In re FireEye, Inc. Securities Litigation 14-CV-05204-Consolidated Amended Class Action Complaint

Case 5:14-cv-05204-EJD Document 72 Filed 06/29/15 Page 1 of 84

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Lionel Z. Glancy (#134180) Ex Kano S. Sams II (#192936) Robert V. Prongay (#270796) GLANCY PRONGAY & MURRAY LLP 1925 Century Park East, Suite 2100 Los Angeles, California 90067 Telephone: (310) 201-9150 Facsimile: (310) 201-9160 Email: [email protected]

[email protected] [email protected]

Attorneys for Lead Plaintiff Vijay Fadia and Co-Lead Counsel for the Class

Jonathan Gardner (pro hac vice) Angelina Nguyen (pro hac vice) LABATON SUCHAROW LLP 140 Broadway New York, New York 10005 Telephone: (212) 907-0700 Facsimile: (212) 818-0477 Email: [email protected]

[email protected]

Attorneys for Lead Plaintiff State-Boston Retirement System and Co-Lead Counsel for the Class

UNITED STATES DISTRICT COURT

NORTHERN DISTRICT OF CALIFORNIA, SAN JOSE DIVISION

)

Case No.: 5:14-cv-05204-EJD

IN RE FIREEYE, INC. SECURITIES LITIGATION

CONSOLIDATED AMENDED CLASS ACTION COMPLAINT

) ) )

CONSOLIDATED AMENDED CLASS ACTION COMPLAINT CASE NO. 5:14- CV-05204-EJD


1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

TABLE OF CONTENTS

I. NATURE OF THE ACTION .......................................................................................... 1

II. JURISDICTION AND VENUE ...................................................................................... 8

III. PARTIES ........................................................................................................................

IV. CONTROL PERSON ALLEGATIONS ........................................................................ 11

V. SUBSTANTIVE ALLEGATIONS ............................................................................... 1

A. The Company And Its Business ......................................................................... 1

B. FireEye Acquires Mandiant and Touts an Integrated Product Solution Featuring Mandiant’s Endpoint Threat Detection ............................................... 1

C. Defendants Conceal Significant Problems With Mandiant’s Flagship MIR Product.............................................................................................................. 2

D. Defendants Update Market on “Smooth” and “Rapid” Mandiant Integration......................................................................................................... 2

E. Defendants Sell Millions in Stock Following FireEye’s Secondary Offering............................................................................................................. 2

F. FireEye Misses Consensus Product Revenue in 1Q14 ........................................ 2

G. In Reality, Integration Problems, Channel Friction, And Competition Adversely Impact Product Sales ........................................................................ 2

1. Integration Problems Cause Delays in Sales Cycles................................ 2

2. Integrating Sale of Mandiant Services Causes Channel Friction ............. 3

3. Increasing Competition Reduces The Pipeline ........................................ 3

H. FireEye Announces A Change in Revenue Recognition For Its Email Product And Appoints a New Head of Sales ...................................................... 3

I. FireEye Introduces FireEye-as-a-Service, A New Subscription Service ............. 3

VI. DEFENDANTS’ MATERIALLY FALSE AND MISLEADING STATEMENTS ANDOMISSIONS ....................................................................................................... 4

A. Class Period Financials ......................................................................................

B. January 2, 2014 8-K Attaching Press Release Announcing Mandiant Acquisition........................................................................................................ 41


i CASE NO. 5:14- CV-05204-EJD


1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

C. January 2, 2014 Call Announcing Mandiant Acquisition ................................... 4

D. February 11, 2014 4Q13 Earnings Call .............................................................. 4

E. May 6, 2014 1Q14 Earnings Call ....................................................................... 4

F. May 20, 2014 JP Morgan Global Technology Media Telecom Conference ........ 5

G. May 29, 2014 Cowen Technology Media & Telecom Conference ..................... 5

H. June 3, 2014 Bank of America Merrill Lynch Global Technology Conference........................................................................................................ 5

I. August 5, 2014 2Q14 Earnings Call ...................................................................

J. August 11, 2014 Pacific Crest Global Technology Leadership Forum................

K. September 3, 2014 Citi Global Technology Conference .....................................

L. September 18, 2014 FireEye Tech Talk .............................................................

VII. THE ENTIRE TRUTH IS FINALLY REVEALED ......................................................

VIII. ADDITIONAL SCIENTER ALLEGATIONS ..............................................................

IX. CLASS ACTION ALLEGATIONS ..............................................................................

X. APPLICABILITY OF PRESUMPTION OF RELIANCE UNDER THE AFFILIATED UTE DOCTRINE, AND/OR, IN THE ALTERNATIVE, THE FRAUD ON THE MARKET DOCTRINE .................................................................... 6

XI. NO SAFE HARBOR ....................................................................................................

XII. LOSS CAUSATION/ECONOMIC LOSS .....................................................................

COUNT I Violation Of Section 10(b) Of The Exchange Act And Rule 10b-5(b) Promulgated Thereunder Against All Defendants .......................................................... 7

COUNT II Violation Of Section 10(b) Of The Exchange Act And Rule 10b-5(a) and (c) Promulgated Thereunder Against All Defendants .......................................................... 7

COUNT III Violation Of Section 20(a) Of The Exchange Act Against the Individual Defendants.................................................................................................................... 7

JURY TRIAL DEMANDED ....................................................................................................

OLIDATED AMENDED CLASS ACTION COMPLAINT

ii NO. 5:14- CV-05204-EJD

27

28


1

Lead Plaintiffs State-Boston Retirement System (“State-Boston”) and Vijay Fadia

2

(“Fadia”) (collectively, “Plaintiffs”), by their undersigned attorneys, hereby bring thi

3

Consolidated Amended Class Action Complaint (the “Complaint”) against FireEye, Inc

4

(“FireEye” or the “Company”), David G. DeWalt (“DeWalt”), Michael J. Sheridan (“Sheridan”)

5

and Kevin Mandia (“Mandia”). The allegations herein are based on Plaintiffs’ persona

6

knowledge as to their own acts and on information and belief as to all other matters, such

7

information and belief having been informed by the investigation conducted by and under the

8

supervision of their counsel, which included interviews of former employees of FireEye and

9

other persons with knowledge of the matters alleged herein; these confidential witnesse

10

(“CWs”) will be identified herein by number (CW1, CW2, etc.), 1 and review and analysis o

11

publicly available information, including United States Securities and Exchange Commission

12

(“SEC”) filings by FireEye, as well as regulatory filings and reports, securities analysts’ report

13

and advisories about the Company, press releases and other public statements issued by the

14

Company, and media reports about the Company. Plaintiffs believe that substantial additiona

15

evidentiary support will exist for the allegations set forth herein after a reasonable opportunity

16

for discovery. On behalf of themselves and the class they seek to represent, Plaintiffs allege a

17

follows:

18

I. NATURE OF THE ACTION

19

1. This action is brought on behalf of a class of purchasers of FireEye

20

between January 2, 2014 and November 4, 2014 inclusive (the purchasers being the “Class” a

21

the time frame being the “Class Period”). Plaintiffs seek remedies under the Securities Exchan

22

Act of 1934, 15 U.S.C. §§ 78a et seq. (the “Exchange Act”).

23

2. FireEye, founded in 2004, develops and markets products and services related

24

network security, including the real-time detection of and protection from threats from t

25

internet, through email, and from other sources. FireEye’s systems claim to offer protectio

26

superior to those of traditional products that rely on matching data with an existing database

27

28 1 All CWs will be described in the masculine to protect their identities.


1 CASE NO. 5:14- CV-05204-EJD


1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

previously identified programs, or “signatures.” The Company purports to be an industry leade

in protecting networks against advanced persistent threats (APTs), particularly unknown

previously undetected threats known as “zero day” threats, using quarantining or “sandboxing

to detect novel malware that signature-based technologies are unable to detect. The “sandbox” i

an emulation environment run inside FireEye’s Multi-Vector Virtual Machine Execution (MVX

engine, a virtual machine that “detonates” suspected files and analyzes their behavior to asses

whether they are malicious. Prior to and during the Class Period, FireEye described its busines

as generating substantial revenue from the sale of the Company’s product portfolio, includin

software-based malware protection systems such as its Web MPS and File MPS. FireEye serve

more than 2,700 customers in over 67 countries.

3. The Company sells its products and services through both its direct sales

and its value-added reseller (“VAR”) channel. The direct sales team is made up of field

inside sales personnel. The Company also utilizes an indirect channel sales teams to sup

channel partner sales, or a “direct-touch sales model” wherein the support team works

channel partners to secure prospects, convert prospects to customers, and pursue follow-on

opportunities. FireEye primarily targets large enterprise and government customers.

4. FireEye’s offerings include physical appliances and subscription services.

MVX engine is deployed in on-premise purpose-built appliances. These machines include a

proprietary hypervisor and other software logic and can contain up to about 200 virtual machine

(“VMs”) in a single appliance, with each VM in turn containing approximately 10 MVX engines

The appliances scan web and email traffic and are usually deployed at points on the network

through which such traffic passes.

5. According to FireEye’s Form 10-K for fiscal year 2014, revenue for

Company’s product appliances usually is recognized at the time of shipment 2 and

2 One product, the Email Threat Prevention appliance, historically could not functi without accompanying services and was billed ratably; as of June 2014, however, FireE announced a policy change – that appliance would be shipped with the necessary software function without associated subscription services, and revenue for the appliance would, goi forward, be recognized at shipment.


2 NO. 5:14- CV-05204-EJD


1

revenue is recognized ratably over the contractual service period, which is typically one to fi

2

I years.

3

6. FireEye went public in September 2013 at $20 per share. In December 2013, the

4

Company acquired privately-held Mandiant Corporation (“Mandiant”), a computer forensics

5

specialist and acknowledged leader in endpoint security, incident response, and remediation

6

with more than two million endpoints installed globally, for 21.5 million shares (at a value o

7

$884M), $106.5M in net cash, and performance incentives. Mandiant, known for investigator

8

that act like a “cyber-SWAT” team for companies that have been hacked, also offered software

9

products that detected threats on a network’s endpoints. Endpoints refer to remote devices

10

accessing a corporate network, such as desktop or laptop computers, tablets, smartphones, etc

11

In comparison, FireEye’s products focused on detecting threats at strategic points on the

12

network, but not the endpoints.

13

7. The January 2, 2014 press release announcing the Mandiant acquisition stated tha

14

“[t]he combination of FireEye and Mandiant brings together two highly complementary

15

companies, each a recognized leader and innovator in security, and creates an organization

16

uniquely qualified to meet organizations’ needs for real-time detection, contextual th

17

intelligence, and rapid incident response.” The press release further stated that “Mandiant

18

been a strategic alliance partner of FireEye since April 2012. The combination of the

19

companies is a natural extension of this partnership and their integrated product offering , w

20

both companies announced in February 2013.”

21

8. The press release also noted that Kevin Mandia, Mandiant’s founder and chi

22

executive officer prior to the acquisition, would be chief operating officer of FireEye, and quote

23

Mandia as saying that “[t]he combination of FireEye and Mandiant will deliver end-to-e

24

protection and meaningful value to customers... By joining FireEye and Mandiant, we will

25

able to deliver fully integrated products and services that help organizations protect themsel

26

from attacks.” According to the press release, Mandiant’s endpoint threat detection and respo

27

products would be “incorporated as a core element of the FireEye Oculus platform.”

28


3 NO. 5:14- CV-05204-EJD


1

9. On the January 2, 2014 analyst call discussing the Mandiant acquisition, DeW

2

further emphasized the “proven synergy potential” between the two companies:

3

We formalized our partnership almost a year ago with the announced integration of the Mandiant Infinite Response platform

4

or MIR with our FireEye web and email MPS solutions. Many customers have now deployed this integrated solution, proving the

5

synergy potential between the companies.... In addition to the full lifecycle remediation capabilities, we see many synergies between

6

the companies. First of all, FireEye can now leverage the MIR endpoint management framework to port our virtual machine-

7

based technology to the endpoint, expanding our TAM -- our total addressable market -- and creating an end-to-end solution capable

8

of protecting any company at any part of the architecture.

9

10. DeWalt also highlighted the ability of the combined company to “quickly

10

products and the opportunity to “cross-sell” to the companies’ respective customer bases:

11

To further expand on the synergies, I believe there’s a number of additional near-term opportunities, including the ability to sell

12

FireEye’s existing products into Mandiant’s base of more than 500 customers, of which we have less than 20% overlap. Also, the

13

ability to sell Mandiant’s endpoint and cloud solutions into FireEye’s base of more than 1,500 customers, of which we have

14

less than 10% overlap.

15

With more than 50% of Mandiant’s bookings in products and subscriptions, the opportunity to grow products even faster is a

16

reality; also, the ability to sell Mandiant’s products and services internationally in the more than 40 countries where FireEye is now

17

present. Today Mandiant has less than 5% of its sales outside the US. This will be a key synergy opportunity for the joint

18

companies.

19

11. DeWalt further stated that an “immediate short-term synergy will be the length o

20

the FireEye sales cycle. Being closer to the breach created by the Mandiant service engine

21

significantly shorten the product cycles and increase the average sales price.”

22

12. In response to an analyst question regarding whether the combined

23

“over time this looks like a traditional software company, or is it always going to have a he

24

consulting services mix to the business?”, DeWalt stated “I think it looks more like a pr

25

company than anything else, clearly” and “[o]n the Mandiant side it is becoming more and

26

product as well. This is a business that started out 100/zero services/product and now is

27

than 50% product/services. So it is evolving in that direction as well, I think almost the

28

path that FireEye is on.”


4 NO. 5:14- CV-05204-EJD


1

13. Even as DeWalt touted the combined company’s “product” synergies, however,

2

I Defendants were aware of a serious flaw in the latest version of the Mandiant Infinite

3

(“MIR”) endpoint threat detection product. According to a former sales engineer with

4

I (and later with the combined company), changes made to the MIR product in November 201

5

caused significant scalability issues, such that MIR was unable to scale past 3,000-4,000

6

endpoints without dropping offline, when the product was supposed to monitor 10,000 endpoint

7

per server. Those problems – with an estimated resolution date of early 2015 – led many o

8

Mandiant’s legacy customers to abandon the combined company for competitors like

9

CrowdStrike and AccessData. In other words, one of the primary reasons FireEye identified a

10

driving the Mandiant acquisition – the ability to “integrate” FireEye’s products with MIR –

11

suffered serious setbacks from the beginning of the Class Period.

12

14. FireEye completed a follow-on offering of its stock on March 6, 2014,

13

which the Company raised approximately $1.1 billion and sold 14 million shares at $82.00

14

share, more than four times the price at its initial public offering (“IPO”). Mere days after

15

follow-on offering, the Individual Shares sold their shares at $79.54, near the all-time hi

16

earning tens of millions of dollars in profits.

17

15. Yet Defendants failed to disclose that FireEye – contrary to the synergies

18

touted – experienced multiple difficulties integrating Mandiant throughout the Class P

19

leading to problems selling the combined company’s products and, correspondingly, to a he

20

services revenue component. As detailed below, former employees of the combined com

21

describe (1) a significant slowdown in sales resulting from mass confusion and chaos at the

22

level as the consolidated field personnel struggled with selling unfamiliar products and

23

forced to share sales territories from the sheer increase in their numbers as a result of the me

24

(2) pushback from customers that did not want to be pitched on cross-sales of services; (3

25

lengthening of sales cycles from integration inefficiencies; (4) friction with FireEye’s channe

26

partners caused by FireEye’s competing with the channel over FireEye’s new services

27

particularly as services have higher margins for channel sellers than products; (5) problems with

28

the updated version of Mandiant’s core MIR solution, which DeWalt had touted as an


5 NO. 5:14- CV-05204-EJD


1

“integrated solution” at the beginning of the Class Period, leading to customers leaving

2

competitors and a shrinking pipeline; (6) increasing competition in the marketplace for leg

3

FireEye products; and (7) legacy Mandiant customers that did not want to upgrade to

4

combined company solution because it was significantly more expensive.

5

16. Throughout the Class Period, Defendants failed to disclose that their

6

sales were suffering, even as FireEye’s revenue began shifting increasingly toward servi

7

revenue, meaning less up-front revenue in the Company’s reported financials. On the Febru

8

11, 2014 4Q 13 earnings call, DeWalt continued to reiterate the Company’s purported focus

9

selling product:

10

We have a series of new products rolling out, going into the first quarter and the second order that we haven’t announced yet, that

11

are really organic between the two. We think we’ve got a really nice place now to add products to the sales and marketing engine

12

we put in place.

13 ....Our ability to scale of the Mandiant business is really a matter of selling products now. We’re going to continue to scale services

14

people, but not at a faster pace than we are going to be selling products.... As we sell more and more product, it’s all about the

15

automation of that service component.

16

17. Additionally, DeWalt denied that competition was affecting FireEye’s

17

sales, even though analysts noted that FireEye faced increasing competition, with a May 2014

18

Deutsche Bank report stating that “FireEye now has a host of emerging rivals and at the recent

19

RSA event it felt like every security IT vendor was selling an APT solution.” DeWalt, however

20

responded to an analyst’s question regarding competition on the May 6, 2014 1Q14 earnings cal

21

that “[t]he head-to-head battles with any competitor in the market has resulted in near flawless

22

execution and win rates. I would say 100%, but I’m sure there is one out there that we lost to

23

some competitor, but our win rates are dramatic when competing head to head with a produc

24

bake-off,” and further stating that a competing product named WildFire from Palo Alto

25

Networks had had no impact on the Company’s business:

26

[O]ur renewal rates are spectacular, first of all. Second of all, our win rate is spectacular; any conversions to a competitor that you

27

just named, to my knowledge, is zero. I have not seen a single transaction when somebody moves from FireEye to Wildfire . When

28

I look at Wildfire, that product is highly ineffective in the marketplace where these types of attacks, a million reasons I could


6 NO. 5:14- CV-05204-EJD


1

go on and on about. But I have not seen any of that, I don’t anticipate seeing any of that.

2 In fact, there [are] many accounts where we go into where Wildfire

3

was already sold and we had FireEye behind it, and on top of that our detection efficacy doesn’t change one bit, whether that product

4

was in front of us or behind it. The way I look at this is that technology is having almost zero influence on these advanced

5

detection models that are out there, in my opinion. So I just don’t see that technology as something that is there right now to

6

changing our business model.

7

So a little -- a little aggressive statement, but it is what it is. I don’t see them as a major factor for us right now .

8

9

18. On the same analyst call, DeWalt also asserted that “we generated

10

growth in incremental pipeline for the Company,” contrary to accounts from former emp

11

that pipelines were shrinking as Mandiant software problems caused legacy Mandiant

12

to leave for competitors.

13

19. FireEye’s shift towards services revenue as a result of the undisclosed

14

with product sales and competition led to lower reported quarterly revenues because ser

15

revenue – being rated over the term of the services contract – was largely deferred.

16

Company’s reported 1Q 14 results constituted the first partial disclosure to the market

17

product sales were being adversely affected, as product revenue (which analysts, e.g. , Deu

18

Bank, viewed as “driv[ing] overall momentum”) fell meaningfully short of analysts’ estim

19

In response, FireEye’s stock price plummeted 22.84% to close at $28.65 per share on May 7

20

2014 on unusually heavy trading volume, with 23,205,700 shares traded compared with

21

average daily trading volume over the Class Period of 5,850,012 shares.

22

20. In August 2014, when FireEye announced 2Q 14 results, the market learned

23

the Company had managed to meet product revenue expectations at the same time as it learne

24

that FireEye also had boosted product revenue through a “policy change” that resulted i

25

recognizing revenue at shipment for its email appliance, which historically had require

26

accompanying subscription services and thus previously had been reported as services revenue

27

A JP Morgan analyst observed that the change in revenue recognition was “a major contributo

28

to the increase in revenue guidance for FY14 along with the upside in 2Q14 billings.”


7 NO. 5:14- CV-05204-EJD


1

21. The Company also announced on the August 2014 earnings call that a new he

2

of global sales would displace the former head, in addition to the realization of “cost saving

3

from “personnel... consolidation[].” DeWalt explicitly denied, however, that the sales force w

4

being restructured, and failed to disclose any elongation of sales cycles.

5

22. The disclosure that product sales were artificially boosted and that a new head

6

sales had been appointed amid “cost savings” from “personnel consolidation” caused shares

7

fall a further 11.42%, to close at $30.78 per share on August 6, 2014 on unusually heavy tradi

8

volume, with 12,839,900 shares traded compared with an average daily trading volume over

9

Class Period of 5,850,012 shares.

10

23. Finally, on November 4, 2014, Defendants acknowledged a pronounced shift i

11

revenue from product to services, announcing revenues at the low end of their previous guidanc

12

and lower than analysts’ consensus expectations. Defendants attributed the shift t

13

“outperformance” of FireEye-as-a-Service, a new subscription service (“SaaS”) the Compan

14

had announced in September 2014 – a mere two weeks before the end of the third quarter. A

15

Citigroup analyst cut his price target in response, stating that analyst consensus revenu

16

estimates would decline given the reduction in product revenue, and that FireEye’s growth woul

17

be difficult to estimate given the changes in its revenue recognition practices and its introductio

18

of subscription models like FireEye-as-a-Service.

19

24. In reaction to FireEye’s disappointing product revenue, the Company’s share

20

plummeted 14.98%, on unusually heavy trading volume, with 25,224,200 shares trade

21

compared with an average daily trading volume over the Class Period of 5,850,012 shares.

22

II. JURISDICTION AND VENUE

23

25. The claims asserted herein arise under and pursuant to Sections 10(b) and 20(a) o

24

the Exchange Act [15 U.S.C. §§ 78j(b) and 78t(a)] and Rule 10b-5 promulgated thereunder b

25

the Securities and Exchange Commission (“SEC”) [17 C.F.R. § 240.10b-5].

26

26. This Court has jurisdiction over the subject matter of this action pursuant to 2

27

U.S.C. § 1331 and Section 27 of the Exchange Act [15 U.S.C. § 78aa].

28


8 NO. 5:14- CV-05204-EJD


1

27. Venue is proper in this District pursuant to Section 27 of the Exchange Act,

2

28 U.S.C. § 1391(b).

3

28. In connection with the acts alleged in this Complaint, Defendants, directly

4

indirectly, used the means and instrumentalities of interstate commerce, including, but

5

limited to, the mails, interstate telephone communications and the facilities of the natio

6

I securities markets.

7

III. PARTIES

8

29. On May 1, 2015, the Court appointed State-Boston and Fadia to serve as L

9

Plaintiffs in this securities class action pursuant to the Private Securities Litigation Reform

10

of 1995 (the “PSLRA”), Pub. L. 104-67, 109 Stat. 737.

11

30. Lead Plaintiff State-Boston is a defined-benefit governmental pension

12

headquartered in Boston, Massachusetts and governed by a five-member board. As of Decem

13

31, 2013, Boston managed approximately $5.39 billion in assets on behalf of approxima

14

44,000 beneficiaries. As set forth in the certification annexed State-Boston’s Motion

15

Appointment as Lead Plaintiff, incorporated by reference herein, State-Boston purc

16

FireEye’s securities on the open market during the Class Period and suffered damages as a

17

of the misconduct alleged herein.

18

31. Lead Plaintiff Fadia purchased more than 32,000 FireEye shares during the Cla

19

Period and retained those shares throughout the Class Period. As set forth in the certificatio

20

annexed to Fadia’s Motion for Appointment as Lead Plaintiff, incorporated by reference herei

21

Fadia purchased FireEye’s securities on the open market during the Class Period and suffere

22

damages as a result of the misconduct alleged herein.

23

32. Defendant FireEye offers a comprehensive cybersecurity solution, through a suit

24

of products and services, for detecting, preventing and resolving advanced cyber-attacks tha

25

evade legacy signature-based security products. FireEye was incorporated in Delaware i

26

February 2004 under the name NetForts, Inc., and changed its name to FireEye, Inc. i

27

September 2005. FireEye has principal executive offices at 1440 McCarthy Blvd, Milpitas

28

California 95035. The Company completed its IPO in September 2013. FireEye’s commo


9 NO. 5:14- CV-05204-EJD


1

stock trades on the NASDAQ Global Select Market (“NASDAQ”) under the ticker symbol

2

I “FEYE.”

3

33. Defendant DeWalt is the current Chairman of the Board and Chief

4

Officer (“CEO”), and has served in those capacities since May 2012 and November 201

5

respectively. Before joining FireEye, DeWalt was President, Chief Executive Officer, an

6

Director of McAfee, Inc. from April 2007 until February 2011, when McAfee was acquired b

7

Intel Corporation. Before McAfee, DeWalt held various positions at EMC Corporation,

8

company specializing in information infrastructure technology, as well as Documentum. Al

9

with his executive duties, DeWalt has served on the board of directors for several organizati

10

including Delta Air Lines, Inc., Polycom, Inc., and Jive Software, Inc. DeWalt was Chairman o

11

the Board at Mandiant from May 2012 until FireEye’s IPO in September 2013. He holds a B.S

12

in computer science from the University of Delaware. DeWalt was a direct and substantia

13

participant in the fraud.

14

34. Defendant Sheridan is Chief Financial Officer (CFO) and Senior Vice Presiden

15

of the Company, and has served in those capacities since June 2011. Before FireEye, Sheridan

16

oversaw all financial endeavors for several technology companies, including Mimosa Systems

17

Playlist, Inc., social media giant Facebook, IGN Entertainment (now part of News Corp.), and

18

network security company SonicWALL. Sheridan received a B.S. in commerce from Santa

19

Clara University. Sheridan was a direct and substantial participant in the fraud.

20

35. Defendant Mandia was Chief Operating Officer (“COO”) and Senior Vice

21

President of the Company during the Class Period, and currently is President of the Company

22

Mandia is the founder and was CEO of Mandiant prior to its acquisition by FireEye. Mandia

23

has overseen all operations at the Company since December 2013, when FireEye acquired

24

Mandiant. Before Mandiant, Mandia was the Director of Computer Forensics at Foundstone

25

(acquired by McAfee Corporation) from 2000 to 2003, and the Director of Information Security

26

for Sytex (later acquired by Lockheed Martin) from 1998 to 2000. Mandia was also a United

27

States Air Force Officer, where he was a computer security officer in the 7th Communications

28

Group at the Pentagon, and a special agent in the Air Force Office of Special


10 NO. 5:14- CV-05204-EJD


1

Mandia holds a B.S. in computer science from Lafayette College and a M.S. in forensic scie

2

from The George Washington University. Mandia was a direct and substantial participant in

3

I fraud.

4

36. Defendants DeWalt, Sheridan, and Mandia are collectively referred to as

5

“Individual Defendants.” The Individual Defendants, together with FireEye, are collecti

6

I referred to as the “Defendants.”

7

IV. CONTROL PERSON ALLEGATIONS

8

37. The Individual Defendants, because of their positions of control and authority a

9

senior executive officers (and as Director for DeWalt), had access to the adverse, undisclose

10

information about FireEye’s business through their access to internal corporate documents an

11

information, conversations and associations with other corporate officers and employee

12

attendance at management and Board of Directors meetings and committees thereof, and report

13

and other information provided to them in connection therewith.

14

38. Each of the above officers of FireEye, by virtue of his high-level position with th

15

Company, directly participated in the management of the Company, and was directly involved i

16

the day-to-day operations of the Company at the highest levels. The Individual Defendant

17

participated in drafting, preparing, and/or approving the public statements and communication

18

complained of herein and were aware of, or recklessly disregarded, the material misstatement

19

contained therein and omissions therefrom, and were aware of their materially false an

20

misleading nature. Both DeWalt and Sheridan repeatedly portrayed the Mandiant acquisition a

21

smooth and failed to disclose the problems with integration and competition that affected produc

22

sales during the Class Period, even though product revenue historically had comprised almos

23

half of total revenues, and the market viewed product sales as driving overall momentum of the

24

Company’s business. Product revenue, including sales trends, were fundamental aspects o

25

FireEye’s business that the Individual Defendants followed, tracked, and were aware of, o

26

should have followed, tracked and been aware of, at all times.

27

39. The Individual Defendants, as senior executive officers of the Company,

28

able to and did control the content of the various SEC filings, press releases, and other p


11 NO. 5:14- CV-05204-EJD


1

statements pertaining to the Company during the Class Period. The Individual Defendants were

2

provided with copies of the documents and statements alleged herein to be materially false and

3

misleading prior to or shortly after their issuance or had the ability and opportunity to preven

4

their issuance or cause them to be corrected. Accordingly, the Individual Defendants are

5

responsible for the accuracy of the public reports, releases, and other statements detailed herein

6

and are primarily liable for the misrepresentations and omissions contained therein.

7

40. As senior officers and controlling persons of a publicly-held company whose

8

securities were, during the relevant time, registered with the SEC pursuant to the Exchange Act

9

traded on the NASDAQ, the Individual Defendants each had a duty to promptly disseminate

10

accurate and truthful information with respect to the Company’s operations and business, and to

11

correct any previously issued statements that were or had become materially misleading o

12

untrue, so that the market price of the Company’s publicly-traded securities would be based upon

13

truthful and accurate information. The Individual Defendants’ wrongdoing during the Clas

14

Period violated these specific requirements and obligations.

15

41. Each of the Individual Defendants is liable as a primary participant in a wrongfu

16

scheme and course of business that operated as a fraud and deceit on purchasers of FireEye’

17

securities during the Class Period, which included the dissemination of materially false an

18

misleading statements (both affirmative statements and statements rendered misleading becaus

19

of material omission) regarding FireEye’s product sales and the Mandiant integration, includin

20

the undisclosed problems with Mandiant’s flagship MIR product. The scheme: (i) deceived th

21

investing public regarding FireEye’s operations and business, and the true value of FireEye’

22

securities; and (ii) caused Plaintiff and other members of the Class to purchase FireEye’

23

securities at artificially inflated prices, which fell as the truth concerning FireEye’s produc

24

revenue deceleration became known.

25

42. In making the statements complained of herein, the Individual Defendants, w

26

were senior officers and controlling persons of FireEye, were acting on behalf of the Company

27

the regular course of business. Therefore, each of the statements made by the Individu

28

Defendants is attributable to the Company.


12 NO. 5:14- CV-05204-EJD


1

V. SUBSTANTIVE ALLEGATIONS

2

A. The Company And Its Business

3

43. Based in Milpitas, California, FireEye had approximately 2,700 employees as

4

December, 2014, and claims to provide a comprehensive cybersecurity solution for detecti

5

preventing and resolving cyber-attacks that evade legacy signature-based security products. T

6

Company’s cybersecurity solutions combine its purpose-built virtual-machine technology, thr

7

intelligence, and advanced security expertise in a suite of products and services. FireEye off

8

intelligence subscriptions, managed services, incident response, and consulting services

9

complement its threat prevention products.

10

44. FireEye’s threat detection “platform” or system combines its virtual machi

11

based detection engine, MVX, and its cloud-based threat intelligence network to ident

12

previously unknown threats. The MVX engine is deployed in on-premise purpose-

13

appliances. These machines include a proprietary hypervisor and other software logic and

14

contain up to about 200 VMs in a single appliance, with each VM in turn containin

15

approximately 10 MVX engines. The appliances scan web and email traffic and are usuall

16

deployed at points on the network through which such traffic passes.

17

45. FireEye appliances scan everything, including known and unknown threats acros

18

all key “vectors” (web, email, file and mobile). As data objects pass through a FireEy

19

appliance, they are analyzed using FireEye’s custom-built anomaly detector and associate

20

heuristic or experienced-based algorithms that attempt to filter suspicious data (potentiall

21

exploit objects or code) from benign traffic. These suspicious web objects, attachments and file

22

are then copied and loaded onto a VM or virtual sandbox environment that mimics operati

23

systems and device configurations, “fooling” the malware into thinking that it’s on re

24

computers by simulating their execution path.

25

46. This methodology allows for newly identified threats to be quarantined

26

sandboxed to prevent further exposure. In this virtual environment, the FireEye engine (us

27

sensors inside the sandbox) monitors the behavior of the suspicious data and determines if

28

actions are malicious or benign (for example, a PDF file is not supposed to be able to open


13 NO. 5:14- CV-05204-EJD


1

network connection, and if the sensor detects that is able to, this is a sign that the PDF may

2

malware that is trying to communicate with an external master server). Sandboxed threats

3

“detonated,” akin to exploding a bomb in a remote and safe place. The resulting

4

I intelligence is then sent to FireEye’s cloud-based Dynamic Threat Intelligence (“DTI”)

5

which allows for threat intelligence sharing among vector-specific VMs, updating the

6

algorithms and protecting against multi-vector threats.

7

47. FireEye’s revenue consists of “product revenue” and “subscription and

8

revenue.” Product revenue is generated from sales of the Company’s appliances. Prior to June

9

2014, product revenue for the Company’s Web MPS, File MPS, MAS and CMS appliances was

10

recognized at the time of shipment, whereas revenue for the Company’s Email MPS appliances

11

were recognized ratably over the longer of the contractual term of the subscription service or the

12

estimated period the customer was expected to benefit from the product. In June 2014, however

13

FireEye announced a change in its policy, and that revenue for the Email appliances would

14

going forward, be recognized at the time of shipment, as with its other products.

15

48. FireEye generated subscription and services revenue primarily from its

16

cloud, the Email MPS Attachment/URL engine prior to June 2014, and support and maintena

17

services. The Company determined DTI cloud subscription as a percentage of the price of

18

related appliance. The Company recognized revenue from subscriptions and support

19

maintenance services over the one or three year contract term, as applicable.

20

49. The Company sells its products and services through both its direct sales

21

and its value-added reseller channel. Although no end-customer represented more than 10% o

22

revenue for any of the years ended December 31, 2014, 2013 and 2012, FireEye reported in it

23

Form 10-K for FY14 that Carahsoft Technology Corporation, a channel reseller, accounted fo

24

approximately 11% of revenue for FY13 and FY14, and Accuvant, another reseller, accounte

25

for approximately 11% and 10% of revenue in FY13 and FY12, respectively.

26

50. Investors viewed the Company’s product revenue as a critical measure o

27

FireEye’s growth. For example, a May 7, 2014 Deutsche Bank report stated that product

28

“drive overall momentum. Moreover, because product revenue was recognized up-front,


14 NO. 5:14- CV-05204-EJD


1

shipping, higher product revenues meant higher total reportable revenues per quarter,

2

compared with services revenue, which was deferred over one or three years per contract length.

3

B. FireEye Acquires Mandiant and Touts an Integrated Product Solution Featuring Mandiant’s Endpoint Threat Detection

4

5

51

In December 2013, the Company acquired privately-held Mandiant, a

6

provider of advanced endpoint security products and security incident response

7

solutions, with more than two million endpoints installed globally, for 21.5 million shares (at

8

value of $884M), $106.5M in net cash, and performance incentives.

9

52. FireEye’s January 2, 2014 press release announcing the Mandiant

10

highlighted Mandiant’s endpoint products first (followed by its incident response and

11

consulting services), and asserted that those endpoint products were “already integrated with

12

FireEye platform”:

13

Endpoint Threat Detection, Response, and Remediation Products

14

Mandiant pioneered and continues to lead the industry for endpoint-based advanced threat detection and response.

15

Mandiant’s endpoint products, which are already integrated with the FireEye platform , enable security teams to make faster, more

16

accurate decisions about potential security incidents while eliminating blind spots by connecting the dots with the FireEye

17

network-based threat detection and prevention platform.

18

53. The press release also touted the companies’ “integrated product offering,”

19

I that “Mandiant has been a strategic alliance partner of FireEye since April 2012.

20

combination of the two companies is a natural extension of this partnership and their

21

product offering, which both companies announced in February 2013 .”

22

54. Defendants continued to emphasize the combined company’s

23

opportunities and offerings on the January 2, 2014 analyst call announcing the

24

acquisition. DeWalt stated that:

25

Mandiant generates over 50% of its sales through its products and subscription offerings targeted at the endpoint. The combination of

26

our companies significantly moves us forward in completing the circle of protection around organizations, networks, and endpoints

27

with our MVX virtual machine-based technology, and provides us with significant opportunities to upsell and cross-sell our products

28

and recurring subscriptions into our respective customer bases.


15 NO. 5:14- CV-05204-EJD


55. DeWalt highlighted the “integrated” solution combining Mandiant’s endpo

2

MIR platform with FireEye’s web and email solutions, calling it proof of the “synergy

3

between the two companies:

4

We recognize Mandiant’s leadership and innovative approach in incident response and remediation and began collaborating nearly

5

two years ago. We formalized our partnership almost a year ago with the announced integration of the Mandiant Infinite Response

6

platform or MIR with our FireEye web and email MPS solutions.

7

Many customers have now deployed this integrated solution, proving the synergy potential between the companies. In fact,

8

some of the most important Fortune 500 companies now run this combined offering in production.

9

10

56

DeWalt stressed the importance of Mandiant’s MIR product:

11

[W]e see many synergies between the companies. First of all, FireEye can now leverage the MIR endpoint management

12

framework to port our virtual machine-based technology to the endpoint, expanding our TAM -- our total addressable market --

13

and creating an end-to-end solution capable of protecting any company at any part of the architecture.

14

15

57

DeWalt further stated that the acquisition would allow FireEye to “cross-sell”

16

products to Mandiant’s legacy customers and vice versa, and that the product sales cycle

17

I shorten:

18

To further expand on the synergies, I believe there’s a number of additional near-term opportunities, including the ability to sell

19

FireEye’s existing products into Mandiant’s base of more than 500 customers, of which we have less than 20% overlap. Also, the

20

ability to sell Mandiant’s endpoint and cloud solutions into FireEye’s base of more than 1,500 customers, of which we have

21

less than 10% overlap.

22

With more than 50% of Mandiant’s bookings in products and subscriptions, the opportunity to grow products even faster is a

23

reality; also, the ability to sell Mandiant’s products and services internationally in the more than 40 countries where FireEye is now

24

present. Today Mandiant has less than 5% of its sales outside the US. This will be a key synergy opportunity for the joint

25

companies.

26

We also believe an immediate short-term synergy will be the length of the FireEye sales cycle. Being closer to the breach

27

created by the Mandiant service engine can significantly shorten the product cycles and increase the average sales price.

28


16 NO. 5:14- CV-05204-EJD


58. Not surprisingly, analysts focused on the effect of the acquisition on products,

2

DeWalt again highlighted Mandiant’s MIR product:

3

Keith Weiss - Morgan Stanley – Analyst

4

[W]hat do you guys acquire today in terms of product, sort of the existing integration with Mandiant that you have today, that is

5

going to go into your sales guys’ tool bag on day one?

6

David DeWalt - FireEye, Inc. - Chairman, CEO

7

But this is the most exciting part, I think, of the combination, although the services side is a huge opportunity globally as well.

8 But when you look at the products, this really completes FireEye.

9

When we think about the vision we had set out to do earlier this year, we wanted to put virtual machines at every important

10

architecture point in the customer enterprise. So initially we have products that we can put into the FireEye sales teams.

11 What we call the Mandiant Infinite Response platform, this is an

12

endpoint solution that can sit on up to hundreds of thousands of host agents. Some of them are running in the biggest Fortune 500

13

companies in the world.

14

And what we can do is, again, take detection out of the network, pass it immediately to the endpoint, and remediate it in seconds. So

15

we have a really strong endpoint management platform.

16

There is sort of a heavier version of that that is called MIR and a lighter version of that called MSO, which is the Mandiant Security

17

Operations, MSO. That comes in an appliance form factor, can drop right into the FireEye sales and install base as well as cross-

18

sell into the Mandiant base. So those two big products sitting on the endpoint are really prime-time products to sell.

19

20

59. DeWalt further mentioned another combined product called IPS, based

21

Mandiant’s forensic capabilities, “in the next 60 to 90 days,” and referred to the strong

22

synergies”:

23

Then you alluded as well, there is another set of products that they offer. They have a series of sensors that they deploy as part of their

24

managed defense. These are some of the most critical and advanced intelligence signatures in the world.

25 A lot of what [Mandia] does and his team is collecting forensics.

26

These intelligence signatures can load onto our IPS product that we are working on. This product was just coming out in beta; we hope

27

to have it in production here in the next 60 to 90 days . And a real opportunity for us to create another major add-on product for the

28

Company and really unique, because it combines some Mandiant


17 NO. 5:14- CV-05204-EJD


capabilities and some FireEye capabilities all into a combined offering that we have been working on.

2 ***

3 So the product synergies here are very strong. There’s other

4

products I will just say are in the pipeline as well that we are not announcing today, but we really feel good about some of the

5

product direction.

6

60. Sheridan reiterated that “product” would continue to be a “major growth driver”:

7

In terms of the long-term target model and our targets for operating margin and EBITDA margins and so forth, it is not going to

8

change it significantly, because if you look at the two businesses they are actually very similar. There is a bigger service component;

9

but as I mentioned in my comments, on a combined basis services are only going to make up 15% to 17% of our current makeup of

10

revenues .

11

So the product and the recurring subscriptions will continue to be major growth drivers for both. So I would expect that that target

12

model is going to be pretty close to what we discussed historically.

13

61. In addition to another analyst’s question regarding product versus service

14

Sheridan repeated that:

15

Yes. Raimo, yes, we talked about the 15% to 17% for 2014; and without talking about specific percentages outside of that time

16

frame, I would tell you that the products and the recurring subscriptions of course will grow faster as a business than the

17

services .

18

This is in no way to diminish the critical nature of the services. They’re strong margins; they’re premium; and they create a lot of

19

pull for the products. But if we execute on the strategy we are articulating, you will continue to see that product and product

20

subscription and recurring revenue growth outpace the service part of the business, which would therefore imply that s ervices as

21

a percentage should move to a smaller percentage than that over time.

22

23

Sheridan repeated that product would outpace services in response to a third analyst:

24

Gregg Moskowitz - Cowen and Company – Analyst

25

Then just for Kevin or Mike, I know that in total Mandiant had been growing over 50% and you expect product to grow faster than

26

the overall business going forward. Just wondering if in 2013, if there were significant differences in the growth rates by segment

27

across recurring subscriptions, products, and incident response.

28


18 NO. 5:14- CV-05204-EJD


1

Michael Sheridan - FireEye, Inc. - SVP, CFO

2

So we haven’t broken out those numbers; but as I mentioned before, generally speaking what you would expect in 2013 is what

3

I discussed for 2014, which is that the product and recurring subscription part of the business has grown faster.

4

5

62. Yet another analyst asked whether the combined company would have a

6

services component, but Defendants again reiterated that product was the focus:

7

Brent Thill - UBS – Analyst

8

Dave, do you think over time this looks like a traditional software company, or is it always going to have a heavier consulting

9

services mix to the business?

10


11

Yes, Brent, that’s a good question.... I think it looks more like a product company than anything else, clearly . I mean, Mike

12

Sheridan articulated this is 82% to 85% product and product subscriptions. We have 15% to 17%-ish coming from services in

13

the model that he outlined. That is pretty traditional software, big software kinds of companies, if you are thinking of the Oracles and

14

SAPs of the world. So we don’t think we are out of bounds with that.

15 ***

16 So you think of the service now, as you think of these models, this

17

is what I think security is going to: combinations of products and services where the majority will be product, a large majority ; but a

18

critical and essential element of it for security will be services components.

19

20

63. The market responded positively to the purported product enhancement from

21

merger. A January 2, 2014 TheStreet.com article noted that “[t]he merger should help FireEye

22

strengthen its current cybersecurity products.” Further strengthening this impression, in a

23

separate January 2, 2014 press release, FireEye increased its guidance for 4Q13, with expected

24

revenue of between $55 million and $57 million for 4Q13, compared to previous guidance o

25

$52 million to $54 million; total revenue for FY13 of between $159 million and $161 million

26

compared to previous estimates of between $156 million and $158 million; total 4Q13 billings o

27

$95 to $100 million, compared with previous guidance of $82 to $86 million; and total billing

28


19 NO. 5:14- CV-05204-EJD


1

for FY13 of between $254 and $259 million, compared with previous guidance of $240 to

2

I million.

3

64. On January 3, 2014, the day after FireEye announced the Mandiant

4

and increased guidance, the Company’s stock price soared, closing up 39%.

5

C. Defendants Conceal Significant Problems With Mandiant’s Flagship MIR Product

6

7

65. At the time the Mandiant acquisition was announced, Defendants were aware

8

Mandiant had significant issues with the MIR endpoint product that was ostensibly the m

9

reason FireEye acquired Mandiant.

10

66. CW1 was a former Sales Engineer in Houston, Texas for Mandiant, and

11

FireEye following the acquisition, from July 2013 to August 2014. As a Sales Engineer,

12

worked in conjunction with the sales team as the key technical advisor for Mandiant’s pro

13

offerings. He reported to John Bradshaw, Worldwide Director of Sales Engineers.

14

67. According to CW1, the issues with the integration of Mandiant’s products

15

FireEye’s products began immediately following the acquisition. CW1 indicated that there

16

significant product issues on the Mandiant side while trying to integrate these products

17

FireEye, noting that “FireEye only elongated the pain that their customers were feeling

18

these product issues.” CW1 stated that the internal estimates for fixing these issues (at the

19

of his departure in August 2014) were 1Q and 2Q of 2015 . CW1 observed “that was too long

20

a paying customer to suffer through.”

21

68. According to CW1, the main issue was with MIR, a solution whereby a ser

22

could have up to 10,000 endpoints monitored. If a customer had additional endpoints, such

23

20,000 endpoints, they needed two servers. CW1 stated that Mandiant did some infrastruct

24

changes on the backend of this product in November 2013. As a result of these changes,

25

had scalability issues and was unable to scale past 3,000-4,000 endpoints without

26

offline.

27

69. CW1 stated that FireEye continued to sell MIR to customers and had its

28

teams “babysit” the customers until they developed a fix for this product in the e


20 NO. 5:14- CV-05204-EJD


1

timeframe. According to CW1, after a customer bought MIR it took approximately one qua

2

to roll the product out. CW1 indicated that FireEye was trying to stall the customers w

3

workarounds as they deployed the product. Customers with 10,000 endpoints, for example, w

4

told that it was going to take some time and testing, and control procedure changes, before t

5

could expeditiously have all 10,000 endpoints running. CW1 noted that the idea was to “s

6

things down with the customers as best as you can until the fix comes out.” CW1 stated

7

FireEye continued to tell customers that MIR could fully scale when they knew the product

8

flawed and unable to. He added, “we kept telling the customers that one box could han

9

10,000 endpoints when, in reality, it couldn’t handle half of that.”

10

70. CW1 noted that FireEye received very irate customer feedback on MIR during

11

tenure with the Company. According to CW1, many of these customers wanted to return

12

product or drop the solution entirely. Certain customers that had their solutions managed

13

Mandiant through FireEye’s Managed Services, were (and still are) getting an older version

14

the software which is much more stable, but those customers buying the product that planned

15

managing the product themselves get the flawed, most recent version of MIR. CW1 stated th

16

many of those customers left for competitors such as CrowdStrike and AccessData.

17

71. CW1 stated that FireEye knew immediately about these issues after acquiri

18

Mandiant because the flawed version of MIR came out in November 2013 and the acquisiti

19

was in January 2014.

20

D. Defendants Update Market on “Smooth” and “Rapid” Mandiant Integration

21

22

72. On the February 11, 2014 4Q13 earnings call, DeWalt updated the market on th

23

Mandiant integration by saying: “From a personnel perspective, the two organizations are highl

24

complementary. We’re already working together in a number of projects before the acquisition

25

and, as a result, the integration is progressing rapidly and smoothly.”

26

73. Contrary to CW1’s observations regarding significant problems integrating MIR

27

with FireEye’s solution, DeWalt emphasized “Mandiant’s endpoint products, which were alread

28

integrated with the FireEye platform before the acquisition...and are now be [ sic] marketed a


21 NO. 5:14- CV-05204-EJD


1

the endpoint solution of the FireEye platform.” DeWalt then stated that “[t]he engineering

2

product management teams have been fully integrated and are already tightly connected and

3

at work at planning additional enhancements as well as entirely new offerings.”

4

74. DeWalt again highlighted “product synergies,” stating that “[t]o summarize

5

integration effort, we’re moving along quickly to bring the two organizations together. As

6

teams meet with one another, the synergies across every segment of the combined product

7

map become more and more evident.”

8

75. DeWalt acknowledged that “[d]eveloping a strong channel is also critical

9

reaching the scale necessary to execute on this vision” of the combined company, and praised

10

reaction of channel partners to the acquisition and integration:

11

I’m pleased to say that the customer and partner response to this vision has been overwhelmingly positive . In the past few weeks,

12

we’ve hosted a series of webcasts for customers, partners, and prospects. Participation had run in to the thousands on each, and

13

every time, the participants have been highly engaged.... Last week, we hosted Momentum, as I mentioned, our annual partner

14

event in conjunction with our internal sales kickoff, where we trained another 350 channel representatives, including 135 reps

15

from international distributors and resellers. In addition to the benefits of having partners train side-by-side with the FireEye

16

sales team, one of the highlights of Momentum was the partner showcase, featuring more than 20 technology alliance partners.

17 ***

18 I wish you all could’ve been at our Momentum event. It was

19

absolutely emotional and moving to see the mission that Mandiant had, the mission that FireEye had, teams coming together, the

20

teams working together, the eye of the tiger that we had, the partners feeling that, the training that they felt. It was all creating

21

an environment that you only wish you had as an executive, and we gathered that. There were a lot of good surprises, positive

22

things. The partners rallied for us, and we hope the best is yet to come.

23

24

76. DeWalt continued to highlight the importance of products for the

25

company, stating that “We have a series of new products rolling out, going into the first quarte

26

and the second order that we haven’t announced yet, that are really organic between the two. W

27

think we’ve got a really nice place now to add products to the sales and marketing engine we pu

28

in place.” To that end, DeWalt also stated that:


22 NO. 5:14- CV-05204-EJD


1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Our ability to scale of the Mandiant business is really a matter of selling products now. We’re going to continue to scale services people, but not at a faster pace than we are going to be selling products.

We talked about 15% to 17% would be service oriented in our model, moving forward on the last call. There’s no change to that . As we sell more and more product, it’s all about the automation of that service component.

E. Defendants Sell Millions in Stock Following FireEye’s Secondary Offering

77. On March 6, 2014 FireEye completed a secondary offering of its stock. T

Company raised approximately $1.1 billion and sold 14 million shares at $82.00 per share, m

than four times the IPO price.

78. Mere days after the follow-on offering, the Individual Defendants sold t

shares at $79.54, near all-time highs, and earned tens of millions of dollars in proceeds.

F. FireEye Misses Consensus Product Revenue in 1Q14

79. On May 6, 2014, FireEye announced 1Q14 results and disclosed that product

revenue only grew 62% y/y to $24.3 million, versus consensus of $30.2 million. According to a

May 7, 2014 Barclays analyst report, “management... noted that several large customers opted

for subscription vs. product deals which also impacted product growth this quarter.”

80. Similarly, a May 7, 2014 Deutsche Bank analyst report viewed the decrease in

product revenue growth as a “negative” but also noted that management was “sticking to their”

product/services mix guidance for 2014:

[P]roduct sales (which drive overall momentum) of $24.3m were light compared to our $26.0m estimate and at 33% of the overall mix were below the 40%-45% mix that FireEye guided to for 2014 . Mandiant product sales were <$1m, implying ~55% product sales


23 NO. 5:14- CV-05204-EJD


1

growth for standalone FireEye, down from 60%-80% growth throughout 2013 . FireEye said that 1Q14 deals simply skewed

2

more to subscription/services... and that they are sticking to their 40%-45% mix guidance for 2014.

3

4

81. Other analysts noted the decline in product revenue of 25% quarter over quarter.

5

A May 7, 2014 Cowen and Co. analyst report stated that “product revenue was

6

lighter than expected... [it] was disappointing and fell meaningfully short of the Street’s ~$3

7

I forecast.” A May 7, 2014 Morgan Stanley analyst report noted that “despite 60% growth in

8

customer base and >130% growth in sales capacity in Q1, product billings lagged, up

9

estimated ~42% YoY organically in Q1, a deceleration from 78% growth in Q4.” The Mor

10

Stanley report also noted, however, that management had highlighted continued strong prod

11

growth from the Mandiant integration despite the disappointing 1Q14 results:

12

[M]anagement noted several positive indicators for continued strong top-line growth, including the quick pace of integration of

13

the Mandiant business and significant new product both in the market today (mobile security, cloud-based email, threat

14

monitoring, high-end/low-end appliances) and coming in 2014 (4 new services, including the GA of its IPS solution.)

15

16

82. Notwithstanding the underperformance of product, DeWalt touted the

17

benefits of the combined company on the May 6, 2014 1Q14 earnings call:

18

In Q1 we had a record number of transactions, a record number of new customers. We also had a record number of deals that over $1

19

million, and a record number of partner-assisted transactions. Including the Mandiant business, we had a record number of

20

cross-sell opportunities, with 15 significant deals where we sold Mandiant and FireEye together. These included some of the largest

21

transactions in the quarter, and included a Fortune 500 insurance company, large high tech companies and large retailers.

22

23

83. A May 7, 2014 Wells Fargo analyst report stated that “New Product

24

Continues. As expected, FEYE saw many cross-sell transactions with Mandiant

25

including several multi-million deals.”

26

84. DeWalt also denied that competition was affecting FireEye’s product sales,

27

though analysts noted that FireEye faced increasing competition, with a May 5, 2014

28

Bank report stating that “FireEye now has a host of emerging rivals and at the recent RSA


24 NO. 5:14- CV-05204-EJD


1

it felt like every security IT vendor was selling an APT solution.” At the May 20, 2014

2

Morgan Global Tech Media Telecom Conference, DeWalt also referenced the RSA event:

3

Sterling Auty - JPMorgan - Analyst

4

The other thing that I wanted to touch upon, because it’s tough for the investors. So if we go prior to FireEye even going public, I

5

think when you were talking about advanced persistent threats and the type of model that you had, it was very unique. Suddenly, you

6

come public, and there’s lots of media attention, etc. Now I pick up and I go to a website, if I go to Fortinet, or if I go to Palo Alto, or if

7

I go to Sourcefire, if I go to a number of these – I see a lot of the same terminology. I see APT protection. I see Zero-day protection.

8

How is it for an investor, let alone a customer, easy to understand exactly are you still different or are these solutions good enough to

9

actually compete with what you have?

10

Dave DeWalt - FireEye, Inc. - CEO

11

You were at the event called RSA. Some of you probably know this. Thirteen hundred-plus security vendors there . I think every

12

one of them said they had an APT solution now .... So yes, the competition is starting to market in the direction of, I’ve got an

13

APT too....

14

85. On the 1Q14 call, DeWalt responded to an analyst’s question

15

competition by stating that “[t]he head-to-head battles with any competitor in the market

16

I resulted in near flawless execution and win rates. I would say 100%, but I’m sure there is

17

out there that we lost to some competitor, but our win rates are dramatic when competing head

18

head with a product bake-off,” and further stating that a competing product named

19

from Palo Alto Networks had had no impact on the Company’s business:

20

[O]ur renewal rates are spectacular, first of all.

21

Second of all, our win rate is spectacular; any conversions to a competitor that you just named, to my knowledge, is zero. I have

22

not seen a single transaction when somebody moves from FireEye to Wildfire . When I look at Wildfire, that product is highly

23

ineffective in the marketplace where these types of attacks, a million reasons I could go on and on about. But I have not seen

24

any of that, I don’t anticipate seeing any of that.

25

In fact, there [are] many accounts where we go into where Wildfire was already sold and we had FireEye behind it, and on top of that

26

our detection efficacy doesn’t change one bit, whether that product was in front of us or behind it. The way I look at this is that

27

technology is having almost zero influence on these advanced detection models that are out there, in my opinion. So I just don’t

28

see that technology as something that is there right now to changing our business model.


25 NO. 5:14- CV-05204-EJD


1

So a little – a little aggressive statement, but it is what it is. I don’t see them as a major factor for us right now .

2

3

86. DeWalt further asserted that “we generated explosive growth in

4

pipeline for the Company.... I alluded to a little bit some of the explosive pipeline growth we

5

having, and lead generation that’s occurring. The amount of proof of values that we have in

6

pipeline, and all that kind of capulates [ sic] on our optimism for the remainder of the year.”

7

87. DeWalt also responded to direct questions on the status of the

8

integration, but did not disclose any problems:

9

Melissa Gorham - Morgan Stanley - Analyst

10

Question for Dave on the integration of Mandiant, just wondering if you are now well integrated with Mandiant or if there is more

11

work to do from a go-to-market and distribution perspective, and just wondering if you have any anecdotal color on how the

12

integration is resonating with your customer base?

13

David DeWalt - FireEye Inc - Chairman, CEO

14

We made a lot of progress. If you recall from our acquisition announcement back in early January, the nice part about this

15

combination was we were quite familiar with each other beforehand.

16 We had the products integrated at least at some level, and the

17

endpoint platform and network platform that FireEye had, had ways of handshaking intelligence that we could do detection to

18

response. We are integrating that even further.

19

In fact, we’ve now integrated a whole work flow, a single pane of glass, so we can go from network events to remediation and

20

response on endpoints, to a common console. We are working on extended endpoint features that we’ll announce soon and there is

21

more development under way there, so we are off to a really good start from a products point of view.

22 ....Then we have a number of other new products coming out,

23

intelligence products. Product-wise, pretty far along, but always more integration to do and more work to do.

24

25

88. DeWalt also stated that the sales teams were “fully integrated” and did

26

disclose any issues with FireEye’s channel partners following the acquisition:

27

On the go-to-market side, almost from the first day we integrated the go-to-market model, meaning that the FireEye sales team

28

would sell every Mandiant product. And it is one of the reasons why we are not breaking out everything either, is because the go-


26 NO. 5:14- CV-05204-EJD


to-market model is fully integrated at this point; from the comp plans, to what they sell, to how they deliver it . We also trained and

2

certified all the partner channels and got them up to speed on a combined FireEye/Mandiant product, albeit halfway or three-

3

quarters of the way through the quarter, but we made progress with both the field and telesales models of FireEye, with the partner and

4

channel models of FireEye.

5

89. DeWalt detailed the importance of the channel partners to FireEye:

6

But the three areas I really focus myself on is first, recruiting partners and getting partners to sign with us and commit with us

7

and getting them on board .

8 ***

9

The second metric that is important is the amount of leads coming from that partner community, and I mentioned a little earlier we

10

had 50% of our business or more coming from partners now in closing. That we’re assisting them in the close. That’s a really nice

11

metric that’s expanding.

12

And really, the third metric is how many no-touch deals are we getting from the channel, as well, and I noted that was a record for

13

us in the number of no-touch deals we received. Of course, we’re a channel company entirely, meaning 90% plus of our business goes

14

through the channel, we don’t have direct models here.

15

So when you look at these metrics of how many you signed up, how many leads you have coming in that closed, and how many no

16

touches you have the trends and indications are in the right direction for us in terms of what we are doing.

17

18

90. DeWalt summed up his positive message by reiterating:

19

So, you know, my main message is this. We’ve performed very well this past quarter, I feel. We had one of our best quarters ever

20

on so many fronts. I mentioned them, the size of our expansion in products, in pipeline, marketing activities, competitive edges,

21

competitive win rates . It is the best, you know, we felt like we could do and deliver this quarter, so that felt good. We raised

22

guidance, the outlook looks positive for the Company. The competitive landscape looks good .

23

24

91. On the news that product revenue was significantly below market

25

however, FireEye’s stock price declined 22.84%.

26

27

28


27 NO. 5:14- CV-05204-EJD


1 G.

2

3

In Reality, Integration Problems, Channel Friction, And Competition Adversely Impact Product Sales

1. Integration Problems Cause Delays in Sales Cycles

4

92. CW2 was a former Regional Sales Manager at FireEye from September 2011

5

through September 12, 2014. CW2 sold all of FireEye’s products (Malware Protection Platfor

6

as well as Mandiant’s services (after the acquisition) to customers in the southeast regio

7

including Florida, Georgia and Bermuda. During part of his tenure at the Company, CW

8

reported to Bill Kurpiel, the Senior Director of Sales, who reported to Jeff Williams, Senior Vi

9

President of Sales, Americas. who in turn reported to DeWalt. CW2 later reported to Jo

10

McGee, VP of North America, 3 when his job transitioned.

11

93. According to CW2, the Mandiant acquisition added 500 employees to the

12

force. CW2 stated that the drastic increase in inexperienced personnel had a detrimental a

13

disruptive effect on many of FireEye’s processes including training, sales processes a

14

ultimately revenue generation. CW2 further stated that the Mandiant acquisition created “a lot

15

confusion” that slowed down FireEye’s sales. CW2 recalled that when fiscal 2014 started, the

16

was mass confusion, caused in part by a complete lack of integration between Mandiant’s a

17

FireEye’s respective systems in 1Q14.

18

94. CW2 recalled mass confusion at the sales level, specifically. He explained

19

FireEye kept “rebranding” products and the sales personnel did not even know the name of th

20

product from one day to the next. According to CW2, the Mandiant acquisition created a lot o

21

difficulty and havoc for the FireEye personnel that were in the field trying to make sales. H

22

explained that the addition of so many new sales people as a result of the acquisition create

23

chaos in the marketplace. For example, in 2014, CW2’s region, which he had handled for ove

24

two years, was divided between six people, so CW2 lost a lot of his own pipeline to others

25

CW2 stated that the new people did not have the institutional knowledge that he had, and in an

26

event, no-one knew how to integrate the new Mandiant services into sales.

27 3 CW2 explained that Williams had been in charge of Global Sales until the Compan 28

brought in McGee in August 2014. Williams then reported to McGee.

OLIDATED AMENDED CLASS ACTION COMPLAINT 28 NO. 5:14- CV-05204-EJD


1

95. CW2 further stated that because Mandiant’s systems were not integrated into

2

FireEye’s, people did not know who was supposed to sell what, where, resulting in a “total los

3

of brain power” when they could no longer rely on the field to assist the new people because

4

“even the field doesn’t know what’s going on anymore.” CW2 explained that “just the shee

5

fact of adding people delayed” sales dramatically. He explained that the new personnel did no

6

know the technology or the nuances of FireEye’s products so the “ramp” took a very long time

7

Conversely, sales personnel could not even quote Mandiant services for months.

8

96. CW2 further stated that although the acquisition might have looked good “on

9

paper,” in reality “the execution was atrocious.” CW2 recalled that prior to the acquisition, he

10

could get equipment orders out within a week, but once Mandiant was involved the sales cycle

11

increased to a month or more. According to CW2, the increase in sales cycle occurred because

12

after the acquisition, “you don’t get one [FireEye] without the other [Mandiant],” causing majo

13

delays in the sales cycle. CW2 recalled attending meetings where, given all the problems tha

14

they were having, ways to improve the sales process were frequently discussed.

15

97. According to CW2, immediately after the acquisition he (and all the sales force

16

were encouraged by management to sell services over product, and were instructed

17

management to focus on getting retainer agreements in place – even though FireEye did n

18

charge for being placed on retainer – so that if a customer suffered a security breach, FireE

19

would have direct and rapid access to its systems.

20

98. According to CW2, the directive to promote service and/or zero dollar retai

21

took a tremendous amount of time away from selling products. CW2 recalled that in 2Q14, ther

22

was a sales promotion (“SPIFF”) to do “eval-less” (no testing) deals by selling services. CW

23

explained that he and the others in the field were incentivized to sell services by giving them

24

more money to promote them, even though prior to that time, CW2 had “zero, maybe one” dea

25

without a customer testing the product in the over two year time period that he was at th

26

Company. According to CW2, many of the newer sales representatives focused on the service

27

because they were incentivized by the SPIFF, and by doing so they slowed down the sales o

28

products.


29 NO. 5:14- CV-05204-EJD


1

99. According to CW2, FireEye and Mandiant were “two different worlds.” He

2

explained that when the sales team would approach a customer, there would be two different

3

people/departments within the organization that would be making the decision depending if it

4

was a product or service issue. CW2 stated that the addition of Mandiant did not open any sales

5

opportunities in his region. He noted that even though the field sales team received a directive to

6

push Mandiant and its services, customers did not want to “talk” about Mandiant and its services

7

100. CW2 stated that the integration was a nightmare, particularly given the cultur

8

clash between the two companies. He described Mandiant as a “federal company” based out o

9

Washington DC where people wore suits and ties, whereas FireEye was traditionally “ver

10

loose,” they would ship things out fast and get the deal done whereas Mandiant was “ver

11

regimented and process oriented.” CW2 recalled efforts internally to rectify the problems.

12

101. According to CW2, FireEye used Salesforce to track sales. CW2 recalled tha

13

sales personnel were definitely reporting the problems in the field to Williams as well as CW2’

14

direct manager, Jim Brannigan.

15

102. CW3 was a former Senior Director of Infrastructure and was employed at th

16

Company from March 2010 to August 2014, beginning his tenure as a consultant at FireEye an

17

then transitioning to be the Director of IT, then the Senior Director of Infrastructure at th

18

Company. He reported directly to the Chief Information Officer, who in turn reported to DeWalt

19

CW3 was responsible for various IT functions at FireEye including the corporate infrastructure

20

customer base and, at one point, the cloud.

21

103. CW3 stated that the Mandiant integration was difficult and the

22

expectations unattainable. CW3 noted that the Company decided to do a mass lay-off in Au

23

2014 – the same time McGee was brought in as head of sales – because the Mandiant integr

24

was not going well. According to CW3, “it took forever to do anything” which imp

25

“business as a whole.” CW3 stated that ultimately FireEye lost a “percentage” of bus

26

because of the execution problems, and characterized the integrations as a “near nightmare.”

27

104. CW3 further stated that another problem with the integration was on the

28

level, as the sales personnel at FireEye were expected to sell “this massive list of stuff” fo


30 NO. 5:14- CV-05204-EJD


1

the acquisition and no one knew how to do it. CW3 stated that at the field level there was a

2

“inability” for the sales people “get their arms around” what they needed to sell.

3

105. CW1 also observed the many integration issues, including the issues integratin

4

the most recent MIR product with FireEye’s platform, see supra §V.C.

5

106. CW4 was a former Director of Strategic Solutions at Mandiant and then th

6

combined Company from November 2013 to May 2014, and Chief Cyber Solutions Strategis

7

from May 2014 to September 2014. According to CW4, there were “so many” problems relate

8

to the acquisition and integration of Mandiant. CW4 stated that a “huge amount of issues

9

stemmed from the different grades of quality of personnel from each Company, along wit

10

multiple people from each of the companies serving in duplicate roles.

11

107. CW4 explained that the integration went so poorly because of a completel

12

different caliber of people, product and customer (business) development, and that it wa

13

immediately apparent following the acquisition that the two different cultures did not mesh wit

14

one another. CW4 stated he was amazed at how quickly it became clear that was no synerg

15

between the two companies.

16

108. According to CW4, everything that happens at FireEye is led by DeWalt, w

17

was viewed as a “god.” CW4 noted that at all FireEye offices (including Europe) there had to

18

a picture of DeWalt hanging on the wall. According to CW4, “there is one boss, o

19

controller.”

20

109. CW4 recalled attending many meetings where revenue and projections of

21

business units, Mandiant and FireEye, were discussed. CW4 recalled discussions as early

22

within the first week or two of the acquisition that the FireEye side of the business was suffering

23

CW4 attended meetings in Washington, D.C. where they would look at the projections and

24

consensus was “this is just crazy.” According to CW4, one thing that really upset him and h

25

Mandiant colleagues was that FireEye operated with two different sets of sales and projection

26

numbers. CW4 stated that there were figures within Salesforce, and another set of figures on

27

completely separate spreadsheet that were generated by a separate system. According to CW

28

he and others were being held accountable for the numbers on the spreadsheet rather than thos


31 NO. 5:14- CV-05204-EJD


1

that they could access through Salesforce. CW4 described the spreadsheets as an

2

reporting mechanism” that were sent to DeWalt and other senior executives, and that the

3

spreadsheets were “not a reflection of reality.”

4

110. CW5 was a former Senior Manager of ISS from August 2013 to January 2015

5

CW5 described himself as a Manager of FireEye’s back-office business. He reported to Alden

6

Huen, Senior Manager of Business Systems.

7

111. According to CW5, the Company’s business analytics team used Salesforce

8

CW5 worked on integrating FireEye’s Salesforce system with Mandiant’s. CW5 stated that Jim

9

Crum, Business System Manager, Salesforce, was in charge of Salesforce at FireEye, and was

10

CW5’s counterpart when the Company introduced new products.

11

112. CW5 stated that from a systems perspective, the Mandiant integration was

12

difficult. He explained that even by the time he left the Company in January 2015, Mandiant stil

13

had not brought over some of their systems because they were continuing to rely on a financia

14

system named NetSuite. CW5 further stated that Mandiant also used a program called OpenAir

15

a product management software that manages services and feeds into Salesforce. CW5 stated

16

that FireEye did not use OpenAir prior to the acquisition.

17

2. Integrating Sale of Mandiant Services Causes Channel Friction

18

113. CW2 also described problems with channel partners as a result of the acquisition

19

He explained that historically, FireEye sold its products through the channel partners including

20

Northrop Grumman, Lockheed Martin, FishNet Security, and Oculent, etc. The channel would

21

represent, i.e. , purchase products for, FireEye’s customers. According to CW2, the channe

22

provided services to those customers along with other products. CW2 stated that when FireEye

23

acquired Mandiant, however, FireEye began competing directly with the channel’s primary

24

source of revenue, namely, services. He explained that FireEye sold services at a lower margin

25

ruining the relationships that FireEye had with its channel partners. CW2 further stated that once

26

Mandiant was brought in, the channel customers “did not trust” FireEye because of the services

27

component. CW2 recalled that it became “very apparent immediately” that the loss of channe

28

business was a “very big deal.”


32 NO. 5:14- CV-05204-EJD


1

3. Increasing Competition Reduces The Pipeline

2

114. CW1 witnessed the Company’s pipeline getting “extremely small” as custom

3

experiencing issues with the most recent version of the MIR product, see §V.C. supra, left

4

competitors, and decided to resign from the Company in August 2014.

5

115. CW5 observed that FireEye encountered a lot of competition in the marketpla

6

when it came to its legacy products. According to CW5, the Mandiant customers were reluct

7

to give up the end-point detection product (MIR) that Mandiant had previously provided th

8

customers. It was CW5’s understanding that the customers were reluctant to replace with

9

upgrade to FireEye’s new integrated product because it was significantly more expensive

10

According to CW5, his team wanted to integrate Mandiant’s systems with FireEye’s but could

11

not because the old Mandiant product required that Mandiant maintain their NetSuite software

12

CW5 noted that anything that required NetSuite also required FireEye to keep the legacy

13

Mandiant Salesforce running and their business applications “alive,” making it apparent which

14

customers had refused to purchase or upgrade to the integrated FireEye product.

15

116. According to CW5, the Company had good visibility into every sale. CW5 stated

16

that when a sales opportunity was logged into their systems, it included a percentage o

17

probability of closing. CW5 stated that the Company had reports through their Oracle Busines

18

Intelligence software (“OBIEE”) that broke down each product sale in real-time, or at leas

19

nightly by warehouse. According to CW5, the Cloud Services and the Mobile Email Prevention

20

products did not sell well and “did nothing,” and it was very clear in 1Q14 that they would not be

21

successful.

22

117. CW6 was a former Senior Revenue Manager at FireEye in the United Kingdo

23

from May 2014 to August 2014. He interfaced the U.S.-based revenue. CW6 stated that

24

quarter-end, the executives and personnel like him were all in a “war room” on the last days o

25

the quarter calling sales personnel to see if specific deals would close by quarter-end. CW6

26

further stated that DeWalt, Sheridan, and Mandia were “definitely hands-on.” CW6 stated tha

27

in 2Q14, the executives were on the phone and knew the likelihood of specific deals closing

28

quarter-end.


33 NO. 5:14- CV-05204-EJD


1

118. CW6 confirmed that FireEye used Salesforce to track deals, and that

2

updated everyone at FireEye “constantly.” CW6 stated that within Salesforce, one could tell the

3

likelihood of each deal closing by quarter end, and “what deals were where.” According to

4

CW6, as with most software companies, most deals at FireEye closed in the last week or day o

5

the quarter. He explained that because of this, it was important to track which deals where a

6

certain points, with anyone with experience in the industry exactly what is happening with thei

7

deals. According to CW6, there are accordingly very few surprises at quarter end.

8

119. CW7 was a former Senior Director of Sales from May 2014 to April 2015.

9

was part of the sales teams and confirmed that the Company actively used Salesforce to tra

10

each deal. CW7 participated in weekly calls with various regions to discuss sales. According

11

CW7, the weekly calls were led by the area vice presidents, and there were also quarte

12

meetings with the entire sales force.

13

H. FireEye Announces A Change in Revenue Recognition For Its Email Product And Appoints a New Head of Sales

14

15

120. On August 5, 2014, FireEye announced 2Q14 results and issued a separate

16

release announcing that John McGee, formerly Executive Vice President, Worldwide

17

Operations for Informatica, had joined FireEye as the Company’s Senior Vice

18

Worldwide Sales. The press release noted that the former head of sales, Jeff Williams,

19

to Senior Vice President, Americas Sales, reporting to McGee.

20

121. On the earnings call the same day, DeWalt touted the combined Company’s

21

product engine” and the “conversion rate” to product sales from customers using

22

services:

23

Finally, through the efforts of our engineering, threat research, and infinite response teams at the combined Company, we accelerated

24

our new product engine , and transformed FireEye from a Company with just two network-based products a year ago to one with 20-

25

plus products today, integrated across the Endpoint network and the cloud, all wrapped with a suite of services, including our

26

Managed Defense offering, which is now deployed worldwide.

27 ***

28

Finally, Mandiant’s respected Infinite Response practice has expanded to our go-to-market strategies with services-led sales


34 NO. 5:14- CV-05204-EJD


1

models. When we lead with Infinite Response services, the conversion rate for product sales or Managed Defense is very

2

high.

3

122. DeWalt further stated that “[w]e also increased the number and the value of

4

that included multiple products , including cross-sell of FireEye and Mandiant products....

5

successful as we have been with the largest of the G2K, or the Global 2,000, there’s still ple

6

of opportunity in this market segment, in terms of both new logos, and the opportunity to cr

7

sell and up-sell to the existing customers we have.”

8

123. DeWalt noted the importance of product sales to the Company’s growth

9

purported competitive edge in announcing the new head of sales:

10

As the Company moves into this critical next phase of our growth , I’m also very excited to announce that Jeff Williams, our current

11

head of sales, will be staying on as our new Senior Vice President of Americas, reporting to John. In this capacity, Jeff will continue

12

to be a vital part of our global Executive Management Team, and help drive the Company to the next level.

13 On the product front, we’ve continued to invest in both platform

14

expansion and enhancements to our existing products, as well as threat-detection technology and threat intelligence. I believe that

15

maintaining this balance between enhancements to existing products, and the introduction of new products, all supported by

16

the industry’s most comprehensive threat intelligence, is the key to maintaining our multi-year technology lead in supporting our

17

growth.

18

124. DeWalt denied that appointing a new head of sales implied a

19

reorganization or any problems in the sales force:

20

Rick Sherlund - Nomura Asset Management – Analyst

21

[O]n John McGee, are you planning on any changes, restructuring and so forth of the sales organization? We’ve found historically

22

that can be kind of disruptive. If you can address what your plans might be there?

23 Dave DeWalt - FireEye Inc - Chairman, CEO

24 [T]he answer to your question is no, we’re not do anything

25

restructuring in sales operations. We’re tuning it a little bit.... But for the most part, sales is doing great. We’re scaling

26

internationally. We have multi-vectors of sales we’re doing, both inside sales, partner sales, service-led sales, and product sales. For

27

the most part we feel pretty good about what we’re doing. We’re just trying to bring in some new leadership to help get us to the

28

next level, and quite frankly, just augment what we’ve got. No major change there.


35 NO. 5:14- CV-05204-EJD


125. Sheridan similarly did refer to an official restructuring of the sales force,

2

only to “cost savings” from personnel “consolidations”:

3

We’ve had sufficient time as combined operations to identify opportunities for cost synergies, and we have initiated a process in

4

the third quarter to optimize our spending.

5

We expect to achieve these cost savings in Q3 and Q4 of this year, and we expect that they will relate primarily to personnel

6

resources and facilities consolidations. We expect to incur one- time charges in the next two quarters related to these efforts, and

7

these charges will primarily be comprised of severance cost and excess lease commitments.

8 126. In response to a question on whether the integration had shortened the sales

9 DeWalt claimed that it had:

10 Rick Sherlund - Nomura Asset Management – Analyst

11 [O]n the sales cycle, any comments in terms of with Mandiant, has

12

it – and the branding benefit you get from that and the publicity around Target and some of the others? Have you seen any material

13

shortening of the sales cycle?

14

Dave DeWalt - FireEye Inc - Chairman, CEO

15

One of the things that Mike alluded to in his script was improving our cross-sell between FireEye’s base and Mandiant’s base, and

16

Mandiant’s stuff back to FireEye.... We like what we’re seeing. They are shortening the sales cycle , especially where the Infinite

17

Responding-led model starts.

18

127. Similarly, in response to another question regarding sales cycles, DeWalt failed

19

disclose that the Company seen an elongation in sales cycles, and denied that competition

20

having an effect on business:

21

Rob Owens - Pacific Crest Securities – Analyst

22

[D]ave, as you look at the market place, you mentioned you’re doing a better job of cross-selling. Talk about new customer

23

acquisition, because it seems like there’s a lot of noise out there from competition. Are you seeing any elongation in sale cycles , or

24

just how that’s playing out?

25


26

I think that’s the heart of what we watch and monitor here .... We certainly did a lot better in Q2 than we did in Q1 when it came to

27

cross-selling of FireEye-Mandiant technology, and even selling multiple products, as Mike mentioned, into FireEye cases in the

28

FireEye customers. Then it’s just the upsell is the last one – selling more product to the same customer. All those keep moving


36 NO. 5:14- CV-05204-EJD


1

positively. The competition really hasn’t had any impact that’s of notice . Quite frankly, our win rates are extraordinarily high across

2

the board.... whenever we’ve competed directly, we have a very high win rate – near 100% win rates.

3

4

128. When yet another analyst asked about competition, DeWalt again denied

5

there was any adverse effect:

6

Daniel Ives - FBR Capital Markets – Analyst

7

[I]’m curious in terms of, not just sales cycles, but competition- wise, are you starting to see any changes out there, as more of

8

your competitors are going after the same space – almost copycat solutions? Are you seeing any changes out there in the field?


10 I would tell you similar to I think what Rob was asking-- Rob

11

Owens was asking, we haven’t . Sales cycles have been very consistent . The average sales price discounts have been consistent.

12

We certainly see the news much like you do about competitors kind of copying FireEye’s model here, and talking about

13

sandboxes or virtual machines or some sort of improved detection. But the proof is when we compete head-on, and we feel we have a

14

substantial gap.

15

129. On the same earnings call, Sheridan disclosed a policy change in recognizi

16

revenue for FireEye’s email product, from having revenue recognized ratably to having

17

for the email product recognized at the time of shipment:

18

[N]ear the end of the second quarter we made changes to our e- mail product that will allow us to recognize revenue for this

19

product in period rather than a ratable basis. For all e-mail shipments prior to this change, those billings will continue to be

20

amortized ratably over the life of the initial contract.

21

130. Sheridan then claimed that “[b]ecause this change was implemented late in

22

second quarter, it did not have a significant impact on our Q2 reported results.”

23

131. An August 6, 2014 JP Morgan analyst report however, observed that the

24

in revenue recognition was “a major contributor to the increase in revenue guidance for FYi

25

along with the upside in 2Q14 billings ,” and noted that the “[r]evenue recognition change

26

likely spur a lot of noise/discussion” as “[w]e could see the market questioning the move.”

27

28


37 NO. 5:14- CV-05204-EJD


1

132. The disclosure that product sales were – and would continue to be –

2

boosted by the revenue recognition change, and that a new head of sales had been hired

3

displaced the former head of sales, caused shares to fall a further 11.42%.

4

I. FireEye Introduces FireEye-as-a-Service, A New Subscription Service

5

133

In a September 17, 2014 press release, FireEye introduced FireEye-as-a-

6

as new subscription service for customers:

7

The new FireEye as a ServiceTM offering is an on-demand security management offering that allows organizations to apply FireEye’s

8

technology, intelligence and expertise to find and stop cyber attacks. The second new offering announced today, FireEye®

9

Advanced Threat IntelligenceTM, provides access to threat data and analytical tools that help identify attacks and provide context about

10

the tactics and motives of specific threat actors.

11 ***

12

With FireEye as a Service, organizations can choose to manage their own security operations, offload security operations to

13

FireEye, or co-manage operations with FireEye or a FireEye partner. When organizations choose FireEye as a Service, they tap

14

into FireEye’s team of expert threat analysts located in security operations centers around the world to hunt for attackers in their

15

organization by applying FireEye’s unique combination of technology, intelligence and expertise.... [FireEye-as-a-Service is]

16

available as a subscription to customers that have purchased FireEye products.

17

18

134. At a September 18, 2014 call to discuss the new offering, DeWalt stated that:

19

So, some of the announcements we’re making today are really significant, in my opinion. The culmination of FireEye and

20

Mandiant now eight months, nine months into the acquisition and merger between the two firms, and I can’t be more pleased, quite

21

honestly. Everything that we had told you at the beginning of this acquisition is coming true and more. We’re finding ourselves with

22

a tremendous amount of synergy, not just in the people and the expertise that Mandiant has brought, but also the intelligence and

23

the products.

24

135

Less than two months later, however, FireEye stunned the market when

25

reported 3Q14 results. Specifically, on November 4, 2011, Defendants acknowledged

26

pronounced and unexpected shift in revenue from product to services, announcing revenues

27

the low end of their previous guidance and lower than analysts’ consensus expectation

28

Defendants attributed the shift to “outperformance” of FireEye-as-a-Service. In response


38 NO. 5:14- CV-05204-EJD


1

Citigroup analyst cut his price target, stating that analyst consensus revenue estimates would

2

decline given the reduction in product revenue, and that FireEye’s growth would be difficult to

3

estimate given the changes in its revenue recognition practices and its introduction o

4

subscription models like FireEye-as-a-Service.

5

136. A November 5, 2014 Cowen analyst report titled “Downgrade: Growth Should

6

Better than This; Moving to Market Perform” blamed competition, noting that “channel tension

7

re: Mandiant has increased. We are also more incrementally concerned that the co.’s high

8

pricing, combined with the presence of several ‘good enough’ alternatives (PANW, CHKP

9

Lastline, et al.), could be curbing the co.’s growth potential.”

10

137. A November 5, 2014 William Blair analyst report focused on the deceleration

11

product revenue, stating that:

12

We believe some investors will view the light revenue results with skepticism, given the slower-than-anticipated growth of product

13

revenue . We expect the stock to open materially lower reflecting the disappointment and increasing fears over competition and

14

sustainability of the business model . We view the results as acceptable, but are concerned that product billings were not

15

stronger given the investments the company has made in expanding its salesforce , which we believe should be translating

16

into stronger results.

17

138. A November 5, 2014 Stephens analyst report noted that FireEye-as-a-Service

18

been “introduced just two weeks before the end of the quarter” and that “FireEye’s host of

19

products...seem to have not yet made a meaningful impact on the business.”

20

139. A November 5, 2014 Deutsche Bank report questioned whether the shift

21

revenue to subscription revenue was the sole cause of the disappointing results, and implied

22

competition was a factor:

23

On a sequential basis, 3Q14 product revenue growth and the mid- point of the 4Q14 revenue and billings guidance imply growth

24

rates below that of 2013 ( despite a favorable revenue recognition change on FEYE’s email appliance).... FEYE missed product

25

revenue expectations in 1Q14, billings expectations in 2Q14 (blaming shorter invoicing durations) and now product revenue

26

and guidance expectations on the 3Q14 call. FEYE also recently replaced its head of sales. We worry that something other than a

27

standard ‛ subscription mix shift is at work (are customers pushing- back on FEYE’s appliance model or price points?). We are

28

unwilling to make a cautious extrapolation to PANW


39 NO. 5:14- CV-05204-EJD


1

2

3 VI.

4

5

(USD106.71), CTiKP (USD72.84) and other security vendors, which are posting very strong results .

DEFENDANTS’ MATERIALLY FALSE AND MISLEADING STATEMENTS AND OMISSIONS

A. Class Period Financials

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

140. Defendants’ failure to disclose the Mandiant integration issues and their imp

on the Company’s business during the Class Period, including (1) problems with the updat

version Mandiant’s core MIR solution at the time of the acquisition leading to integration issu

with FireEye’s platform, causing customers to leave for competitors and a shrinking pipeline ( s

¶¶66-71, 114); (2) a significant slowdown in sales resulting from mass confusion and chaos

the sales level as the consolidated field personnel struggled with selling unfamiliar products a

were forced to share sales territories from the sheer increase in their numbers as a result of t

merger (see ¶¶92-100, 102-104); (3) lengthening of sales cycles as a result of problems in

field (see ¶¶93, 95-98, 103-104, 112); (4) pushback from customers that did not want to

pitched on cross-sales of services ( see ¶¶99, 115); (5) friction with FireEye’s channel partn

caused by Mandiant’s service offerings ( see ¶113); (6) increasing competition in the marketpl

for legacy FireEye products ( see ¶¶115, 116); and (7) legacy Mandiant customers that did

want to upgrade to the combined company solution because it was significantly more expens

(see ¶115), rendered the Company’s Class Period figures for product revenue and product

product subscription revenue (which incorporated misleading product revenue) false

misleading, because product revenue was negatively impacted by the undisclosed integration

competition issues. Those misleading figures are set forth in the following table:

4Q13 FY13 1Q14 2Q14

Product Revenue $32.3 M $88.3 M $24.3 M $37.7 M 8-K 2/11/14 8-K 2/11/14 8-K 5/6/14 8-K 8/5/14

Product and $46.7M $131.3 M $47.1 M $65.7 M Product Subscrip- Transcript Transcript Transcript Transcript tion Revenue (Sheridan) 2/11/14 (Sheridan) 2/11/14 (Sheridan) 5/6/14 (Sheridan) 8/5/14



1

141. The 1Q14 and 2Q14 Forms 10-Q and the March 3, 2014 Form 10-K

2

certifications signed by DeWalt and Sheridan, required under the Sarbanes-Oxley Act of

3

(“SOX”), representing that the “report does not contain any untrue statement of a material fact

4

omit to state a material fact necessary to make the statements made, in light of the

5

under which such statements were made, not misleading with respect to the period covered

6

this report.”

7

B. January 2, 2014 8-K Attaching Press Release Announcing Mandiant Acquisition

8

9

142. On January 2, 2014 the Company filed a Form 8-K attaching a press

10

I announcing the Mandiant acquisition. The press release contained the following false

11

misleading statements regarding Mandiant’s end-point products and their integration with

12

FireEye platform:

13

Endpoint Threat Detection, Response, and Remediation Products

14 Mandiant pioneered and continues to lead the industry for

15

endpoint-based advanced threat detection and response. Mandiant’s endpoint products, which are already integrated with

16

the FireEye platform , enable security teams to make faster, more accurate decisions about potential security incidents while

17

eliminating blind spots by connecting the dots with the FireEye network-based threat detection and prevention platform.

18 ***

19 Mandiant has been a strategic alliance partner of FireEye since

20

April 2012. The combination of the two companies is a natural extension of this partnership and their integrated product offering,

21

which both companies announced in February 2013.

22

143. These statements regarding Mandiant’s products and their integration with

23

FireEye platform were false and misleading because of Defendants’ failure to disclose pro

24

I with the updated version Mandiant’s core MIR solution at the time of the acquisition, leading

25

integration issues with FireEye’s platform and a shrinking pipeline as dissatisfied customers

26

for competitors. See ¶¶66-71, 114.

27

28


41 NO. 5:14- CV-05204-EJD


1 C. January 2, 2014 Call Announcing Mandiant Acquisition

2 144. On the January 2, 2014 call announcing the Mandiant acquisition, DeWalt

3

the following false and misleading statements regarding (1) Mandiant’s end-point products

4

their integration with the FireEye platform; and (2) the synergies of the acquisition:

5

We recognize Mandiant’s leadership and innovative approach in incident response and remediation and began collaborating nearly

6

two years ago. We formalized our partnership almost a year ago with the announced integration of the Mandiant Infinite Response

7

platform or MIR with our FireEye web and email MPS solutions.

8

Many customers have now deployed this integrated solution, proving the synergy potential between the companies . In fact, some

9

of the most important Fortune 500 companies now run this combined offering in production. I believe this acquisition

10

perfectly aligns to our strategy which we outlined on our IPO roadshow.

11 In addition to the full lifecycle remediation capabilities, we see

12

many synergies between the companies. First of all, FireEye can now leverage the MIR endpoint management framework to port

13

our virtual machine-based technology to the endpoint , expanding our TAM – our total addressable market -- and creating an end-to-

14

end solution capable of protecting any company at any part of the architecture.

15

16

145. The statements regarding the “integrated” FireEye and Mandiant

17

“proving the synergy potential between the companies” were false and misleading because at the

18

time of the acquisition, the latest update to Mandiant’s MIR solution led to significant integration

19

problems with FireEye’s platform. In particular, where customers were told the solution could

20

handle up to 10,000 endpoints, in reality the solution could only scale up to half that. Thi

21

caused customer dissatisfaction and drove customers to competitors such as CrowdStrike and

22

AccessData. See ¶¶67-70. Similarly, the statement regarding FireEye’s ability to use the MIR

23

framework to expand its platform and generate more “TAM” is false and misleading because o

24

DeWalt’s failure to disclose the significant integration problems with the latest version of MIR

25

Id.

26

146. On the same call, DeWalt made the following false and misleading

27

regarding MIR and product sales:

28



Keith Weiss - Morgan Stanley – Analyst

2

[W]hat do you guys acquire today in terms of product, sort of the existing integration with Mandiant that you have today, that is

3

going to go into your sales guys’ tool bag on day one?

4


5

But this is the most exciting part, I think, of the combination, although the services side is a huge opportunity globally as well.

6

But when you look at the products, this really completes FireEye . When we think about the vision we had set out to do earlier this

7

year, we wanted to put virtual machines at every important architecture point in the customer enterprise. So initially we have

8

products that we can put into the FireEye sales teams .

9

What we call the Mandiant Infinite Response platform, this is an endpoint solution that can sit on up to hundreds of thousands of

10

host agents. Some of them are running in the biggest Fortune 500 companies in the world.

11 And what we can do is, again, take detection out of the network,

12

pass it immediately to the endpoint, and remediate it in seconds. So we have a really strong endpoint management platform.

13 There is sort of a heavier version of that that is called MIR and a

14

lighter version of that called MSO, which is the Mandiant Security Operations, MSO. That comes in an appliance form factor, can

15

drop right into the FireEye sales and install base as well as cross- sell into the Mandiant base. So those two big products sitting on

16

the endpoint are really prime-time products to sell.

17 ***

18

So the product synergies here are very strong. There’s other products I will just say are in the pipeline as well that we are not

19

announcing today, but we really feel good about some of the product direction.

20

21

147. These statements regarding the MIR products “drop[ping] right into the FireE

22

sales and install base” and being “prime-time products to sell,” as well as the statement that t

23

“product synergies here are very strong,” were false and misleading because DeWalt failed

24

disclose that the latest update to Mandiant’s MIR solution led to significant integration proble

25

with FireEye’s platform. See ¶¶67-71.

26

148. On the same call, Sheridan made the following false and misleading

27

regarding the product/services revenue mix at the combined company:

28


43 NO. 5:14- CV-05204-EJD


Keith Weiss - Morgan Stanley - Analyst

2

[I]n terms of the long-term model, long-term targets that you have put out there, particularly for the operating margin line, does this

3

change the target margin profile for FireEye in any appreciable way, given the services content at Mandiant? And does it change

4

the time frame for getting to that target margin profile?

5


6

In terms of the long-term target model and our targets for operating margin and EBITDA margins and so forth, it is not going to

7

change it significantly, because if you look at the two businesses they are actually very similar. There is a bigger service component;

8

but as I mentioned in my comments, on a combined basis services are only going to make up 15% to 17% of our current makeup of

9

revenues .

10

So the product and the recurring subscriptions will continue to be major growth drivers for both.

11 ***

12 Raimo Lenschow - Barclays Capital - Analyst

13 And then a question for Mike as well. Like, how do we have to

14

think about from a long-term model? You guided for a 15% to 17% in services next year. How do you think about that?....

15 Michael Sheridan - FireEye, Inc. - SVP, CFO

16 Raimo, yes, we talked about the 15% to 17% for 2014; and without

17

talking about specific percentages outside of that time frame, I would tell you that the products and the recurring subscriptions of

18

course will grow faster as a business than the services .... But if we execute on the strategy we are articulating, you will continue to see

19

that product and product subscription and recurring revenue growth outpace the service part of the business, which would

20

therefore imply that services as a percentage should move to a smaller percentage than that over time.

21 ***

22 Gregg Moskowitz - Cowen and Company - Analyst

23 Then just for Kevin or Mike, I know that in total Mandiant had

24

been growing over 50% and you expect product to grow faster than the overall business going forward. Just wondering if in 2013, if

25

there were significant differences in the growth rates by segment across recurring subscriptions, products, and incident response.

26 Michael Sheridan - FireEye, Inc. - SVP, CFO

27 So we haven’t broken out those numbers; but as I mentioned

28

before, generally speaking what you would expect in 2013 is what


44 NO. 5:14- CV-05204-EJD


1

I discussed for 2014, which is that the product and recurring subscription part of the business has grown faster.

2

3

149. These statements regarding product revenue continuing to be a “major

4

I driver” and that product would grow faster than services were misleading because

5

failed to disclose that integration issues were causing significant confusion and chaos in the s

6

force and lengthening sales cycles ( see ¶¶92-100, 102-104, 112); and integration issues with

7

latest version of Mandiant’s MIR product were causing customers to leave for competitors.

8

¶¶67-71, 114.

9

150. On the same call, DeWalt made the following misleading statements

10

I product revenue:

11

Brent Thill - UBS – Analyst

12

Dave, do you think over time this looks like a traditional software company, or is it always going to have a heavier consulting

13

services mix to the business?

14


15

Yes, Brent, that’s a good question. Happy new year to you as well. I think it looks more like a product company than anything else ,

16

clearly.

17

I mean, Mike Sheridan articulated this is 82% to 85% product and product subscriptions. We have 15% to 17%-ish coming from

18

services in the model that he outlined.

19

That is pretty traditional software, big software kinds of companies, if you are thinking of the Oracles and SAPs of the

20

world. So we don’t think we are out of bounds with that.

21 ***

22

On the Mandiant side it is becoming more and more product as well . This is a business that started out 100/zero services/product

23

and now is more than 50% product/services. So it is evolving in that direction as well, I think almost the same path that FireEye is

24

on.

25

151. These statements regarding product revenue being the major component for

26

company were misleading because DeWalt failed to disclose that integration issues – i

27

separate financial systems – were causing significant confusion and chaos in the sales force

28

lengthening sales cycles (see ¶¶92-100, 102-104, 112), driving down product revenue;


45 NO. 5:14- CV-05204-EJD


1

integration issues with the latest version of Mandiant’s MIR product were causing customers

2

leave for competitors. See ¶¶67-71, 114.

3

D. February 11, 2014 4Q13 Earnings Call

4

152. On the February 11, 2014 4Q13 earnings call, DeWalt made the following

5

and misleading statements regarding the status of the Mandiant acquisition and the channel:

6

Now that we are about five weeks into the post announcement of Mandiant, I’d like to give you an update on the integration of our

7

people and the products, as well as the tremendous response we’ve had from our customers and from our partners.

8 Over the course of many years and transactions I’ve had in

9

technology, I’ve learned that the most important aspect of business integrations are the people. From a personnel perspective, the two

10

organizations are highly complementary. We’re already working together in a number of projects before the acquisition, and, as a

11

result, the integration is progressing rapidly and smoothly.

12 ***

13

To summarize the integration effort, we’re moving along quickly to bring the two organizations together. As the teams meet with

14

one another, the synergies across every segment of the combined product road map become more and more evident .

15 ***

16 While we continue to build out our partner ecosystem in a targeted

17

way in 2014, our focus is shifting to our partners to drive business across the sales cycle.

18 Last week, we hosted Momentum, as I mentioned, our annual

19

partner event in conjunction with our internal sales kickoff, where we trained another 350 channel representatives, including 135

20

reps from international distributors and resellers.

21

153. These statements regarding the status of the Mandiant integration pro

22

“rapidly” and “smoothly” are false and misleading because DeWalt failed to disclose that th

23

combined companies’ sales force was in “chaos,” with sales personnel having difficulty sellin

24

unfamiliar product and cross-selling customers, being forced to deal with separate product an

25

services decision-makers at customers, Mandiant’s systems not being integrated into FireEye’

26

and lengthening sales cycles. See ¶¶92-100, 102-104, 112.

27

154. The statement regarding the partner ecosystem was misleading because DeW

28

failed to disclose that selling Mandiant services was causing friction with the channel


46 NO. 5:14- CV-05204-EJD


1

that sold competing services at higher margin, leading to a significant loss of channel busines

2

See ¶113.

3

155. On the same call, DeWalt made the following false and misleading

4

I regarding product:

5

Our ability to scale [off] the Mandiant business is really a matter of selling products now. We’re going to continue to scale services

6

people, but not at a faster pace than we are going to be selling products .

7 We talked about 15% to 17% would be service oriented in our

8

model, moving forward on the last call. There’s no change to that. As we sell more and more product , it’s all about the automation of

9

that service component.

10

156. These statements regarding product are false and misleading because DeWal

11

failed to disclose that the combined sales force was in “chaos,” with sales personnel having

12

difficulty selling unfamiliar product and cross-selling customers, being forced to deal w

13

separate product and services decision-makers at customers, Mandiant’s systems not bei

14

integrated into FireEye’s, and lengthening sales cycles. See ¶¶92-100, 102-104, 112. DeW

15

further failed to disclose that problems with Mandiant’s MIR product were causing customers

16

leave for competitors, shrinking the pipeline. See ¶¶66-71, 114.

17

157. On the same call, DeWalt made the following false and misleading stateme

18

regarding channel partners: “We focused heavily on Mandiant products this past week with t

19

350 of our partners, and we made great progress.”

20

158. This statement is false and misleading because DeWalt failed to disclose t

21

selling Mandiant services was causing friction with the channel partners that sold competi

22

services at higher margin, leading to a significant loss of channel business. See ¶113.

23

E. May 6, 2014 1Q14 Earnings Call

24

159. On the May 6, 1Q14 earnings call, DeWalt made the following mi

25

statement regarding the sales force:

26

We then had our most successful sales training and partner event every at our inaugural Momentum conference in Las Vegas. This

27

event included nearly 1,000 salespeople and partner personnel, with a focus on certification and education. The net result was

28

more than 8,000 hours of training.


47 NO. 5:14- CV-05204-EJD


1

160. This statement was misleading because DeWalt failed to disclose that in real

2

(1) the sales force was in disarray, with sales personnel in the field confused about how

3

integrate Mandiant’s services offerings and legacy Mandiant sales personnel ignorant ab

4

FireEye’s products (see ¶¶93-95, 104); and (2) the rapid increase in sales force resulting in cha

5

as the two companies’ systems were not integrated, such that sales personnel did not know w

6

was selling what, where. See ¶¶93-95, 112, 115.

7

161. On the same call, DeWalt made the following misleading statement regard

8

pipeline: “Moreover, in the subsequent 60 days we conducted more than 40 field seminar eve

9

in more than 40 cities, as we also conducted 20 webinar events, all to introduce

10

Mandiant/FireEye value proposition. All in all, we generated explosive growth in

11

pipeline for the Company.”

12

162. This statement regarding pipeline growth was misleading because DeWalt

13

to disclose that problems with the latest version of Mandiant’s MIR product had

14

customers to leave for competitors and the pipeline to shrink. See ¶¶66-71, 114.

15

163. On the same call, DeWalt made the following misleading statement reg

16

cross-selling: “Including the Mandiant business, we had a record number of cross-

17

opportunities, with 15 significant deals where we sold Mandiant and FireEye together.

18

included some of the largest transactions in the quarter, and included a Fortune 500 insu

19

company, large high tech companies and large retailers.”

20

164. This statement was misleading because DeWalt failed to disclose that the

21

force was having significant difficulty cross-selling products, with customers unwilling to

22

pitched on Mandiant’s services or unwilling to replace/upgrade legacy Mandiant solutions w

23

FireEye products because of their expense. See ¶¶99, 115.

24

165. On the same call, DeWalt made the following misleading statements regarding

25

channel:

26


27

Our two-tiered partner strategy, including both distribution and value added resellers, now totaling more than 700 partners

28

worldwide. This component generated more than 50% of the leads that closed in the quarter, as well as our highest percentage of no-


48 NO. 5:14- CV-05204-EJD


touch deals. Our partner registrations were also up dramatically in Q1.

2 ***

3 Sanjit Singh - Wedbush Securities – Analyst

4 [W]here do you see your partners, maybe your strategic partners,

5

your large partners, where are necessity now and where do you see that going in the future in terms of them being able to carry more

6

of the load, more of the selling effort, so we can start to see more of the sales to marketing leverage over the next couple years?

7

Where are we now, and where are we going?

8


9

I think you are hitting on a really important aspect.... But the three areas I really focus myself on is first, recruiting partners and

10

getting partners to sign with us and commit with us and getting them on board. Remember we went from less than 200 one year

11

ago to 700 one year later, so a bit of a jump there. It takes the partners a little longer to ramp than even our own sales force.

12 The second metric that is important is the amount of leads coming

13

from that partner community, and I mentioned a little earlier we had 50% of our business or more coming from partners now in

14

closing. That we’re assisting them in the close. That’s a really nice metric that’s expanding .

15 And really, the third metric is how many no-touch deals are we

16

getting from the channel, as well, and I noted that was a record for us in the number of no-touch deals we received . Of course, we’re a

17

channel company entirely, meaning 90% plus of our business goes through the channel, we don’t have direct models here.

18 So when you look at these metrics of how many you signed up,

19

how many leads you have coming in that closed, and how many no touches you have the trends and indications are in the right

20

direction for us in terms of what we are doing.

21

166. These statements regarding channel partners were misleading because De

22

failed to disclose that Mandiant’s services offering was causing significant friction with

23

partners who sold competing services, causing a loss of channel business. See ¶113.

24


25

competition:

26


27

David, I wonder if you could talk about the competitive environment out there. I know at RSA, a number of your

28

competitors said – oh, we do this also. I’m curious, you know, how much confusion, if any, you are running into out in the market?


49 NO. 5:14- CV-05204-EJD



2

Probably is most germane one in the competitive landscape is we continue to feel extraordinarily confident, I don’t know how else to

3

describe it.

4

The head-to-head battles with any competitor in the market has resulted in near flawless execution and win rates. I would say

5

100%, but I’m sure there is one out there that we lost to some competitor, but our win rates are dramatic when competing head to

6

head with a product bake-off.... We have a very unique advantage of people and process and product that none of the competition

7

has. I think that’s really showing up in results from us competing head to head.

8 ***

9 Sterling Auty - JPMorgan Chase & Co. – Analyst

10 You mentioned the high renewal rates... I would be curious what

11

the renewal rates are for solutions that are actually in a Palo Alto environment where the customer has a choice to potentially all to

12

environment where they have the chance to move to Wildfire or even the free version of Wildfire?

13 David DeWalt - FireEye Inc - Chairman, CEO

14 [O]ur renewal rates are spectacular, first of all.

15 Second of all, our win rate is spectacular; any conversions to a

16

competitor that you just named, to my knowledge, is zero . I have not seen a single transaction when somebody moves from FireEye

17

to Wildfire. When I look at Wildfire, that product is highly ineffective in the marketplace where these types of attacks, a

18

million reasons I could go on and on about. But I have not seen any of that, I don’t anticipate seeing any of that.

19 In fact, there [are] many accounts where we go into where Wildfire

20

was already sold and we had FireEye behind it, and on top of that our detection efficacy doesn’t change one bit, whether that product

21

was in front of us or behind it. The way I look at this is that technology is having almost zero influence on these advanced

22

detection models that are out there, in my opinion. So I just don’t see that technology as something that is there right now to

23

changing our business model.

24

So a little – a little aggressive statement, but it is what it is. I don’t see them as a major factor for us right now .

25 ***

26 We had one of our best quarters ever on so many fronts. I

27

mentioned them, the size of our expansion in products , in pipeline , marketing activities, competitive edges, competitive win rates . It is

28

the best, you know, we felt like we could do and deliver this quarter, so that felt good.


50 NO. 5:14- CV-05204-EJD


1

We raised guidance, the outlook looks positive for the Company. The competitive landscape looks good .

2

3

168. These statements regarding competition were misleading because DeWalt

4

to disclose that customers dissatisfied with the problematic latest version of MIR were leaving

5

for competitors; that legacy Mandiant customers did not want to upgrade to FireEye’s produc

6

because of its expense; and that the Company’s customer pipeline was shrinking. See ¶¶66-71

7

114, 115. DeWalt further failed to disclose that integration problems were leading to delays in

8

product sales cycles. See ¶¶93, 95-98, 103-104, 112.

9

169. On the same call, DeWalt made the following misleading statements regarding

10

Mandiant integration:

11

Melissa Gorham - Morgan Stanley – Analyst

12

Question for Dave on the integration of Mandiant, just wondering if you are now well integrated with Mandiant or if there is more

13

work to do from a go-to-market and distribution perspective, and just wondering if you have any anecdotal color on how the

14

integration is resonating with your customer base?

15


16

We made a lot of progress. If you recall from our acquisition announcement back in early January, the nice part about this

17

combination was we were quite familiar with each other beforehand.

18 We had the products integrated at least at some level, and the

19

endpoint platform and network platform that FireEye had, had ways of handshaking intelligence that we could do detection to

20

response. We are integrating that even further.

21

In fact, we’ve now integrated a whole work flow, a single pane of glass, so we can go from network events to remediation and

22

response on endpoints, to a common console. We are working on extended endpoint features that we’ll announce soon and there is

23

more development under way there, so we are off to a really good start from a products point of view .

24 ***

25 On the go-to-market side, almost from the first day we integrated

26

the go-to-market model, meaning that the FireEye sales team would sell every Mandiant product. And it is one of the reasons

27

why we are not breaking out everything either, is because the go- to-market model is fully integrated at this point ; from the comp

28

plans, to what they sell, to how they deliver it. We also trained and certified all the partner channels and got them up to speed on a


51 NO. 5:14- CV-05204-EJD


1

combined FireEye/Mandiant product, albeit halfway or three- quarters of the way through the quarter, but we made progress with

2

both the field and telesales models of FireEye, with the partner and channel models of FireEye.

3

4

170. These statements that Mandiant’s and FireEye’s products were integrated; that

5

Company was “off to a really good start from a product point of view”; that the sales team

6

“fully integrated,” and the statement regarding the partner channel were misleading bec

7

DeWalt failed to disclose that (1) the sales force was in disarray, with sales personnel in the

8

confused about how to integrate Mandiant’s services offerings and legacy Mandiant s

9

personnel ignorant about FireEye’s products ( see ¶¶93-95, 104); (2) the rapid increase in s

10

force resulting in chaos as the two companies’ systems were not integrated, such that s

11

personnel did not know who was selling what, where ( see ¶¶93-95, 112, 115); and

12

Mandiant’s services offering was causing significant friction with channel partners who

13

competing services, causing a loss of channel business (s ee ¶113).

14


15

product revenue:

16

Daniel Ives - FBR & Co. – Analyst

17

Maybe you could talk, I mean (inaudible) subscription (inaudible) talk about maybe some of the dynamics going on with licenses. I

18

think that’s what a lot of investors are focused on, especially here with the interim-adjusted results.... just the dynamic in terms of

19

what is happening on the license side versus the subscription side this quarter. I mean, there are some questions like, did any licenses

20

flow into the firm, just a question about that in the quarter.

21


22

If you look at it on a bookings basis, minus back log a bit, and you take a look at the product and product subscriptions business of

23

FireEye, and the product and product subscriptions business of Mandiant, both those businesses grew at 50% or greater. So, you

24

know, that’s an important point here, because Mandiant business and the FireEye business both were very healthy from what I think

25

you’re alluding to, which is licenses, which is really what we think of as product and product subscriptions, so both models were

26

really good.

27

172. The statement that product “looked good” was false and misleading

28

DeWalt failed to disclose that the combined companies’ sales force was in “chaos,” with


52 NO. 5:14- CV-05204-EJD


1

personnel having difficulty selling unfamiliar product and cross-selling customers, being forced

2

to deal with separate product and services decision-makers at customers, Mandiant’s systems no

3

being integrated into FireEye’s, and lengthening sales cycles. See ¶¶92-100, 102-104, 112, 115

4

DeWalt further failed to disclose that problems with Mandiant’s MIR product were causing

5

customers to leave for competitors, shrinking the pipeline. See ¶¶67-71, 114.

6


7

sales force productivity and pipeline growth:

8

Sanjit Singh - Wedbush Securities – Analyst

9

I had a question on sales force productivity. You are in the midst of an integration. You have a bunch of new salespeople that has

10

joined the team over the past 12 to 18 months, and then you have, as you said, Dave, 20 to 24 products now. So how do you manage

11

and evaluate that sales force productivity, given that the second half of the year street estimates do imply a pretty significant ramp

12

on a revenue and a billings basis?

13


14

I think that’s a great question. We inspect it very closely, with a lot of metrics, as the team knows. You look at it so many different

15

ways. You have sort of these bottoms up analysis.... what you want to inspect is how many you have, how many are ramped,

16

what’s the productivity per ramped rep and does that add up to what the plan is or what the guidance is or what the consensus is,

17

do you have enough gaps between all that and how do you model that.

18 Mike and I spent a lot of time reviewing that from a bottoms up

19

point of view making sure ramped capacity is coming in the model properly. And then, of course, you look geographically around the

20

world. Ramp capacity happens quicker in some markets than other markets, but we feel confident that this sales coming online well

21

and performing .

22

I alluded to a little bit some of the explosive pipeline growth we are having, and lead generation that’s occurring. The amount of

23

proof of values that we have in the pipeline, and all that kind of capulates on our optimism for the remainder of the year.

24

25

174. These statements regarding sales force productivity and “explosive”

26

growth were misleading because DeWalt failed to disclose that the combined sales force was

27

“chaos,” with sales personnel having difficulty selling unfamiliar product and cross

28

customers, being forced to deal with separate product and services decision-makers at


53 NO. 5:14- CV-05204-EJD


1

Mandiant’s systems not being integrated into FireEye’s, and lengthening sales cycles. See ¶¶92-

2

100, 102-104, 112, 115. DeWalt further failed to disclose that in the 2Q, sales personnel were

3

incentivized to obtain “no fee” retainers with customers over selling product. See ¶¶97-98.

4

DeWalt also failed to disclose that problems with Mandiant’s MIR product were causing

5

customers to leave for competitors, shrinking the pipeline, and that channel friction was

6

a loss in business. See ¶¶67-71, 113, 114.

7

F. May 20, 2014 JP Morgan Global Technology Media Telecom Conference

8

175

At the May 20, 2014 JP Morgan conference, DeWalt made the fo

9

misleading statements regarding competition and product sales:

10

Sterling Auty - JPMorgan - Analyst

11

So do you have a primary competitor within that environment? And I think also from the investors’ standpoint, when you’re

12

looking at a new opportunity, is it primarily a company that says, oh my goodness, I need APT protection and I do an APT RFP –

13

that they’re sitting there saying, okay, I’m going to bring in these three companies? Or how does that sales opportunity evolve, and

14

who do you see most often as the other alternative that a customer might be considering?

15 Dave DeWalt - FireEye, Inc. - CEO

16 [M]ost times we walk in to a customer, and we say, hey, try our

17

technology, and if you like it, buy it; If we don’t find anything, and we’re not helpful with the technology, then we lose out. We do a

18

very good job showing the value of our product, and typically, that results in some sort of bake-off. And then we have an evaluation

19

maybe as Palo Alto’s WildFire or Sourcefire’s capability, or name a vendor. And so we’ll do a little competition there. But our win

20

rates are very high in that model, particularly after we’ve shown the technology to a company.

21 The other model, which is maybe even more explosive for the

22

company, is we lead after an incident response. This is where Mandiant’s model became very powerful for the company. We’re

23

responding to hundreds of breach incidences around the world. Every time there’s a major breach, we get in very high in the

24

organization, oftentimes to the Board of Directors, the audit committees, CEOs, and now post-Target and other types of major

25

breaches, they’re taking these things very, very seriously. So what happens after an incident response? Very quick product sales .

26

Because Mandiant and the brand walks in, and they evaluate what’s happening in the architecture. They discover a major

27

breach, and then the company’s like, well what do you recommend? And we oftentimes get very high conversions, over

28

90% conversions to a product or a product subscription, post the incident response.


54 NO. 5:14- CV-05204-EJD


1

176. The statement regarding high win rates was misleading because DeWalt failed

2

disclose that problems with Mandiant’s MIR product were causing customers to leave

3

competitors, shrinking the pipeline, and that channel friction was causing a loss in business.

4

¶¶67-71, 113, 114.

5

177. The statement that product sales were “very quick” was misleading

6

DeWalt failed to disclose that the combined companies’ sales force was in “chaos,” with sale

7

personnel having difficulty selling unfamiliar product and cross-selling customers, being force

8

to deal with separate product and services decision-makers at customers, Mandiant’s systems no

9

being integrated into FireEye’s, and lengthening sales cycles due to the integration issues. Se

10

¶¶92-100, 102-104, 112, 115. DeWalt further failed to disclose that in the 2Q, sales personne

11

were incentivized to obtain “no fee” retainers with customers over selling product. See ¶¶97-98.

12

G. May 29, 2014 Cowen Technology Media & Telecom Conference

13

178. At the May 29, 2014 Cowen conference, Sheridan made the following mi

14

statements regarding product revenue and cross selling:

15

Gregg Moskowitz - Cowen and Company – Analyst

16

Having said that, there were many who were... a little bit more in the way of product revenue. And maybe you could sort of talk to

17

some of the dynamics around that.

18

Mike Sheridan - FireEye, Inc. - SVP, CFO

19

I think there was probably one central point of confusion on that. When I had issued our annual guidance for the year, I said the

20

product revenue in our business would be 40% to 45% of the mix. And we have reiterated that guidance, by the way, for the year . But

21

if you look at our business, it is a seasonal business. The first half is lower and the second half is higher, and it is the total that falls

22

within that range.

23

So, what we have explained [since] those numbers came out is we are still on track for that 40% to 45%. But having Q1/Q2 a bit

24

below that range and Q3/Q4 in or in the higher end to that range was really one factor. The other factor is actually related to trends

25

we are seeing in the business that we consider very positive.

26

Gregg Moskowitz - Cowen and Company - Analyst

27

And, then, with Mandiant, maybe you could talk about some of the cross-selling that you have seen so far, realizing that it is early

28

days. And then, more importantly, when do you expect going


55 NO. 5:14- CV-05204-EJD


1

forward, particularly as the integration of around product and product and systems and sales all gets tighter?

2 Mike Sheridan - FireEye, Inc. - SVP, CFO

3 So we had a good start. We completed the acquisition on

4

December 30 and the first thing that we did was we brought the two sales forces together. And in Q1 we spent about 8000 hours

5

worth of training to get both sales forces up to speed on our technologies .

6 ***

7 And what we reported in the first quarter was we had several deals

8

where we actually were selling and cross-selling across both platforms. So we had a good start. We are continuing that process.

9

10

179. The statements regarding product revenue were misleading because S

11

failed to disclose that the combined sales force was in “chaos,” with sales personnel

12

difficulty selling unfamiliar product and cross-selling customers, being forced to deal wit

13

separate product and services decision-makers at customers, Mandiant’s systems not bein

14

integrated into FireEye’s, and lengthening sales cycles due to the integration issues. See ¶¶92

15

100, 102-104, 112, 115. Sheridan further failed to disclose that in the 2Q, sales personnel wer

16

incentivized to obtain “no fee” retainers with customers over selling product, leading to a declin

17

in product sales. See ¶¶97-98.

18

180. The statements regarding cross selling and sales force training were mi

19

because Sheridan failed to disclose that sales personnel were having difficulty selling unfamilia

20

product and cross-selling customers. See ¶¶92-100, 102-104, 115.

21

H. June 3, 2014 Bank of America Merrill Lynch Global Technology Conference

22

181. At the June 3, 2014 Bank of America Conference, DeWalt made the following

23

misleading statements regarding product revenue:

24

Tal Liani - BofA Merrill Lynch – Analyst

25

Product revenue. Last quarter product revenues were weak and the consent was that that this was a sign of a slowdown. And you

26

explained it on the conference call. Can you discuss again what happened last quarter with product revenues and why it is not a

27

sign for a forthcoming slowdown in activity?

28


56 NO. 5:14- CV-05204-EJD


1

Dave DeWalt - FireEye, Inc. - Chairman and CEO

2

I guess there is a difference between weak and strong at least on the perception because we felt like (multiple speakers) whoever’s

3

model was there. I just look at it this way, product and product subscriptions is our product. So the mix between product revenue

4

and product subscription revenue is not a factor for the way we look at our business. In fact we almost like more product

5

subscription than we like product because it creates a longer-term ratable business model for the company and we think it creates

6

stickier opportunity than hardware at point of customer, point-of- sale.

7 ***

8 So we had a blend difference between product and product

9

subscription in the quarter largely due to one major factor which was Mandiant.... So it is just important that it is complicated on

10

the models and it is also important to look at it in totality, at least that is how we look and we do not in our go-to-market model

11

distinguish a difference in the way we pay our reps or go to market trying to get them to do more product content versus product

12

subscription content versus support or services so a dollar is a dollar across those four components.

13

14

182. The statements regarding product revenue were false and misleading

15

DeWalt failed to acknowledge that product revenue and sales were decelerating due to th

16

negative impact of integration issues, including that sales personnel were having difficul

17

selling unfamiliar product and cross-selling customers, and were being forced to deal wi

18

separate product and services decision-makers at customers, Mandiant’s systems not bein

19

integrated into FireEye’s, and lengthening sales cycles as a result. See ¶¶92-100, 102-104, 11

20

115. DeWalt further failed to disclose that in the 2Q, sales personnel were incentivized to obta

21

“no fee” retainers with customers over selling product, leading to a decline in product sales. S

22

¶¶97-98.

23

I. August 5, 2014 2Q14 Earnings Call

24

183

On the August 5, 2014 2Q14 earnings call, DeWalt made the followi

25

misleading statement regarding cross selling: “We also increased the number and the value o

26

deals that included multiple products, including cross-sell of FireEye and Mandiant products.”

27

184. This statement was misleading because DeWalt failed to disclose that

28

personnel were having difficulty selling unfamiliar product and cross-selling customers


57 NO. 5:14- CV-05204-EJD


¶¶92-100, 102-104, 112, 115), and that in the 2Q, sales personnel were incentivized to obtain

2

I fee” retainers with customers over selling product, leading to a decline in product sales.

3

¶¶97-98.

4

185. On the same call, DeWalt made the following misleading statement regarding

5

sales force, cross-selling, and sales cycles:

6


7

First on John McGee, are you planning on any changes, restructuring and so forth of the sales organization? We’ve found

8

historically that can be kind of disruptive. If you can address what your plans might be there?


10 We’re really excited to have John come aboard, number one. But

11

we really have kind of a best of both worlds, frankly. We have Jeff Williams, who’s done an amazing job helping to build this

12

Company from sort of zero to $0.5 billion range here. He’s taking over the big portion of the Americas operation, which as you know

13

is 65% to 70% of our business. John’s taking over global sales. John’s had a track record of running and operating billion-dollar-

14

plus businesses, so we’re excited to have both of them.

15

But the answer to your question is no, we’re not do [sic] anything restructuring in sales operations.

16 ***

17 But for the most part, sales is doing great. We’re scaling

18

internationally. We have multi-vectors of sales we’re doing, both inside sales, partner sales, service-led sales, and product sales. For

19

the most part we feel pretty good about what we’re doing . We’re just trying to bring in some new leadership to help get us to the

20

next level, and quite frankly, just augment what we’ve got. No major change there.

21 Rick Sherlund - Nomura Asset Management - Analyst

22 [O]n the sales cycle, any comments in terms of with Mandiant, has

23

it – and the branding benefit you get from that and the publicity around Target and some of the others? Have you seen any material

24

shortening of the sales cycle?

25


26

One of the things that Mike alluded to in his script was improving our cross-sell between FireEye’s base and Mandiant’s base, and

27

Mandiant’s stuff back to FireEye. We made some really good traction. We went from like 15 or so cross sales from Q4 to Q1 in

28

our first-quarter of operation, and now had triple that in the next quarter of operations.


58 NO. 5:14- CV-05204-EJD


1

We’re seeing some good things. The number of companies that we’ve cross-sold to is picking up.... We like what we’re seeing.

2

They are shortening the sales cycle , especially where the Infinite Responding-led model starts.

3

4

186. DeWalt’s statement that “we’re not doing any restructuring in sales operati

5

and that there was “no major change there” was false and misleading because DeWalt failed

6

disclose that there had been lay-offs in August as a result of problems with the integration.

7

¶103.

8

187. The statements regarding cross selling and shortening the sales cycle

9

misleading because DeWalt failed to disclose that the sales force was having difficulty

10

unfamiliar product and cross-selling product to customers, and sales cycles were

11

from integration issues including separate financial systems and general confusion. See ¶¶92

12

100, 102-104, 112, 115.

13


14

competition, cross-selling, and sales cyles:

15

Rob Owens - Pacific Crest Securities – Analyst

16

And Dave, as you look at the market place, you mentioned you’re doing a better job of cross-selling. Talk about new customer

17

acquisition, because it seems like there’s a lot of noise out there from competition. Are you seeing any elongation in sale cycles, or

18

just how that’s playing out?

19


20

I think that’s the heart of what we watch and monitor here.... We certainly did a lot better in Q2 than we did in Q1 when it came to

21

cross-selling of FireEye-Mandiant technology, and even selling multiple products, as Mike mentioned, into FireEye cases in the

22

FireEye customers. Then it’s just the upsell [in] the last one – selling more product to the same customer. All those keep moving

23

positively. The competition really hasn’t had any impact that’s of notice . Quite frankly, our win rates are extraordinarily high across

24

the board.

25

We recognize we’re not in all markets in all segments. But at the same time, whenever we’ve competed directly, we have a very

26

high win rate – near 100% win rates.... When I look at that compared to where we’re at with competition, I feel good about it.

27

28


59 NO. 5:14- CV-05204-EJD


1

189. The statements that cross-selling was improving and that the competition had

2

no impact are misleading because DeWalt failed to disclose that (1) the sales force was

3

difficulty cross-selling products ( see ¶¶99, 115); and (2) problems with Mandiant’s MIR

4

were causing customers to leave for competitors, shrinking the pipeline, and that channel

5

was causing a loss in business. See ¶¶66-71, 113, 114.

6

190. DeWalt’s failure to disclose that sales cycles were lengthening was misleadi

7

because sales personnel were having difficulty selling unfamiliar product and cross-sell

8

customers, and were forced to deal with separate product and services decision-makers

9

customers, Mandiant’s systems not being integrated into FireEye’s, and lengthening sales cyc

10

as a result. See ¶¶92-100, 102-104, 112, 115. DeWalt further failed to disclose that in the 2

11

sales personnel were incentivized to obtain “no fee” retainers with customers over

12

product, leading to a decline in product sales. See ¶¶97-98.

13


14

I competition and sales cycles:

15

Daniel Ives - FBR Capital Markets – Analyst

16

Tom, I’m curious in terms of, not just sales cycles, but competition-wise, are you starting to see any changes out there, as

17

more of your competitors are going after the same space -- almost copycat solutions? Are you seeing any changes out there in the

18

field?

19


20

Daniel, this is Dave. I would tell you similar to I think what Rob was asking – Rob Owens was asking, we haven’t. Sales cycles

21

have been very consistent . The average sales price discounts have been consistent. We certainly see the news much like you do about

22

competitors kind of copying FireEye’s model here, and talking about sandboxes or virtual machines or some sort of improved

23

detection. But the proof is when we compete head-on , and we feel we have a substantial gap.

24

25

192. The statement regarding sales cycles being consistent was misleading

26

DeWalt failed to disclose that sales personnel were having difficulty selling unfamiliar

27

and cross-selling customers, and were being forced to deal with separate product and

28

decision-makers at customers, Mandiant’s systems not being integrated into FireEye’s,


60 NO. 5:14- CV-05204-EJD


1

lengthening sales cycles as a result. See ¶¶92-100, 102-104, 112, 115. DeWalt further failed

2

disclose that in the 2Q, sales personnel were incentivized to obtain “no fee” retainers

3

customers over selling product, leading to a decline in product sales. See ¶¶97-98.

4

193. The statement regarding competition was misleading because DeWalt failed

5

disclose that problems with Mandiant’s MIR product were causing customers to leave

6

competitors, shrinking the pipeline, and that channel friction was causing a loss in business.

7

¶¶66-71, 113, 114.

8

194. On the same call, DeWalt and Sheridan made the following misleading

9

regarding pipeline:

10


11

As we look into the second half with enterprise spending, you tend to see a lot more opportunity if you’re us, as we worked during the

12

first half of the year to build pipeline and close it in the second half of the year. For all the factors that I just described, that’s why

13

you’re seeing an increase of that growth rate a bit, as you get into the first nine months versus the Q4 quarter; just because again, a

14

lot of things get teed up. A lot of renewal opportunity. A lot of opportunity for us to close bigger transactions. We think the

15

pipeline and outlook looks good there . Mike, do you want to add onto that?

16 Michael Sheridan - FireEye Inc - SVP, CFO

17 As I mentioned in my comments, we are seeing a good increase in

18

the number of accounts that are purchasing products across Mandiant, FireEye, nPulse, and so forth. That’s a primary driver. I

19

think in terms of confidence, certainly just the fact that we’re guiding it, we believe that the road is there. We believe the pipeline

20

is there. We think our sales force is making great progress ramping up. Yes, we’re heading into the second half with an

21

optimistic view.

22

195. These statements regarding the strength of the pipeline and the success of

23

sales force in cross-selling product were misleading because Sheridan failed to disclose that (1

24

the sales force was having difficulty cross-selling products ( see ¶¶99, 115); and (2) problem

25

with Mandiant’s MIR product were causing customers to leave for competitors, shrinking th

26

pipeline, and that channel friction was causing a loss in business. See ¶¶66-71, 113, 114.

27

28


61 NO. 5:14- CV-05204-EJD


1

J. August 11, 2014 Pacific Crest Global Technology Leadership Forum

2

196. At the August 11, 2014 Pacific Crest forum, Sheridan failed to disclose that

3

cycles were lengthening in response to the following question on sales cycles, which

4

response did not address: 4

5

Unidentified Participant

6

We’ve been a little bit on the competitive landscape – very noisy and continues to pick up considerably. Any impact that you guys

7

are seeing relative to sales cycles? And is new customer acquisition stalling as a result of the noise?

8

9

197. Sheridan’s failure to disclose that sales cycles were lengthening was misleadi

10

I because sales personnel were having difficulty selling unfamiliar product and

11

customers, and were forced to deal with separate product and services decision-makers

12

customers, Mandiant’s systems not being integrated into FireEye’s, and lengthening sales cyc

13

as a result. See ¶¶92-100, 102-104, 112, 115. Sheridan further failed to disclose that proble

14

with Mandiant’s MIR product were causing customers to leave for competitors, shrinking

15

pipeline, and that channel friction was causing a loss in business. See ¶¶66-71, 113, 114.

16

198. At the same forum, Sheridan made the following misleading statements

17

channel partners:

18

Unidentified Participant

19

And along that point, if I can interject, how do avoid channel conflict along those lines? Because Mandiant offers services,

20

managed services. A lot of your [top] channel partners offer services and managed services. And so as that ramps and there’s a

21

better integration there, how do you avoid channel conflict?

22


23

It’s a great question. It’s one that we had to spend a lot of time with our channel – and I’ll start at the end and then work

24

backwards.

25

Where we are today is, our channel remains very engaged. We haven’t lost our channel partners. As you can see in Q2, we’ve

26

done just the opposite. They remain very strong, in terms of

27 4 Sheridan’s response addressed only the question regarding new customer acquisition, 28

competition generally.


62 NO. 5:14- CV-05204-EJD


1

relationships.... So many channel partners will offer a managed service where they will say to a company, you’ve got all this stuff

2

deployed; we’ll help you manage it.

3

If you compare that to what we mean in terms of incident response and breach response and this deep cyber-security expertise, threat-

4

intelligence kind of thing – they’re generally not in that business.

5

Now, it’s not 100% one way or the other. And where there is some cross-over, we’ve got very talented channel – internal channel

6

executives and others that will establish rules of engagement as to how to deal with those conflicts, such that we can maintain good

7

relationships. And I think we’ve been very successful with that .

8 ***

9

But the bottom line is, we’ve spent a lot of time with the channel to ensure that those conflicts are addressed. Where there could be

10

overlap, we establish rules of engagement to deal with them. But in the significant majority of the time, it really hasn’t been a

11

problem .

12

199. The statements that relationships with the channel were strong were

13

because Sheridan failed to disclose that selling Mandiant services was causing friction with

14

channel partners that sold competing services at higher margin, leading to a significant loss o

15

I channel business. See ¶113.

16

K. September 3, 2014 Citi Global Technology Conference

17

200. At the September 3, 2014 Citi conference Mandia and Sheridan mi

18

denied that there had been a sales force restructuring:

19

Walter Pritchard - Citi – Analyst

20

And Kevin, for you, you came from the Mandiant side, the Company has gone through an integration there I think on the

21

conference in Q2 you talked about making some restructuring moves around just sort of bringing the companies together. Can

22

you update us on the integration and was that restructuring planned or was that sort of --?

23 Kevin Mandia - FireEye, Inc. - SVP, COO

24 I don’t think that was restructuring. Mike, do you want to talk to

25

that? I mean, what we were really doing there.

26

Michael Sheridan

27

Yes. I mean, I think the word restructuring would imply something very different than what we did. Restructuring would be, gee, we

28

wanted to invest in this particular product, and so we hired these


63 NO. 5:14- CV-05204-EJD


1

people and now we don’t think it’s a great idea so we’re going to take them out and –

2 Kevin Mandia - FireEye, Inc. - SVP, COO

3 I don’t know the exact word but that was something –

4 Michael Sheridan

5 We’re going to have some overlap in employees. We may have

6

hired into some regions that now, in retrospect, may not have been exactly where we should have made our bets. There’s going to be

7

those kinds of things. So I wanted to talk about that on the call, and I refer to it as cost alignment and cost optimization which is

8

exactly what it is because as we move towards that target model, we’re going to continue to do so with an eye towards growth but

9

also recognizing that we have to be efficient.

10 201. Mandia’s and Sheridan’s failure to disclose that the Company had

11 employees (see ¶103) because of integration issues that negatively impacted product sales

12 materially misleading. See ¶¶92-100, 102-104, 112, 115.

13 L. September 18, 2014 FireEye Tech Talk

14 202. On the September 18, 2014 FireEye Tech Talk call, DeWalt made the fo

15 misleading statements regarding the Mandiant integration:

16 The culmination of FireEye and Mandiant now eight months, nine

17

months into the acquisition and merger between the two firms, and I can’t be more pleased, quite honestly. Everything that we had

18

told you at the beginning of this acquisition is coming true and more. We’re finding ourselves with a tremendous amount of

19

synergy, not just in the people and the expertise that Mandiant has brought, but also the intelligence and the products.

20 203. This statement regarding the “tremendous amount of synergy” and the success

21 the integration was misleading because DeWalt failed to disclose that (1) the sales force was in

22 disarray, with sales personnel in the field confused about how to integrate Mandiant’s service

23 offerings and legacy Mandiant sales personnel ignorant about FireEye’s products ( see ¶¶93-95

24 104); (2) the rapid increase in sales force resulting in chaos as the two companies’ systems were

25 not integrated, such that sales personnel did not know who was selling what, where ( see ¶¶93-95

26 112, 115); and (3) Mandiant’s services offering was causing significant friction with channe

27 partners who sold competing services, causing a loss of channel business (s ee ¶113).

28


64 NO. 5:14- CV-05204-EJD


1

I VII. THE ENTIRE TRUTH IS FINALLY REVEALED

2

204. Only two weeks after FireEye announced FireEye-as-a-Service on September 17,

3

2014, the Company stunned the market by disclosing a pronounced shift in revenue from produc

4

to services, as well as revenues at the low end of their previous guidance and lower tha

5

analysts’ consensus expectations – in other words, a marked deceleration in product revenu

6

growth leading to lower reported revenues as service revenues are largely deferred. Defendant

7

attributed the shift to “outperformance” of FireEye-as-a-Service, a new subscription servic

8

(“SaaS”) the Company had announced in September 2015 – only two weeks before the end of th

9

third quarter. A Citigroup analyst cut his price target in response, stating that analyst consensu

10

revenue estimates would decline given the reduction in product revenue, and that FireEye’

11

growth would be difficult to estimate given the changes in its revenue recognition practices an

12

its introduction of subscription models like FireEye-as-a-Service.

13

205. A November 5, 2014 William Blair analyst report highlighted the deceleration

14

product revenue, stating that:

15

We believe some investors will view the light revenue results with skepticism, given the slower-than-anticipated growth of product

16

revenue . We expect the stock to open materially lower reflecting the disappointment and increasing fears over competition and

17

sustainability of the business model . We view the results as acceptable, but are concerned that product billings were not

18

stronger given the investments the company has made in expanding its salesforce , which we believe should be translating

19

into stronger results.

20

206. A November 5, 2014 Stephens analyst report observed that FireEye-as-a-

21

had been “ introduced just two weeks before the end of the quarter” and that “FireEye’s host

22

new products...seem to have not yet made a meaningful impact on the business.”

23

207. In reaction to FireEye’s disappointing product revenue, the Company’s

24

plummeted 14.98%, on unusually heavy trading volume, with 25,224,200 shares

25

compared with an average daily trading volume over the Class Period of 5,850,012 shares.

26

VIII. ADDITIONAL SCIENTER ALLEGATIONS

27

208. During the Class Period, DeWalt and Sheridan reaped the rewards of Defendants

28

fraud while FireEye’s stock price was artificially inflated. As shown in the tables below, DeW


65 NO. 5:14- CV-05204-EJD


1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

sold 485,656 shares of his FireEye stock for net proceeds of over $38.5 million. In co

DeWalt had no proceeds in the time periods both before and after the Class Period.

sold 121,733 shares of his FireEye stock for net proceeds of over $9.5 million. In co

Sheridan had no proceeds in the time periods both before and after the Class Period.

Pre-Class Period 9/20/13 – 1/1/14

Class Period 1/2/14 – 11/4/14

Post-Class Period 11/5/14 – 6/12/15

IX. CLASS ACTION ALLEGATIONS

209. Plaintiffs bring this action as a class action pursuant to Federal Rule of Civi

Procedure 23(a) and (b)(3) on behalf of a Class, consisting of all purchasers of FireEye’

securities between January 2, 2014 and November 4, 2014 inclusive and who were damage

when the truth about the deceleration in FireEye’s product revenue was disclosed. Exclude

from the Class are Defendants, the officers and directors of the Company, at all relevant times

members of their immediate families and their legal representatives, heirs, successors or assign

and any entity in which Defendants have or had a controlling interest.


66 NO. 5:14- CV-05204-EJD

28


1

210. The members of the Class are so numerous that joinder of all members i

2

impracticable. Throughout the Class Period, FireEye had more than 137,000,000 shares o

3

common stock outstanding that traded on the NASDAQ. While the exact number of Clas

4

members is unknown to Plaintiffs at this time and can only be ascertained through appropriate

5

discovery, Plaintiffs believe that there are hundreds or thousands of members in the proposed

6

Class. Record owners and other members of the Class may be identified from record

7

maintained by FireEye or its transfer agent and may be notified of the pendency of this action by

8

mail, using the form of notice similar to that customarily used in securities class actions.

9

211. Plaintiffs’ claims are typical of the claims of the members of the Class as al

10

members of the Class are similarly affected by Defendants’ wrongful conduct in violation o

11

federal law that is complained of herein.

12

212. State-Boston and Fadia will fairly and adequately protect the interests of

13

members of the Class and have retained counsel competent and experienced in class

14

securities litigation.

15

213. Common questions of law and fact exist as to all members of the Class

16

predominate over any questions solely affecting individual members of the Class. Among

17

questions of law and fact common to the Class are:

18

(a) whether the federal securities laws were violated by Defendants’ acts as

19

I herein;

20

(b) whether statements made (or omissions) by Defendants to the investing publi

21

during the Class Period misrepresented (or omitted) to state material facts about FireEye’

22

business, in particular its product sales and product revenue following the Mandiant acquisitio

23

during the Class Period, as well as the Company’s operations and management;

24

(c) whether the Defendants made their misstatements or misrepresentations with th

25

required scienter; and

26

(d) to what extent the members of the Class have sustained damages and the

27

measure of damages.

28


67 NO. 5:14- CV-05204-EJD


1

214. A class action is superior to all other available methods for the fair and efficie

2

adjudication of this controversy since joinder of all members is impracticable. Furthermore,

3

the damages suffered by individual Class members may be relatively small, the expense a

4

burden of individual litigation make it impossible for members of the Class to individua

5

redress the wrongs done to them. There will be no difficulty in the management of this action

6

I a class action.

7

X. APPLICABILITY OF PRESUMPTION OF RELIANCE UNDER THE AFFILIATED UTE DOCTRINE, AND/OR, IN THE ALTERNATIVE,

8

THE FRAUD ON THE MARKET DOCTRINE

9

215. Plaintiffs are entitled to a presumption of reliance under Affiliated Ute v. Un

10

States, 406 U.S. 128 (1972), because the claims asserted herein against the Defendants

11

primarily predicated upon omissions of material fact which there was a duty to disclose.

12

216. Plaintiffs are entitled to a presumption of reliance because, as more fully alleg

13

above, the Defendants failed to disclose material information regarding the Mandiant integrati

14

issues that negatively impacted product sales and product revenue, elongated sales cycles, a

15

caused customers to leave for competitors.

16

217. Alternatively, Plaintiffs are entitled to a presumption of reliance under the fra

17

on the market doctrine of the Defendants’ material misrepresentations and omissions, because

18

all relevant times, the market for FireEye’s securities was an efficient market for the followi

19

reasons, among others:

20

(a) FireEye’s stock met the requirements for listing, and was listed and active

21

traded on the NASDAQ, a highly efficient and automated market;

22

(b) As a regulated issuer, FireEye filed periodic public reports with the SEC (and w

23

eligible to file SEC Form S-1) and the NASDAQ;

24

(c) FireEye regularly communicated with public investors via established mark

25

communication mechanisms, including through regular disseminations of press releases on t

26

national circuits of major newswire services and through other wide-ranging public disclosur

27

such as communications with the financial press and other similar reporting services; and

28


68 NO. 5:14- CV-05204-EJD


1

(d) FireEye was followed by numerous investor research services that

2

publicly available reports, as well as by several securities analysts (including Tal Liani and Eri

3

Ghernati at Bank of America Merrill Lynch; Raimo Lenschow, Saket Kalia, Stefan

4

I David Wang, Chris Hogan, Harris Heyer, and Andrew Kisch at Barclays; Walter Pritchard

5

Citigroup; Gregg Moskowitz, Matthew Broome, Christine Arnold, Charles Rhyee, and Co

6

Synesael at Cowen and Company; Karl Keirstead, Jobin Mathew, and Imtiaz Koujalgi

7

Deutsche Bank; Shebly Seyrafi at FBN Securities; Daniel Ives and Jim Moore at FBR Capi

8

Markets; Hendi Susanto at Gabelli & Company; Greg Dunham and Matthew Niknam

9

Goldman Sachs; Michael Kim at Imperial Capital; Sterling Auty, Saket Kalia, Kenneth

10

Talanian Jr., Darren Jue, Jackson E. Ader, and Sumeet Surana at J.P. Morgan; Erik Suppiger a

11

John Lucia at JMP Securities; Keith Weiss and Melissa Gorham at Morgan Stanley; R

12

Sherlund at Nomura Asset Management; Shaul Eyal at Oppenheimer; Rob Owens at Paci

13

Crest Securities; Andrew J. Nowinski and Ryan R. Bergan at Piper Jaffray; Jonathan Ruykha

14

and Nathan Leiphardt at Stephens Inc.; Gur Talpaz at Stifel Nicolaus; Richard Williams, Sr

15

Nandury, and Srini Sundararajan at Summit Research; Frederick Ziegel at Topeka Capi

16

Markets; Brent Thill, Reid Menge, John Byun, and Fatima Boolani at UBS Investment Resear

17

Sanjit Singh, Rohit Chopra, and Ryan Flanagan at Wedbush; Gray Powell and Pr

18

Parasuraman at Wells Fargo; and Jonathan Ho and John Weidemoyer at William Blair

19

Company) at major brokerage firms who wrote reports that were distributed to the sales fo

20

and certain customers of their respective brokerage firms. Each of these reports was publi

21

available and entered the public marketplace.

22

218. As a result of the foregoing, the market for FireEye’s securities promptly

23

current information regarding FireEye from all publicly available sources and reflected

24

information in FireEye’s stock price. Under these circumstances, all purchasers of FireEye’

25

securities during the Class Period suffered similar injury through their purchase of FireEye’

26

securities at artificially inflated prices and a presumption of reliance applies.

27

28


69 NO. 5:14- CV-05204-EJD


1

XI. NO SAFE HARBOR

2

219. The statutory safe harbor provided for forward-looking statements under

3

circumstances does not apply to any of the allegedly false statements pleaded in this Com

4

Many of the specific statements pleaded herein were not identified as “forward-

5

statements” when made. To the extent there were any forward-looking statements, there were

6

meaningful cautionary statements identifying important factors that could cause actual results

7

differ materially from those in the purportedly forward-looking statements. Further, most of t

8

identified false and misleading statements and omissions herein are not forward looki

9

statements, but are statements of current and historic fact regarding FireEye’s practices.

10

220. To the extent that any of the false and misleading statements identified herein a

11

mixed statements of current fact and forward looking projection, the portion of those stateme

12

relating to current fact are not protected by the safe harbor.

13

221. Alternatively, to the extent that the statutory safe harbor does apply to a

14

forward-looking statements pleaded herein, Defendants are liable for those false forward-looki

15

statements because at the time each of those forward-looking statements was made, the parti

16

speaker knew that the particular forward-looking statement was false, and/or the forward-loo

17

statement was authorized and/or approved by an executive officer of FireEye who knew

18

those statements were false when made.

19

XII. LOSS CAUSATION/ECONOMIC LOSS

20

222. Defendants’ wrongful conduct, as alleged herein, directly and proximately cause

21

the damages suffered by Plaintiffs and the Class.

22

223. During the Class Period, as detailed herein, Defendants engaged in a scheme t

23

deceive the market and a course of conduct which artificially inflated the price of FireEye’

24

securities by (1) misrepresenting that the Mandiant integration was progressing “smoothly” an

25

“rapidly”; and (2) failing to disclose significant integration issues from the Mandiant acquisition

26

including problems integrating the latest Mandiant MIR product with the FireEye platform tha

27

drove customers to competitors, confusion in the combined sales force over selling unfamilia

28

products to customers that were unwilling to be “cross-sold,” incentives to get retainers in p


70 NO. 5:14- CV-05204-EJD


1

over selling product; and elongation of product sales cycles as a result of the disruption

2

by these integration issues, resulting in product revenue deceleration.

3

224. The truth about FireEye’s integration problems and product sales decline

4

partially disclosed in a press release issued after the market closed on May 6, 2014 in wh

5

Defendants announced product revenue (which analysts, e.g. , Deutsche Bank, viewed

6

“driv[ing] overall momentum”) that meaningfully fell short of analysts’ estimates. In respon

7

FireEye’s stock price plummeted 22.84% to close at $28.65 per share on May 7, 2014

8

unusually heavy trading volume, with 23,205,700 shares traded compared with an average d

9

trading volume over the Class Period of 5,850,012 shares.

10

225. The truth about FireEye’s continuing problems with product sales and integratio

11

issues was further partially disclosed (1) in a press release issued after the market closed o

12

August 5, 2014 in which Defendants announced a revenue recognition change that would allo

13

the Company to record revenue at shipping for its email appliance product, rather than th

14

historical recognition over a contractual term; and (2) in a press release issued after the mark

15

closed on August 5, 2014 in which Defendants announced the appointment of a new global hea

16

of sales, and on the August 5, 2014 earnings call in which Defendants acknowledged “co

17

savings” from “personnel consolidation.” In response, FireEye’s stock price fell a furth

18

11.42%, to close at $30.78 per share on August 6, 2014 on unusually heavy trading volume, wit

19

12,839,900 shares traded compared with an average daily trading volume over the Class Perio

20

of 5,850,012 shares.

21

226. The entire truth about FireEye’s decelerating product revenue was final

22

disclosed in a press release issued after the market closed on November 4, 2014 in whic

23

Defendants announced a pronounced shift in revenue from product to services, as well a

24

revenues at the low end of their previous guidance and lower than analysts’ consensu

25

expectations. In response, FireEye’s stock price plummeted 14.98%, on unusually heavy tradin

26

volume, with 25,224,200 shares traded compared with an average daily trading volume over th

27

Class Period of 5,850,012 shares.

28


71 NO. 5:14- CV-05204-EJD


1

COUNT I

2

Violation Of Section 10(b) Of The Exchange Act And Rule 10b-5(b)

3

Promulgated Thereunder Against All Defendants

4

227. Plaintiffs repeat and reallege each and every allegation contained above as if fully

5

I set forth herein.

6

228. During the Class Period, Defendants carried out a plan, scheme and course o

7

conduct which was intended to and, throughout the Class Period, did: (i) deceive the investing

8

public regarding FireEye’s business, operations, management and the intrinsic value of FireEye’

9

securities; and (ii) cause Plaintiff and other members of the Class to purchase securities a

10

artificially inflated prices. In furtherance of this unlawful scheme, plan and course of conduct

11

Defendants, and each of them, took the actions set forth herein.

12

229. Defendants (a) employed devices, schemes, and artifices to defraud; (b) made

13

untrue statements of material fact and/or omitted to state material facts necessary to make the

14

statements not misleading; and (c) engaged in acts, practices, and a course of business which

15

operated as a fraud and deceit upon the purchasers of the Company’s securities in an effort to

16

maintain artificially high market prices for FireEye’s securities in violation of Section 10(b) o

17

the Exchange Act and Rule 10b-5. All Defendants are sued as primary participants in the

18

wrongful and illegal conduct charged herein.

19

230. Defendants, individually and in concert, directly and indirectly, by the use, mean

20

or instrumentalities of interstate commerce and/or of the mails, engaged and participated in a

21

continuous course of conduct to conceal adverse material information about the adverse i

22

of integration issues from the Mandiant acquisition on product sales and product revenue durin

23

the Class Period, as specified herein.

24

231. The Defendants employed devices, schemes and artifices to defraud, while

25

possession of material adverse non-public information, and engaged in acts, practices, and

26

course of conduct as alleged herein in an effort to assure investors of FireEye’s value an

27

performance and continued substantial growth, which included the making of, or t

28

participation in the making of, untrue statements of material facts and omitting to state materi


72 NO. 5:14- CV-05204-EJD


1

facts necessary in order to make the statements made about FireEye, the integration of

2

and FireEye’s product sales and product revenue in the light of the circumstances under w

3

they were made, not misleading, as set forth more particularly herein, and engaged i

4

transactions, practices and a course of business which operated as a fraud and deceit upon

5

purchasers of FireEye’s securities during the Class Period.

6

232. Each of the Individual Defendants’ primary liability arises from the fo

7

facts: (i) the Individual Defendants were high-level executives and/or directors at the Compa

8

during the Class Period and members of the Company’s management team or had cont

9

thereof; (ii) each of these Defendants, by virtue of his responsibilities and activities as a sen

10

officer of the Company was privy to and participated in the creation, development and report

11

of the Company’s internal budgets, plans, projections and/or reports; (iii) each of th

12

Defendants enjoyed significant personal contact and familiarity with the other Defendants a

13

was advised of and had access to other members of the Company’s management team, inter

14

reports and other data and information about the Company’s finances, operations, and sales at

15

relevant times; and (iv) each of these Defendants was aware of the Company’s dissemination

16

information to the investing public which they knew or recklessly disregarded was materia

17

false and misleading, or failed to disclose material information that made those statements fa

18

and misleading.

19

233. The Defendants had actual knowledge of the misrepresentations and omissions o

20

I material facts set forth herein, or acted with reckless disregard for the truth in that they failed

21

ascertain and to disclose such facts, even though such facts were available to them. Defendants

22

material misrepresentations and/or omissions were done knowingly or recklessly and for the

23

purpose and effect of concealing the problems stemming from the Mandiant acquisition and thei

24

detrimental impact on the sales force, product sales, and product revenue from the investing

25

public and supporting the artificially inflated price of the Company’s securities. A

26

demonstrated by Defendants’ misstatements of the Mandiant integration, FireEye’s produc

27

sales, and product revenue throughout the Class Period, Defendants, if they did not have actua

28

knowledge of the misrepresentations and omissions alleged, were reckless in failing to obtain


73 NO. 5:14- CV-05204-EJD


1

such knowledge by deliberately refraining from taking those steps necessary to discover

2

those statements were false or misleading.

3

234. As a result of the dissemination of the materially false and misleading i

4

and failure to disclose material facts, as set forth above, the market price of FireEye’s securitie

5

was artificially inflated during the Class Period. In ignorance of the fact that market price o

6

FireEye’s securities was artificially inflated, and relying directly or indirectly on the false an

7

misleading statements made by Defendants, or upon the integrity of the market in which th

8

securities trade, and/or on the absence of material adverse information that was known to o

9

recklessly disregarded by Defendants but not disclosed in public statements by Defendant

10

during the Class Period, Plaintiffs and the other members of the Class acquired FireEye’

11

securities during the Class Period at artificially high prices and were damaged when the value o

12

their securities declined upon disclosure of the truth about Defendants’ false and misleadin

13

statements and omissions.

14

235. At the time of said misrepresentations and omissions, Plaintiffs and

15

members of the Class were ignorant of their falsity, and believed them to be true. Had Pla

16

and the other members of the Class and the marketplace known the truth regarding the Ma

17

integration and FireEye’s product sales, which were not disclosed by Defendants, Plaintiffs an

18

other members of the Class would not have purchased or otherwise acquired their FireEye’

19

securities, or, if they had acquired such securities during the Class Period, they would not hav

20

done so at the artificially inflated prices which they paid.

21

236. By virtue of the foregoing, Defendants have violated Section 10(b) of th

22

Exchange Act, and Rule 10b-5 promulgated thereunder.

23

237. As a direct and proximate result of Defendants’ wrongful conduct, Plaintiffs an

24

the other members of the Class suffered damages in connection with their respective purchase

25

and sales of the Company’s securities during the Class Period.

26

27

28


74 NO. 5:14- CV-05204-EJD


1

COUNT II

2

Violation Of Section 10(b) Of The Exchange Act And Rule 10b-5(a) and (c)

3

Promulgated Thereunder Against All Defendants

4

238. Plaintiffs repeat and reallege each and every allegation contained above as if

5

I set forth herein.

6

239. This Count is brought solely and exclusively under the provisions of Rule 1

7

5(a) and (c). Accordingly, Plaintiff need not allege in this Count nor prove in this case that

8

of the Defendants made any misrepresentations or omissions of material fact for which they m

9

also be liable under Rule 10b-5(b) and/or any other provisions of law.

10

240. During the Class Period, Defendants carried out a common plan, scheme,

11

unlawful course of conduct that was intended to, and did: (i) deceive the investing public

12

including Plaintiffs and the Class; (ii) artificially inflate the market price of FireEye’s securities

13

and (iii) cause Plaintiffs to purchase FireEye’s securities at artificially inflated prices.

14

241. In furtherance of this unlawful plan, scheme and course of conduct, Defendant

15

employed devices, schemes and artifices to defraud, and knowingly and/or recklessly engaged in

16

acts, transactions, practices, and courses of business that operated as a fraud and deceit upon

17

Plaintiffs and the Class in connection with their purchases of FireEye’s securities, in violation o

18

Section 10(b) of the Exchange Act and Rule 10b-5(a) and (c) promulgated thereunder.

19

242. Defendants’ fraudulent devices, schemes, artifices and deceptive acts, practices

20

and course of business included the knowing and/or reckless suppression and concealment

21

information regarding the Mandiant integration and its detrimental impact on FireEye’s prod

22

sales and product revenue.

23

243. Plaintiffs and the Class reasonably relied upon the integrity of the market

24

which FireEye’s securities traded.

25

244. During the Class Period, Plaintiffs and the Class were unaware of Defendants

26

I fraudulent scheme and unlawful course of conduct. Had Plaintiffs and the Class known o

27

Defendants’ unlawful scheme and unlawful course of conduct, they would not have

28


75 NO. 5:14- CV-05204-EJD


1

FireEye’s securities, or if they had, would not have done so at the artificially inflated prices

2

I for such securities.

3

245. As a direct and proximate result of Defendants’ scheme to defraud and

4

I unlawful course of conduct, Plaintiffs and the Class suffered damages in connection with

5

purchases of FireEye’s securities during the Class Period.

6

246. By reason of the foregoing, Defendants violated Section 10(b) of the Exc

7

Act and Rule 10b-5(a) and (c) promulgated thereunder, and are liable to Plaintiffs and the

8

for damages suffered in connection with their purchases of FireEye’s securities during the

9

Period.

10

COUNT III

11

Violation Of Section 20(a) Of The Exchange Act Against the Individual Defendants

12

13

247. Plaintiffs repeat and reallege each and every allegation contained above as if

14

I set forth herein.

15

248. The Individual Defendants acted as controlling persons of FireEye within the

16

meaning of Section 20(a) of the Exchange Act as alleged herein. By virtue of their high-leve

17

positions, and their ownership and contractual rights, participation in and/or awareness of

18

Company’s core operations and/or intimate knowledge of the false statements filed by

19

Company with the SEC and otherwise disseminated to the investing public, the Individ

20

Defendants had the power to influence and control and did influence and control, directly

21

indirectly, the decision-making of the Company, including the content and dissemination of

22

various statements which Plaintiffs contend are false and misleading. The Individual Defenda

23

were provided with or had unlimited access to copies of the Company’s reports, press relea

24

public filings and other statements regarding the Mandiant integration and FireEye’s prod

25

sales and product revenue prior to and/or shortly after these statements were issued and had

26

ability to prevent the issuance of the statements or cause the statements to be corrected.

27

249. In particular, each of the Individual Defendants had direct and supervi

28

involvement in the day-to-day operations of the Company and, therefore, is presumed to h


76 NO. 5:14- CV-05204-EJD


1

had the power to control or influence the particular transactions giving rise to the

2

I violations as alleged herein, and exercised the same.

3

250. As set forth above, FireEye violated Section 10(b) and Rule 10b-5 by its acts a

4

omissions as alleged in this Complaint. By virtue of their positions as controlling persons,

5

Individual Defendants are liable pursuant to Section 20(a) of the Exchange Act as cont

6

persons of FireEye, the primary violator. As a direct and proximate result of the Individ

7

Defendants’ wrongful conduct, Plaintiffs and other members of the Class suffered damages

8

connection with their purchases of the Company’s securities during the Class Period.

9

WHEREFORE , Plaintiffs pray for relief and judgment, as follows:

10

(a) Determining that this action is a proper class action and certifying

11

Boston and Fadia as class representatives under Rule 23 of the Federal Rules of Civil Pro

12

and Labaton Sucharow LLP and Glancy Prongay & Murray LLP as co-Lead Counsel;

13

(b) Awarding compensatory damages in favor of Plaintiffs and the other Clas

14

members against all Defendants, jointly and severally, for all damages sustained as a result o

15

Defendants’ wrongdoing, in an amount to be proven at trial, including interest thereon;

16

(c) Awarding Plaintiffs and the Class their reasonable costs and expense

17

incurred in this action, including counsel fees and expert fees; and

18

(d) Such other and further relief as the Court may deem just and proper.

19

JURY TRIAL DEMANDED

20

Plaintiffs hereby demand a trial by jury.

21

22

I Dated: June 29, 2015

Respectfully submitted,

23 LABATON SUCHAROW LLP

24 By: s/ Jonathan Gardner

25 Jonathan Gardner (pro hac vice)

Angelina Nguyen (pro hac vice) 26

140 Broadway New York, New York 10005

27

Telephone: (212) 907-0700 Facsimile: (212) 818-0477

28


77 NO. 5:14- CV-05204-EJD


1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

Attorneys for Plaintiff State-Boston Retirement System and Co-Lead Counsel for the Class

GLANCY PRONGAY & MURRAY LLP Lionel Z. Glancy (#134180) Ex Kano S. Sams II (#192936) Robert V. Prongay (#270796) 1925 Century Park East, Suite 2100 Los Angeles, California 90067 Telephone: (310) 201-9150 Facsimile: (310) 201-9160

Attorneys for Plaintiff Vijay Fadia and Co-Lead Counsel for the Class


78 NO. 5:14- CV-05204-EJD

27

28


1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

CERTIFICATE OF SERVICE

I hereby certify that on June 29, 2015, I authorized the electronic filing of the forego

with the Clerk of the Court using the CM/ECF system which will send notification of such fi

to the e-mail addresses denoted on the attached Electronic Mail Notice List, and I hereby cer

that I caused to be mailed the foregoing document or paper via the United States Postal Serv

to the non- CM/ECF participants indicated on the attached Manual Notice List.

I certify under penalty of perjury under the laws of the United States of America that

foregoing is true and correct. Executed on June 29, 2015.

s/ Jonathan Gardner Jonathan Gardner LABATON SUCHAROW LLP 140 Broadway New York, New York 10005 Telephone: (212) 907-0700 Fax: (212) 818-0477 E-mail: [email protected]

CERTIFICATE OF SERVICE CASE NO. 5:14- CV-05204-EJD


1

Mailing Information for a Case 5:14-cv-05204-EJD

2

John E Collins v. FireEye, Inc. et al

3

Electronic Mail Notice List

4

The following are those who are currently on the list to receive e-mail notices for this case.

5 • Boris Feldman

6

[email protected]

7 • Jonathan Gardner

8

[email protected],[email protected],[email protected] ,

9

[email protected],[email protected],[email protected],

10

[email protected]

11 • John Jasnoch

12

[email protected],[email protected]

13 • Nicole Catherine Lavallee

14

[email protected] ,[email protected]

15 • Marisa C. Livesay

16


17 • Angelina Nguyen

18

[email protected]

19 • Robert Vincent Prongay

20

[email protected] ,[email protected],[email protected],

21

[email protected]

22 • Rachele R. Rickert

23

[email protected],[email protected],[email protected]

24 • Laurence M. Rosen

25


26 • Ignacio Evaristo Salceda

27


28

IFICATE OF SERVICE NO. 5:14- CV-05204-EJD


1 • Ex Kano S. Sams , II

2

[email protected]

3 • Shimon Yiftach

4

[email protected]

5

Manual Notice List

6

The following is the list of attorneys who are not on the list to receive e-mail notices for this c

7

(who therefore require manual noticing). You may wish to use your mouse to select and copy

8

this list into your word processing program in order to create notices or labels for these

9

recipients.

10

~ (No manual recipients)

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

IFICATE OF SERVICE NO. 5:14- CV-05204-EJD

In re FireEye, Inc. Securities Litigation 14-CV-05204-Consolidated Amended Class Action Complaint

Documents