

We claim copyright and trademark protection for proprietary documentation and a variety of branding marks. For example, Brightmail and Email You Can Trust are trademarks registered in a number of countries, including, among others, the United Kingdom, France, Italy, Germany, Australia, Mexico, Singapore, New Zealand and the U.S. We have also registered several Internet domain names that we use for electronic interaction with our customers, including dissemination of product information, marketing programs, product registration, sales activities and other commercial uses.

We also integrate third-party software into our products that is necessary for their operation and functionality. We obtain the rights to use such software through license agreements. In particular, we have entered into an agreement with Symantec that allows us to integrate certain of Symantec’s anti-virus technology with our anti-spam technology. This agreement has a three-year term expiring in July 2005. In addition, Symantec has the right to terminate this agreement upon the occurrence of certain events, including if we are subject to a change of control transaction, or if we transfer more than 25% of our voting control or substantially all of our assets to a Symantec competitor. We estimate that sales of our anti-virus module under this agreement represented approximately 20% of our total revenues for the fiscal year ended January 31, 2004.

As of January 31, 2004, we had a total of 127 full-time employees, of whom 63 were involved in product development, 47 in sales and marketing and customer support and 17 in finance and administration. None of our employees are represented by a labor union. We have not experienced any work stoppages and believe that our relationships with employees are good. Our future success will depend in part on our ability to attract, retain and motivate highly qualified technical and management personnel, for whom competition is intense.

Our headquarters are located at 301 Howard Street, Suite 1800, San Francisco, California. We lease approximately 25,000 square feet of space under agreements expiring in December 2004. We sublease approximately 8,700 square feet of our facilities to a subtenant due to expire in December 2004. We believe that our facilities are adequate for the next 12 months and that, if required, suitable additional space will be available on commercially reasonable terms to accommodate expansion of our operations. In addition to our headquarters, we lease office space in The Netherlands, Australia, Taiwan, the United Kingdom and Ireland to support our field sales and operations staff.

Although we are not currently a party to any material litigation, we may occasionally become involved in litigation arising in the ordinary course of our business.

The following table sets forth the names, ages and positions of our executive officers and directors as of the date hereof:

Enrique Salem has served as our president and chief executive officer and on our board of directors since April 2002. From February 2001 to March 2002, Mr. Salem served as senior vice president of products and technology at Oblix, Inc., a developer of identity-based security solutions. From October 1999 to January 2001, Mr. Salem was vice president of engineering and operations at Ask Jeeves Inc., a provider of natural language question answering technologies and services. From April 1990 to October 1999, Mr. Salem served as chief technical officer and vice president of the security and assistance business of Symantec Corporation. Mr. Salem holds an A.B. in Computer Science from Dartmouth College and is also a graduate of the AeA/Stanford Executive Institute at Stanford University.

Michael Irwin has served as our chief financial officer since April 2003 and as our vice president of finance from January 2002 until April 2003. From April 2000 to December 2001, Mr. Irwin served as vice president of finance at B2SB Technologies Corp. (previously known as SmartAge.com Corporation), a provider of software and services to small businesses. From December 1992 to March 2000, Mr. Irwin worked at PricewaterhouseCoopers LLP, a public accounting firm. Mr. Irwin received a B.S. in business administration from the University of Wisconsin, Milwaukee.

Ken Schneider has served various positions at our company since March 1999, most recently as chief technology officer and vice president of operations. From November 1993 to March 1999, Mr. Schneider was the president of South Beach Software, a software development and consulting company. Mr. Schneider received a B.S. in Engineering from Swarthmore College and an M.S. in Mechanical Engineering from the University of California, Berkeley.

Michael D. Conner has served as our vice president of worldwide sales since August 2002. From August 1997 to July 2002, Mr. Conner served in various positions at Trend Micro, Inc., a network security company, most recently as president of North American operations and senior vice president. From July 1995 to July 1997, Mr. Conner was vice president of sales at Astound Inc.

(formerly Gold Disk, Inc.), a web conferencing and multi-media presentation software company. From August 1994 to July 1995, Mr. Conner was senior director of channel sales at Borland Software Corporation. Mr. Conner received a B.S. degree from Western Illinois University.

Brad Kingsbury has served as our vice president of engineering since November 2002. From November 2001 to October 2002, Mr. Kingsbury was vice president of engineering of McAfee.com Corporation (which was acquired by Network Associates, Inc.), an Internet security company. From October 1997 to September 2001, Mr. Kingsbury was self-employed as a consultant to a number of security and storage management software companies. From April 1996 to September 1997, Mr. Kingsbury served as the chief technical officer and vice president of engineering for CyberMedia Corporation (also acquired by Network Associates), an Internet security and productivity company. From July 1985 to April 1996, Mr. Kingsbury served as chief technologist at Symantec Corporation. Mr. Kingsbury received a B.S. degree in Computer Science from California State University, Northridge.

François A. Lavaste has served as our vice president of marketing since September 2001. From April 1999 to August 2001, Mr. Lavaste was vice president of marketing at B2SB Technologies Corp. From September 1996 to March 1999, Mr. Lavaste served as senior marketing manager in the small business division at Intuit Inc., a provider of business and financial management solutions for small businesses, consumers and accounting professionals. From April 1992 to March 2000, Mr. Lavaste was a director of Eneide, a customer relationship management software company co-founded by Mr. Lavaste and acquired in March 2000 by Coheris, a public company providing CRM, CTI, Mobile Internet and Voice over IP technology listed on the Euronext Paris “Nouveau Marché.” Mr. Lavaste received a B.A. degree in business administration from ESCP-EAP European School of Management, and an M.B.A. from Harvard Business School.

Bettina H. Koblick has served various positions at our company since April 2000, most recently as vice president of human resources. From July 1995 to April 2000, Ms. Koblick served as the division human resources manager at Curtis Instruments, a provider of integrated systems technology for electric vehicles. Ms. Koblick received a HR Management certification from the University of California, Berkeley.

Eric W. Spivey has served on our board of directors since April 1999 and as the chairman of our board of directors since February 2002 and from February 2002 to April 2002, Mr. Spivey served as our interim chief executive officer. From April 1999 to December 1999, Mr. Spivey served as the chairman, president and chief executive officer of NetGravity, Inc., a provider of online advertising and direct marketing solutions. From 1998 to March 1999, Mr. Spivey served as chairman, president and chief executive officer of Netcom On-Line Communications Services, Inc., a global Internet company. From 1996 to 1997 Mr. Spivey was president of Netcom International. From 1985 to 1995, Mr. Spivey held various senior executive positions with the Dun & Bradstreet Corporation, a provider of global business and marketing information. Mr. Spivey received a B.A. in Economics and Environmental Studies from the University of California, Santa Barbara and an M.B.A. from the McCombs School of Business, University of Texas at Austin.

John C. Colligan has served on our board of directors since July 1998. Since March 1998, Mr. Colligan has been a partner with Accel Partners, a venture capital firm. Mr. Colligan co-founded Macromedia, Inc., a multimedia software company, in 1992 through a merger of Authorware and Macromind-Paracomp. From March 1992 to January 1993 Mr. Colligan served as president and chief operating officer of Macromedia, as president and chief executive officer

from January 1993 to July 1995, as chairman, president and chief executive officer from July 1995 to November 1996, and as chairman from November 1996 to July 1998. From January 1989 to 1992, Mr. Colligan was president and chief executive officer of Authorware, a multimedia software company, and from 1983 to 1988, he held various positions at Apple Computer, Inc. Mr. Colligan received a B.S. degree in international economics from Georgetown University and a M.B.A from Stanford Graduate School of Business. Mr. Colligan is a member of the board of directors of CNET Networks, Inc.

Henri J. Isenberg has served as one of our directors since June 2001. Since June 1996, Mr. Isenberg has worked at Symantec Corporation, where since February 2000, Mr. Isenberg has served as vice president of business development, and from June 1996 to February 2000 as chief architect for Symantec’s anti-virus division. Mr. Isenberg received a B.S. degree in Computer Science and Engineering from the University of California, Los Angeles, and a M.B.A. from Woodbury University.

Sunil Paul, a founder of our company, has served on our board of directors since our inception in February 1998 and was our chief executive officer from February 1998 to April 2000, Mr. Paul was a founder of FreeLoader, Inc. (which was acquired by Individual, Inc.), a creator of web browsing utilities, and served as its chief executive officer from January 1996 to July 1997. From February 1994 to December 1995, Mr. Paul served as Internet product manager and director corporate development for America Online, Inc, an internet service provider. From 1991 to February 1994, Mr. Paul served as senior analyst for the United States Congress, Office of Technology Assessment and from 1991 to 1998 Mr. Paul served as a senior engineer for Booz, Allen & Hamilton, a consulting firm. Mr. Paul received a B.E. in Electrical Engineering from Vanderbilt University.

Jon Q. Reynolds, Jr. has served as one of our directors since August 1999. Since July 1997, Mr. Reynolds has worked at Technology Crossover Ventures, a venture capital firm, where he is currently a general partner. Mr. Reynolds received an A.B. degree in Geography from Dartmouth College and a M.B.A. from Columbia Business School.

Our board of directors consists of six members, Messrs. Colligan, Isenberg, Paul, Reynolds, Salem and Spivey. Our directors hold office until their successors have been elected or qualified or until the earlier of their death, resignation, disqualification or removal. There are no family relationships among any of our directors and executive officers.

Following this offering, our board of directors will be divided into three classes, with each class serving staggered three-year terms. Any additional directorships resulting from an increase in the number of directors will be distributed among the three classes so that, as nearly as possible, each class will consist of one-third of the directors.

Eric Spivey, our chairman of the board, receives an annual fee of $60,000 for serving as chairman. Other than Mr. Spivey, directors do not receive any cash fees for their services on the Board but are entitled to reimbursement of all reasonable out-of-pocket expenses incurred in connection with their attendance at board of directors and board committee meetings.

We have also offered our non-employee directors compensation in the form of stock options. During the last three fiscal years, Messrs. Colligan and Spivey have each received stock option grants of 10,000 shares per year, and during the last two fiscal years, Mr. Paul has received stock option grants of 10,000 shares per year. A total of 25% of the shares subject to the foregoing option grants vests at the end of one year after the grant date, and thereafter, 1/48 of the shares subject to the foregoing option grants vests monthly. In addition, in February 2002, Mr. Spivey

received an option to purchase 158,520 shares of our common stock that was 100% vested on the date of grant, when he served as our interim chief executive officer.

Following this offering, our non-employee directors will be entitled to reimbursement of business, travel and other related expenses incurred in connection with their attendance at meetings of the board of directors and committee meetings. In addition, the chairman of the board will continue to receive a $60,000 annual fee. In addition, our 2004 Equity Incentive Plan also provides for the automatic grant of options to our non-employee directors. Each non-employee director appointed to the board after the completion of this offering will receive an initial option to purchase shares upon such appointment. In addition, beginning in 2005, non-employee directors who have been directors for at least six months will receive an option to purchase shares immediately following each annual meeting of our stockholders. See “Benefit plans—2004 Equity Incentive Plan.”

Our board of directors has the authority to appoint committees to perform certain management and administrative functions. Our board of directors currently has an audit committee and a compensation committee.

Our audit committee is responsible for the oversight of our accounting, reporting and financial control practices. Among other functions, the audit committee is responsible for:

• overseeing and monitoring our accounting and financial reporting processes and the audits and integrity of our financial statements;

• appointing and overseeing the work of our independent auditors, and reviewing the adequacy of our system of overseeing the independent auditor’s qualifications, independence and performance;

• assisting the board of directors in the oversight and monitoring of our compliance with legal and regulatory requirements;

• reviewing our audited financial statements and reports and discussing the statements and reports with management, including any significant adjustments, management judgments and estimates, new accounting and policies.

Our audit committee currently consists of Messrs. Spivey and Isenberg, each of whom is a non-management member of our board of directors.

Our compensation committee is primarily responsible for reviewing and approving the compensation, benefits, corporate goals and objectives of our chief executive officer and our

other executive officers and approving and evaluating our employee benefit plans. Among other functions, the compensation committee is responsible for:

• reviewing and making recommendations to the board of directors regarding compensation goals and guidelines for employees and amendments to equity compensation plans;

• producing a report on executive compensation for inclusion in our proxy statement.

Our compensation committee currently consists of Messrs. Colligan, Reynolds and Spivey, each of whom is a non-management member of our board of directors. Our board of directors has approved a compensation committee charter that meets the applicable standards of the SEC and Nasdaq.

No interlocking relationship exists between our board of directors or compensation committee and the board of directors or compensation committee of any other company, nor has any such interlocking relationship existed in the past.

The following table sets forth information concerning the compensation earned by our chief executive officer and each of our four other most highly compensated executive officers, collectively referred to as our named executive officers, during the fiscal year ended January 31, 2004:

The following table sets forth certain information concerning grants of stock options to each of our named executive officers during the fiscal year ended January 31, 2004. The percentage of total options set forth below is based on an aggregate of 1,071,228 options granted to employees during the fiscal year ended January 31, 2004. All options were granted at the fair market value of our common stock, as determined by our board of directors, on the date of grant.

Aggregated option exercises in last fiscal year and fiscal year end option values

None of our named executive officers exercised options during the fiscal year ended January 31, 2004. The following table sets forth the number and value of securities underling options held as of January 31, 2004.

On March 11, 2002, we entered into an employment agreement with Mr. Salem, our president and chief executive officer, pursuant to which we granted Mr. Salem an option to purchase 2,219,274 shares of our common stock. The agreement provides that upon a change of control of the company, Mr. Salem shall be entitled to acceleration of vesting with respect to 25% of the shares subject to his stock options on the effective date of the change of control, and if Mr. Salem is constructively terminated or is terminated without cause within six months after a change of control of the company, he will be entitled to acceleration of vesting with respect to all of the shares subject to his stock options. In addition, if Mr. Salem is constructively terminated or is terminated without cause, he shall be entitled to severance payments at his base salary rate for either: (1) 12 months, if the termination occurs within six months after a change of control, or (2) six months, if the termination occurs at any time other than within six months after a change of control. We also entered into a stock option agreement with Mr. Salem effective July 15, 2003, pursuant to which we granted Mr. Salem an option to purchase 200,000 shares of our common stock. A constructive termination is generally deemed to have occurred upon any one of the following three events: (1) a material reduction in the executive’s title or responsibilities; (2) a reduction of the executive’s base salary; and (3) the relocation of the executive to a facility more than 50 miles from the company’s current location, without the executive’s express written consent.

On May 13, 2002, we entered into an offer letter with Mr. Irwin, our chief financial officer, pursuant to which we granted Mr. Irwin an option to purchase 200,000 shares of our common stock. The agreement provides that upon a change of control of the company, Mr. Irwin shall be entitled to acceleration of vesting with respect to 25% of the shares subject to his stock options subject to the agreement, and if Mr. Irwin is constructively terminated or is terminated without cause within six months after a change of control of the company, he will be entitled to acceleration of vesting with respect to all of the shares subject to the stock options subject to the agreement. We entered into a stock option agreement with Mr. Irwin on April 8, 2003, pursuant to which we granted Mr. Irwin an option to purchase 131,841 shares of our common stock, with the same terms with respect to acceleration of vesting upon and after a change of control that are contained in his offer letter. We entered into stock option agreements with Mr. Irwin on the following dates to purchase the following number of shares: 55,000 shares, on September 12, 2002; 35,000 shares, on February 5, 2004; and 20,000 shares, on March 10, 2004. These agreements provide that if Mr. Irwin is constructively terminated or is terminated without cause within six months after a change of control of the company, 75% of the shares subject to each of these stock option agreements shall become vested and exercisable.

Effective September 12, 2002, we entered into a stock option agreement with Mr. Schneider, our chief technology officer and vice president of operations, pursuant to which we granted

Mr. Schneider an option to purchase 35,000 shares of our common stock. Effective February 5, 2004, we entered into a stock option agreement with Mr. Schneider, pursuant to which we granted Mr. Schneider an option to purchase 25,000 shares of our common stock. These agreements provide that if Mr. Schneider is constructively terminated or is terminated without cause within six months after a change of control of the company, 75% of the shares subject to these stock option agreements shall become vested and exercisable.

On June 12, 2002, we entered into an offer letter with Mr. Conner, our vice president of worldwide sales, pursuant to which we granted Mr. Conner an option to purchase 331,841 shares of our common stock. The agreement provides that if Mr. Conner is terminated without cause, he shall be entitled to severance payments at his base salary rate for six months. In addition, upon a change of control of the company, Mr. Conner shall be entitled to acceleration of vesting with respect to 25% of the shares subject to his stock options subject to the agreement, and if Mr. Conner is terminated without cause within six months after a change of control of the company, he will be entitled to acceleration of vesting with respect to an additional 25% of the shares subject to his stock options subject to the agreement. Effective February 5, 2004, we entered into a stock option agreement with Mr. Conner, pursuant to which we granted Mr. Conner an option to purchase 35,000 shares of our common stock. This agreement provides that if Mr. Conner is constructively terminated or is terminated without cause within six months after a change of control of the company, 75% of the shares subject to this stock option agreement shall become vested and exercisable.

On October 23, 2002, we entered into an offer letter with Mr. Kingsbury, our vice president of engineering, pursuant to which we granted Mr. Kingsbury an option to purchase 497,762 shares of our common stock. This offer letter provides that if Mr. Kingsbury is constructively terminated or is terminated without cause, he shall be entitled to severance payments at his base salary rate for either: (1) six months, if the termination occurs within nine months after a change of control, or (2) three months, if the termination occurs at any time other than within nine months after a change of control. In addition, upon a change of control of the company, Mr. Kingsbury shall be entitled to acceleration of vesting with respect to 25% of the shares subject to his stock options, and if Mr. Kingsbury is constructively terminated or is terminated without cause within nine months after a change of control of the company, he will be entitled to acceleration of vesting with respect to 75% of the shares subject to his stock options. Pursuant to the offer letter, we have agreed to reimburse reasonable and necessary living expenses incurred, as well as travel expenses with respect to Mr. Kingsbury’s travel from his home in Los Angeles to our offices in San Francisco each week. Effective February 5, 2004, we entered into a stock option agreement with Mr. Kingsbury, pursuant to which we granted Mr. Kingsbury an option to purchase 62,500 shares of our common stock, with the same terms with respect to acceleration of vesting upon and after a change of control that are contained in his offer letter.

On September 7, 2001, we entered into an offer letter with François A. Lavaste, our vice president of marketing, pursuant to which we granted Mr. Lavaste an option to purchase up to

175,000 shares of our common stock. We entered into stock option agreements with Mr. Lavaste on the following dates to purchase the following number of shares: 35,000 shares, on September 12, 2002; 20,000 shares, on February 5, 2004; and 10,000 shares, on March 10, 2004. These agreements provide that if Mr. Lavaste is constructively terminated or is terminated without cause within six months after a change of control of the company, 75% of the shares subject to these stock option agreements shall become vested and exercisable.

On March 24, 2000, we entered into an offer letter with Bettina Koblick, as director of human resources, pursuant to which we granted Ms. Koblick an option to purchase up to 40,000 shares of our common stock. We entered into stock option agreements with Ms. Koblick on the following dates to purchase the following number of shares: 16,000 shares, on September 12, 2002; 12,500 shares, on February 5, 2004; and 20,000 shares, on March 10, 2004. These agreements provide that if Ms. Koblick is constructively terminated or is terminated without cause within six months after a change of control of the company, 75% of the shares subject to these stock option agreements shall become vested and exercisable.

Our 1998 Stock Option Plan was adopted by our board of directors in March 1998 and approved by our stockholders in April 1998. Our 1998 Stock Option Plan provides for the grant of incentive stock options, within the meaning of Section 422 of the Internal Revenue Code of 1986, as amended, to our employees, and for the grant of nonstatutory stock options to our employees, directors and consultants. We will not grant any additional awards under our 1998 Stock Option Plan following this offering. Instead we will grant options under our 2004 Equity Incentive Plan.

A total of 9,909,974 shares of our common stock were authorized for issuance under the 1998 Stock Option Plan. As of January 31, 2004, options to purchase 6,151,184 shares of common stock were outstanding and 2,015,465 shares were available for future grant under this plan. Our 1998 Stock Option Plan provides that in the event of our merger with or into another corporation or a sale of substantially all of our assets, the successor corporation will assume or substitute each award. If the outstanding awards are not assumed or substituted, the administrator will provide notice to the optionee that he or she has the right to exercise the award as to all of the shares subject to the award, including shares that would not otherwise be exercisable, for a period of 15 days from the date of notice. The award will terminate upon the expiration of the 15-day period.

Our board of directors adopted our 2004 Equity Incentive Plan in March 2004, and we expect our stockholders to approve it prior to the completion of this offering. Our 2004 Equity Incentive Plan provides for the grant of incentive stock options, within the meaning of Section 422 of the Internal Revenue Code, to our employees and any parent and subsidiary corporations’ employees, and for the grant of nonstatutory stock options, restricted stock, stock appreciation rights, performance units and performance shares to our employees, directors and consultants and any parent and subsidiary corporations’ employees and consultants.

We have reserved a total of shares of our common stock for issuance pursuant to the 2004 Equity Incentive Plan plus (1) any shares which have been reserved but not issued under our 1998 Stock Option Plan as of the effective date of this offering and (2) any shares returned to our 1998

Stock Option Plan on or after the effective date of this offering as a result of termination of options or the repurchase of unvested shares issued under the 1998 Stock Plan. In addition, our 2004 Equity Incentive Plan provides for annual increases in the number of shares available for issuance thereunder on the first day of each fiscal year, beginning with our fiscal year 2005, equal to the least of:

• % of the outstanding shares of our common stock on the first day of the fiscal year;

Our board of directors or a committee of our board administers our 2004 Equity Incentive Plan. In the case of options intended to qualify as “performance-based compensation” within the meaning of Section 162(m) of the Internal Revenue Code, the committee will consist of two or more “outside directors” within the meaning of Section 162(m) of the Internal Revenue Code. The administrator has the power to determine the terms of the awards, including the exercise price, the number of shares subject to each such award, the exercisability of the awards and the form of consideration, if any, payable upon exercise. The administrator also has the authority to institute an exchange program whereby the exercise prices of outstanding awards may be reduced or outstanding awards may be surrendered in exchange for awards with a lower exercise price.

The administrator determines the exercise price of options granted under our 2004 Equity Incentive Plan, but with respect to nonstatutory stock options intended to qualify as “performance-based compensation” within the meaning of Section 162(m) of the Internal Revenue Code and all incentive stock options, the exercise price must at least be equal to the fair market value of our common stock on the date of grant. The term of an incentive stock option may not exceed ten years, except that with respect to any participant who owns 10% of the voting power of all classes of our outstanding stock, the term must not exceed five years and the exercise price must equal at least 110% of the fair market value on the grant date. The administrator determines the term of all other options.

No optionee may be granted an option to purchase more than shares in any fiscal year. However, in connection with his or her initial service, an optionee may be granted an additional option to purchase up to shares.

After termination of an employee, director or consultant, he or she may exercise his or her option for the period of time stated in the option agreement. Generally, if termination is due to death or disability, the option will remain exercisable for 12 months. In all other cases, the option will generally remain exercisable for three months. However, an option generally may not be exercised later than the expiration of its term.

Stock appreciation rights may be granted under our 2004 Equity Incentive Plan. Stock appreciation rights allow the recipient to receive the appreciation in the fair market value of our common stock between the exercise date and the date of grant. The administrator determines the terms of stock appreciation rights, including when such rights become exercisable and whether to pay the increased appreciation in cash or with shares of our common stock, or a combination thereof.

Restricted stock may be granted under our 2004 Equity Incentive Plan. Restricted stock awards are shares of our common stock that vest in accordance with terms and conditions established by

the administrator. The administrator will determine the number of shares of restricted stock granted to any employee. The administrator may impose whatever conditions to vesting it determines to be appropriate. For example, the administrator may set restrictions based on the achievement of specific performance goals. Shares of restricted stock that do not vest are subject to our right of repurchase or forfeiture.

Performance units and performance shares may be granted under our 2004 Equity Incentive Plan. Performance units and performance shares are awards that will result in a payment to a participant only if performance goals established by the administrator are achieved or the awards otherwise vest. The administrator will establish organizational or individual performance goals in its discretion, which, depending on the extent to which they are met, will determine the number and/or the value of performance units and performance shares to be paid out to participants. Performance units shall have an initial dollar value established by the administrator prior to the grant date. Performance shares shall have an initial value equal to the fair market value of our common stock on the grant date.

Our 2004 Equity Incentive Plan also provides for the automatic grant of options to our non-employee directors. Each non-employee director appointed to the board after the completion of this offering will receive an initial option to purchase shares upon such appointment subject to years vesting. In addition, beginning in 2005, non-employee directors who have been directors for at least six months will receive a subsequent option to purchase shares immediately following each annual meeting of our stockholders. All options granted under the automatic grant provisions have a term of ten years and an exercise price equal to fair market value on the date of grant.

Unless the administrator provides otherwise, our 2004 Equity Incentive Plan does not allow for the transfer of awards and only the recipient of an award may exercise an award during his or her lifetime.

Our 2004 Equity Incentive Plan provides that in the event of our change in control, the successor corporation or its parent or subsidiary will assume or substitute an equivalent award for each outstanding award. If there is no assumption or substitution of outstanding awards, the administrator will provide notice to the recipient that he or she has the right to exercise the option and stock appreciation right as to all of the shares subject to the award, all restrictions on restricted stock will lapse, and all performance goals or other vesting requirements for performance shares and units will be deemed achieved and all other terms and conditions met. The award will terminate upon the expiration of the period of time the administrator provides in the notice. In the event the service of an outside director is terminated on or following a change in control, other than pursuant to a voluntary resignation, his or her options will fully vest and become immediately exercisable.

Our 2004 Equity Incentive Plan will automatically terminate in 2014, unless we terminate it sooner. In addition, our board of directors has the authority to amend, suspend or terminate the 2004 Equity Incentive Plan provided such action does not impair the rights of any participant.

Concurrently with this offering, we intend to establish the 2004 Employee Stock Purchase Plan. A total of shares of our common stock will be reserved for issuance under the plan. In addition, our 2004 Employee Stock Purchase Plan provides for annual increases in the number of shares available for issuance under the 2004 Employee Stock Purchase Plan on the first day of each fiscal year, beginning with our fiscal year 2006, equal to the lesser of:

• % of the outstanding shares of our common stock on the first day of the fiscal year;

Our board of directors or a committee of our board administers the 2004 Employee Stock Purchase Plan. Our board of directors or its committee has full and exclusive authority to interpret the terms of the 2004 Employee Stock Purchase Plan and determine eligibility.

All of our employees are eligible to participate if they are customarily employed by us or any participating subsidiary for at least 20 hours per week and more than five months in any calendar year. However, an employee may not be granted an option to purchase stock if such employee:

• immediately after grant owns stock possessing 5% or more of the total combined voting power or value of all classes of our capital stock; or

• whose rights to purchase stock under all of our employee stock purchase plans accrues at a rate that exceeds $25,000 worth of stock for each calendar year.

Our 2004 Employee Stock Purchase Plan is intended to qualify under Section 423 of the Internal Revenue Code and provides for consecutive, overlapping -month offering periods. Each offering period includes four 6-month purchase periods. The offering periods generally start on the first trading day on or after and of each year, except for the first such offering period which will commence on the first trading day on or after the effective date of this offering and will end on the first trading day on or after .

Our 2004 Employee Stock Purchase Plan permits participants to purchase common stock through payroll deductions of up to 15% of their eligible compensation which includes a participant’s base salary, wages, overtime pay, commissions, bonuses and other compensation remuneration paid directly to the employee. A participant may purchase a maximum of shares during a six-month purchase period.

Amounts deducted and accumulated by the participant are used to purchase shares of our common stock at the end of each six-month purchase period. The price is 85% of the lower of the fair market value of our common stock at the beginning of an offering period or at the end of a purchase period. If the fair market value at the end of a purchase period is less than the fair market value at the beginning of the offering period, participants will be withdrawn from the current offering period following their purchase of shares on the purchase date and will be automatically re-enrolled in a new offering period. Participants may end their participation at any time during an offering period, and will be paid their payroll deductions to date. Participation ends automatically upon termination of employment with us.

A participant may not transfer rights granted under the 2004 Employee Stock Purchase Plan other than by will, the laws of descent and distribution or as otherwise provided under the 2004 Employee Stock Purchase Plan.

In the event of our change of control, a successor corporation may assume or substitute each outstanding option. If the successor corporation refuses to assume or substitute for the outstanding options, the offering period then in progress will be shortened, and a new exercise date will be set.

Our 2004 Employee Stock Purchase Plan will automatically terminate in 2024, unless we terminate it sooner. Our board of directors has the authority to amend or terminate our 2004

Employee Stock Purchase Plan, except that, subject to certain exceptions described in the 2004 Employee Stock Purchase Plan, no such action may adversely affect any outstanding rights to purchase stock under our 2004 Employee Stock Purchase Plan.

Indemnification of directors and executive officers and limitation of liability

As permitted by the Delaware General Corporation Law, our certificate of incorporation and bylaws limit or eliminate the personal liability of our directors for a breach of their fiduciary duty of care as a director. The duty of care generally requires that, when acting on behalf of the corporation, directors exercise an informed business judgment based on all material information reasonably available to them. Consequently, a director will not be personally liable to us or our stockholders for monetary damages or breach of fiduciary duty as a director, except for liability for:

• acts or omissions not in good faith or that involve intentional misconduct or a knowing violation of law;

• unlawful payments of dividends or unlawful stock repurchases, redemptions or other distributions; or

• any transaction from which the director derived an improper personal benefit.

The limitations of liability do not affect the availability of equitable remedies such as injunctive relief or rescission. If Delaware law is amended to authorize the further elimination or limiting of the liability of a director, then the liability of our directors will be eliminated or limited to the furthest extent permitted by Delaware law as so amended.

Our certificate of incorporation allows us to indemnify our officers, directors and other agents to the full extent permitted by Delaware law. Our bylaws permit us to purchase insurance on behalf of any officer, director, employee or other agent for any liability arising out of his or her actions in such capacity, regardless of whether Delaware law would permit indemnification, and to provide indemnification in circumstances in which indemnification is otherwise discretionary under Delaware law. Our bylaws specify circumstances in which indemnification for our directors and executive officers is mandatory and when we may be required to advance expenses before final disposition of any litigation.

We have entered into indemnification agreements with each of our directors and officers that are, in some cases, broader than the specific indemnification provisions permitted by Delaware law, and that may provide additional procedural protection. The indemnification agreements require us, among other things, to:

• indemnify officers and directors against certain liabilities that may arise because of their status as officers or directors;

• advance expenses, as incurred, to officers and directors in connection with a legal proceeding, subject to limited exceptions; or

At present, there is no pending litigation or proceeding involving any of our directors, officers or employees in which indemnification is sought, nor are we aware of any threatened litigation that may result in claims for indemnification.

We describe below transactions, or series of similar transactions, that occurred since February 1, 2001, to which we were or will be a party:

• in which any director, executive officer, holder of more than 5% of our common stock or any member of their immediate family had or will have a direct or indirect material interest.

We have granted options to purchase common stock to our directors and officers. Please see “Management—Director compensation” and “Management—Employment agreements and change of control arrangements.”

On March 28, 2003, we entered into an Amended and Restated Symantec Service Provider Agreement, as amended on August 25, 2003, with Symantec Corporation, a Delaware corporation and Symantec Limited, an Irish corporation. Under this agreement, we integrate certain of Symantec’s anti-virus technology with our anti-spam products. We estimated that subscription fees for our anti-virus module under this agreement represented approximately 20% of our total revenues for the fiscal year ended January 31, 2004. Amounts charged to costs of revenues pursuant to this agreement, were $2.0 million, $1.6 million and $1.2 million for fiscal years 2004, 2003 and 2002, respectively. In July 2000, we sold an aggregate of 3,585,657 shares of Series D preferred stock for a purchase price of $5.02 per share to Symantec. Henri Isenberg, one of our directors, is vice president of business development at Symantec.

Holders of our preferred stock are entitled to certain registration rights with respect to the common stock issued or issuable upon conversion of the preferred stock. See “Description of capital stock—registration rights.”

We have entered into indemnification agreements with each of our directors and officers. See “Management—Indemnification of directors and executive officers and limitation of liability.” We have also entered into employment agreements and offer letters with our officers. See “Management—Employment agreements and change of control arrangements.”

The following table sets forth certain information with respect to the beneficial ownership of our common stock, as of February 29, 2004, and as adjusted to reflect the sale of common stock offered by us in this offering, for:

Beneficial ownership is determined in accordance with the rules of the Securities and Exchange Commission and includes voting or investment power with respect to the securities. Except as indicated by footnote, and subject to applicable community property laws, each person identified in the table possesses sole voting and investment power with respect to all capital stock shown to be held by them. The number of shares of common stock outstanding, on an as-converted basis, used in calculating the percentage for each listed person or entity includes common stock underlying options or a warrant held by the person or entity that are exercisable within 60 days of February 29, 2004, but excludes common stock underlying options or warrants held by any other person or entity. Percentage of beneficial ownership is based on 26,949,847 shares of common stock outstanding as of February 29, 2004, after giving effect to the conversion of all outstanding preferred stock upon the closing of this offering. The numbers shown in the table assume no exercise by the underwriters of their over-allotment option. Unless otherwise indicated, the principal address of each of the stockholders below is c/o Brightmail, Incorporated, 301 Howard St., Suite 1800, San Francisco, California 94105.

Upon the closing of the offering, our authorized capital stock will consist of 100,000,000 shares of common stock, $0.001 par value, and 5,000,000 shares of preferred stock, $0.001 par value.

The following summary of provisions of our common stock and preferred stock does not purport to be complete and is subject to, and qualified in its entirety by, the provisions our certificate of incorporation and bylaws, which are included as exhibits to the registration statement of which this prospectus is a part, and by the provisions of Delaware law.

As of February 29, 2004, after giving effect to the conversion of all outstanding convertible preferred stock into shares of common stock, there were 26,949,847 shares of common stock outstanding held of record by approximately 145 stockholders. In addition, as of February 29, 2004, 6,822,718 shares of our common stock were subject to outstanding options and 73,099 shares of our common stock were subject to outstanding warrants. Upon completion of this offering, there will be shares of common stock outstanding, assuming no exercise of the underwriters’ over-allotment option and no exercise of outstanding stock options or warrants after February 29, 2004. In addition, shares of common stock were available for issuance under our 2004 Equity Incentive Plan, and shares of common stock were available for issuance under our 2004 Employee Stock Purchase Plan as of February 29, 2004.

The holders of common stock are entitled to one vote for each share held of record on all matters submitted to a vote of stockholders. Subject to preferences that may apply to any outstanding shares of preferred stock, the holders of our common stock will receive ratably any dividends our board of directors declares out of funds legally available for that purpose. If we liquidate, dissolve or windup, the holders of common stock are entitled to share ratably in all assets remaining after payment of liabilities and any liquidation preference of any of our outstanding convertible preferred stock. Holders of our common stock have no preemptive rights or rights to convert their common stock into any other securities or other subscription right. There are no redemption or sinking fund provisions applicable to the common stock. All outstanding shares of common stock are fully paid and non-assessable, and the shares of common stock to be issued in the offering will be fully paid and non-assessable. The rights, preferences and privileges of the holders of common stock are subject to, and may be adversely affected by, the rights of the holders of any shares of any series of preferred stock that we may designate in the future.

After the completion of the offering, our board of directors has the authority, without further action by the stockholders, to issue up to 5,000,000 shares of preferred stock in one or more series and to fix the designations, powers, preferences, privileges of the preferred stock, including dividend rights, conversion rights, voting rights terms of redemption, liquidation preference, sinking fund terms and number of shares constituting any series or the designation of any series. The board of directors, without common stockholder approval, can issue preferred stock with voting, conversion or other rights that could adversely affect the voting power and other rights of the holders of common stock. Preferred stock could thus be issued quickly with terms calculated to delay or prevent a change in control of or make removal of management

more difficult and/or impair the liquidation rights of our common stock. Additionally, the issuance of preferred stock may have the effect of decreasing the market price of the common stock. After the completion of this offering, no shares of preferred stock will be outstanding, and we currently have no plans to issue any preferred stock.

As of February 29, 2004, warrants to purchase a total of 73,099 shares of our common stock were outstanding with exercise prices ranging from $1.50 to $5.02 per shares and a weighted exercise price of $2.82 per share. Each warrant contains provisions for the adjustment of the exercise price and the number of shares issuable upon the exercise of the warrant in the event of stock dividends, stock splits, reorganizations, reclassifications, merger and consolidations.

Upon completion of the offering, the holders of an aggregate of approximately 21,012,474 shares of common stock issuable upon the conversion of all outstanding shares of our convertible preferred stock, including 73,099 shares of common stock issuable upon the exercise of warrants to purchase our convertible preferred stock, are entitled to rights to cause their shares to be registered under the Securities Act of 1933, as amended. These registration rights are contained in our amended and restated investors’ rights agreement and in certain outstanding warrants, which incorporate the terms of the investor rights agreement. These registration rights include demand registration rights, piggyback registration rights exercisable in connection with any registration proposed by us or holders of demand registration rights, and Form S-3 registration rights, as described below. The registration rights under the investors’ rights agreement will expire five years following the completion of this offering, or for any particular stockholder with registration rights, at such time following this offering when all securities held by that stockholder subject to registration rights may be sold pursuant to Rule 144 under the Securities Act during any ninety day period. These registration rights are subject to conditions and limitations, including the right of underwriters to limit the number of shares of our common stock included in certain registration statements.

At any time six months after the closing of this offering, and before the expiration of these registration rights, if requested by the holders of at least thirty percent of our then outstanding shares of common stock having registration rights under the investors’ rights agreement, we will be required to register all or a portion of their shares. We are only required to effect two registrations in response to this demand registration right. Each demand registration right exercised must cover a sale of securities with a total aggregate public offering price, net of commissions, of more than $10.0 million. We may postpone the filing of any registration statement for up to 90 days once in any 12-month period if we determine that the filing would be seriously detrimental to our stockholders and us. The underwriters of any underwritten offering have the right to limit the number of shares to be included in a registration statement filed in response to the exercise of these demand registration rights, provided that the number may not be reduced unless all other securities are excluded from the registration statement. We must pay all expenses, except for underwriters’ discounts and commissions, incurred in connection with these demand registration rights.

If we register any securities for public sale, our stockholders with registration rights under the rights agreement have the right to include their shares in the registration, subject to specified exceptions. The underwriters of any underwritten offering have the right to limit the number of shares registered by these stockholders, subject to certain limitations. We must pay all expenses, except for underwriters’ discounts and commissions, incurred in connection with these piggyback registration rights.

If we are eligible to file a registration statement on Form S-3, holders of at least ten percent of our then outstanding shares of common stock having Form S-3 registration rights under the investors’ rights agreement can require us to register their shares, provided that the total price of the shares of common stock offered to the public is at least $1.0 million and subject to other exceptions. We are not required to file a registration statement on Form S-3 if we have already effected two registrations on Form S-3 at the request of the holders of shares having these registration rights in the 12-month period prior to the holder’s request. We may postpone the filing of a registration statement for up to 90 days once in any 12-month period if we determine that the filing would be seriously detrimental to our stockholders and us. We must pay all expenses, except for underwriters’ discounts and commissions, incurred in connection with these Form S-3 registration rights.

Certain provisions of our certificate of incorporation and bylaws and Delaware anti-takeover law

Certain provisions of Delaware law and our certificate of incorporation and bylaws could make more difficult the acquisition of us by means of a tender offer, a proxy contest, or otherwise, and the removal of incumbent officers and directors. These provisions are expected to discourage certain types of coercive takeover practices and inadequate takeover bids and to encourage persons seeking to acquire control of us to first negotiate with us. We believe that the benefits of increased protection of our potential ability to negotiate with the proponent of an unfriendly or unsolicited proposal to acquire or restructure us outweighs the disadvantages of discouraging such proposals, including proposals that are priced above the then current market value of our common stock, because, among other things, negotiation of such proposals could result in an improvement of their terms.

• establish a classified board of directors so that not all members of our board are elected at one time;

• allow the board of directors to issue, without further action by the stockholders, up to 5,000,000 shares of undesignated preferred stock;

• require that any action to be taken by our stockholders be effected at a duly called annual or special meeting and not by written consent;

• require that special meetings of our stockholders be called only by the board of directors, the chairman of the board, the chief executive officer or the president;

• establish an advance notice procedure for stockholder proposals to be brought before an annual meeting of our stockholders, including proposed nominations of persons for election to the board of directors; and

• require that certain amendments to the certificate of incorporation and the bylaws require the approval of the holders of at least 66²/3% of the voting power of all outstanding stock.

We are subject to Section 203 of the Delaware General Corporation Law. This provision generally prohibits a Delaware corporation from engaging in any business combination with any interested stockholder for a period of three years following the date the stockholder became an interested stockholder, unless:

• prior to such date, the board of directors of the corporation approved either the business combination or the transaction that resulted in the stockholder becoming an interested stockholder;

• upon consummation of the transaction that resulted in the stockholder becoming an interested stockholder, the interested stockholder owned at least 85% of the voting stock of the corporation outstanding at the time the transaction commenced, excluding for purposes of determining the number of shares outstanding those shares owned by persons who are directors and also officers and by employee stock plans in which employee participants do not have the right to determine confidentially whether shares held subject to the plan will be tendered in a tender or exchange offer; or

• on or subsequent to such date, the business combination is approved by the board of directors and authorized at an annual or special meeting of stockholders and not by written consent, by the affirmative vote of at least 66²/3% of the outstanding voting stock that is not owned by the interested stockholder.

• any merger or consolidation involving the corporation and the interested stockholder;

• any sale, transfer, pledge or other disposition of 10% or more of the assets of the corporation involving the interested stockholder;

• subject to certain exceptions, any transaction that results in the issuance or transfer by the corporation of any stock of the corporation to the interested stockholder;

• any transaction involving the corporation that has the effect of increasing the proportionate share of the stock of any class or series of the corporation beneficially owned by the interested stockholder; or

• the receipt by the interested stockholder of the benefit of any loans, advances, guarantees, pledges or other financial benefits provided by or through the corporation.

In general, Section 203 defines an “interested stockholder” as any entity or person beneficially owning 15% or more of the outstanding voting stock of a corporation, or an affiliate or associate of the corporation and was the owner of 15% or more of the outstanding voting stock of a corporation at any time within three years prior to the time of determination of interested stockholder status; and any entity or person affiliated with or controlling or controlled by such entity or person.

We have applied to have our common stock approved for quotation on the NASDAQ National Market under the trading symbol “BRML.” We have not applied to list its common stock on any other exchange or quotation system.

Immediately prior to this offering, there was no public market for our common stock. Future sales of substantial amounts of common stock in the public market could adversely affect the market price of the common stock. Furthermore, since only a limited number of shares will be available for sale shortly after this offering because of contractual and legal restrictions on resale described below, sales of substantial amounts of our common stock in the public market after the restrictions lapse could adversely affect the prevailing market price and our ability to raise capital in the future.

Upon completion of this offering, we will have outstanding an aggregate of shares of common stock. Of these outstanding shares, the shares sold by us in the offering will be freely tradable without restriction or further registration under the Securities Act, unless these shares are purchased by “affiliates” as that term is defined in Rule 144 under the Securities Act. The shares of common stock outstanding upon completion of the offering and held by existing stockholders will be “restricted securities” as that term is defined in Rule 144 under the Securities Act. Restricted shares may be sold in the public market only if registered or if they qualify for exemption under Rules 144, 144(k) or 701 promulgated under the Securities Act, which rules are summarized below, or another exemption.

We have obtained lock-up agreements from all of our officers, directors, stockholders, warrant holders and optionholders under which they will agree not to transfer or dispose of, directly of indirectly, any shares of common stock or any securities convertible into or exercisable or exchangeable for shares of common stock, for a period of 180 days after the date of this prospectus without the prior written consent of J.P. Morgan Securities Inc. The lock-up agreements permit transfers of shares of our common stock in limited circumstances, provided that the transferee agrees to be bound in writing by the provisions of the lock-up agreement and that any such transfer shall not involve a disposition for value.

J.P. Morgan Securities Inc., in its sole discretion, may release the shares subject to the lock-up agreements in whole or in part at anytime with or without notice. We have been advised by J.P. Morgan Securities Inc. that, when determining whether or not to release shares form the lock-up agreements, J.P. Morgan Securities Inc. will consider, among other factors, the stockholder’s reasons for requesting the release, the number of shares for which the release is being requested and market conditions at the time. J.P. Morgan Securities Inc. has advised us that they have no present intention to release any of the shares subject to the lock-up agreements prior to the expiration of the lock-up period.

As a result of these lock-up agreements and rules of the Securities Act, the restricted shares will be available for sale in the public market, subject to certain volume and other restrictions, and subject to release mentioned above, as follows:

In general, under Rule 144, as currently in effect, a person who owns shares that were acquired from us or an affiliate of us at least one year prior to the proposed sale is entitled to sell upon expiration of the lock-up described above, within any three-month period beginning 90 days after the date of this prospectus, a number of shares that does not exceed the greater of:

• 1% of the number of shares of common stock then outstanding, which will equal approximately shares immediately after this offering; or

• the average weekly trading volume of the common stock on the Nasdaq National Market during the four calendar weeks preceding the filing of a notice on Form 144 with respect to such sale.

Sales under Rule 144 are also subject to certain manner of sale provisions and notice requirements and to the availability of current public information about us. Rule 144 also provides that our affiliates who sell shares of our common stock that are not restricted shares must nonetheless comply with the same restrictions applicable to restricted shares with the exception of the holding period requirement.

Under Rule 144(k), a person who is not deemed to have been one of our affiliates for purposes of the Securities Act at any time during the 90 days preceding a sale and who has beneficially owned the shares proposed to be sold for at least two years, including the holding period of any prior owner other than an affiliate of us, is entitled to sell such shares without complying with the manner of sale, public information, volume limitation or notice provisions of Rule 144. Therefore, unless otherwise restricted, “144(k) shares” may be sold immediately upon the completion of this offering.

In general, under Rule 701 as currently in effect, any of our employees, consultants or advisors who purchase shares from us in connection with a compensatory stock or option plan or other written agreement will be eligible to resell such shares 90 days after the effective date of this offering in reliance on Rule 144, but without compliance with certain restrictions, including the holding period, contained in Rule 144.

As of February 29, 2004, options to purchase 6,822,718 shares of common stock were issued and outstanding under our 1998 Stock Plan. In addition, as of February 29, 2004, shares of common stock were available for issuance under our 2004 Equity Incentive Plan, and shares of common stock were available for issuance under our 2004 Employee Stock Purchase Plan.

Immediately after the completion of this offering, we intend to file a registration statement under the Securities Act covering shares of common stock issued or reserved for issuance under our stock option and employee stock purchase plans. This registration statement is expected to be filed and become effective as soon as practicable after the effective date of this offering. Accordingly, shares registered under this registration statement will, subject to vesting provisions and Rule 144 volume limitation, manner of sale, notice and public information requirements applicable to our affiliates, be available for sale in the open market immediately after the 180 day lock-up agreements expire.

Certain of our stockholders are parties to an agreement that obligates us to register their shares of our capital stock after this offering in specified circumstances. See “Description of Capital Stock—Registration Rights” for additional information.

J.P. Morgan Securities Inc. is acting as sole book running lead manager for this offering. J.P. Morgan Securities Inc. and Lehman Brothers Inc. are acting as joint lead managers for this offering.

We and the underwriters named below have entered into an underwriting agreement covering the common stock to be offered in this offering. J.P. Morgan Securities Inc., Lehman Brothers Inc. and Pacific Crest Securities Inc. are the representatives of the underwriters. Each underwriter has severally agreed to purchase the number of shares of common stock set forth opposite its name in the following table.

The underwriting agreement provides that the obligations of the underwriters are subject to certain conditions precedent, including the absence of any material adverse change in our business and the receipt of certain certificates, opinions and letters from us, our counsel and our independent auditors. The underwriters are committed to purchase all of the shares of the common stock offered by us, other than those shares covered by the over-allotment option described below, if they purchase any shares of common stock. No underwriter is obligated to take any shares allocated to a defaulting underwriter except under limited circumstances.

The underwriters are offering the shares of common stock subject to the prior sale of shares, and when, as and if such shares are delivered to and accepted by them. The underwriters will initially offer to sell shares to the public at the initial public offering price shown on the cover page of this prospectus. The underwriters may sell shares to securities dealers at a discount of up to $ per share from the initial public offering price. Any such securities dealers may resell shares to certain other brokers or dealers at a discount of up to $ per share from the initial public offering price. After the initial public offering, the underwriters may vary the public offering price and other selling terms.

If the underwriters sell more shares than the total number shown in the table above, the underwriters have the option to buy up to an additional shares of common stock from us to cover such sales. They may exercise this option during the 30-day period from the date of this prospectus. If any shares are purchased with this option, the underwriters will purchase shares in approximately the same proportions as shown in the table above.

The following table shows the per share and total underwriting discounts and commissions that we will pay to the underwriters. These amounts are shown assuming both no exercise and full exercise of the underwriters’ options to purchase additional shares.

We estimate that the total expenses of this offering, excluding underwriting discounts and commissions, will be approximately $ .

The offering of the shares of common stock is made for delivery when, as and if accepted by the underwriters and subject to prior sale and to withdrawal, cancellation or modification of this offering without notice. The underwriters reserve the right to reject an order for the purchase of shares of common stock in whole or in part.

We have agreed to indemnify the underwriters against certain liabilities, including liabilities under the Securities Act, and to contribute to payments the underwriters may be required to make in respect of these liabilities.

Persons participating in the offering may engage in transactions, including over-allotments, syndicate covering transactions, stabilizing bids, or imposition of penalty bids, that may have the effect of stabilizing or maintaining above, or otherwise affecting, the market price of shares of common stock at a level from that which might otherwise prevail in the open market.

A syndicate covering transaction is a bid for or the purchase of shares of common stock on behalf of the underwriters to reduce a syndicate short position incurred by the underwriters in connection with the offering. The underwriters may create a syndicate short position by making short sales of shares of common stock and may purchase shares of common stock on the open market to cover syndicate short positions created by short sales. Short sales involve the sale by the underwriters of a greater number of shares of common stock than they are required to purchase in this offering. Short sales can be either covered or naked. Covered short sales are sales made in an amount not greater than the underwriters’ over-allotment option to purchase additional shares from us in the offering. Naked short sales are sales in excess of the over-allotment option. A naked short position is more likely to be created if the underwriters are concerned that there may be downward pressure on the price of shares of common stock in the open market after pricing that could adversely affect investors who purchase in this offering. If the underwriters create a syndicate short position, they may choose to reduce or cover this position by either exercising all or part of the over-allotment option to purchase additional shares of common stock from us or by engaging in syndicate covering transactions. The underwriters may close out any covered short position by either exercising their over-allotment option or purchasing securities in the open market. The underwriters must close out any naked short position by purchasing securities in the open market. In determining the source of shares of common stock to close out the covered short position, the underwriters will consider, among other things, the price of shares available for purchase in the open market as compared to the price at which they may purchase securities through the over-allotment option.

A stabilizing bid is a bid for or the purchase of shares of common stock on behalf of the underwriters for the purpose of fixing or maintaining the price of shares of common stock. A penalty bid is an arrangement that permits the representatives to reclaim the selling concession from an underwriter or a syndicate member for shares of common stock purchased by the

underwriters in a syndicate covering transaction and therefore have not been effectively placed by the underwriter or syndicate member.

These transactions may be effected on the Nasdaq National Market or otherwise and, if commenced, may be discontinued at any time. Similar to other purchase activities, these activities may have the effect of preventing or retarding a decline in the market price of shares of common stock. As a result, the price of shares of common stock may be higher than the price that might otherwise exist in the open market.

One or more of the underwriters may facilitate the marketing of this offering online directly or through one of its affiliates. In those cases, prospective investors may view offering terms and a prospectus online and, depending upon the particular underwriter, place orders online or through their financial advisors.

We and our executive officers, directors and certain stockholders have agreed that, with limited exceptions, during the period beginning from the date of this prospectus and continuing to and including the date 180 days after the date of this prospectus, none of us will, directly or indirectly, offer, sell, offer to sell, contract to sell or otherwise dispose of any shares of common stock or any of our securities which are substantially similar to the common stock, including but not limited to any securities that are convertible into or exchangeable for, or that represent the right to receive, common stock or any such substantially similar securities or enter into any swap, option, future, forward or other agreement that transfers, in whole or in part, the economic consequence of ownership of common stock or any securities substantially similar to the common stock, other than pursuant to employee stock option plans existing on the date of this prospectus, without the prior written consent of J.P. Morgan Securities Inc.

It is expected that delivery of the shares will be made to investors on or about , 2004.

From time to time in the ordinary course of their respective businesses, some of the underwriters and their affiliates may in the future engage in commercial banking and/or investment banking transactions with us and our affiliates.

The following is a general discussion of material U.S. federal income and estate tax considerations with respect to the ownership and disposition of shares of our common stock applicable to non-U.S. holders. In general, a “non-U.S. holder” is any holder other than:

• a corporation created or organized in or under the laws of the United States or any political subdivision thereof;

• an estate, the income of which is includible in gross income for U.S. federal income tax purposes regardless of its source; or

• a trust if (1) a court within the United States is able to exercise primary supervision over the administration of the trust and one or more U.S. persons have the authority to control all substantial decisions of the trust or (2) it has a valid election in effect under applicable Treasury regulations to be treated as a United States person.

This discussion is based on current provisions of the Internal Revenue Code, final, temporary or proposed Treasury regulations promulgated thereunder, judicial opinions, published positions of the Internal Revenue Service and all other applicable authorities, all of which are subject to change (possibly with retroactive effect). We assume in this discussion that a non-U.S. holder holds shares of our common stock as a capital asset (generally property held for investment). This discussion does not address all aspects of U.S. federal income and estate taxation that may be important to a particular non-U.S. holder in light of that non-U.S. holder’s individual circumstances, nor does it address any aspects of U.S. state, local or non-U.S. taxes. This discussion also does not consider any specific facts or circumstances that may apply to a non-U.S. holder subject to special treatment under the U.S. federal income tax laws (such as partnerships, “controlled foreign corporations,” “passive foreign investments companies,” “foreign personal holding companies” and certain U.S. expatriates). Accordingly, we urge prospective investors to consult with their own tax advisors regarding the U.S. federal, state, local and non-U.S. income and other tax considerations of acquiring, holding and disposing of shares of our common stock.

If a partnership holds shares of our common stock, the tax treatment of a partner will generally depend upon the status of the partner and the activities of the partnership. Any partner of a partnership holding shares of our common stock should consult its own tax advisors.

In general, dividends we pay, if any, to a non-U.S. holder will be subject to U.S. withholding tax at a 30% rate of the gross amount. The withholding tax might not apply or might apply at a reduced rate under the terms of an applicable income tax treaty between the United States and the non-U.S. holder’s country of residence. A non-U.S. holder must demonstrate its entitlement to treaty benefits by certifying, among other things, its nonresident status. A non-U.S. holder generally can meet this certification requirement by providing an Internal Revenue Service Form W-8BEN or appropriate substitute form to us or our paying agent. Also, special rules apply if the dividends are effectively connected with a trade or business carried on by the non-U.S. holder within the United States and, if a treaty applies, are attributable to a permanent establishment of the non-U.S. holder within the United States. Dividends effectively connected with this U.S.

trade or business, and, if a treaty applies, attributable to such a permanent establishment of a non-U.S. holder, generally will not be subject to U.S. withholding tax if the non-U.S. holder files certain forms, including Internal Revenue Service Form W-8ECI (or any successor form), with the payor of the dividend, and generally will be subject to U.S. federal income tax on a net income basis, in the same manner as if the non-U.S. holder were a resident of the United States. A non-U.S. holder that is a corporation may be subject to an additional “branch profits tax” at a rate of 30% (or a reduced rate as may be specified by an applicable income tax treaty) on the repatriation from the United States of its “effectively connected earnings and profits,” subject to certain adjustments. A non-U.S. holder of shares of our common stock eligible for a reduced rate of U.S. withholding tax pursuant to an income tax treaty may obtain a refund of any excess amounts withheld by filing an appropriate claim for refund with the Internal Revenue Service.

In general, a non-U.S. holder will not be subject to U.S. federal income tax on any gain realized upon the sale or other disposition of the holder’s shares of our common stock unless:

• the gain is effectively connected with a trade or business carried on by the non-U.S. holder within the United States and, if required by an applicable income tax treaty as a condition to subjecting a non U.S. holder to United States income tax on a net basis, the gain is attributable to a permanent establishment of the non-U.S. holder maintained in the United States, in which case a non-U.S. holder will be subject to U.S. federal income tax on any gain realized upon the sale or other disposition on a net income basis, in the same manner as if the non-U.S. holder were a resident of the United States. Furthermore, the branch profits tax discussed above may also apply if the non-U.S. holder is a corporation;

• the non-U.S. holder is an individual and is present in the United States for 183 days or more in the taxable year of disposition and certain other tests are met, in which case a non-U.S. holder will be subject to a flat 30% tax on any gain realized upon the sale or other disposition, which tax may be offset by United States source capital losses (even though the individual is not considered a resident of the United States);

• the non-U.S. holder is subject to tax pursuant to the provisions of the Internal Revenue Code regarding the taxation of U.S. expatriates; or

• we are or have been a U.S. real property holding corporation, or a USRPHC, for U.S. federal income tax purposes at any time within the shorter of the five-year period preceding the disposition and the non-U.S. holder’s holding period. We do not believe that we are or have been a USRPHC, and we do not anticipate becoming a USRPHC. If we have in the past or were to become a USRPHC at any time during this period, generally gains realized upon a disposition of shares of our common stock by a non-U.S. holder that did not directly or indirectly own more than 5% of our common stock during this period would not be subject to U.S. federal income tax, provided that our common stock is “regularly traded on an established securities market” (within the meaning of Section 897(c)(3) of the Internal Revenue Code). Our common stock will be treated as regularly traded on an established securities market during any period in which it is listed on a registered national securities exchange or any over-the-counter market, including the Nasdaq National Market.

Shares of our common stock that are owned or treated as owned by an individual who is not a citizen or resident (as defined for U.S. federal estate tax purposes) of the United States at the time of death will be includible in the individual’s gross estate for U.S. federal estate tax purposes, unless an applicable estate tax treaty provides otherwise, and therefore may be subject to U.S. federal estate tax.

Generally, we must report annually to the Internal Revenue Service the amount of dividends paid, the name and address of the recipient, and the amount, if any, of tax withheld. A similar report is sent to the holder. Pursuant to tax treaties or other agreements, the Internal Revenue Service may make its reports available to tax authorities in the recipient’s country of residence.

Payments of dividends or of proceeds on the disposition of stock made to a non-United States holder may be subject to backup withholding (currently at a rate of 28%) unless the non-United States holder establishes an exemption, for example by properly certifying its non-United States status on a Form W-8BEN or another appropriate version of Form W-8. Notwithstanding the foregoing, backup withholding may apply if either we or our paying agent has actual knowledge, or reason to know, that the holder is a United States person.

Backup withholding is not an additional tax. Rather, the United States income tax liability of persons subject to backup withholding will be reduced by the amount of tax withheld. If withholding results in an overpayment of taxes, a refund may be obtained, provided that the required information is furnished to the Internal Revenue Service.

The foregoing discussion of certain U.S. federal income tax considerations is for general information only and is not tax advice. Accordingly, each prospective non-U.S. holder of shares of our common stock should consult his, her or its own tax adviser with respect to the federal, state, local and foreign tax consequences of the acquisition, ownership and disposition of common stock.

The validity of the shares of common stock offered by this prospectus and certain other legal matters are being passed upon for us by our counsel, Wilson Sonsini Goodrich & Rosati, Palo Alto, California. Davis Polk & Wardwell, Menlo Park, California is representing the underwriters of this offering.

Our consolidated financial statements as of January 31, 2003 and 2004 and for each of the three years in the period ended January 31, 2004 appearing in this prospectus and registration statement have been audited by Ernst & Young LLP, independent auditors, as set forth in their report thereon appearing elsewhere herein and are included in reliance upon such report given on the authority of such firm as experts in accounting and auditing.

We have filed with the Securities and Exchange Commission, or SEC, under the Securities Act of 1933, as amended, a registration statement on Form S-1 relating to the common stock to be sold in the offering. The registration statement, including the attached exhibits and schedules, contains additional relevant information about us and our capital stock. This prospectus does not contain all of the information set forth in the registration statement and the exhibits and schedules thereto. The rules and regulations of the SEC allow us to omit from this prospectus certain information included in the registration statement. For further information about us and our common stock, you should refer to the registration statement, including the exhibits and schedules filed with the registration statements. With respect to the statements contained in this prospectus regarding the contents of any agreement or any other document, in each instance, the statement is qualified in all respects by the complete text of the agreement or document, a copy of which has been filed as an exhibit to the registration statement. You may inspect a copy of the registration statement and the exhibits and schedules filed with the registration statement without charge at the Public Reference Room of the SEC at 450 Fifth Street, N.W., Room 1024, Washington, D.C. 20549. You may obtain copies of all or any part of the registration statement may be obtained from such offices at prescribed rates. You may also obtain information on the operation of the Public reference Room by calling the Securities and Exchange Commission at 1-800-SEC-0300. The SEC maintains an Internet site at http://www.sec.gov that contains reports, proxy and information statements and other information regarding issuers, including Brightmail, that file electronically with the SEC.

Upon completion of this offering, we will become subject to the information and periodic reporting requirements of the Securities Exchange Act of 1934, and, in accordance therewith, will file periodic reports, proxy statements and other information with the SEC. Such periodic reports, proxy statements and other information will be available for inspection and copying at the public reference room and website of the SEC referred to above. We maintain a website at www.brightmail.com. You may access our annual report on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and amendments to those reports filed or furnished pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of 1934, as amended, with the SEC free of charge at our website as soon as reasonably practicable after such material is electronically filed with, or furnished to, the SEC. The reference to our web address does not constitute incorporation by reference of the information contained at this site.

We have audited the accompanying consolidated balance sheets of Brightmail Incorporated as of January 31, 2003 and January 31, 2004, and the related consolidated statements of operations, convertible preferred stock and stockholders’ deficit, and cash flows for each of the three years in the period ended January 31, 2004. These financial statements are the responsibility of the Company’s management. Our responsibility is to express an opinion on these financial statements based on our audits.

We conducted our audits in accordance with auditing standards generally accepted in the United States. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement. An audit includes examining, on a test basis, evidence supporting the amounts and disclosures in the financial statements. An audit also includes assessing the accounting principles used and significant estimates made by management, as well as evaluating the overall financial statement presentation. We believe that our audits provide a reasonable basis for our opinion.

In our opinion, the financial statements referred to above present fairly, in all material respects, the consolidated financial position of Brightmail Incorporated at January 31, 2003 and 2004, and the consolidated results of its operations and its cash flows for each of the three years in the period ended January 31, 2004, in conformity with accounting principles generally accepted in the United States.

Brightmail Incorporated consolidated statements of convertible preferred stock and stockholders’ deficit

Brightmail Incorporated, (“Brightmail” or the “Company”), was incorporated on February 27, 1998 as a California corporation. The Company is a provider of electronic messaging security software and services to enterprises and messaging service providers worldwide. Brightmail B.V., a limited liability company, was formed on May 23, 2001 and organized under the laws of the Netherlands as a wholly-owned subsidiary of Brightmail. Brightmail Pty Limited, a Company Limited by Shares, was formed on October 23, 2003, and organized under the laws of Australia as a wholly-owned subsidiary of Brightmail. Brightmail Limited, a Private Limited Company, was formed on November 12, 2003, and organized under the laws of England as a wholly-owned subsidiary of Brightmail. Brightmail Incorporated has maintained an Ireland branch office which was registered on February 13, 2003 with the Ireland Companies Registration Office.

The Company operates in one segment, which is the electronic messaging security market.

If the offering contemplated by this prospectus is consummated and the criteria described in note 4 are met, all of the convertible preferred stock outstanding will convert into 20,939,375 shares of common stock based on the shares of convertible preferred stock outstanding at January 31, 2004. Unaudited pro forma stockholders’ equity as adjusted for the assumed conversion of the convertible preferred stock, is set forth on the consolidated balance sheet.

The preparation of consolidated financial statements in conformity with accounting principles generally accepted in the United States requires management to make estimates and assumptions that affect the reported amounts of assets and liabilities at the date of the consolidated financial statements and the reported amounts of revenue and expenses during the reporting period. Actual results could differ materially from those estimates.

The consolidated financial statements include the accounts of the Company and its wholly-owned subsidiaries. All significant intercompany balances have been eliminated.

The assets and liabilities of foreign subsidiaries are translated from their respective functional currencies into U.S. dollars at the current exchange rate at the end of each reporting period. Revenues and expenses are translated at the average exchange rate prevailing during the period. The functional currency of the Company’s subsidiaries is the local currency. Gains and losses resulting from the translation of the financial statements of the foreign subsidiaries are reported as a separate component of stockholders’ equity. Net gains and losses resulting from foreign exchange transactions, which are included in other income, were not material in any of the periods presented.

Financial instruments that potentially subject the Company to concentrations of credit risk consist primarily of cash, cash equivalents, short-term investments and accounts receivable. Cash, cash equivalents and short-term investments are deposited with high-credit quality financial institutions. The Company has not experienced any significant losses on its cash, cash equivalents or short-term investments. The Company performs periodic credit evaluations of its customers’ financial condition and generally does not require collateral. Losses on accounts receivable have been insignificant to date.

The Company conducts business with companies in various industries primarily in the United States. For the years ended January 31, 2002, 2003, and 2004, revenues from major customers were as follows:

At January 31, 2003 and 2004, the following table represents the percent of accounts receivable outstanding as follows:

The Company considers all cash and highly liquid investments purchased with an original maturity of less than three months at the date of purchase to be cash equivalents. The Company considers investments with maturities of more than ninety days but less than one year to be short-term investments. The Company has classified all cash equivalents and short-term investments as held to maturity as the Company has the intent and ability to hold these investments to maturity. Cash equivalents and short-term investments are recorded at amortized cost, which approximates fair value. Fair value is determined based on quoted market prices. Short-term investments consist primarily of high quality, investment grade, corporate and municipal interest bearing securities. Substantially all of the Company’s cash, cash equivalents and short-term investments are custodied with two major domestic financial institutions.

The following table presents the estimated fair value of our cash and short-term investments by investment grade (in thousands):

Unrealized gains (losses) on all securities were not significant as of January 31, 2003 and 2004.

Accounts receivable are comprised of billed receivables arising from recognized or deferred revenues. The Company’s receivables are unsecured. The Company maintains an allowance for doubtful accounts at an amount it estimates to be sufficient to provide adequate protection against losses resulting from collecting less than full payment on its receivables. Estimated reserves are determined based upon the number of days that billings are past due and an evaluation of the potential risk of loss associated with specific problem accounts.

The carrying amounts of the Company’s financial instruments, which include cash and cash equivalents, short-term marketable securities, restricted cash, accounts receivable, accounts payable, and other accrued expenses, approximate their fair values due to their short maturities.

Equipment and furniture are stated at cost and are depreciated using the straight-line method over the estimated useful lives of the assets, which range from two to five years. Maintenance and repairs that do not extend the life or improve the asset are expensed in the year incurred. Leasehold improvements are amortized over the shorter of the useful life or remaining lease term.

The Company evaluates the recoverability of its long-lived assets in accordance with SFAS No. 144, Accounting for the Impairment or Disposal of Long-Lived Assets (“SFAS 144”). Long-lived assets are reviewed for possible impairment whenever events or circumstances indicate that the carrying amount of such assets may not be recoverable. If such review indicates that the carrying amount of long-lived assets is not recoverable, the carrying amount of such assets is reduced to fair value.

The Company accounts for the development cost of software incorporated into the Company’s products in accordance with Statement of Financial Accounting Standards No. 86, Accounting for the Costs of Computer Software to be Sold, Leased or Otherwise Marketed, (“SFAS 86”). SFAS 86 requires product development costs to be charged to expense as incurred until technological feasibility is attained. With respect to the Company’s software development process, technological feasibility is established upon completion of a working model. To date, the Company’s products have been released shortly after reaching technological feasibility. Therefore, development costs incurred after completion of a working model and prior to general release have not been significant. Accordingly, from its inception through January 31, 2004, the Company has not capitalized any software development costs.

Accumulated other comprehensive income (loss) consists solely of cumulative foreign currency translation adjustments resulting from the translation of the financial statements of the foreign subsidiaries.

The Company accounts for compensation expense for its stock-based employee compensation plan using the intrinsic value method prescribed in Accounting Principles Board Opinion (“APB”) No. 25, Accounting for Stock Issued to Employees (“APB 25”), and complies with the disclosure provisions of SFAS No. 123, Accounting for Stock-Based Compensation (“SFAS 123”), and SFAS No. 148, Accounting for Stock-Based Compensation—Transition and Disclosure (“SFAS 148”). Under APB 25, compensation expense of fixed stock options is based on the difference, if any, on the date of the grant between the deemed fair value of the Company’s stock and the exercise price of the option. Compensation expense is recognized on an accelerated basis over the option- vesting period of four years. The Company accounts for stock issued to nonemployees in accordance with the provisions of SFAS 123 and EITF Issue No. 96-18, Accounting for Equity Instruments That Are Issued to Other Than Employees for Acquiring, or in Conjunction with Selling, Goods or Services (“EITF 96-18”).

SFAS 123 requires pro forma disclosure of net income as if the Company had accounted for its stock-based awards to employees under the alternative fair value method, which requires the use of option valuation models. For pro forma purposes, the estimated fair value of the Company’s stock-based awards to employees is amortized ratably over the option-vesting period.

The fair value of each option granted is estimated on the date of grant using the Black-Scholes option-pricing valuation model with the following assumptions for options granted during the year as follows:

Had the company recorded compensation expense for options granted for the years ended January 31, 2002, 2003 and 2004 using the fair value method, the Company’s net loss would have changed to the pro forma amounts as follows (in thousands, except per share data):

The weighted-average deemed fair value at the grant date of options granted during the year ended January 31, 2002, 2003 and 2004 was $0.61, $0.60 and $2.24 per share, respectively.

The per share weighted-average deemed fair value of options granted are as follows:

Basic net income (loss) per share is computed by dividing net income (loss) by the weighted-average number of shares of common stock outstanding for the fiscal period. Diluted net income (loss) per share is computed giving effect to all potentially dilutive common stock, options, warrants (using the treasury stock method) and convertible preferred stock.

A reconciliation of the numerator and denominator used in the calculation of basic and diluted net income (loss) per share is as follows (in thousands):

The following common share equivalents were excluded from the computation of diluted earnings per share as they had an anti-dilutive impact (in thousands):

The Company uses the liability method of accounting for income taxes. Under this method, deferred tax assets and liabilities are determined based on temporary differences between the financial statement and tax basis of assets and liabilities and net operating loss and credit carryforwards using enacted tax rates in effect for the year in which the differences are expected to reverse. The effect on deferred tax assets and liabilities of a change in tax rates is recognized in income in the period that includes the enactment date.

Valuation allowances are established when necessary to reduce deferred tax assets to the amounts expected to be realized.

The Company recognizes revenue pursuant to the requirements of Statement of Position 97-2 “Software Revenue Recognition” (SOP 97-2), issued by the American Institute of Certified Public Accountants, as amended by SOP 98-9 Modification of SOP 97-2, Software Revenue Recognition, With Respect to Certain Transactions.

The Company sells its products and services on a subscription basis. The subscription contracts are typically non-cancelable with a term of 12 to 24 months. Because the support component of the Company’s products require continuous delivery and is not separable from the product, the

Company recognizes revenues from subscription contracts ratably over the term of the contracts. The Company generates substantially all of its revenue from two products. In accordance with SOP 97-2, the Company begins to recognize revenue from the licensing and support of its products when all of the following criteria are met: (1) the Company has entered into a legally binding agreement with a customer; (2) the Company delivers the products; (3) subscription agreement terms are deemed fixed or determinable; and (4) collection is probable.

Customers are generally invoiced in advance, either bi-annually, annually or quarterly. Amounts that have been invoiced are recorded in accounts receivable and in deferred revenue, and are amortized into revenue ratably over the term of the subscription contract as described above. The Company’s subscription contracts do not contain general rights of return.

Revenue from sales made through indirect sales channels are recognized as the product and support are delivered to the end users provided that all four of the SOP 97-2 revenue recognition criteria noted above are met. This is commonly referred to as the sell-through method.

When a subscription contract includes an acceptance provision, the Company does not recognize revenue until the earlier of the receipt of a written customer acceptance or, if not notified by the customer to cancel the subscription contract, the expiration of the acceptance period.

The Company expenses the costs of advertising as incurred. Advertising expense for the year ended January 31, 2002, 2003 and 2004 was $791,000, $10,000 and $438,000, respectively.

Sales commissions are expensed in the period in which the related subscription contract is executed.

The Company offers a limited warranty for product and service sales that generally provide the customer a ninety-day warranty period against defects. To date, the Company has not incurred any material costs as a result of such warranties and has not accrued any liabilities related to such obligations in the accompanying consolidated financial statements.

The Company’s subscription contracts generally include certain provisions for indemnifying customers against liabilities if its product or services infringe a third-party’s intellectual property rights. To date, the Company has not incurred any material costs as a result of such indemnifications and has not accrued any liabilities related to such obligations in the accompanying consolidated financial statements.

In January 2003 the Financial Accounting Standards Board issued FASB Interpretation 46, “Consolidation of Variable Interest Entities”. The interpretation defines variable interest entities as those in which equity investment at risk is not sufficient to permit the entity to finance its activities without additional subordinated financial support from other parties, or entities in which equity investors lack certain essential characteristics of a controlling financial interest. The primary beneficiary of a variable interest entity is the party that absorbs a majority of the entity’s expected losses, receives a majority of its expected residual returns, or both, as a result of holding

variable interests, which are the ownership, contractual, or other pecuniary interests in an entity. The primary beneficiary is required to consolidate the financial position and results of operations of the variable interest entity. In December 2003, the Financial Accounting Standards Board, issued revisions to FASB Interpretation 46, resulting in multiple effective dates based on the characteristics as well as the creation dates of the variable interest entities, however with no effective date later than the Company’s first quarter of 2005. The Company does not believe that adoption of this statement will have a material effect on its consolidated financial statements.

In December 2004, the Securities and Exchange Commission issued Staff Accounting Bulleting No. 104 “Revenue Recognition” (SAB 104), which updates and summarizes the Commissions views on the application of generally accepted accounting principles to revenue recognition in financial statements. The Company believes that its revenue recognition policies conform to the requirements of SAB 104.

Computer equipment includes $957,000 of cost and $925,000 and $957,000 of accumulated amortization related to assets held under capital leases at January 31, 2003 and 2004, respectively.

The Company entered into a lease financing arrangement with an equipment vendor in December 1998 that provided for capital equipment lease financing of up to $1 million through June 2000. As part of the leasing arrangement, the Company issued a warrant to purchase 20,000 shares of the Company’s Series B convertible preferred stock. This arrangement was extended to September 7, 2000. Outstanding advances accrue interest at 7% per annum and payment of principal and interest are due in monthly installments over 48 months. There were no future minimum lease payments under capital leases as of January 31, 2004.

The Company leases its office facility under a noncancelable operating lease with an initial term that expires in December 2004. Rent expense under operating leases amounted to approximately $1,092,000, $1,113,000 and $1,239,000 for the years ended January 31, 2002, 2003 and 2004, respectively.

Future minimum lease payments, net of minimum sublease obligations of $182,000, for 2005 under noncancelable operating leases having initial terms in excess of one year as of January 31, 2004 are as follows (in thousands):

On October 16, 2001, in connection with the leasing of the Company’s primary premises, the Company entered into a one-year letter of credit agreement for $480,000 with a financial institution. The letter of credit will automatically renew for consecutive one-year periods and will expire on February 28, 2005. The letter of credit decreases in value by $120,000 each January 1 through January 1, 2005. As security for this letter of credit, the Company opened a restricted cash account at the issuing institution for $480,000. The restricted account has a balance of $120,000 as of January 31, 2004. The restricted funds are to be reduced in concert with reductions in the value of the letter of credit.

Each share of Series A, Series B, Series C and Series D convertible preferred stock is convertible at the option of the holder into shares of common stock as determined by the applicable conversion rate specified in the Company’s amended and restated articles of incorporation, subject to certain antidilution provisions. Currently, each share of outstanding convertible preferred stock is convertible into one share of the Company’s common stock. In addition, each share of a series of convertible preferred stock will automatically be converted into shares of common stock at the then-applicable conversion rate at the earlier of: (1) the affirmative election of the holders of a majority of the then-outstanding shares of that series of convertible preferred stock, voting as separate series; or (2) upon the closing of a firm commitment underwritten public offering of the Company’s common stock with aggregate gross proceeds of at least $20,000,000 and a per share price of (a) at least $3.585 in the case of the Series A, Series B and Series C convertible preferred stock and (b) at least $10.04 in the case of the Series D convertible preferred stock. Each share of convertible preferred stock is entitled to the number of votes equal to the number of shares of common stock into which each share of the convertible preferred stock is convertible.

The holders of Series A, Series B, Series C and Series D convertible preferred stock are entitled to receive, when and if declared by the Board of Directors, noncumulative dividends at the rate of 8% of the original issue price per annum on each outstanding share of Series A, Series B, Series C and Series D convertible preferred stock. The effective original issue prices of Series A, Series B, Series C and Series D preferred stock were $0.085, $0.92, $2.39 and $5.02 per share, respectively. No dividends have been declared to date.

In the event of the sale, liquidation, dissolution or winding up of the Company, whether voluntary or involuntary (including upon the occurrence of certain change of control events), the holders of Series A, Series B, Series C and Series D convertible preferred stock are entitled to receive, prior to and in preference of any distribution of any of the assets of the Company to the

holders of common stock, an amount per share equal to the sum of the original issue price for each share, plus all declared and unpaid dividends with respect to such shares. If the assets are insufficient to make payments in full to all holders of preferred stock, assets will be distributed ratably among the holders of convertible preferred stock in proportion to the preferential amount each such holder is otherwise entitled to receive. After payment in full of the initial liquidation preference, any remaining assets will be distributed ratably among the holders of Series A, Series B, Series C and Series D preferred stock and common stock on an as-if converted basis until the aggregate distributions to holders of Series A, Series B, Series C and Series D preferred stock (including preferential distribution) equal $0.255, $2.77, $7.17 and $10.04 per share, respectively. Any remaining assets will be distributed on a pro rata basis to the holders of common stock.

In December 1998, in connection with the equipment lease financing arrangement described in Note 3, the Company issued a warrant to purchase 20,000 shares of the Company’s Series B convertible preferred stock at an exercise price of $1.50 per share. The warrant is exercisable through December 2008 or five years from the effective date of an initial public offering, whichever is earlier.

In December 1998, the Company issued a warrant to purchase 13,334 shares of the Company’s Series B convertible preferred stock at an exercise price of $1.50 per share. This warrant expires in December 2005.

In July 1999, the Company issued a warrant to purchase 39,652 shares of the Company’s Series C convertible preferred stock at an exercise price of $2.27 per share. This warrant expires in July 2009 or five years from the effective date of an initial public offering, whichever is earlier. Due to the early termination of a note payable, the aforementioned warrant was amended to provide for the purchase of 15,861 shares.

In June 2000, the Company issued a warrant to purchase 19,920 shares of the Company’s Series D convertible preferred stock at an exercise price of $5.02 per share. This warrant expires in December 2005, or on the second anniversary of the effective date of an initial public offering, if such effective date occurs within 2 years prior to December 2005.

In August 2001, the Company issued a warrant to purchase 3,984 shares of Series D convertible preferred stock at an exercise price of $5.02 per share. This warrant expires in August 2006.

In the event of an initial public offering and the conversion of preferred stock into common stock, all warrants will be converted into warrants to purchase common stock.

In April 1998, the Company adopted the 1998 Stock Option Plan (the “Plan”), as amended, under which 9,909,974 shares of common stock are reserved for the issuance of incentive stock options (“ISOs”) or nonstatutory stock options (“NSOs”) to employees, officers, directors and consultants. The ISOs may be granted at a price per share not less than 100% (110% if granted to holders of 10% or more of the Company’s stock) of the fair market value on the date of the grant. The NSOs may be granted at a price per share not less than 85% (110% if granted to holders of 10% or

more of the Company’s stock) of the fair market value at the date of grant. Options granted under the Plan are exercisable over a maximum term of ten years from the date of grant and generally vest over a four-year period. Options may be immediately exercised, but unvested shares are subject to repurchase by the Company at the original issuance price if the holder is no longer employed or is no longer providing services to the Company. Options generally vest 25% one year after the date of grant and then ratably over the remaining vesting period, subject to acceleration upon certain events.

A summary of the Company’s stock option activity under the Plan is set forth below:

At January 31, 2004, options to purchase 2,622,203 shares of common stock were vested, and all outstanding options were exercisable. A total of 30,909 shares of common stock issued pursuant to exercises of stock options were subject to repurchase at January 31, 2004. At January 31, 2004, the weighted-average remaining contractual life of outstanding stock options is 8.48 years.

In February 2002, in connection with the resignation of a key employee, the Company’s Board of Directors approved an extension of the exercise and vesting terms for stock options held by that key employee, resulting in a charge of $243,000.

The Company recorded $1,863,000 of deferred stock-based compensation during the year ended January 31, 2004. The Company recorded no deferred stock-based compensation for the years ended January 31, 2003 or 2002. All amounts recorded as deferred stock-based compensation representing the difference between the exercise price and the deemed fair value of certain of the Company’s stock options granted to employees are being amortized by charges to operations on an accelerated vesting method over the vesting periods of the individual stock options. Such amortization amounted to $595,000, $149,000, and $490,000 for the years ended January 31, 2002, 2003 and 2004, respectively.

At January 31, 2004, the Company has reserved shares of common stock for future issuance as follows:

The domestic and foreign components of income (loss) before the provision for income taxes were as follows (in thousands):

A reconciliation of income taxes at the statutory federal income tax rate to net income taxes included in the accompanying statements of operations is as follows (in thousands):

Deferred income taxes reflect the net tax effect of temporary differences between the carrying amounts of assets and liabilities for financial reporting purposes and the amounts used for income tax purposes. Significant components of the Company’s deferred tax assets are as follows (in thousands):

The valuation allowance increased by $4,196,000, $1,150,000 and $400,000 in 2002, 2003 and 2004, respectively.

At January 31, 2004, the Company has net operating loss carryforwards of approximately $32,495,000 for federal income tax purposes and $25,488,000 for state net operating loss carryforwards available to offset future taxable income, which will begin to expire in 2018 for federal and 2006 for state tax purposes, respectively. Under the Tax Reform Act of 1986, the amounts of and benefits from net operating loss carryforwards may be impaired or limited in certain circumstances. Events which cause limitations in the amount of net operating losses that the company may utilize in any one year include, but are not limited to, a cumulative ownership change of more than 50%, as defined, over a three year period. Such an annual limitation could result in the expiration of the net operating loss carryforwards before utilization. Accordingly, our net deferred tax assets have been fully offset by a valuation allowance.

Approximately $808,000 and $602,000 of research and development credits are carried forward to future years respectively for federal and California income tax purposes. The federal R&D credit will begin to expire in 2018. The California R&D credit may be carried forward indefinitely.

Applicable U.S. income taxes have not been provided on approximately $73,000 of undistributed earnings of foreign subsidiaries as of January 31, 2004 since these earnings are considered indefinitely reinvested. The tax liability that would arise if these earnings were remitted is approximately $7,000.

Revenues from customers outside the Americas for the years ended January 31, 2002, 2003 and 2004, were 2 percent, 8 percent and 14 percent, respectively, of total revenues. Revenues from customers by geographical region are as follows (in thousands):

In January 1999, the Company adopted a 401(k) plan for its employees, whereby currently eligible employees may contribute up to a specified percentage of their earnings, on a pre-tax basis, subject to the maximum amount permitted by the Internal Revenue Code. Under the 401(k) plan, the Company may make discretionary contributions. No Company contributions were made during the years ended January 31, 2002, 2003 and 2004.

The Company has a license and royalty agreement under which it resells a complimentary product owned by a significant stockholder. Amounts charged to royalty expense, included in cost of revenue, under this agreement were $1,235,000, $1,618,000 and $1,988,000, for the years ended January 31, 2002, 2003 and 2004, respectively. At January 31, 2004, the Company owed $33,000 to the significant stockholder.

Pro forma net income per share has been computed to give effect to the conversion of the convertible preferred stock that will convert into common stock upon the closing of the Company’s initial public offering if the criteria described in note 4 are met, for the fiscal year ended January 31, 2004. A reconciliation of the numerator and denominator used in the calculation of pro forma net income per share is as follows (in thousands):

The Company excluded warrants exercisable for 23,904 shares of common stock from its computation of pro forma net income per share for the year ended January 31, 2004 as these securities had an anti-dilutive impact.

On March 21, 2004, the Board of Directors authorized the filing of a registration statement with the Securities and Exchange Commission for an initial public offering of the Company’s common stock and the Company’s reincorporation into Delaware. Additionally, the Board of Directors approved the 2004 Equity Incentive Plan and the 2004 Employee Stock Purchase Plan, both of which are subject to shareholder approval and will be effective upon the closing of the initial

public offering. The successor equity incentive program to the 1998 Stock Option Plan and will increase the shares reserved for issuance by shares. The 2004 Employee Stock Purchase Plan will be available to all eligible employees, who will be able to individually purchase a maximum of shares annually at a price equal to 85 percent of the lower of the fair market value at the start date of the offering or fair market value on the semi-annual purchase dates. The Company will initially reserve for issuance shares of common stock. The 2004 Employee Stock Purchase Plan and 2004 Equity Incentive Plan have provisions for annual automatic increases to the shares reserved for issuance based on a specific percentage of the total number of shares outstanding at each year-end.

You should rely only on the information contained in this prospectus. We have not authorized anyone to provide you with information different from that contained in this prospectus. We are offering to sell, and seeking offers to buy, common shares only in jurisdictions where offers and sales are permitted. The information contained in this prospectus is accurate only as of the date of this prospectus, regardless of the time of delivery of this prospectus or of any sale of our common shares.

No action is being taken in any jurisdiction outside the United States to permit a public offering of the common shares or possession or distribution of this prospectus in that jurisdiction. Persons who come into possession of this prospectus in jurisdictions outside the United States are required to inform themselves about and to observe any restrictions as to this offering and the distribution of this prospectus applicable to that jurisdiction.

Until , 2004, all dealers that buy, sell or trade in our common shares, whether or not participating in this offering, may be required to deliver a prospectus. This is in addition to the dealers’ obligation to deliver a prospectus when acting as underwriters and with respect to their unsold allotments or subscriptions.

The following table sets forth the expenses, other than underwriting discounts and commissions, payable by the registrant in connection with the sale of common stock being registered. All amounts are estimates except the registration fee, the NASD filing fee, and the Nasdaq National Market listing fee.

Section 145 of the Delaware General Corporation Law authorizes a court to award, or a corporation’s board of directors to grant, indemnity to officers, directors and other corporate agents in terms sufficiently broad to permit such indemnification under certain circumstances and subject to certain limitations.

The registrant’s certificate of incorporation and bylaws provide that the registrant shall indemnify its directors, officers, employees and agents to the full extent permitted by Delaware General Corporation Law, including in circumstances in which indemnification is otherwise discretionary under Delaware law.

In addition, the registrant has entered into separate indemnification agreements with its directors, officers which require the registrant, among other things, to indemnify them against expenses, judgments, fines, settlements, and other amounts and certain liabilities (including with respect to a derivative action) in connection with any proceeding, whether actual or threatened, which may arise by reason of their status as directors, officers or certain other employees. This indemnification obligation is conditioned on such person to have acted in good faith and in a manner such person reasonably believed to be in, or not opposed to, the best interests of the registrant. The indemnification agreements also set forth certain procedures that will apply in the event of a claim for indemnification thereunder. At present, no litigation or proceeding is pending that involves a director or officer of the registrant regarding which indemnification is sought, nor is the registrant aware of any threatened litigation that may result in claims for indemnification.

The registrant maintains a directors’ and officers’ insurance policy. The policy insures directors and officers against unindemnified losses arising from certain wrongful acts in their capacities as directors and officers and reimburses the registrant for those losses for which the registrant has lawfully indemnified the directors and officers. The policy contains various exclusions, none of which apply to this offering.

These indemnification provisions and the indemnification agreements entered into between the registrant and its officers and directors may be sufficiently broad to permit indemnification of the registrant’s officers and directors for liabilities (including reimbursement of expenses incurred) arising under the Securities Act of 1933, as amended.

The underwriting agreement filed as Exhibit 1.1 to this registration statement provides for indemnification by the underwriters of the registrant and its officers and directors for certain liabilities arising under the Securities Act, or otherwise.

Since January 1, 2001, the Registrant has sold and issued the following unregistered securities other than shares of common stock to its employees, directors, consultants and other service providers upon exercise of options granted by the registrant under its 1998 Stock Option Plan. Since inception through February 29, 2004, the registrant had issued 1,957,666 shares of common stock under the 1998 Stock Option Plan with exercise prices ranging from $0.05 to $0.80 per share, and as of February 29, 2004, 6,822,718 shares of common stock are issuable upon exercise of outstanding options, with exercise prices ranging from $0.05 to $0.95 per share. The sale and issuances of securities listed above were deemed to be exempt from registration under the Securities Act by virtue of Rule 701 promulgated under Section 3(b) of the Securities Act as transactions pursuant to compensation benefits plans and contracts relating to compensation. All of the foregoing securities are deemed restricted securities for purposes of the Securities Act.

Schedules not listed above have been omitted because the information required to be set forth therein is not applicable or is shown in the financial statements or notes thereto.

The undersigned hereby undertakes to provide to the Underwriters at the closing specified in the Underwriting Agreement, certificates in such denominations and registered in such names as required by the Underwriters to permit prompt delivery to each purchaser.

Insofar as indemnification for liabilities arising under the Act may be permitted to directors, officers and controlling persons of the registrant pursuant to the provisions referenced in Item 14 of this registration Statement or otherwise, the registrant has been advised that in the opinion of the Securities and Exchange Commission such indemnification is against public policy as expressed in the Act, and is, therefore, unenforceable. In the event that a claim for indemnification against such liabilities (other than the payment by the registrant of expenses incurred or paid by a director, officer, or controlling person of the registrant in the successful defense of any action, suit or proceeding) is asserted by such director, officer or controlling person in connection with the securities being registered hereunder, the registrant will, unless in the opinion of its counsel the matter has been settled by controlling precedent, submit to a court of appropriate jurisdiction the question whether such indemnification by it is against public policy as expressed in the Act and will be governed by the final adjudication of such issue.

(1) For purposes of determining any liability under the Act, the information omitted from the form of prospectus filed as part of this registration statement in reliance upon Rule 430A and contained in a form of prospectus filed by the registrant pursuant to Rule 424(b)(1) or (4) or 497(h) under the Act shall be deemed to be part of this registration statement as of the time it was declared effective.

(2) For the purpose of determining any liability under the Act, each post-effective amendment that contains a form of prospectus shall be deemed to be a new registration statement relating to the securities offered therein, and the offering of such securities at that time shall be deemed to be the initial bona fide offering thereof.

Pursuant to the requirements of the Securities Act of 1933, the registrant has duly caused this registration statement on Form S-1 to be signed on its behalf by the undersigned, thereunto duly authorized, in the City of San Francisco, State of California, on this 22^nd day of March 2004.


BRIGHTMAIL INCORPORATED

By:		/s/ Enrique Salem
		Enrique Salem President and Chief Executive Officer

KNOW ALL PERSONS BY THESE PRESENTS, that each person whose signature appears below constitutes and appoints, jointly and severally, Enrique Salem and Michael Irwin and each one of them acting individually, his true and lawful attorney-in-fact and agents, each with full power of substitution, for his and in his name, place and stead, in any and all capacities, to sign any and all amendments (including post-effective amendments) to this registration statement, and any registration statement related to the offering contemplated by this registration statement that is to be effective upon filing pursuant to Rule 462(b) under the Securities Act of 1933, and all post-effective amendments thereto, and to file the same, with all exhibits thereto and all other documents in connection therewith, with the Securities and Exchange Commission, granting unto said attorneys-in-fact and agents, and each of them, full power and authority to do and perform each and every act and thing requisite and necessary to be done with respect to the offering of securities contemplated by this Registration Statement, as fully to all intents and purposes as he might or could do in person, hereby ratifying and confirming all that each of said attorneys-in-fact and agents or any of them, or his or their substitute or substitutes, may lawfully do or cause to be done or by virtue hereof.

Pursuant to the requirements of the Securities Act of 1933, this registration statement has been signed by the following persons in the capacities and on the dates indicated.


California	7372	94-3295092
(prior to reincorporation)	(Primary Standard Industrial Classification Code Number)	(I.R.S. Employer Identification Number)

Delaware	301 Howard Street Suite 1800 San Francisco, CA 94105 (415) 905-5595
(after reincorporation) (State or other jurisdiction of incorporation or organization)




	Per Share	Total

Initial public offering price	$	$

Underwriting discounts and commissions	$	$

Proceeds to Brightmail, before expenses	$	$




Year ended January 31, (in thousands, except per share data)	2002			2003			2004

Consolidated statement of operations:
Revenues	$	6,428		$	12,184		$	26,046
Operating income (loss)		(11,755	)		(5,243	)		1,040
Net income (loss)		(10,844	)		(4,974	)		1,169

Net income (loss) per share:
Basic	$	(2.17	)	$	(0.87	)	$	0.20
Diluted		(2.17	)		(0.87	)		0.04
Pro forma (unaudited)		—			—			0.04

Number of shares used in per share calculations:
Basic⁽¹⁾		4,997			5,691			5,878
Diluted⁽¹⁾		4,997			5,691			30,499
Pro forma (unaudited)⁽¹⁾		—			—			30,499




January 31, 2004, (in thousands)	Actual			Pro forma			Pro forma as adjusted


Consolidated balance sheet data:

Cash, cash equivalents and short-term investments	$	26,837		$	26,837		$
Deferred revenue		17,706			17,706
Working capital		17,889			17,889
Total assets		38,836			38,836
Convertible preferred stock		53,210			—
Common Stock		4,692			57,902
Accumulated deficit		(38,833	)		(38,833	)
Total stockholders’ equity (deficit)		(35,515	)		17,695


		Page
Prospectus summary		1

Risk factors		7

Special note regarding forward-looking statements		21

Use of proceeds		22

Dividend policy		22

Capitalization		23

Dilution		25

Selected consolidated financial data		27

Management’s discussion and analysis of financial condition and results of operations		29

Business		40

Management		54

Certain relationships and related-party transactions		67

Principal stockholders		68

Description of capital stock		70

Shares eligible for future sale		75

Underwriting		78

Certain United States tax considerations for non-United States holders		81

Legal matters		84

Experts		84

Where you can find additional information		85

Index to consolidated financial statements		F-1




January 31, 2004, (in thousands except share data)	Actual			Pro forma			Pro forma as adjusted

Cash, cash equivalents and short-term investments	$	26,837		$	26,837		$

Convertible preferred stock, $0.001 par value; 21,135,705 shares authorized, 20,939,375 shares issued and outstanding, actual; 5,000,000 shares authorized, none issued and outstanding, pro forma and pro forma, as adjusted		53,210			—			—
Stockholders’ equity (deficit):
Common Stock, $0.001 par value, 51,000,000 shares authorized; 6,005,006 shares issued and outstanding, actual; 51,000,000 shares authorized, 26,944,381 shares issued and outstanding, pro forma; 100,000,000 shares authorized, shares issued and outstanding, pro forma as adjusted		4,692			57,902
Deferred stock-based compensation		(1,380	)		(1,380	)		(1,380	)
Accumulated other comprehensive income		6			6			6
Accumulated deficit		(38,833	)		(38,833	)		(38,833	)

Total stockholders’ equity (deficit)		(35,515	)		17,695

Total capitalization	$	17,695		$	17,695		$


Assumed initial public offering price per share		$
Pro forma net tangible book value per share before the offering	$
Increase per share attributable to new public investors

Pro forma net tangible book value per share after this offering

Dilution per share to new public investors		$




Year ended January 31,
(in thousands, except per share data)	2000			2001			2002			2003			2004


Consolidated statement of operations:
Revenues ⁽¹⁾	$	93		$	1,953		$	6,428		$	12,184		$	26,046
Cost of revenues		576			1,333			3,025			3,561			5,548

Gross profit (loss)		(483	)		620			3,403			8,623			20,498
Operating expenses:
Product development		2,979			5,692			6,575			6,393			7,432
Sales and marketing		4,055			4,095			5,361			4,292			8,004
General and administrative		1,291			2,849			2,627			3,032			3,550
Stock-based compensation ⁽²⁾		252			1,241			595			149			472

Total operating expenses		8,577			13,877			15,158			13,866			19,458

Operating income (loss)		(9,060	)		(13,257	)		(11,755	)		(5,243	)		1,040
Other income:
Other income (expense)		(53	)		38			—			5			36
Interest income		215			1,223			1,025			352			243
Interest expense		(79	)		(200	)		(114	)		(88	)		(38	)

Income (loss) before provision for income taxes		(8,977	)		(12,196	)		(10,844	)		(4,974	)		1,281
Provision for income taxes		—			—			—			—			(112	)

Net income (loss)	$	(8,977	)	$	(12,196	)	$	(10,844	)	$	(4,974	)	$	1,169

Net income (loss) per share:
Basic ⁽³⁾	$	(3.49	)	$	(3.11	)	$	(2.17	)	$	(0.87	)	$	0.20
Diluted ⁽³⁾	$	(3.49	)	$	(3.11	)	$	(2.17	)	$	(0.87	)	$	0.04
Pro forma (unaudited) ^{(3) (4)}													$	0.04
Weighted average shares used in per share calculations:
Basic ⁽³⁾		2,574			3,924			4,997			5,691			5,878
Diluted ⁽³⁾		2,574			3,924			4,997			5,691			30,499
Pro forma (unaudited) ^{(3) (4)}														30,499



Year ended January 31,

(in thousands)	2002		2003		2004

Revenues by geography:
Americas	$	6,323	$	11,183	$	22,445
Europe, Middle East and Africa		105		767		2,968
Asia Pacific		—		234		633




January 31,

(in thousands)	2000			2001			2002			2003			2004

Balance sheet data:
Cash, cash equivalents and short-term investments	$	6,918		$	30,618		$	23,430		$	22,292		$	26,837
Deferred revenue		342			1,035			3,010			9,933			17,706
Working capital		5,258			29,553			19,588			15,306			17,889
Total assets		8,777			33,896			26,392			28,387			38,836
Long-term obligations, net of current portion		737			891			489			203			—
Convertible preferred stock		17,734			53,224			53,210			53,210			53,210
Accumulated deficit		(11,988	)		(24,184	)		(35,028	)		(40,002	)		(38,833	)
Total stockholders’ deficit		(11,685	)		(22,558	)		(32,759	)		(37,221	)		(35,515	)




Three months ended (unaudited) (in thousands)	Apr. 30, 2002			Jul. 31, 2002			Oct. 31, 2002			Jan. 31, 2003			Apr. 30, 2003			Jul. 31, 2003			Oct. 31, 2003			Jan. 31, 2004


Consolidated statement of operations data:
Revenues	$	2,156		$	2,385		$	3,117		$	4,526		$	5,305		$	6,015		$	6,747		$	7,979
Cost of revenues		814			836			857			1,054			1,152			1,243			1,394			1,759

Gross profit		1,342			1,549			2,260			3,472			4,153			4,772			5,353			6,220
Operating expenses:
Product development		1,420			1,499			1,685			1,789			1,754			1,714			1,841			2,123
Sales and marketing		1,169			968			1,084			1,071			1,350			1,633			2,136			2,885
General and administrative		1,090			707			612			623			736			763			942			1,109
Stock-based compensation		62			50			27			10			8			53			148			263

Total operating expenses		3,741			3,224			3,408			3,493			3,848			4,163			5,067			6,380

Operating income (loss)		(2,399	)		(1,675	)		(1,148	)		(21	)		305			609			286			(160	)
Other income:
Other income (expense)		(1	)		12			—			(6	)		—			—			39			(3	)
Interest income		95			86			92			79			69			62			55			57
Interest expense		(23	)		(23	)		(22	)		(20	)		(17	)		(15	)		(3	)		(3	)

Income (loss) before provision for income taxes		(2,328	)		(1,600	)		(1,078	)		32			357			656			377			(109	)
Provision for income taxes		—			—			—			—			(15	)		(47	)		(35	)		(15	)

Net income (loss)	$	(2,328	)	$	(1,600	)	$	(1,078	)	$	32		$	342		$	609		$	342		$	(124	)




Three months ended (unaudited)	Apr. 30, 2002		Jul. 31, 2002		Oct. 31, 2002		Jan. 31, 2003		Apr. 30, 2003		Jul. 31, 2003		Oct. 31, 2003		Jan. 31, 2004

Consolidated statement of operations data:
Revenues	100	%	100	%	100	%	100	%	100	%	100	%	100	%	100	%
Cost of revenues	38		35		27		23		22		21		21		22

Gross profit	62		65		73		77		78		79		79		78
Operating expenses:
Product development	66		63		54		40		34		28		27		27
Sales and marketing	54		41		35		24		25		27		32		36
General and administrative	50		30		20		14		14		13		14		15
Stock-based compensation	3		2		1		—		—		1		2		3

Total operating expenses	173		136		110		78		73		69		75		81
Operating income (loss)	(111	)	(71	)	(37	)	(1	)	5		10		4		(3	)
Other income:
Other income (expense)	—		1		—		—		—		—		1		—
Interest income	4		4		3		2		1		1		1		1
Interest expense	(1	)	(1	)	(1	)	—		—		—		—		—

Income (loss) before provision for income taxes	(108	)	(67	)	(35	)	1		6		11		6		(2	)
Provision for income taxes	—		—		—		—		—		(1	)	(1	)	—

Net income (loss)	(108	)%	(67	)%	(35	)%	1	%	6	%	10	%	5	%	(2	)%




	Payments due by period
Contractual obligations (in thousands)	Total		Less than 1 year		1-3 years		3-5 years		More than 5 years

Operating lease obligations	$	883	$	843	$	40	$	—	$	—




Name	Age	Position

Enrique Salem	38	Director, chief executive officer and president
Michael Irwin	34	Chief financial officer
Ken Schneider	42	Chief technical officer and vice president of operations
Michael D. Conner	48	Vice president of worldwide sales
Brad Kingsbury	40	Vice president of engineering
François A. Lavaste	37	Vice president of marketing
Bettina H. Koblick	38	Vice president of human resources
Eric W. Spivey ^{(1) (2)}	43	Director, chairman of the board
John C. Colligan ⁽¹⁾	49	Director
Henri J. Isenberg ⁽²⁾	38	Director
Sunil Paul	39	Director
Jon Q. Reynolds, Jr. ⁽¹⁾	36	Director




	Annual compensation						Long-term compensation

Name and principal position	Salary		Bonus		Other annual compensation		Securities underlying options	All other compensation⁽¹⁾

Enrique Salem President and chief executive officer	$	240,000	$	175,157	—		200,000	$	234
Michael Irwin Chief financial officer		170,000		68,006	—		131,841		234
Ken Schneider Chief technical officer and vice president of operations		170,000		55,961	—		—		234
Michael D. Conner Vice president of worldwide sales		165,000		155,424	—		—		234
Brad Kingsbury Vice president of engineering		210,000		82,934	45,785	⁽²⁾	—		234




Name	Number of securities underlying options granted ⁽¹⁾	% of total options granted to employees in fiscal year		Exercise or base price per share		Expiration date	Potential realizable value at assumed annual rates of stock price appreciation for option term ($) ⁽²⁾
Name	Number of securities underlying options granted ⁽¹⁾	% of total options granted to employees in fiscal year		Exercise or base price per share		Expiration date	5%		10%

Enrique Salem	200,000	18.67	%	$	0.80	7/15/13	$		$
Michael Irwin	131,841	12.31	%	$	0.80	4/08/13
Ken Schneider	—	—			—	—		—		—
Michael D. Conner	—	—			—	—		—		—
Brad Kingsbury	—	—			—	—		—		—




Name	Number of shares acquired on exercise	Value received ($)	Number of securities underlying unexercised options at January 31, 2004⁽¹⁾			Value of unexercised in-the-money options at year end ⁽²⁾
Name	Number of shares acquired on exercise	Value received ($)	Exercisable		Unexercisable	Exercisable	Unexercisable

Enrique Salem	—	—	2,419,274	⁽³⁾	—	$	—
Michael Irwin	—	—	386,841	⁽⁴⁾	—		—
Ken Schneider	—	—	312,117	⁽⁵⁾	—		—
Michael D. Conner	—	—	331,841	⁽⁶⁾	—		—
Brad Kingsbury	—	—	497,762	⁽⁷⁾	—		—




		Percentage beneficially owned
Name	Number of shares	Prior to offering		After offering


Five percent stockholders:
Accel Partners ⁽¹⁾	5,265,501	19.54	%	%
Symantec Corporation ⁽²⁾	3,585,657	13.30
Technology Crossover Ventures ⁽³⁾	3,440,077	12.76
Andreas V. Bechtolsheim	1,473,726	5.47

Executive officers and directors:
Enrique Salem ⁽⁴⁾	2,419,274	8.24
Michael Irwin ⁽⁵⁾	421,841	1.54
Ken Schneider ⁽⁶⁾	337,117	1.24
Michael D. Conner ⁽⁷⁾	366,841	1.34
Brad Kingsbury ⁽⁸⁾	560,262	2.04
Eric W. Spivey ⁽⁹⁾	305,324	1.12
John C. Colligan ⁽¹⁰⁾	282,284	1.05
Henri Isenberg ⁽²⁾	3,585,657	13.30
Sunil Paul ⁽¹¹⁾	5,241,622	19.45
Jon Q. Reynolds, Jr. ⁽³⁾	3,440,077	12.76

All executive officers and directors as a group (12 persons) ⁽¹²⁾	17,285,601	54.65




Days after the date of this prospectus	Number of shares eligible for sale	Comment

Date of Prospectus		Shares not locked up and eligible for sale under Rule 144
180 days		Lock-up released; shares eligible for sale under Rule 144
		Lock-up released; shares eligible for sale under Rule 144(k) or Rule 701




Name		Number of shares

J.P. Morgan Securities Inc.
Lehman Brothers Inc.
Pacific Crest Securities Inc.


Total




	Without over-allotment exercise	With over-allotment exercise

Per share	$	$
Total	$	$


		Page
Report of Ernst & Young LLP, independent auditors		F-1

Audited financial statements

Consolidated balance sheets		F-2

Consolidated statements of operations		F-3

Consolidated statements of convertible preferred stock and stockholders’ deficit		F-4

Consolidated statements of cash flows		F-5

Notes to consolidated financial statements		F-6




	January 31,

(In thousands, except for share and per share data)	2003			2004			Pro forma 2004 (unaudited)

Assets
Current assets:
Cash and cash equivalents	$	10,740		$	12,781
Short-term investments		11,552			14,056
Short-term restricted cash		120			120
Accounts receivable (net of allowance for doubtful accounts of $58 in 2004)		4,577			8,879
Prepaid expenses and other current assets		183			863

Total current assets		27,172			36,699

Restricted cash		120			—
Equipment and furniture, net		1,091			2,106
Deposits and other assets		4			31

Total assets	$	28,387		$	38,836

Liabilities and stockholders’ equity (deficit)
Current liabilities:
Accounts payable and accrued liabilities	$	1,876		$	3,435
Deferred revenue		9,604			15,375
Current portion of borrowings under bank loan agreement		161			—
Current portion of capital lease obligations		225			—

Total current liabilities		11,866			18,810
Deferred revenue, net of current portion		329			2,331
Long term borrowings under bank loan agreement, less current portion		70			—
Capital lease obligations, less current portion		133			—

Total liabilities		12,398			21,141

Commitments and contingencies (Note 3)

Convertible preferred stock:
Series A, $0.001 par value; 2,889,962 shares authorized, issued and outstanding, zero pro forma (aggregate liquidation preference—$246)		246			246
Series B, $0.001 par value; 6,026,158 shares authorized; 5,952,824 shares issued and outstanding, zero pro forma (aggregate liquidation preference—$5,490)		5,446			5,446
Series C, $0.001 par value; 5,048,270 shares authorized; 5,020,364 shares issued and outstanding, zero pro forma (aggregate liquidation preference—$11,999)		12,020			12,020
Series D, $0.001 par value; 7,171,315 shares authorized; 7,076,225 shares issued and outstanding, zero pro forma (aggregate liquidation preference—$35,523)		35,498			35,498
Stockholders’ equity (deficit)
Common stock, $0.001 par value; 51,000,000 shares authorized; 5,880,261 and 6,005,006 shares issued and outstanding at January 31, 2003 and 2004, respectively, 26,944,381 pro forma		2,812			4,692		$	57,902
Deferred stock-based compensation		(32	)		(1,380	)		(1,380	)
Accumulated other comprehensive income		1			6			6
Accumulated deficit		(40,002	)		(38,833	)		(38,833	)

Total stockholders’ equity (deficit)		(37,221	)		(35,515	)	$	17,695

Total liabilities and stockholders’ equity (deficit)	$	28,387		$	38,836




	For the year ended January 31,

(in thousands, except per share data)	2002			2003			2004

Revenues	$	6,428		$	12,184		$	26,046
Cost of revenues (1)		3,025			3,561			5,548

Gross profit		3,403			8,623			20,498

Operating expenses (1):
Product development		6,575			6,393			7,432
Sales and marketing		5,361			4,292			8,004
General and administrative		2,627			3,032			3,550
Stock-based compensation		595			149			472

Total operating expenses		15,158			13,866			19,458

Operating income (loss)		(11,755	)		(5,243	)		1,040

Other income		—			5			36
Interest income		1,025			352			243
Interest expense		(114	)		(88	)		(38	)

Income (loss) before provision for income taxes		(10,844	)		(4,974	)		1,281
Provision for income taxes		—			—			(112	)

Net income (loss)	$	(10,844	)	$	(4,974	)	$	1,169

Net income (loss) per share:
Basic	$	(2.17	)	$	(0.87	)	$	0.20
Diluted	$	(2.17	)	$	(0.87	)	$	0.04
Pro forma (unaudited)							$	0.04

Weighted average number of shares used in per share amounts:
Basic		4,997			5,691			5,878
Diluted		4,997			5,691			30,499
Pro forma (unaudited)								30,499
(1) Amounts included in stock-based compensation:
Cost of revenues	$	5		$	1		$	23
Product development		162			57			78
Sales and marketing		147			22			152
General and administrative		281			69			219

Total stock-based compensation	$	595		$	149		$	472




	Convertible Preferred Stock				Common Stock					Deferred Stock- Based Compen- sation			Accumu- lated Deficit			Accumu- lated Other Compre- hensive Income (Loss)			Total Stock- holders’ Deficit
(in thousands)	Shares	Amount			Shares		Amount			Deferred Stock- Based Compen- sation			Accumu- lated Deficit						Total Stock- holders’ Deficit

Balances at January 31, 2001	20,939,375	$	53,224		5,469,103		$	2,892		$	(1,266	)	$	(24,184	)	$	—		$	(22,558	)
Issuance of common stock					123,422			14												14
Issuance of common stock to consultants and employees for services performed								28												28
Issuance of warrant in connection with bank line of credit arrangement			9																	—
Amendment of warrant in connection with subordinated note payable			(23	)																—
Repurchase of common stock					(667	)														—
Reversal of stock-based compensation for terminated employees								(353	)		353									—
Amortization of deferred stock-based compensation											595									595
Net loss														(10,844	)					(10,844	)
Cumulative translation adjustment																	6			6

Total comprehensive loss																				(10,838	)

Balances at January 31, 2002	20,939,375		53,210		5,591,858			2,581			(318	)		(35,028	)		6			(32,759	)
Issuance of common stock on exercise of stock options					294,486			125												125
Repurchase of common stock					(6,083	)														—
Reversal of stock-based compensation for terminated employees								(137	)		137									—
Amortization of deferred stock-based compensation											149									149
Other stock-based expense								243												243
Net loss														(4,974	)					(4,974	)
Cumulative translation adjustment																	(5	)		(5	)

Total comprehensive loss																				(4,979	)

Balances at January 31, 2003	20,939,375		53,210		5,880,261			2,812			(32	)		(40,002	)		1			(37,221	)
Issuance of common stock on exercise of stock options					124,745			60												60
Deferred stock compensation								1,863			(1,863	)								—
Reversal of stock-based compensation for terminated employees								(43	)		25									(18	)
Amortization of deferred stock-based compensation											490									490
Net income														1,169						1,169
Cumulative translation adjustment																	5			5

Total comprehensive loss																				1,174

Balances at January 31, 2004	20,939,375	$	53,210		6,005,006		$	4,692		$	(1,380	)	$	(38,833	)	$	6		$	(35,515	)




	Operating Leases

Year ending January 31,
2005	$	843
2006		25
2007		15

Total minimum lease payments	$	883




	Number of Shares		Exercise Price	Weighted- Average Exercise Price per Share

Outstanding at January 31, 2001	3,929,157		$0.005 to $0.80	$	0.46
Granted	1,184,593		$0.80	$	0.80
Exercised	(122,755	)	$0.005 to $0.80	$	0.27
Canceled	(965,504	)	$0.005 to $0.80	$	0.47

Outstanding at January 31, 2002	4,025,491		$0.05 to $0.80	$	0.56

Granted	4,091,401		$0.80	$	0.80
Exercised	(288,403	)	$ 0.01 to $0.80	$	0.44
Canceled	(2,368,078	)	$ 0.01 to $0.80	$	0.57

Outstanding at January 31, 2003	5,460,411		$0.05 to $0.80	$	0.74

Granted	1,071,228		$ 0.80 to $0.95	$	0.81
Exercised	(124,745	)	$ 0.01 to $0.80	$	0.49
Canceled	(255,710	)	$ 0.24 to $0.80	$	0.67

Outstanding at January 31, 2004	6,151,184		$0.05 to $0.95	$	0.76





Convertible preferred stock		20,939,375
Stock options outstanding		6,151,184
Stock options available for grant		2,015,465
Warrants to purchase convertible preferred stock		73,099

		29,179,123




	Year ended January 31, 2004
Current:
Federal	$	50
State		29
Foreign		33

	$	112




	Year ended January 31, 2004
U.S. federal taxes (benefit) at statutory rate	$	436
State taxes, net of federal benefit		75
Tax credits		(570	)
Change in valuation allowance		378
Foreign tax rate differential		(416	)
Permanent Items		209

	$	112




	Year ended January 31,

	2004

Numerator:
Net income	$	1,169


Denominator:
Weighted-average shares outstanding		5,878
Adjustments to reflect the assumed conversion of the convertible preferred stock from date of issuance		20,939
Effect of dilutive securities—employee stock options and warrants		3,682

Weighted-average shares used in computing diluted pro forma net income per share		30,499




	Amount To Be Paid

SEC registration fee	$	10,136
NASD filing fee		8,500
NASDAQ listing fee		*
Printing and engraving expenses		*
Legal fees and expenses		*
Accounting fees and expenses		*
Blue sky fees and expenses		*
Transfer agent and registrar fees		*
Miscellaneous		*

Total	$




Exhibit Number		Description

1.1*		Form of Underwriting Agreement.

2.1*		Agreement and Plan of Merger between Brightmail Incorporated, a California corporation, and Brightmail Incorporated, a Delaware corporation.

3.1*		Form of Certificate of Incorporation of Registrant.

3.2*		Form of Amended and Restated Certificate of Incorporation of Registrant to be filed upon the closing of the offering made under the Registration Statement.

3.3*		Form Bylaws of Registrant.

4.1*		Form of Registrant’s Common Stock Certificate.

4.2		Amended and Restated Investors’ Rights Agreement, dated as of July 20, 2000, between the Registrant and the parties named therein.

5.1*		Opinion of Wilson Sonsini Goodrich & Rosati.

10.1		Form of Indemnification Agreement entered into by Registrant with each of its directors and executive officers.




Exhibit Number		Description

10.2		1998 Stock Option Plan and form of stock option agreement thereunder.

10.3*		2004 Equity Incentive Plan to be effective upon the closing of the initial public offering.

10.4*		2004 Employee Stock Purchase Plan to be effective upon the closing of the initial public offering.

10.5		Employment Agreement, dated March 11, 2002, between the Registrant and Enrique Salem.

10.6		Offer letter, dated June 12, 2002, between the Registrant and Michael Conner.

10.7		Offer letter, dated May 13, 2002, between the Registrant and Michael Irwin.

10.8		Offer letter, dated October 23, 2002, between the Registrant and Brad Kingsbury.

10.9		Office Lease Agreement dated as of July 14, 1999, between Registrant and EOP-301 Howard Street, L.L.C., and amendments thereto.

10.10		Amended and Restated Symantec Service Provider Agreement, dated as of March 28, 2003, between the Registrant, Symantec Corporation and Symantec Limited.

21.1		Subsidiaries of the Registrant.

23.1*		Consent of Wilson Sonsini Goodrich & Rosati (included in Exhibit 5.1).

23.2		Consent of Ernst & Young LLP, Independent Auditors.

24.1		Power of Attorney (See page II-5 of this Registration Statement).