Sourcefire Aquires ClamAV Project

Open source innovator and SNORT creator, Sourcefire, Inc., today announced that it has acquired ClamAV, a leading open source gateway anti-virus and anti-malware project. Sourcefire's first acquisition since its Initial Public Offering in March 2007, ClamAV will broaden the company's open source footprint while providing the technology foundation for new products and services that will extend the company's Enterprise Threat Management network security portfolio.

With nearly 1 million unique IP addresses downloading ClamAV malware updates daily across more than 120 mirrors in 38 countries, ClamAV is one of the most broadly adopted open source security projects worldwide. ClamAV has also been recognized as comparable in quality and coverage to leading commercial anti-virus solutions. Most recently, at LinuxWorld this year, ClamAV was one of only three anti-virus technologies to provide a 100% detection rate in their live 'Fight Club' test featuring live submissions from the show audience.

Under terms of the transaction, Sourcefire has acquired the ClamAV project and related trademarks, as well as the copyrights held by the five principal members of the ClamAV team including project founder Tomasz Kojm. Sourcefire will also assume control of the open source ClamAV project including the ClamAV.org domain, web site and web site content and the ClamAV Sourceforge project page. In addition, the ClamAV team will remain dedicated to the project as Sourcefire employees, continuing their management of the project on a day-to-day basis.

In accounting for the transaction, Sourcefire anticipates a one-time charge in the third quarter of 2007 of between $0.09 and $0.12 per share for the immediate write-off of in-process research and development, which will be classified as an extraordinary item. Details of the transaction consideration are not being disclosed.

"This acquisition gives Sourcefire the ability to bring together two of the security industry's most widely adopted open source projects; Snort and ClamAV. This will not only broaden our reach, but will also allow us to extend our product family into a number of intriguing new markets," said Martin Roesch, Founder and CTO of Sourcefire and Creator of Snort. "The success of the ClamAV project is a direct reflection of the talent and dedication of the founding team and the project community. Sourcefire will continue to invest in the ClamAV technology, much as we have with Snort and Snort.org. Sourcefire pioneered the business of balancing commercial solutions with open source innovation, and we intend to apply those same Snort sensibilities to the ClamAV project."

ClamAV has been adopted by network security solution and service providers worldwide and is currently integrated within leading enterprise solutions, including Unified Threat Management Systems (UTM), Secure Web Gateways and Secure Mail Gateways, to identify deeply embedded threats such as viruses, trojans, spyware, and other forms of malware.

"We are very excited to join Sourcefire and we believe that this combination will allow us to deliver increased value to the open source community, as well as Sourcefire's commercial customers," said Tomasz Kojm, ClamAV Project Founder. "Sourcefire is a well respected company in the open source arena, and they really understand how to balance open source community investment with the commercial needs of their customers. This is an exciting development for me, as the project founder, and I look forward to the future growth of the ClamAV technology and community."

Conference Call and Webcast

On Friday, August 17, 2007 at 11:00 a.m. Eastern Time, Sourcefire will host a conference call to review this announcement. A listen-only web cast of the session will be available at http://investor.sourcefire.com. Those wishing to participate in the live session should use the following numbers to dial in:

Calling from the United States or Canada: 866-831-6270
Calling from other countries: 617-213-8858
Pass code: 19013275

An online replay will be available at http://investor.sourcefire.com following the completion of the live call and will remain available for at least 90 days.

http://www.sourcefire.com/