Item 1. Business

Overview

Symantec Corporation is a global leader in security. We operate our business on a global civilian cyber intelligence threat network and track a vast number of threats across the Internet from hundreds of millions of mobile devices, endpoints, and servers across the globe. We believe one of our competitive advantages is our database of threat indicators which allows us to reduce the number of false positives and provide faster and better protection for customers through our products. Through the delivery of new and enhanced solutions, we are integrating our security offerings across our portfolio. We are also developing novel solutions in growing markets like cloud, advanced threat protection, information protection and cyber security services. Founded in 1982, Symantec has operations in more than 35 countries and our principal executive offices are located at 350 Ellis Street, Mountain View, California, 94043. Our Internet home page is located at www.symantec.com.

Strategy

Our security strategy is to deliver a unified security analytics platform that provides big data analytics, utilizes our vast telemetry, provides visibility into real-time global threats, and powers Symantec and third-party security analytics applications; leverage this analytics platform to provide best-in-class consumer and enterprise security products; and offer cyber security services that provide a full-suite of services from monitoring to incident response to threat intelligence, all supported by over 500 cyber security experts and nine global security response centers.

During fiscal 2016, we executed on our five priorities: running our business with a portfolio approach by managing certain businesses for operating margin; prioritizing investments for growth; further reducing costs and improving efficiencies; attracting top talent to our executive team; and continuing to return significant cash to stockholders.

After closing the divestiture of our information management business ("Veritas"), as the world leader in cybersecurity, we are more focused than ever on the following priorities: delivering upon our Unified Security strategy, building our enterprise security pipeline and go-to-market capabilities, improving our cost structure, and fulfilling our commitment to allocate capital to our stockholders.

Divestiture of Veritas

In August 2015, we entered into a definitive agreement to sell the assets of Veritas to The Carlyle Group and certain co-investors ("Carlyle"). The transaction closed on January 29, 2016, at which time, we received net consideration of $6.6 billion in cash, excluding transaction costs, and 40 million B common shares of Veritas and Veritas assumed certain liabilities. We now have two reporting segments, Consumer Security and Enterprise Security.

Business highlights

During fiscal 2016, we took the following actions in support of our business:

•	We completed the divestiture of Veritas and refocused Symantec as a pure cybersecurity company.

•	We launched our SecureOne channel partner program designed specifically to help security-focused partners grow their businesses.

•	In Enterprise Security, Symantec Endpoint Protection won AV-TEST’s “Best Protection 2015 Award” for corporate users.

•	In Consumer Security, Norton Security won AV-TEST’s coveted “Best Protection Award 2015” for “home user” security.

•	We released new products and services:

◦	We launched Advanced Threat Protection endpoint, email, and network solutions, which detect and remediate advanced threats across control points, from a single console with just a click, without deployment of new endpoint agents.

◦	We launched Encryption Everywhere, a website security package available through web hosting providers that integrates encryption into websites from the moment they are created.

•	We completed a $500 million strategic investment by Silver Lake Partners and in connection with this investment, Kenneth Hao joined our Board of Directors.

•	We increased our capital return program to $5.5 billion, including a $2.6 billion special dividend that was paid in March 2016 and a total of $1.5 billion in accelerated share repurchase ("ASR") transactions that were announced in November 2015 and March 2016.

Operating segments and products

Our operating segments are significant strategic business units that offer different products and services distinguished by customer needs. The two reporting segments, which are the same as our operating segments, are: Consumer Security and Enterprise Security.

Consumer Security

Our Consumer Security segment focuses on making it simple for customers to be productive and protected at home and at work. Our Norton-branded services provide multi-layer security and identity protection on major desktop and mobile operating systems, to defend against increasingly complex online threats to individuals, families, and small businesses.

Our Norton Security products help customers protect against increasingly complex threats and address the need for identity protection, while also managing the rapid increase in mobile and digital data, such as personal financial records, photos, music, and videos.

Enterprise Security

Our Enterprise Security segment protects organizations so they can securely conduct business while leveraging new platforms and data. Our Enterprise Security segment includes our threat protection products, information protection products, cyber security services, and website security offerings, previously named trust services.

These products and services help our customers secure their information in transit and wherever it resides in the network path, from the user’s device to the data’s resting place. These products protect customer data from sophisticated threats such as advanced protection threats, malicious spam and phishing attacks, malware, drive-by website infections, hackers, and cyber criminals. In addition, these products help to prevent the loss of confidential data by insiders, and help customers achieve and maintain compliance with laws and regulations. Our enterprise endpoint security and management offerings support the evolving endpoint, providing advanced threat protection while helping reduce cost and complexity. These solutions are delivered through various methods, such as software, appliance, Software-as-a-Service ("SaaS"), and managed services.

Financial information by segment and geographic region

For information regarding our revenue by segment, revenue by geographical area, and property and equipment by geographical area, see Note 8 of the Notes to Consolidated Financial Statements in this annual report. For information regarding the amount and percentage of our revenue contributed by each of our segments and our financial information, including information about geographic areas in which we operate, see Item 7, Management’s Discussion and Analysis of Financial Condition and Results of Operations. For information regarding risks associated with our international operations, see Item 1A, Risk Factors.

Sales and go-to-market strategy

Our go-to-market network includes direct sales forces and broad e-commerce capabilities, as well as indirect sales resources that support our global partner ecosystem. We also maintain important relationships with a number of original equipment manufacturers (“OEMs”), Internet service providers (“ISPs”), and retail and online stores through which we market and sell our products.

Our dedicated renewals team remains focused on extending customer relationships and renewing customer contracts with us. We also continued to streamline our indirect sales strategy to have fewer, more focused partners with specialized partner programs to enhance sales. We believe these changes provide customers with a high-quality sales and post-sales support experience, while also enabling us to expand our business.

Consumer

We sell and market our consumer products and services to individuals, households and small businesses globally. We bring these products to market through our e-commerce platform, distributors, direct marketers, Internet-based resellers, system builders, ISPs, wireless carriers, and retailers worldwide. We also maintain a limited number of partnerships with OEMs globally to distribute our Internet security and online backup offerings.

Commercial

We sell and market our products and related services to small, medium and large customers through field sales and inside sales forces that leverage indirect sales partners around the world that are specifically trained and certified to sell our solutions. These partners include national solution providers, regional solution providers, national account resellers, global/federal system integrators and managed service providers. Our products and services are also available on our e-commerce platform, as well as through authorized distributors and OEMs who incorporate our technologies into their products, bundle our products with their offerings, or serve as authorized resellers of our products.

Enterprise

We sell and market our products and related services to large enterprises, including government and public sector customers, through our field sales force. This field sales team is responsible for leveraging our global partner ecosystem primarily targeting senior executives and IT department personnel responsible for managing a company’s highest-order IT initiatives.

Research and development

Symantec embraces a global research and development strategy to drive organic innovation. Our engineers and researchers are focused on delivering new versions of existing product lines as well as developing entirely new offerings to drive the company’s leadership in cybersecurity. We also have a technology research organization focused on short, medium, and longer-term applied research projects, with the goal of transferring completed innovations into our product groups for commercialization.

Symantec’s Security Technology and Response organization consists of a global team of security engineers, threat analysts, and researchers that provide the underlying functionality, content, and support for many of our consumer, commercial and enterprise security products. Our security experts analyze threat telemetry collected through Symantec’s massive global sensor network, one of the largest cyber intelligence networks in the world, to protect our customers against current and emerging threats. Our research and development teams also leverage this vast amount of data and related insights to develop new technologies and approaches, including our Unified Security analytics platform, in order to improve security outcomes for our customers.

Research and development expenses were $748 million, $812 million, and $722 million in fiscal 2016, 2015, and 2014, respectively, representing approximately 21%, 21% and 17% of revenue in fiscal 2016, 2015 and 2014, respectively. The percentage fluctuates between periods as a result of a variety of factors, including changes in sales level and foreign currency exchange rates. We believe that technical leadership is essential to our success, and we expect to continue to commit substantial resources to research and development.

Support

Symantec has support facilities throughout the world, staffed by technical product experts knowledgeable in the operating environments in which our products are deployed. Our technical support experts assist customers with issue resolution and threat detection.

We provide consumers with various levels of support offerings. Consumers receive automatic downloads of the latest virus definitions, application bug fixes, and patches for most of our consumer products. Our consumer support program provides self-help online services and phone, chat, and email support to consumers worldwide. In addition, our Norton Security products come with a “Virus Protection Promise,” which in some markets provides free virus removal services to customers whose protected computers become infected.

We provide customers various levels of enterprise support offerings. Our enterprise security support program offers annual maintenance support contracts, including content, upgrades, and technical support. Our standard technical support includes: self-service options delivered by telephone or electronically during the contracted-for hours, immediate patches for severe problems, periodic software updates, and access to our technical knowledge base and frequently asked questions.

Significant customers

In each of fiscal 2016, 2015 and 2014, no customer accounted for more than 10% of our total net revenues. One distributor accounted for 10% of our gross accounts receivable as of April 1, 2016.

Acquisitions

Our strategy will be complemented by business combinations that fit strategically and meet specific profitability hurdles. Our acquisitions are designed to enhance the features and functionality of our existing products and extend our product leadership in core markets. We consider time-to-market, synergies with existing products, and potential market share gains when evaluating the economics of acquisitions of technologies, product lines, or companies. We may acquire or dispose of other technologies, products, and companies in the future.

We did not make any material acquisitions during fiscal 2016.

Competition

Our markets are consolidating, highly competitive, and subject to rapid changes in technology. The competitive landscape has changed significantly over the past few years, with new competition arising. Much of the market growth has come from startups whose focus is on solving a specific customer issue or delivering a niche-oriented product and from larger integration providers that increasingly are looking to put various types of protection into their platforms. We are focused on delivering comprehensive customer solutions, integrating across our broad product portfolio and partnering with other technology providers to differentiate ourselves from the competition. We believe that the principal competitive factors necessary to be successful in our industry include product quality and effectiveness, time-to-market, price, reputation, financial stability, breadth of product offerings, customer support, brand recognition, and effective sales and marketing efforts.

In addition to the competition we face from direct competitors, we face indirect or potential competition from retailers, application providers, operating system providers, network equipment manufacturers, and other OEMs who may provide various solutions and functions in their current and future products. We also compete for access to retail distribution channels and for spending at the retail level and in corporate accounts. In addition, we compete with other software companies, operating system providers, network equipment manufacturers, and other OEMs to acquire technologies, products, or companies and to publish software developed by third parties. We also compete with other software companies in our effort to place our products on the computer equipment sold to consumers and enterprises by OEMs.

Most of the channels in which our products are offered are highly competitive. Some of our consumer competitors are intensely focused on customer acquisition, which has led competitors to offer their technology for free, engage in aggressive marketing, or enter into competitive partnerships. Our primary security competitors are Intel Corporation, Microsoft Corporation (“Microsoft”), and Trend Micro Inc. There are also several freeware providers and regional security companies that we compete against. For our consumer backup offerings, our primary competitors are Carbonite, Inc. and EMC Corporation. In the Secure Socket Layer Certificate market, our primary competitors are Comodo Group, Inc. and GoDaddy.com, Inc. In the SaaS security market, our primary competitors are Proofpoint and Microsoft. Our primary competitors in the managed security services business are SecureWorks Corporation and IBM Corporation.

Intellectual property

Protective measures

We regard some of the features of our internal operations, software, and documentation as proprietary and rely on copyright, patent, trademark and trade secret laws, confidentiality procedures, contractual arrangements, and other measures to protect our proprietary information. Our intellectual property is an important and valuable asset that enables us to gain recognition for our products, services, and technology and enhance our competitive position.

As part of our confidentiality procedures, we generally enter into non-disclosure agreements with our employees, distributors, and corporate partners and we enter into license agreements with respect to our software, documentation, and other proprietary information. These license agreements are generally non-transferable and have either a perpetual or subscription based time limited term. We also educate our employees on trade secret protection and employ measures to protect our facilities, equipment, and networks.

Trademarks, patents, copyrights, and licenses

Symantec and the Symantec logo are trademarks or registered trademarks in the U.S. and other countries. In addition to Symantec and the Symantec logo, we have used, registered, or applied to register other specific trademarks and service marks to help distinguish our products, technologies, and services from those of our competitors in the U.S. and foreign countries and jurisdictions. We enforce our trademark, service mark, and trade name rights in the U.S. and abroad. The duration of our trademark registrations varies from country to country, and in the U.S. we generally are able to maintain our trademark rights and renew any trademark registrations for as long as the trademarks are in use.

We have more than 1,700 patents, in addition to foreign patents and pending U.S. and foreign patent applications, which relate to various aspects of our products and technology. The duration of our patents is determined by the laws of the country of issuance and for the U.S. is typically 17 years from the date of issuance of the patent or 20 years from the date of filing of the patent application resulting in the patent, which we believe is adequate relative to the expected lives of our products.

Our products are protected under U.S. and international copyright laws and laws related to the protection of intellectual property and proprietary information. We take measures to label such products with the appropriate proprietary rights notices, and we actively enforce such rights in the U.S. and abroad. However, these measures may not provide sufficient protection, and our intellectual property rights may be challenged. In addition, we license some intellectual property from third parties for use in our products, and generally must rely on the third party to protect the licensed intellectual property rights. While we believe that our ability to maintain and protect our intellectual property rights is important to our success, we also believe that our business as a whole is not materially dependent on any particular patent, trademark, license, or other intellectual property right.

Seasonality

As is typical for many large technology companies, our business is seasonal. Orders are generally higher in our third and fourth fiscal quarters and lower in our first and second fiscal quarters. Revenue generally reflects similar seasonal patterns but to a lesser extent than orders because revenue is not recognized until an order is shipped or services are performed and other revenue recognition criteria are met, and because a significant portion of our in-period revenue comes from our deferred revenue balance.

Employees

As of April 1, 2016, we employed more than 11,000 people worldwide, approximately 46% of whom reside in the U.S. Approximately 3,000 employees work in sales and marketing, 4,000 in research and development, 2,000 in support and services, and 2,000 in management and administration.

Available information

Our Internet home page is located at www.symantec.com. We make available free of charge our annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and amendments to those reports as soon as reasonably practicable after we electronically file such material with the Securities and Exchange Commission (“SEC”) on our investor relations website located at www.symantec.com/invest. The information contained, or referred to, on our website is not part of this annual report unless expressly noted. The SEC maintains a website that contains reports, proxy and information statements, and other information regarding our filings at http://www.sec.gov. In addition, you may read and copy any filing that we make with the SEC at the public reference room maintained by the SEC, located at 100 F Street, N.E., Washington, D.C. 20549. Please call the SEC at 1-800-SEC-0330 for further information about the public reference room.