Item 1. Business

Overview

Symantec Corporation is a global leader in cybersecurity. We operate our business on a global civilian cyber intelligence threat network that tracks a vast number of threats across the Internet from hundreds of millions of mobile devices, endpoints, and servers across the globe. We believe one of our competitive advantages is our database of threat indicators. This database allows us to reduce the number of false positives and provide faster and better protection for customers through our products. We are leveraging our capabilities to deliver integrated platforms for customers. We are also pioneering solutions in markets such as cloud security, digital safety, advanced threat protection, identity protection, information protection and cyber security services.

Founded in 1982, Symantec has operations in more than 40 countries. Our principal executive offices are located at 350 Ellis Street, Mountain View, California, 94043. Our Internet home page is located at www.symantec.com.

Strategy

Our strategy is to deliver comprehensive cyber security platforms for both enterprises and consumers.

Our enterprise security strategy is to deliver an Integrated Cyber Defense Platform that allows Symantec products to share threat intelligence and improve security outcomes for customers across all control points. Symantec is the leading vendor in protecting users, information, web and messaging across an integrated platform.

Our consumer digital safety strategy is to deliver the most comprehensive consumer digital safety solutions to help people protect their information, identities, devices and families.

Following the completion of the sale of our former information management business (“Veritas”) in the fourth quarter of fiscal 2016, we completed the acquisitions of Blue Coat, Inc. (“Blue Coat”) and LifeLock, Inc. (“LifeLock”) in fiscal 2017 in order to expand our offerings in both our operating segments, as described below.

Business highlights

During fiscal 2017, we took the following actions in support of our business:

•

With the divestiture of Veritas completed, we refocused Symantec as a pure cybersecurity company. In the second fiscal quarter, we completed the acquisition of Blue Coat, a provider of advanced web and cloud security solutions for global enterprises and governments, to complement our Enterprise Security offerings. The aggregate purchase price of the Blue Coat acquisition was $4.7 billion in net consideration, of which $4.5 billion consisted of cash consideration including the repayment of approximately $1.9 billion in Blue Coat’s debt. Following the closing of the Blue Coat acquisition, we appointed Blue Coat’s Chief Executive Officer as our Chief Executive Officer and Blue Coat’s President and Chief Operating Officer as our President and Chief Operating Officer, respectively, in the second quarter of fiscal 2017. In addition, we appointed Blue Coat’s Chief Financial Officer to the position of our Executive Vice President and Chief Financial Officer in the third quarter of fiscal 2017.

•	In the fourth fiscal quarter, we completed the acquisition of LifeLock, a provider of proactive identity theft protection services for consumers and consumer risk management services for enterprises, for approximately $2.3 billion in net consideration.

•	We increased the size of our Board of Directors and appointed representatives of Silver Lake Partners and Bain Capital to our Board of Directors.

▪	We released new products and services:

◦	We launched Symantec Endpoint Protection 14, a solution that fuses endpoint technologies with advanced machine learning and memory exploit mitigation in a single agent, delivering a multi-layered solution designed to stop a wide variety of advanced threats and respond at the endpoint.

◦	We introduced Symantec Endpoint Protection Cloud, a new solution for small and mid-sized businesses (SMBs) designed to protect them from targeted attacks and ransomware. Symantec Endpoint Protection Cloud is for organizations with fewer than 1,000 employees that are looking for an effective way to protect corporate and personal devices on the corporate network.

◦

We announced Cloud Workload Protection, a solution designed to deliver automated security policy enforcement and protect applications from unknown exploits inside of both Amazon Web Service and Microsoft Azure. Cloud Workload Protection automates security for public cloud workloads delivering metered usage billing, rapid workload discovery, increased visibility and elastic protection to help ensure safe cloud workload adoption.

▪	We integrated Blue Coat and Symantec products:

◦	We announced the integration of Symantec Data Loss Prevention (“DLP”) with Symantec CloudSOC (formerly Blue Coat’s Elastica CloudSOC Cloud Access Security Broker) and Cloud Data Protection products to address the needs of the cloud generation. This integrated solution provides visibility and control over all sensitive

content that users upload, store and share via the cloud, protecting confidential information through the stages of its lifecycle.

◦	We integrated our Symantec DLP with our cloud-delivered Web Security Service, providing a seamless platform to help ensure a safe web experience and protect organizational data.

◦	We combined Symantec and Blue Coat’s security telemetry which has led to a series of significant protection improvements as well as discoveries of new attack campaigns.

•	Symantec’s Board of Directors increased the company’s share repurchase authorization by $510 million. In the fourth fiscal quarter, Symantec entered into accelerated stock repurchase agreements to repurchase an aggregate of $500 million of the company’s common stock.

Operating segments, products and services

Our operating segments are significant strategic business units that offer different products and services distinguished by customer needs. Our operating segments are: Consumer Digital Safety and Enterprise Security.

Consumer Digital Safety

Our Consumer Digital Safety segment focuses on providing a comprehensive Digital Safety solution to protect information, devices, networks and the identities of consumers. This solution includes our Norton-branded services, which provide multi-layer security across major desktop and mobile operating systems, public Wi-Fi connections, and home networks, to defend against increasingly complex online threats to individuals, families and small businesses, and our LifeLock-branded identity protection services. Our LifeLock-branded identity protection services primarily consist of identifying and notifying users of identity-related and other events and assisting users in remediating their impact. With the addition of LifeLock-branded identity protection services, we are providing a comprehensive digital safety platform designed to protect information across devices, customer identities and the connected home and family and accelerating our leadership in Consumer Digital Safety to protect all aspects of consumers’ digital lives.

Enterprise Security

Our Enterprise Security segment protects organizations so they can securely conduct business while leveraging new platforms and data. Our Enterprise Security segment includes our endpoint protection products, endpoint management, messaging protection products, information protection products, cyber security services, website security and advanced web and cloud security offerings. Our enterprise endpoint and network security and management offerings support evolving endpoints and networks, providing advanced threat protection while helping reduce cost and complexity. These solutions are delivered through various methods, such as software, appliance, Software-as-a-Service (“SaaS”) and managed services.

The addition of Blue Coat’s suite of network and cloud security products to our innovative Enterprise Security product portfolio has enhanced our threat protection and information protection products while providing us with complementary products, such as advanced web and cloud security solutions, that address the network and cloud security needs of enterprises. This augmentation of our product portfolio, together with the integration of Blue Coat’s large threat database with our global civilian cyber intelligence threat network, allows us to provide an integrated cyber defense platform, addressing both endpoint and network security, and offer differentiated security solutions. It also positions us well to introduce new cybersecurity solutions that address the ever-evolving threat landscape, the changes introduced by the shift to mobile and cloud along with the adoption of Internet of Things (IoT) devices. Our enhanced portfolio also positions us well to address the challenges created by regulatory and privacy concerns.

Financial information by segment and geographic region

For information regarding our revenue by segment, revenue by geographical area, and property and equipment by geographical area, see Note 2 to the Consolidated Financial Statements in this annual report. For information regarding the amount and percentage of our revenue contributed by each of our segments and our financial information, including information about geographic areas in which we operate, see Item 7, Management’s Discussion and Analysis of Financial Condition and Results of Operations. For information regarding risks associated with our international operations, see Item 1A, Risk Factors.

Sales and go-to-market strategy

Our go-to-market network includes direct sales forces and broad e-commerce capabilities, as well as indirect sales resources that support our global partner ecosystem. We also maintain strategic relationships with a number of original equipment manufacturers (“OEMs”), Internet service providers (“ISPs”), wireless carriers, and retail and online stores through which we market and sell our products.

Consumer

We sell and market our consumer products and services to individuals, households and small businesses globally. We bring these products to market through direct marketing and co-marketing programs supported by our e-commerce and telesales platforms. In addition, we utilize Internet-based resellers, system builders, ISPs, employee benefits providers, wireless carriers, retailers, and OEMs to distribute our offerings worldwide.

Commercial

We sell and market our products and related services to small, medium and large customers through field sales and inside sales forces that leverage indirect sales partners around the world that are specifically trained and certified to sell our solutions. These partners include national solution providers, regional solution providers, national account resellers, global/federal system integrators and managed service providers. Our products and services are also available on our e-commerce platform, as well as through authorized distributors and OEMs, which incorporate our technologies into their products, bundle our products with their offerings, or serve as authorized resellers of our products.

Enterprise

We sell and market our products and related services to large enterprises, including government and public sector customers, through our field sales force. This field sales team is responsible for leveraging our global partner ecosystem primarily targeting senior executives and IT department personnel responsible for managing a company’s highest-order IT initiatives.

Research and development

Symantec embraces a global research and development strategy to drive organic innovation. Our engineers and researchers are focused on delivering new versions of existing product lines as well as developing entirely new offerings to drive the company’s leadership in cybersecurity. We also have a technology research organization focused on short, medium, and longer-term applied research projects, with the goal of transferring completed innovations into our product groups for commercialization.

Symantec’s Security Technology and Response organization consists of a global team of security engineers, threat analysts, and researchers that provide the underlying functionality, content, and support for many of our consumer, commercial and enterprise security products. Our security experts analyze threat telemetry collected through our vast cyber intelligence networks to protect our customers against current and emerging threats. Our research and development teams also leverage this vast amount of data and related insights to develop new technologies and approaches, including our Unified Security analytics platform, in order to improve security outcomes for our customers.

Research and development expenses were $823 million, $748 million, and $812 million in fiscal 2017, 2016, and 2015, respectively, representing approximately 20%, 21% and 21% of revenue in fiscal 2017, 2016 and 2015, respectively. The percentage fluctuates between periods as a result of a variety of factors, including changes in sales level and foreign currency exchange rates. We believe that technical leadership is essential to our success, and we expect to continue to commit substantial resources to research and development.

Support

Symantec has support facilities throughout the world, staffed by technical product experts knowledgeable in the operating environments in which our products are deployed. Our technical support experts assist customers with issue resolution and threat detection.

Our consumer support program provides self-help online services and phone, chat, and email support to consumers worldwide. Most of our Norton Security products come with automatic downloads of the latest virus definitions, application bug fixes, and patches, as well as a “Virus Protection Promise,” which in some markets provides free virus removal services to customers whose protected computers become infected. Our LifeLock offerings come with support 24x7x365 and remediation services during normal business hours.

We provide customers various levels of enterprise support offerings. Our enterprise security support program offers annual maintenance support contracts, including content, upgrades, and technical support. Our standard technical support includes: self-service options delivered by telephone or electronically during the contracted-for hours, immediate patches for severe problems, periodic software updates, and access to our technical knowledge base and frequently asked questions.

Significant customers

In each of fiscal 2017, 2016 and 2015, no customer accounted for more than 10% of our total net revenues. Two distributors and one distributor accounted for more than 10% of our gross accounts receivable as of March 31, 2017 and April 1, 2016, respectively.

Acquisitions

Our strategy will be complemented by business combinations that fit strategically and meet specific profitability hurdles. Our acquisitions are designed to enhance the features and functionality of our existing products and extend our product leadership in core markets. We consider time-to-market, synergies with existing products, and potential market share gains when evaluating the economics of acquisitions of technologies, product lines, or companies. We may acquire or dispose of other technologies, products, and companies in the future. See Note 6 to the Consolidated Financial Statements for information regarding our acquisitions in fiscal 2017.

Competition

Our markets are consolidating, highly competitive, and subject to rapid changes in technology. The competitive landscape has changed significantly over the past few years, with new competition arising. Much of the market growth has come from startups whose focus is on solving a specific customer issue or delivering a niche-oriented product and from larger integration providers that increasingly are looking to put various types of protection into their platforms. We are focused on delivering

comprehensive customer solutions, integrating across our broad product portfolio and partnering with other technology providers to differentiate ourselves from the competition. We believe that the principal competitive factors necessary to be successful in our industry include product quality and effectiveness, time-to-market, price, reputation, financial stability, breadth of product offerings, customer support, brand recognition, and effective sales and marketing efforts.

In addition to the competition we face from direct competitors, we face indirect or potential competition from retailers, application providers, operating system providers, network equipment manufacturers, and other OEMs who may provide various solutions and functions in their current and future products. We also compete for access to retail distribution channels and for spending at the retail level and in corporate accounts. In addition, we compete with other software companies, operating system providers, network equipment manufacturers, and other OEMs to acquire technologies, products, or companies and to publish software developed by third parties. We also compete with other software companies in our effort to place our products on the computer equipment sold to consumers and enterprises by OEMs.

Most of the channels in which our products are offered are highly competitive. Some of our consumer competitors are intensely focused on customer acquisition, which has led competitors to offer their technology for free, engage in aggressive marketing, or enter into competitive partnerships. We view our competitive landscape as follows:

•	Our primary security competitors are McAfee (formerly Intel Security), Microsoft Corporation (“Microsoft”), and Trend Micro Inc. There are also several freeware providers and regional security companies that we compete against.

•	For our consumer backup offerings, our primary competitors are Carbonite, Inc. and Dell EMC.

•	In Identity Protection, our competitors are the credit bureaus that include Experian, Equifax, and TransUnion, as well as others, such as Affinion, EWS, Intersections, CSID, and LexisNexis.

•	In the Secure Socket Layer Certificate market, our primary competitors are Comodo Group, Inc., DigiCert, Inc. and Let’s Encrypt.

•	In the email security market, our primary competitors are Proofpoint, Inc. and Microsoft.

•	Our primary competitors in the managed security services business are SecureWorks Corporation and International Business Machines Corporation (“IBM”).

•	Our principal competitors in the web security gateway market are McAfee, Zscaler, Inc. (“Zscaler”), Forcepoint LLC and Cisco Systems, Inc. (“Cisco”). In addition, we expect additional competition from other established and emerging companies as the web security gateway market continues to develop and expand through further consolidation.

•	Our principal competitors in the cloud security services market are Zscaler and Cisco. In addition, we expect additional competition from other established and emerging companies as the market for security-as-a-service continues to develop and expand and as consolidation occurs.

•

Our principal competitors in the advanced threat protection market and incident response, analytics and forensics market include McAfee, IBM and Dell EMC as well as independent security vendors such as Palo Alto Networks Inc., FireEye, Inc., Niksun and Trend Micro Inc. Further, as new IT budgets are created to support next-generation threat protection, we expect to compete with more highly specialized vendors as well as larger vendors that may continue to acquire or bundle their products.

•	Our principal competitors in the WAN optimization market are Riverbed Technology, Inc. and Cisco. In addition, we expect additional competition from other established and emerging companies as the WAN optimization market continues to develop and expand and as consolidation occurs.

Intellectual property

Protective measures

We regard some of the features of our internal operations, software, and documentation as proprietary and rely on copyright, patent, trademark and trade secret laws, confidentiality procedures, contractual arrangements, and other measures to protect our proprietary information. Our intellectual property is an important and valuable asset that enables us to gain recognition for our products, services, and technology and enhance our competitive position.

As part of our confidentiality procedures, we generally enter into non-disclosure agreements with our employees, distributors, and corporate partners and we enter into license agreements with respect to our software, documentation, and other proprietary information. These license agreements are generally non-transferable and have either a perpetual or subscription based time limited term. We also educate our employees on trade secret protection and employ measures to protect our facilities, equipment, and networks.

Trademarks, patents, copyrights, and licenses

Symantec and the Symantec logo are trademarks or registered trademarks in the U.S. and other countries. In addition to Symantec and the Symantec logo, we have used, registered, or applied to register other specific trademarks and service marks to help distinguish our products, technologies, and services from those of our competitors in the U.S. and foreign countries and jurisdictions. We enforce our trademark, service mark, and trade name rights in the U.S. and abroad. The duration of our trademark registrations varies from country to country, and in the U.S. we generally are able to maintain our trademark rights and renew any trademark registrations for as long as the trademarks are in use.

We have approximately 2,100 patents, in addition to foreign patents and pending U.S. and foreign patent applications, which relate to various aspects of our products and technology. The duration of our patents is determined by the laws of the country of issuance and for the U.S. is typically 17 years from the date of issuance of the patent or 20 years from the date of filing of the patent application resulting in the patent, which we believe is adequate relative to the expected lives of our products.

Our products are protected under U.S. and international copyright laws and laws related to the protection of intellectual property and proprietary information. We take measures to label such products with the appropriate proprietary rights notices, and we actively enforce such rights in the U.S. and abroad. However, these measures may not provide sufficient protection, and our intellectual property rights may be challenged. In addition, we license some intellectual property from third parties for use in our products, and generally must rely on the third party to protect the licensed intellectual property rights. While we believe that our ability to maintain and protect our intellectual property rights is important to our success, we also believe that our business as a whole is not materially dependent on any particular patent, trademark, license, or other intellectual property right.

Seasonality

As is typical for many large technology companies, our business is seasonal. Orders are generally higher in our third and fourth fiscal quarters and lower in our first and second fiscal quarters. Revenue generally reflects similar seasonal patterns but to a lesser extent than orders because revenue is not recognized until an order is shipped or services are performed and other revenue recognition criteria are met, and because a significant portion of our in-period revenue comes from our deferred revenue balance.

Employees

As of March 31, 2017, we employed more than 13,000 people worldwide.

Available information

Our Internet home page is located at www.symantec.com. We make available free of charge our annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and amendments to those reports as soon as reasonably practicable after we electronically file such material with the Securities and Exchange Commission (“SEC”) on our investor relations website located at www.symantec.com/invest. The information contained, or referred to, on our website is not part of this annual report unless expressly noted. The SEC maintains a website that contains reports, proxy and information statements, and other information regarding our filings at http://www.sec.gov. In addition, you may read and copy any filing that we make with the SEC at the public reference room maintained by the SEC, located at 100 F Street, N.E., Washington, D.C. 20549. Please call the SEC at 1-800-SEC-0330 for further information about the public reference room.