Item 1. Business

Overview

NortonLifeLock is a trusted brand and leading provider of Cyber Safety solutions for consumers worldwide. Our business is built around the prevention, detection and restoration of potential damages caused by cyber criminals. The need for NortonLifeLock’s products is more critical than ever in today’s increasingly digital world, as people transition to remote work environments, conduct virtual meetings, and engage in online gaming, streaming, shopping, telemedicine and numerous other online transactions and activities on a daily basis. With each new digital interaction comes increased risk for consumers as cyber criminals look to take advantage of this accelerating trend. NortonLifeLock stands between today’s cyber criminals and consumers, helping secure the devices, identities, online privacy, and home and family needs of nearly 50 million consumers globally. We are a trusted ally for our customers in a complex digital world and are committed to advancing our mission of protecting each element of their digital lives.

We offer subscription-based Cyber Safety solutions to consumers under the NortonLifeLock brand, with our integrated cyber safety platform Norton 360. Norton 360’s integrated experience, and substantial scale and reach, provide extensive cyber safety coverage to our members. In addition to Norton 360, we also offer standalone products for device security, privacy, identity, and home and family protection in certain channels and geographies.

We sell our products primarily direct-to-consumer through our in-house e-commerce platform, and indirectly through partner relationships with retailers, telecom service providers, hardware original equipment manufacturers (OEMs), and employee benefit providers. Most of our subscriptions are sold on either annual or monthly terms. As of April 3, 2020, we served over 20 million direct customers and approximately 30 million more through partners or other indirect channels. Our annual retention rate was 85% for fiscal 2020. Please see “Performance Metrics” under “Management’s Discussion and Analysis of Financial Condition and Results of Operations” in Item 7.

Our transformation into a pure-play consumer company follows the sale of our enterprise assets and name change from Symantec Corporation to NortonLifeLock Inc. Founded in 1982, we formerly did business under the Symantec Corporation name as the Consumer Cyber Safety division. The sale of our Enterprise Security assets to Broadcom Inc. (Broadcom) and the sale of our ID Analytics business to LexisNexis Risk Solutions, part of RELX Inc., were completed in fiscal year 2020.

Industry Overview

Cyber crime, and the ways in which cyber criminals target consumers, continue to evolve along with behaviors and technology. Cyber crime encompasses any crime committed digitally over the internet and includes crimes where (i) malicious software or unauthorized access is detected on a device, network or online account (including email, social media, online banking, online retail, etc.); (ii) an individual is digitally victimized through a data breach, cyber theft, cyber extortion, or fraud (stolen personally identifiable information, identity theft); or (iii) online stalking, bullying, or harassment is inflicted.

As cyber crime becomes an intensifying threat to our world, consumers are increasingly concerned. Our annual NortonLifeLock Cyber Safety Insights Report evaluates current cyber crime trends to provide a snapshot of the impact of cyber crime. According to the 2019 report, which is based on research conducted online by The Harris Poll on behalf of us, almost 500 million consumers have been the victim of a cyber crime, with nearly 350 million in the last year alone. While many report having taken at least one step to protect their online activities and personal information, most people are taking only basic steps (clearing cookies, limiting information shared on social media) and few are going to greater lengths such as using anonymous payment methods, deleting social media accounts, or using a virtual private network (VPN).

For more insights or information related to our NortonLifeLock Cyber Safety Insights Report, please visit https://us.norton.com/nortonlifelock-cyber-safety-report. The information contained, or referred to, on our website, including our Cyber Safety Insights Report, is not part of this annual report unless expressly noted.

Cyber Safety Solutions and Services

We help consumers by providing Cyber Safety subscription solutions with an integrated user experience under the NortonLifeLock brand, called Norton 360. Our Norton 360 subscriptions include multiple levels of membership tiers that incorporate solutions from each of our Cyber Safety categories: Device Security, Identity Protection, Online Privacy, and Home and Family Safety. We also provide these solutions as standalone products in certain channels and geographies. Our Consumer Cyber Safety solutions include the following offerings:

•

Device Security (Norton Security): Our Norton Security solution provides real-time protection for PCs, Macs and mobile devices against malware, viruses, adware, ransomware and other online threats. It monitors and blocks unauthorized traffic from the internet to the device to help protect private and sensitive information when customers are online. For mobile devices, Norton Security alerts customers of risky apps, safeguards against fraudulent and malicious websites, identifies Wi-Fi networks that are under attack, enables stolen device recovery, and blocks unwanted spam and potential fraud calls. Norton Security includes 24x7 support by trained support agents. We provide on-call support and offer a money-back guarantee if we cannot remove viruses from infected devices through our Virus Protection Promise.

•	Identity Protection (LifeLock Identity Theft Protection): Our LifeLock identity theft protection solution includes monitoring, alerts and restoration services to protect the safety of our customers. We monitor events that may present a risk of identity theft, such as new account openings and applications. If we detect that a customer’s personally identifiable

information is being used, we deliver notifications and alerts to our customers about potentially suspicious activity. In the event of identity theft, we assign an Identity Restoration Specialist to work directly with customers to help restore their identities. Customers are further protected by our Million Dollar Protection Package, which provides reimbursement for stolen funds and coverage for personal expenses.

•

Online Privacy (Norton Secure VPN and SurfEasy VPN): As people are exchanging more sensitive information through digital channels - be it personal healthcare information to enable tele-health or financial information for personal accounting, having a VPN has become even more crucial. Our Norton Secure VPN and SurfEasy VPN enhance security and online privacy by providing an encrypted data tunnel. This allows customers to securely transmit and access private information such as passwords, bank details and credit card numbers when using public Wi-Fi on PCs, Macs and mobile iOS and Android devices. Our VPN service allows customers to browse the Web anonymously to protect their online privacy and prevent tracking by online advertisers and other companies. Customers can also change their virtual location when they are traveling internationally to allow them to connect to their favorite apps, websites and online streaming services as if they are in their home-country.

•

Home and Family (Norton Family): As entire households now spend hours online, whether for school, work, or personal use, protecting the home and family in a simple way is even more of a need. Norton Family brings the protection and security of our products to every member of the family across multiple devices and platforms. Norton Family also provides Parental Controls tools for parents to monitor kids’ online activities, including videos watched, websites visited, terms searched, and apps downloaded. Parents can manage how much time kids spend online and block access to inappropriate websites. Norton Family also provides GPS location monitoring for mobile devices and content filtering for PCs.

Our Strategy

Our goal is to be the trusted cyber security partner for consumers across the globe and enable them to manage their digital lives safely. The threat landscape is larger, more complicated and more connected than ever before, exposing consumers to an increased risk to their security, online privacy, home networks and identities. As the risks to consumers continue to expand from device-based attacks to more sophisticated threats such as fraud, ransomware, identity theft and privacy risks, our solutions have evolved to provide a multi-layered approach in protecting against threats, detecting attacks and helping customers manage across their digital footprint, including their technology, applications, networks and identities.

The cornerstone of our strategy is to provide consumers with a platform that brings together superior software and service capabilities to enable all facets of Cyber Safety, including device security, identity protection, online privacy, and home and family safety. By combining and leveraging our portfolio of Norton and LifeLock offerings, we are able to deliver an industry-leading set of Cyber Safety solutions. The key elements of our strategy to achieve this goal include the following:

Extend our leadership position through continued enhancement of our solutions and services. The Cyber Safety industry is large and expanding, which provides a significant growth opportunity. We intend to grow our business by investing in research and development and making acquisitions to expand the solutions and services we offer into new cohorts, territories and sectors. We believe there are many additional areas where we can both offer new solutions, as well as use our core capabilities to deliver offerings to new customers and markets.

Grow our customer base. We intend to leverage our expertise in digital marketing, as well as existing and new strategic partnerships, to grow our customer base. We believe that continued investments in these areas, as well as our product offerings and infrastructure, will allow us to further enhance our leading brand and superior products, increase awareness of our consumer services and enhance our ability to efficiently acquire new customers.

Continue our focus on customer retention. We plan to invest in increasing customer retention by optimizing and expanding the value we provide through actionable alerts, education on timely topics, and new capabilities. We aim to provide our customers with peace of mind and convenience, demonstrating the value of our solutions. We plan to offer an integrated mobile application experience to improve customer experience from purchase, through onboarding and use. We have a global customer services organization, and we leverage frequent communication and feedback from our customers to continually improve our solutions and services.

Increase sales to existing customers. We believe the strong customer satisfaction we maintain with our customers provides us with the opportunity to engage them in new services offerings. We introduced Norton 360 in April 2019, with various tiers of membership, and we are actively engaging with customers of standalone products to move them into a Norton 360 membership. We also believe a substantial opportunity exists to increase the penetration of our premium-level consumer solutions. Over time, we plan to add additional offerings and services for our customers to drive further growth.

Sales and Marketing

We execute a global, multi-channel direct acquisition and brand marketing program. We sell our products primarily direct-to-consumer through our in-house e-commerce platform, and indirectly through partner relationships with retailers, telecom service providers, hardware OEMs, and employee benefit providers. This program is designed to grow our customer base by increasing brand awareness and understanding of our superior products, as well as maximizing our reach to prospective customers.

Direct-to-consumer. We use advertising and direct response marketing to elevate our brand, attract new customers, and generate significant demand for our services. This program drives most bookings.

We use a variety of marketing programs to target customers, including digital marketing and online display advertising; paid search and search-engine optimization; radio, television, and print advertisements; direct mail campaigns; press coverage for our company and our services; third-party endorsements; and education programs.

Indirect partner distribution channels. We use strategic and affiliate partner distribution channels to refer prospective customers to us and expand our reach to our partners’ and affiliates’ customer bases. We have developed and implemented a global partner sales organization that targets new, as well as existing, partners to enhance our partner distribution channels. These channels include: retailers, telecom service providers, hardware OEMs, and employee benefit providers. Physical retail and OEM partners represent a small portion of our distribution, which minimizes the impacts of supply chain disruptions.

Competition

We operate in a highly competitive and rapidly evolving business environment. We believe that the competitive factors in our market include access to a breadth of identity and consumer transaction data, broad and effective service offerings, brand recognition, technology, effective and cost-efficient customer acquisition, having a large customer base and strong retention rate, customer satisfaction, price, convenience of purchase, ease of use, frequency of upgrades and updates, and quality and reliable customer service. Our competitors vary by offering, geography, and channel.

Our principal competitors are set forth below:

•	Device Security. Our principal competitors in this market are Avast, Kaspersky, McAfee, Microsoft, Sophos, and Trend Micro.

•	Identity Protection. Our principal competitors in this market are credit bureaus Equifax, Experian, and TransUnion, as well as certain credit monitoring and identity theft protection solutions from others such as Allstate, Credit Karma, and McAfee.

•	Online Privacy. Our principal competitors in this market are Avast, Kape, ExpressVPN, McAfee, NordVPN, and Pango.

•	Home and Family. Our principal competitors in this market are Avast, Life360, and McAfee.

•	Other Competitors. In addition to competition from large consumer security companies such as Avast and McAfee, we also face competition from smaller companies that may develop competing products.

We believe we compete favorably with our competitors on the strength of our technology, people, product offerings and integration across all the Cyber Safety pillars. However, some of our competitors have substantially greater financial, technical, marketing, distribution, and other resources than we possess that afford them competitive advantages. As a result, they may be able to devote greater resources to develop, promote and sell their offerings; deliver competitive offerings at lower prices or for free; and introduce new solutions and respond to market developments and customer requirements more quickly than we can. For more information on the risks associated with our competitors, please see “Risk Factors” in Item 1A.

Research and Development

As cyber threats evolve, we are focused on delivering a portfolio that protects each element of our customers’ digital lives. To do this, we embrace innovation and have developed a global research and development strategy across our Cyber Safety platform. Our engineering and product management teams are focused on delivering new versions of existing offerings, as well as developing entirely new offerings to drive the company’s global leadership in Cyber Safety. We have a technology research organization focused on applied research projects, with the goal of rapidly creating new products to address consumer trends and grow the business, including defending consumer digital privacy. Also, NortonLifeLock’s threat response and security technology organization is a global organization made up of leading threat and security researchers supported by advanced systems to innovate security technology and threat intelligence as the consumer ally for Cyber Safety, protecting our customers against known and emerging threats.

NortonLifeLock has a long history of innovation and we plan to invest in research and development to drive our long-term success.

Intellectual Property

We are a leader amongst Cyber Safety solutions for consumers in pursuing patents and currently have a portfolio of over 1,000 U.S. and international patents issued with many pending. We protect our intellectual property rights and investments in a variety of ways to safeguard our technologies and our long-term success. We work actively in the U.S. and internationally to ensure the enforcement of copyright, trademark, trade secret and other protections that apply to our software products and services. The term of the patents we hold is, on average, twelve years. From time to time, we enter into cross-license agreements with other technology companies covering broad groups of patents; we have an additional portfolio of over 2,500 U.S. and international patents cross-licensed to us as part of our arrangement with Broadcom as a result of the asset sale of our former enterprise security business.

Circumstances outside our control could pose a threat to our intellectual property rights. Effective intellectual property protection may not be available, and the efforts we have taken to protect our proprietary rights may not be sufficient or effective. Any significant impairment of our intellectual property rights could harm our business or our ability to compete. In addition, protecting our intellectual property rights is costly and time consuming. Any unauthorized disclosure or use of our intellectual property could make it more expensive to do business and harm our operating results.

Companies in the technology industry may own a large number of patents, copyrights, and trademarks and may frequently request license agreements, threaten litigation, or file suit against us based on allegations of infringement or other violations of

intellectual property rights. From time to time, we face, and we expect to face in the future, allegations that we have infringed the trademarks, copyrights, patents, and other intellectual property rights of third parties, including our competitors. As we face increasing competition and as our business grows, we may face more claims of infringement. For more information on the risks associated with our intellectual property, please see “Risk Factors” in Item 1A.

Third-Party Service Providers

We are heavily reliant on our technology and infrastructure to provide our products and services to our customers. For example, we host many of our products using third-party data center facilities, and we do not control the operation of these facilities. In addition, our endpoint security solution has historically relied upon certain threat analytics software engines and other software (Engine-Related Services) that have been developed and provided by engineering teams that have transferred to Broadcom as part of the Broadcom sale. The technology, including source code, at issue is shared, and pursuant to the terms of the Broadcom sale, we retain rights to use, modify, enhance and create derivative works from such technology. Broadcom has committed to provide these Engine-Related Services under a transition services agreement, substantially to the same extent and in substantially the same manner, as has been historically provided. For information on the risks associated with our dependence on such third-party service providers, please see “Risk Factors” in Item 1A.

Governmental Regulation

We collect, use, store or disclose an increasingly high volume, variety, and velocity of personal information, including from employees and customers, in connection with the operation of our business, particularly, in relation to our identity and information protection offerings, which rely on large data repositories of personal information and consumer transactions. The personal information we process is subject to an increasing number of federal, state, local, and foreign laws regarding privacy and data security. For information on the risks associated with complying with privacy and data security laws, please see “Risk Factors” in Item 1A.

Seasonality

As is typical for many consumer technology companies, our business is subject to seasonality. Our third and fourth quarters are seasonally higher due to the holidays in our third quarter, and follow-on holiday purchases and the U.S. tax filing season in our fourth quarter.

Corporate Responsibility

Our annual Corporate Responsibility Report can be found via the NortonLifeLock website at https://www.nortonlifelock.com/about/corporate-responsibility. The information contained, or referred to, on our website, including our Corporate Responsibility Report, is not part of this annual report unless expressly noted.

Employees

As of April 3, 2020, we employed more than 3,600 people worldwide. None of our employees are represented by a labor union or covered by a collective bargaining agreement. We consider our relationship with employees to be good, and are focused on effective attraction, development, and retention of, and compensation and benefits to, human resource talent, including workforce and management development, diversity and inclusion initiatives, succession planning, and corporate culture and leadership quality, morale and development, which are vital to the success of our innovation-driven growth strategy. The Compensation and Leadership Development Committee of our Board of Directors oversees workforce and senior management development and our Board of Directors monitors the culture of the company and leadership quality, morale and development.

Available information

Our Internet home page is located at https://www.nortonlifelock.com. We make available free of charge our annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and amendments to those reports as soon as reasonably practicable after we electronically file such material with the Securities and Exchange Commission (SEC) on our investor relations website located at https://investor.nortonlifelock.com/About/Investors/default.aspx/. The information contained, or referred to, on our website is not part of this annual report unless expressly noted. The SEC maintains a website that contains reports, proxy and information statements, and other information regarding our filings at http://www.sec.gov.