Item 1. Business

Overview

Symantec Corporation is a global leader in cyber security. We provide cyber security products, services, and solutions to more than 350,000 organizations and 50 million individuals worldwide. Our Integrated Cyber Defense Platform helps business and government customers unify cloud and on-premises security to deliver a more effective cyber defense solution, while driving down cost and complexity. Our Cyber Safety solutions from Norton LifeLock help consumers protect their devices, online privacy, identities, and home networks.

Our business and consumer offerings are powered by the largest civilian threat intelligence network, which uses artificial intelligence, machine learning, and human intelligence to analyze trillions of rows of data every day across hundreds of millions of devices to discover and help prevent advanced threats that might otherwise go undetected. We believe this threat intelligence data is a competitive advantage, and a primary way we are able to provide faster and better protection for customers.

Founded in 1982, Symantec has operations in more than 45 countries. Our headquarters are located at 350 Ellis Street, Mountain View, California. Our internet home page is located at www.symantec.com. The information contained, or referred to, on our website is not part of this annual report unless expressly noted.

Fiscal 2019 Business Highlights

During fiscal 2019, we continued to make progress enhancing and expanding our product and services portfolio and improving product integration, partner integration, and sales delivery to help enterprise customers deploy our Integrated Cyber Defense Platform. We also made progress driving market adoption and increasing customer retention of our Consumer Cyber Safety (previously called Consumer Digital Safety) solutions, building on our Norton LifeLock product portfolio. In addition, we implemented operational improvements to reduce costs and complexity, building on the business transformation programs we completed in fiscal 2019, and leveraged synergies from the successful integration of our acquired businesses.

•	Our product development teams built extensive point-to-point integrations across endpoint, network, cloud, and email security products, responding to customer demand to consolidate vendors and enhance their security posture across control points.

•

We further extended our Integrated Cyber Defense (ICD) Platform through application programming interfaces (APIs) and engineering-level integration with more than 120 certified technology partners that have developed or are in the process of developing over 250 integrations of complementary products and services to expand our ecosystem, helping businesses implement a coordinated and robust approach to threat protection, detection, and response that improves security outcomes and drives down cost and complexity.

•

We expanded the marketing of bundled offerings of cyber safety services for consumers through the integration of our Norton-branded security services with LifeLock-branded identity theft protection services, to help individuals and families combat ever-evolving cyberthreats. Bundling these solutions enables us to combine our Norton and LifeLock demand generation and customer relationship management programs to drive new customer acquisition, improve retention, and cross-sell within our large installed base.

•	We launched significant new products to advance our portfolio and competitive position:

◦

Symantec Advanced EDR Tools and Managed EDR: We introduced Symantec’s Advanced Endpoint Detection and Response (EDR) tools and fully managed EDR (MEDR) service, enabling security teams around the world to stay ahead of threats. EDR improves incident response, threat hunting, and forensics, fortifying teams with investigation expertise and threat intelligence from a world-class team of security operations center analysts. MEDR detects stealthy attacks and examines suspicious activity for faster incident validation and response.

◦

Cloud Security Portfolio Enhancements: We expanded our cloud security portfolio to help organizations protect cloud applications and related infrastructure. Our ICD Platform offers robust cloud protection, providing visibility and control for virtually any cloud app, and integrations with CloudSOC CASB, Cloud Workload Protection (CWP), and Data Loss Protection (DLP), while enabling customers to track more risk attributes and scan cloud applications and repositories with new API Integrations.

◦	Data Loss Prevention Enhancements for Office 365: We introduced new features to protect data, whether at rest or in transit, on-premises or in the cloud, and everywhere it flows through a single management console.

◦	Cloud-based Network Security with Web Isolation: We introduced industry-first Web Isolation technology that integrates into our Web Security Service (WSS) and enables web browsing, nearly eliminating the risk of infection by zero-day malware or advanced threats.

◦

Cloud-based Network Security with Integrated Endpoint Protection: We introduced improved network-to-endpoint protection with the integration of Symantec Endpoint Protection (SEP) and SEP Mobile into WSS, allowing web traffic re-directs to WSS for enforcement of network security policies while consequently eliminating the need for a separate agent to manage traffic flow. Our new SD-Cloud Connector enables customers to combine the performance and reliability of Software Defined WAN (SD-WAN) technology with our

WSS to create a simple, high-performance method to connect branch office locations with our leading cloud security service.

◦	Targeted Attack Analytics: We expanded our Advanced Threat Protection (ATP) offering to include our targeted attack technology. This feature enables ATP customers to leverage advanced machine learning to automate the discovery of targeted attacks, one of the most dangerous intrusions in corporate networks.

•	Consistent with our strategy of acquiring companies with complementary technology to enhance our products, services, and solutions and speed time to market, we completed several acquisitions during our fiscal year 2019, including the following:

◦	Appthority. With this acquisition, we are able to provide mobile application security to our Consumer Cyber Safety customers, enabling them to analyze mobile apps for both malicious capabilities and unsafe and unwanted behaviors, such as vulnerabilities, risk of sensitive data loss, and privacy-invasive actions.

◦	Javelin. This acquisition brings advanced software technology to our Enterprise Security solutions, enabling enterprises to defend against Active Directory-based (AD) attacks through detection of AD misconfigurations and backdoors to help prevent AD reconnaissance and credentials misuse by authorized devices and applications.

◦	Luminate. With this acquisition, our solutions now incorporate software defined perimeter and zero trust technology enabling us to deliver private secure application access to all users, regardless of device, location, or infrastructure, extending the power of our ICD Platform to users and significantly extending our leadership in cloud security beyond alternative approaches.

•	We expanded our strategic partnerships in our Enterprise Security and Consumer Cyber Safety segments, including:

◦

Fortinet. We entered into an expansive partnership agreement with Fortinet in an effort to provide customers with comprehensive and robust firewall security solutions. Under this arrangement, we intend to integrate Fortinet’s Next-Generation Firewall (NGFW) capabilities into our cloud-delivered WSS and to integrate our endpoint protection solutions into the Fortinet Security Fabric platform. This technology partnership is designed to provide essential security controls across endpoint, network, and cloud environments that are critical to enforcing the zero trust security framework, a model built on the reality that threats everywhere, both inside and outside an organization, require a multi-layered approach to prevention, detection, and response.

◦

AON. We entered into a strategic partnership with AON, as part of our longer-term strategy to drive consumer adoption through business-to-business-to-consumer relationships. AON offers solutions to help high net worth individuals defend their assets against cyber criminals. The partnership provides that we will offer to AON customers features across our Consumer Cyber Safety solutions. We believe Cyber Safety is synergistic with many brands globally, such as insurers, banks, telecom providers and other organizations. As we expand Cyber Safety internationally and to address a growing array of vertical needs, we believe partnerships such as AON will expand the value we bring customers and the revenue potential for our consumer business.

Business Strategy

Our strategy is to combine best-of-breed technology with unmatched scale to deliver a comprehensive cyber security set of solutions for business and government customers, as well as consumers.

Our Enterprise Security strategy is to leverage our ICD Platform, partner ecosystem and global threat intelligence network to deliver Integrated Cyber Defense to business and government customers, helping them improve security while reducing cost and complexity. Our ICD Platform enables us to acquire new customers and cross-sell our full portfolio of products and services to existing customers and to customers of partners in our expansive ecosystem, such as Amazon.com Inc.’s AWS, Box, Inc., IBM Security, Microsoft Corporation (Microsoft), Oracle Corporation, ServiceNow, Inc., Splunk Inc., and many others.

Our Consumer Cyber Safety strategy is to combine and leverage our portfolio of Norton and LifeLock offerings to deliver a set of Cyber Safety solutions that address today’s continually evolving and increasingly complex threat landscape. This threat landscape puts consumers at increased risk of having their security, online privacy, and identities compromised. As the risks to consumers shift from PC-based attacks to more sophisticated threats such as ransomware, identity theft, and privacy risks, our software and services provide a multi-layered approach to protect consumers, regardless of device, network, or location.

Products and Services

Enterprise Security Portfolio: Integrated Cyber Defense

Our Enterprise Security portfolio includes a deep and broad mix of products, services, and solutions, delivered as part of our ICD Platform. Our platform unifies cloud and on-premises security to provide advanced threat protection and information protection across endpoints, networks, email, and cloud applications. Key components of our ICD Platform include:

•	Advanced Security Services

•	Advanced Threat Protection: Multiple layers of threat prevention, detection, and forensic technology provide a robust view of malicious activities across control points, enabling users to contain, investigate, and remediate threats.

•	Information Protection: Encryption, data loss prevention, multi-factor authentication, tagging, and analytics enable businesses and governments to protect confidential information and IT assets while managing compliance requirements and restricting access to authenticated users.

•	Identity Management: Cloud-based authentication service with multi-factor authentication to cloud apps, network, and Virtual Private Network (VPN) to reduce the risk of breaches and unauthorized access.

•	Compliance enforcement: A suite of governance, risk, and compliance tools help customers inventory their IT assets, evaluate vulnerabilities, govern information access, and automate compliance reporting for more than 100 regulatory and best-practice frameworks including GDPR, HIPAA, NIST, PCI, and SWIFT.

•	Third-party applications: Over 250 TIPP (Technology Integration Partner Program) certified integrations enhance productivity for security operations and incident response teams while extending the value of current cyber investments.

•	Control Points

•	Endpoint Security: A single agent architecture delivers multi-layered security across endpoints - desktop, server, mobile, and IoT - and enables customers to protect enterprise and mobile workforces, regardless of operating system, device, or network security approaches.

•	Network Security: Cloud and on-premises network security solutions, based on an advanced proxy architecture, provide superior defense against advanced threats, enable users to protect critical business information, and help ensure secure and compliant use of cloud applications and the web.

•	Email Security: Multiple layers of protection (including threat isolation and advanced analytics) against ransomware, spear phishing, and enterprise email compromise help identify targeted attacks and enable users to protect email against user error and data leakage.

•	Cloud Application Security: Advanced solutions that secure cloud access, cloud infrastructure, and cloud applications, providing in-depth visibility, data security, and threat protection to safeguard users, information, and workloads across public and private clouds.

•	Cyber Security Services

•	An integrated portfolio including Managed Security Services, Incident Response, and Deep Sight Threat Intelligence, driven by our private network of cyber security analysts within our global security operations centers.

•	ICD Platform Foundations

Our solutions are powered by the following critical features:

•	Threat Intelligence: The world’s largest civilian threat intelligence network applies deep security research, expert analysis, and artificial intelligence to monitor and synthesize nine trillion rows of telemetry daily, helping discover and block targeted attacks and cybercrime that would otherwise go undetected.

•	AI and Machine Learning Services: Artificial intelligence and machine learning analyze massive amounts of control point data and sift through our entire telemetry data set to help identify potential threats and accelerate response and remediation.

•	API and ICD Exchange Services: APIs and ICD Exchange (ICDx) vastly simplify integrations with ICD, providing enhanced protection, investigation, and remediation across Symantec endpoints, networks, email, cloud applications, and third-party products.

•	ICD Manager Services: A shared management console provides a single point of control for policy management, monitoring, and reporting.

•	Automation: Built-in automation simplifies investigation, accelerates response times, and minimizes damages from attacks, while reducing manual processes and cost of security operations.

•	Open Ecosystem

•	An expansive set of open APIs with over 100 certified technology partners creating the broadest ecosystem in cyber security, enabling a coordinated and best-in-class approach to threat protection, detection, and response.

In addition to our core product portfolio, Symantec offers enterprise security services including:

•	Consulting Services: We provide the experience, expertise, and industry intelligence to assist enterprises to better architect, design, implement, and optimize their security software, people, and processes. Symantec consultants guide enterprises toward solutions that meet their business goals and leave them with the knowledge to maintain and enhance their security environment.

•

Premium Support Services: Our premium support services for enterprises focus on timely and accurate issue resolution by placing a product family expert at the center of a tailored support experience, who provides technical support, manages escalations, delivers case and system reviews, oversees environmental health checks, and provides proactive services such as upgrade planning and feature optimization.

•	Cyber Security Services: We provide continual threat monitoring, customized guidance, and 24x7 personalized service within an enterprise’s security environment through our Managed Security Services, Deep Sight Intelligence, and Incident Response Services.

Consumer Cyber Safety Portfolio

Our Consumer Cyber Safety solutions consist primarily of the following product offerings which are being integrated into a unified user experience under the Norton LifeLock brand:

•

Norton Security: Our Norton Security solutions are available as a subscription service providing protection for devices against malware, viruses, adware, and ransomware on multiple platforms: Windows, Mac, Android, and iOS. Users also have access to a password manager, parental controls, and safe web browsing that blocks malicious sites and filters browser search results. Users also can perform secure cloud backups of photos, financial files, and other important documents on Windows, providing additional protection in the event ransomware attacks make these files unavailable. For mobile devices, Norton Security also filters risky apps, enables stolen device recovery, provides contact recovery, and blocks unwanted spam texts and calls. Norton Security includes 24x7 support by trained support agents who are available to assist customers.

•

LifeLock Identity Theft Protection: Our LifeLock identity theft protection solution provides identity monitoring, alerts, and restoration to our customers. LifeLock puts users in control of their identity elements, including social security numbers, bank accounts, email addresses, physical addresses, and driver’s license and phone numbers. The service alerts users on key events and recommends actions to prevent unauthorized access. If an identity theft takes place, LifeLock’s identity experts work with the user to restore their identities, managing interaction with various governmental agencies, financial institutions, and merchants - and addressing legal fees, wage loss, and associated damages.

•

Norton Wi-Fi Privacy VPN: Our Norton Wi-Fi Privacy VPN service offers a protected way to connect to the Internet, encrypting data users send over internet connections and enhancing levels of privacy online. With this service, users can confidently access private information such as passwords, bank details, and credit card numbers when using public Wi-Fi on PC, Mac, or mobile device without risk of compromise. Users can also connect globally to their favorite apps, websites, and online streaming by changing their virtual location. This service also limits the ability of websites to track users, thereby eliminating persistent personalized ads based on browsing history.

Sales and Go-to-Market Strategy

Our go-to-market network includes direct sales forces and broad e-commerce capabilities, as well as indirect sales resources that support our global partner ecosystem. We also maintain strategic relationships with a number of original equipment manufacturers (OEMs), Internet service providers (ISPs), global service integrators (GSIs), wireless carriers, and retail and online stores through which we market and sell our products.

Enterprise

We sell and market our products and services to large enterprises, including business, government, and public-sector customers, through our field sales force and reseller channels. Our field sales team leverages our global partner ecosystem, primarily targeting senior executives and IT department personnel responsible for managing a company’s highest-order IT and cyber security initiatives.

We also sell and market our products and services to small, medium, and large businesses through field sales and inside sales forces that leverage indirect sales partners around the world, who are specifically trained and certified to sell our solutions. These partners include national solution providers, regional solution providers, national account resellers, global/federal system integrators, and managed service providers.

Our enterprise products and services are also available on our e-commerce platform, as well as through authorized distributors, GSIs, and OEMs, who incorporate our technologies into their products, bundle our products with their offerings, or serve as authorized resellers of our products.

Consumer

We sell and market our consumer products and services to individuals, households, and small businesses globally. We bring these products to market through direct marketing and co-marketing programs supported by our e-commerce and tele-sales platforms. In addition, we utilize Internet-based resellers, system builders, ISPs, employee benefits providers, wireless carriers, retailers, and OEMs to distribute our offerings worldwide. We drive consumer business growth through global brand and demand campaigns, new customer acquisition, retention focused cross-selling, and customer success programs.

Research and Development

Symantec embraces a global research and development strategy to drive organic innovation and product integration across our portfolio. Our engineering and product management teams are focused on delivering new versions of existing product lines, as well as developing entirely new products and services to drive the company’s leadership in cyber security. We also have a technology research organization focused on short, medium, and longer-term applied research projects, with the goal of transferring completed innovations into our product groups for commercialization.

Symantec’s Security Technology and Response organization is a global team of security engineers, threat analysts, and researchers who provide the underlying functionality, content, and support for many of our solutions. These front-line security experts analyze threat telemetry collected through our vast cyber intelligence networks to protect our customers against current and emerging threats. Our research and development teams also leverage these vast data sets and insights to develop new technologies and approaches in order to improve security outcomes for our customers.

We believe that technical leadership is essential to our success, and we expect to continue to commit substantial resources to research and development.

Product and Technical Support

Symantec has support facilities throughout the world, staffed by technical product experts knowledgeable in the operating environments in which our products are deployed. Our support experts assist customers with both issue resolution and threat detection.

We provide Enterprise Security customers with various levels of technical support and customer success services. Our support program offers annual maintenance support contracts, including content, updates, and technical support. Our Essential Support includes: self-service options, assisted support delivered by telephone or electronically during contracted-for hours, immediate patches for severe problems, periodic software updates, and access to our technical knowledge base and frequently asked questions. Our Premium Support includes all Essential Support services with the addition of proactive health checks, assigned technical contacts, and other customer success activities.

Our Consumer Cyber Safety support includes self-help online services and phone, chat, and email support worldwide. Most of our Norton Security products come with automatic downloads of the latest virus definitions, application bug fixes, and patches, as well as a “Virus Protection Promise,” which in some markets provides free virus removal services to customers whose protected computers become infected. Our Consumer Cyber Safety service and support offerings come with 24x7x365 customer support, along with alert resolution, lost wallet protection, and restoration services during normal business hours.

Competition

Our markets are consolidating, highly competitive, and subject to rapid changes in technology. The competitive landscape has changed significantly over the past few years, with new competition arising. Some of the market growth has come from startups that focus on solving a particular issue or delivering a niche-oriented product, and from larger integration providers that increasingly seek to add to or extend their offerings. We focus on delivering comprehensive customer solutions, integrating across our broad product portfolio, and partnering with other technology providers to differentiate our offerings and platforms from the competition.

In addition to the competition we face from direct competitors, we face indirect or potential competition from retailers, application providers, operating system providers, network equipment manufacturers, and other OEMs who may provide various solutions and functions in their current and future offerings. We compete with these same parties to acquire technologies, products, or companies. We also compete with other software companies in our effort to place our products on the computer equipment sold to consumers and enterprises by OEMs. We compete for access to distribution channels and for spending at the retail level for our consumer offerings and in corporate accounts for our enterprise offerings.

Our Enterprise Security competitors vary by product category, geography, channel, and customer size:

•	Endpoint security competitors include McAfee LLC (McAfee), Microsoft, CrowdStrike, Inc., and Carbon Black, Inc., as well as several point-product competitors, freeware providers, and regional security companies.

•	Network security competitors include Palo Alto Networks Inc. (Palo Alto), FireEye Inc. (FireEye), Cisco Systems, Inc. (Cisco), McAfee, Forcepoint LLC (Forcepoint), and Zscaler, Inc., as well as other established and emerging companies.

•	Cloud security competitors include Cisco, McAfee, Microsoft, and Netskope, Inc., as well as other established and emerging companies. We expect additional competition as the market for security-as-a-service continues to develop and expand.

•	Email security competitors include Proofpoint, Inc. and Microsoft.

•

Advanced threat protection competitors include McAfee, Palo Alto, FireEye, International Business Machines Corporation (IBM), and Dell EMC, as well as Niksun Inc. and Trend Micro Inc. (Trend Micro). As new IT budgets are created to address next-generation threats, we expect to compete with additional specialized vendors, as well as larger vendors that may continue to acquire or bundle their products.

•	Information protection competitors include RSA (a Dell Technologies business), McAfee, Forcepoint, Digital Guardian, Inc., and Microsoft.

•	Cyber security services and managed security services competitors include FireEye, IBM, and SecureWorks Corporation, as well as other additional established and emerging companies.

Our Consumer Cyber Safety competitors vary by product category, geography, and channel. Norton Security competitors include Avast Software s.r.o., McAfee, Microsoft, and Trend Micro. Consumer backup product competitors include Carbonite, Inc. LifeLock identity theft protection competitors include credit bureaus Experian PLC, Equifax Inc., and TransUnion, as well as others including Affinion Group, Inc., Anchor Free, Inc., Credit Karma, Inc., and Intersections, Inc.

We believe that the principal competitive factors necessary to be successful in our industry include product quality and effectiveness, time-to-market, price, reputation, financial stability, breadth of product offerings, customer support, brand recognition, and effective sales and marketing efforts.

Intellectual Property

Protective measures

Our intellectual property is an important and vital asset of the company that enables us to develop, market, and sell our products and services and enhance our competitive position. Intellectual property includes our proprietary business and technical know-how, inventions, works of authorship, and confidential information. To protect our intellectual property, we rely primarily upon legal rights in trade secrets, patents, copyrights, and trademarks, in addition to company policies and procedures, security practices, contracts, and relevant operational measures.

We protect the confidentiality of proprietary information by entering into non-disclosure agreements with our employees, contractors, and channel and business partners, and we enter into license agreements with respect to our software and proprietary information that include confidentiality terms. These agreements are generally non-transferable and have either a perpetual or time-limited term. We also publish company policies on trade secret protection and employ access controls and associated security measures to protect our facilities, equipment, and networks.

Patents, copyrights, trademarks, and licenses

We maintain an internal patent program with the objective of identifying inventions that provide the basis for new patent applications in areas of importance to our business. We have approximately 2,345 U.S. patents, in addition to foreign patents and pending U.S. and foreign patent applications, which relate to inventive aspects of our products and technology. The duration of our patents is determined by the laws of the issuing country. In the U.S., this is typically twenty years from the date of filing of the priority patent application resulting in the patent, which we believe is adequate relative to expected product lifecycles.

Our products, particularly our software and related documentation, are protected under U.S. and international copyright laws and laws related to the protection of intellectual property and proprietary rights. We employ procedures to label copyrightable works with the appropriate proprietary rights notices, and we actively enforce these rights in the U.S. and abroad. However, these measures may not provide adequate protection, and our intellectual property rights may be challenged.

Symantec, Norton, LifeLock, and associated logos, including the checkmark in a circle logo, are trademarks or registered trademarks of the company in the U.S. and other countries in which we conduct business. In addition, we have used, registered, or applied to register other trademarks and service marks to help distinguish our products and services from those of our competitors. We actively enforce our trademark, service mark, and trade name rights in the U.S. and abroad based on our rights under common law, and various U.S. and foreign laws and regulations, as well as rights under international treaties and conventions. The duration of our trademark registrations varies from country to country. In the U.S., we are generally able to maintain our trademark rights and renew trademark registrations for as long as the trademarks are in use.

In limited cases, we license intellectual property from third parties for use in our products and generally must rely on those third parties to protect the licensed rights. This can include open source software which is not subject to proprietary rights protection. While the ability to maintain and protect our intellectual property rights is important to our success, we believe our business is not materially dependent on any individual patent, copyright, trademark, trade secret, license, or other intellectual property right.

Seasonality

As is typical for many technology companies, our business is subject to seasonality. See our quarterly results of operations in “Selected Quarterly Financial Data (Unaudited)” included in Part II, Item 8 of this Annual Report on Form 10-K.

Corporate Responsibility

Our annual Corporate Responsibility Report can be found via the Symantec website at https://www.symantec.com/about/corporate-responsibility. The information contained, or referred to, on our website, including our Corporate Responsibility Report, is not part of this annual report unless expressly noted.

Employees

As of March 29, 2019, we employed more than 11,900 people worldwide.

Available information

Our Internet home page is located at www.symantec.com. We make available free of charge our annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and amendments to those reports as soon as reasonably practicable after we electronically file such material with the Securities and Exchange Commission (SEC) on our investor relations website located at www.symantec.com/invest. The information contained, or referred to, on our website is not part of this annual report unless expressly noted. The SEC maintains a website that contains reports, proxy and information statements, and other information regarding our filings at http://www.sec.gov.