WALLIX GROUP, a French joint stock company with a Management Board and Supervisory Board with share capital of €404,471.00 Registered office: 250 bis rue du Faubourg Saint Honoré 75008 Paris Trade and Companies Register of Paris no. 428 753 149

TRANSLATION OF THE FRENCH REGISTRATION DOCUMENT FISCAL YEAR ENDED DECEMBER 31, 2017

This document is a free non-binding translation into English prepared for the convenience of English speaking readers, for information purposes only, of the French language "Registration Document 2017" as registered with the Autorité des marchés financiers on April 27, 2018, under number R.18- 033, pursuant to article 212-13 of its General Regulation. The original French version of this document may be used for the purposes of public offering and financial operations if it is supplemented by a securities note approved by the Autorité des marchés financiers. The original French version of this document was prepared by the issuer, and its signatories are responsible for its content. In the event of any ambiguity or conflict between corresponding statements or items contained in this English translation and the original French version, the relevant statements or items of the French version shall prevail. The auditor's reports apply to the French version of the financial statements.

IN ACCORDANCE WITH ANNEX 1 OF EUROPEAN REGULATION (EC) NO. 809/2004

1.		PERSONS RESPONSIBLE	10
1.1		Person responsible for the Registration Document 10
1.2		Declaration by the person responsible 10
1.3		Person responsible for financial information 10

2.		STATUTORY AUDITORS	11
2.1		Principal statutory auditor 11
2.2		Alternate statutory auditor 11
2.3		Statutory auditors who have resigned 11
2.4		Statutory auditors' fees 11
3.		SELECTED FINANCIAL INFORMATION	12
4.		RISK FACTORS	14

4.1		Risks related to the Group's activities and the markets in which it operates, and to the implementation of its strategy 14

	4.1.1 4.1.2	Risks related to software reliability and security 14 Risks related to markets, competition and technological development 15
	4.1.3	Risks related to dependence on the Wallix Bastion software suite 17
	4.1.4	Risks related to external acquisition transactions 17
	4.1.5	Risks from protectionism 18
	4.1.6	Risks of dependence on customers and risks associated with suppliers 18
4.2		Legal and regulatory risks 19
	4.2.1	Litigation risks 19
	4.2.2	Risks related to intellectual property rights 19
	4.2.3	Risks related to non-compliance with legislative and regulatory restrictions 20
	4.2.4	Risks related to compliance with laws and regulations 22
4.3		Risks related to the Group's organization 23
	4.3.1	Risks of dependency on key personnel and skilled staff 23
	4.3.2	Risks related to the control of growth 23
4.4		Insurance and risk cover 24
4.5		Risks related to disputes to which the Group is party 24
4.6		Financial risks 24
	4.6.1	Risks related to research tax credits 24
		Please refer to section 4.2.1 of this Registration Document. 24
	4.6.2	Risks related to historical losses 24
	4.6.3	Risks related to access to public advances and subsidies 24
	4.6.4	Dilution risk 25
	4.6.5	Exchange rate risk 25
	4.6.6	Financing and liquidity risks 26
	4.6.7	Interest rate risk 26
	4.6.8	Credit risk and counterparty risk 27
	4.6.9 4.6.10	Risk related to equities and other financial instruments 27 Geopolitical risks 27
	4.6.11	Risks related to the impairment of intangible assets 27

	4.6.12	Off balance sheet commitments 27
5.		INFORMATION ABOUT THE COMPANY	28
5.1		History and development of the Company 28
	5.1.1	Corporate name and commercial name of the Company 28
	5.1.2	Registration place and number of the Company 28
	5.1.3	Date of incorporation and term 28
	5.1.4	Registered office of the Company, legal form, legislation governing its activities 28
	5.1.5	Important milestones in the growth of the Group's business activities 28
5.2		Investments 30
	5.2.1	Main investments (net of disposals) made during the previous two financial years 30
	5.2.2	Main ongoing investments 31
	5.2.3	Main future investments 31
6.		OVERVIEW OF ACTIVITIES	32
6.1		Company Presentation 32
6.2		The WALLIX market 34
	6.2.1	Cybersecurity, identity management, privileged access management 35
	6.2.2	Why protect privileged access? 37
	6.2.3	Growth factors and outlook for PAM 37
	6.2.4	The Identity and Access Management (IAM) market 38
	6.2.5	The cloud-based encryption and security services market 39
6.3		The WALLIX Bastion solution 40
	6.3.1	Overview 40
	6.3.2	The WALLIX Bastion solution secures information systems 40
	6.3.3	The WALLIX Bastion solution can be configured for compliance 41
	6.3.4	The WALLIX Bastion solution and its architecture 41
	6.3.5	The Session Manager module 43
	6.3.6 6.3.7	The Password Manager module 43 The Access Manager module 44
6.4		The competitive advantages of WALLIX 44

	6.4.1 6.4.2	Recognized technological leadership in the market 44 Excellent brand image in France and internationally 45
	6.4.3	A solution adopted by Large Accounts and mid-size companies 47
	6.4.4	A technology certified by ANSSI 49
6.5		WALLIX's development strategy 49
	6.5.1	Continue its international development in the PAM market 50
	6.5.2	Develop technology partnerships and alliances 51
	6.5.3	Undertake development for new types of infrastructure such as the cloud 51
	6.5.4	Enter the market in cloud-based security services 52
6.6		The regulatory framework 52
	6.6.1	The General Data Protection Regulation (GDPR) 52
	6.6.2	The Network & Information Security (NIS) Directive 53
	6.6.3	Sectoral regulations 54
	6.6.4	The special case of France 55
	6.6.5	Consequences for WALLIX 56
6.7		The WALLIX customer portfolio 56
6.8		WALLIX's economic model 57
6.9		Distribution channels 58
6.10		WALLIX competitors in the PAM market 59

6.11		WALLIX innovation and new products for 2018 61
	6.11.1	Version 6 of the WALLIX Bastion solution 61
	6.11.2	The WALLIX DataPeps end-to-end data encryption solution 62
	6.11.3	Collaborative R&D and innovation projects 62
	6.11.4	Loss-leader products: WALLIX Discovery, GPRD SOS and awless CLI 63
6.12		Organizational structure 64
	6.12.1	Organization chart 64
	6.12.2	The Bastion business unit 65
	6.12.3	The Venture business unit 65
	6.12.4	Corporate functions 65
6.13		The senior management team 66
7.		ORGANIZATION CHART	69

7.1		Legal organization chart 69
7.2		List of subsidiaries, branches and secondary establishments 69
7.3		Main intra-group exchanges 70
8.		REAL ESTATE ASSETS, PLANTS AND EQUIPMENT	71

8.1		Description of real estate assets 71
8.2		Environmental issues 71
9.		EXAMINATION OF RESULTS AND FINANCIAL POSITION	72
9.1		General presentation 72
	9.1.1	Introduction 72
	9.1.2	Main factors affecting activity and results 72
9.2		Presentation and analysis of the operating accounts 73
	9.2.1	Turnover and operating revenue 73
	9.2.2	Operating expenses by type 75
	9.2.3	Calculation of operating income 76
	9.2.4	Calculation of net income 77
9.3		Balance sheet presentation and analysis 79

	9.3.1 9.3.2	Fixed assets 79 Current assets 81
	9.3.3	Equity 81
	9.3.4	Provisions for risks and expenses 82
	9.3.5	Financial expenses 83
	9.3.6	Operating payables 84
10.		CASH AND SHARE CAPITAL	85
10.1		Information on share capital, liquidity and sources of financing 85

	10.1.1	Capital Financing 85
	10.1.2	Financing from refundable advances and subsidies 86
	10.1.3	Funding by the research tax credit 87
	10.1.4 10.1.5	Debt financing 87 Off balance sheet commitments 89

10.2		Cash flow 90
	10.2.1	Cash flow from operating activities 90
	10.2.2 10.2.3	Cash flow associated with investment activities 91 Cash flow associated with financing transactions 91

10.3		Information on the terms and conditions of borrowing and the financing structure 92
10.4		Restriction on the use of the loan capital 93
10.5		Sources of financing 94
11.		INNOVATION, PATENTS, LICENCES, TRADEMARKS AND DOMAIN NAMES	95
11.1		Innovation policy 95
11.2		Protection of intellectual property 96
	11.2.1	Patents and patent applications, Nature and coverage of patents 96
	11.2.2 11.2.3	Patents currently in use 97 Protected territories 97
	11.2.4	Other items of intellectual property 97
12.	TRENDS		100
12.1		Main trends since the end of the financial year ended December 31, 2017 100
12.2		Known trend, uncertainty, commitment request or event reasonably likely to influence the
		Group's outlook 100
12.3		Objectives at 2021 101
13.		PROFITS FORECASTS OR ESTIMATES	103
14.	EXECUTIVE	ADMINISTRATIVE, MANAGEMENT AND SUPERVISORY BODIES AND MANAGEMENT	104

14.1		Executives and members of the Supervisory Board 104
	14.1.1 14.1.2	Composition of the Management Board and the Supervisory Board 104 Other corporate appointments 106
	14.1.3	Biographies of the members of corporate bodies 107
14.2		Executive management 109
14.3		Statements concerning the Company's administrative and management bodies 109
14.4		Supervisory Board's report on corporate governance 110
	14.4.1	List of all appointments and positions held in any company by each of the corporate officers during the financial year 110
	14.4.2	Agreements between a corporate officer or shareholder holding more than 10% of the
		voting rights and a subsidiary (excluding standard contracts) 110
	14.4.3	Summary of current delegations of authority granted by the Annual General Meeting for capital increases 110
	14.4.4	Supervisory Board's comments on the Management Board report and financial statements for the year 110
15.		Compensation and benefits	112
15.1		Compensation for members of the Management Board and the Supervisory Board 112
15.2		Amounts set aside by the Group to cover pensions and retirement and other benefits for corporate officers 118
16.		BOARD PRACTICES	119
16.1		Group management 119
16.2		Information on service agreements between members of administrative, management or supervisory bodies and the Company 119
16.3		Supervisory Board and specialized committees – Corporate governance 119
	16.3.1	Supervisory Board 119

	16.3.2	Specialized committees 120
16.4		Corporate governance 121
17.		EMPLOYEES	123
17.1		Human resources 123
	17.1.1	Organization chart at the filing date of the Registration Document 123
	17.1.2	Number and distribution of employees 123
	17.1.3	Employee representation 123
17.2		Shareholdings and stock options of corporate officers 123
17.3		Employee participation in the Company's share capital 124
17.4		Incentive and profit-sharing contracts 124
18.		MAIN SHAREHOLDERS	125
18.1		Breakdown of the capital and voting rights 125
	18.1.1	Breakdown of the capital and voting rights at the filing date of this Registration
		Document 125
	18.1.2	Changes in the distribution of capital and voting rights over the last three financial years 127
	18.1.3	Summary of trading in the Company's securities under Article L.621-18-2 of the
		French Monetary and Financial Code 128
18.2		Significant shareholders not represented on the Supervisory Board 129
18.3		Voting rights of the principal shareholders 129
18.4		Control of the Company 129
18.5		Agreements that could lead to a change in control 129
18.6		Statement of Company share pledges 129
19.		RELATED-PARTY TRANSACTIONS	130
19.1		Related-party agreements 130
19.2		Regulated agreements 130
19.3		Statutory auditors' report on regulated agreements 130
20.		FINANCIAL INFORMATION	134
20.1		Annual consolidated financial statements prepared under French GAAP for the year ended December 31, 2017 134
20.2		Statutory auditor's report on the consolidated 2017 financial statements 164
20.3		Corporate accounts under French GAAP for the 2017 financial year 170
20.4		Statutory auditors' report on the corporate accounts for 2017 196
20.5		Dividend distribution policy 201
20.6		WALLIX GROUP five-year financial summary 201
20.7	201	WALLIX GROUP non-deductible expenses under Article 39-4 of the French General Tax Code
20.8		Information on payment terms for WALLIX GROUP's suppliers and customers in 2017 202
20.9		Internal control procedures 204
		20.10 Legal and arbitration proceedings 205
		20.11 Significant change in financial or trading position 205

21.		OTHER INFORMATION	206
21.1		Share capital 206
	21.1.1	Amount of share capital 206
	21.1.2	Securities other than equity securities 206
	21.1.3	Company's buyback of its own shares 206
	21.1.4	Potential capital 208
	21.1.5	Authorized share capital 212
	21.1.6	Information on the capital of any member of the Company which is under option or
		subject to a firm or contingent agreement to be placed under option 217
	21.1.7	History of share capital 217
21.2		Articles of Incorporation and Bylaws 218
	21.2.1	Corporate purpose (Article 2 of articles of association) 218
	21.2.2	Management and supervisory bodies 218
	21.2.3	Rights, privileges and restrictions attached to Company shares 220
	21.2.4	Procedure for amending shareholders' rights 222
	21.2.5	General Meetings of Shareholders 222
	21.2.6	Provisions permitting the delay, deferral or prevention of a change of control 223
	21.2.7	Breach of statutory thresholds 223
	21.2.8	Special stipulations governing changes to capital 223
22.		MAJOR CONTRACTS	224

23.		THIRD-PARTY DISCLOSURES, EXPERT STATEMENTS, AND DECLARATIONS OF INTEREST	225

23.1		Appointment of experts 225
23.2		Use of third parties 225
24.		PUBLICLY AVAILABLE DOCUMENTS	226
25.		DISCLOSURE OF EQUITY INTERESTS	227
26.		GLOSSARY	228

27.		CONCORDANCE TABLES	230
27.1		Table of concordance of the Management Report with the French Commercial Code 230
27.2		Supervisory Board report on corporate governance in accordance with the French Commercial Code 232
27.3		Additional documents 232

Note

In this Registration Document, the terms "If Research", "WALLIX GROUP" or the "Company" refer to the WALLIX GROUP, a joint stock company with registered office located at 250 bis rue du Faubourg Saint Honoré, 75008 Paris, France, and entered in the Trade and Companies Register of Paris under number 428 753 149; while the term "Group" refers collectively to the WALLIX GROUP, WALLIX SARL and WALLIX CORP.

A glossary defining some of the terms used in this Registration Document can be found in Chapter 26.

In accordance with Article 28 of European Regulation (EC) 809/2004, the following items are incorporated by reference in this Registration Document:

The consolidated financial statements and the corporate accounts as at December 31, 2016 and the relevant Statutory Auditor's reports, presented respectively on pages 35 to 37 and 62 to 64 of the Company's 2016 Annual Report, as published on its website (www.wallix-bourse.com).
The consolidated financial statements and the corporate accounts as at December 31, 2015 and the relevant Statutory Auditor's reports, presented respectively on pages 29 to 32 and 62 to 64 of the Company's 2015 Annual Report, as published on its website (www.wallix-bourse.com).

Disclaimer

Information on the market and the competition

This Registration Document, and particularly in Chapter 6 "Business overview", contains information relating to the Group's markets and its competitive position. This information comes mainly from research carried out by external sources. This publicly available information, which the Group believes to be reliable, has not been verified by an independent expert. Therefore, the Group cannot guarantee that a third party using different methods to collect, analyze or compute market data would obtain the same results.

Forward-looking statements

This Registration Document contains statements regarding the Group's prospects and growth strategies. These statements are sometimes identified by the use of the future or conditional tense, or by the use of forward-looking terms such as "considers", "envisages", "thinks", "aims", "expects", "intends", "should", "plans", "estimates", "believes", "wishes" and "might", or, if applicable, the negative form of such terms, or any other similar terminology or variant. This information is not historic data and should not be interpreted as an assurance that the facts and data mentioned will in fact occur. These statements are based on data, assumptions and estimates which the Group considers to be reasonable. It is possible that they may change or be modified because of uncertainties relating in particular to the economic, financial, competitive and regulatory environment. These statements are contained in various chapters of this Registration Document. They include information on the intentions, estimates and objectives of the Group, with particular regard to the market in which it operates and to its strategy, growth, results, financial position, cash position and forecasts. The forward-looking statements mentioned in this Registration Document were correct only at the time of writing. The Group operates in a competitive and constantly changing environment. For this reason, it cannot anticipate all the risks, uncertainties or other factors likely to affect its business, their possible impact on its business, or to what extent the occurrence of a risk or a combination of risks might have results that are significantly different to those mentioned in any forward-looking statements. Moreover, such forward-looking statements offer no guarantee of actual results.

Risk factors

Investors are asked to read carefully the risk factors described in Chapter 4 "Risk factors" of this Registration Document before taking any investment decisions. If some or all of these risks should materialize, they could have a material adverse effect on the Group's business, financial position, results and prospects. Furthermore, other risks not yet identified or considered significant by the Group at the date of filing this Registration Document could also have a material adverse effect.

English free translation of the French-language 2017 Reference Document – not binding, for information purposes only

1. PERSONS RESPONSIBLE

1.1 Person responsible for the Registration Document

Jean-Noël de Galzain, Chairman of the Management Board.

1.2 Declaration by the person responsible

After taking all reasonable care for this purpose, I declare that the information contained in this Registration Document is, to the best of my knowledge, consistent with the facts and contains no omission likely to affect its impact.

I have obtained from the Statutory Auditors, on completion of their work, a letter in which they state that they have audited the information concerning the financial position and the financial statements presented in this Registration Document and that they have read the Registration Document in its entirety.

Paris, April 27, 2018

Jean-Noël de Galzain Chairman of the Management Board

1.3 Person responsible for financial information

Amaury Rosset Chief Financial Officer Address: 250 bis rue du Faubourg Saint Honoré 75008 Paris Telephone: + 33 1 53 42 12 81 Fax: + 33 1 43 87 68 38 Email: [email protected]

2. STATUTORY AUDITORS

2.1 Principal statutory auditor

KPMG AUDIT PARIS-CENTRE SAS, an audit firm entered on the national list of statutory auditors and a member of the Compagnie Régionale des Commissaires aux comptes (the Regional Association of Statutory Auditors) of Versailles

Tour EQHO

2, avenue Gambetta

92 066 Paris La Défense Cedex

Represented by Clément Fruchard, Partner

First appointed on: March 26, 2007 at the Annual General Meeting

Reappointed on: June 11, 2013 at the Annual General Meeting

Term of office expires: at the Annual General Meeting called to approve the financial statements for the year ended December 31, 2018

2.2 Alternate statutory auditor

KPMG AUDIT NORD SAS, an audit firm entered on the national list of statutory auditors and a member of the Compagnie Régionale des Commissaires aux comptes (the Regional Association of Statutory Auditors) within the jurisdiction of the Court of Appeal of Douai

159, avenue de la Marne

59 700 Marcq en Baroeul

First appointed on: October 21, 2011 at the Annual General Meeting

Reappointed on: June 11, 2013 at the Annual General Meeting

Term of office expires: at the Annual General Meeting convened to approve the financial statements for the financial year ended December 31, 2018

2.3 Statutory auditors who have resigned

During the period covered by historic financial information, no statutory auditors have resigned or been dismissed.

2.4 Statutory auditors' fees

The fees for certifying the Group's corporate accounts and consolidated financial statements totaled €47,000 for the 2017 financial year, €35,000 for the 2016 financial year, and €28,000 for the 2015 financial year.

The fees for services rendered to the Group other than the certification of the financial statements totaled €21,000 for the 2017 financial year, €17,000 for the 2016 financial year, and €33,000 for the 2015 financial year.

3. SELECTED FINANCIAL INFORMATION

The selected financial information presented in this chapter is taken from the consolidated financial statements for the years ended December 31, 2015, December 31, 2016 and December 31, 2017, prepared under French GAAP and set forth in Chapter 20 of this Registration Document. The consolidated financial statements for the year ended December 31, 2015 and December 31, 2016 have been published and are available on the Company's website (www.wallix-bourse.com). The consolidated financial statements for the year ended December 31, 2017 can be found in Chapter 20 of this Registration Document.

This financial information should be read in conjunction with (i) the business and financial review presented in Chapter 9 of this Registration Document and (ii) the review of cash and capital resources presented in Chapter 10 of this Registration Document.

Selected financial information for the years ended December 31, 2015, 2016 and 2017 (French GAAP)

Audited consolidated data	Financial year 2015	Financial year 2016	Financial year 2017
in €000s	12 months	12 months	12 months

Total operating income	7,651	10,242	15,094
Turnover	5,295	7,364	11,545
Capitalized production	1,456	1,896	2,575
Operating subsidy	731	959	813
Reversals of provisions, depreciation and amortization, and transfers	169	23	27
Other operating income	0	0	134
Total operating expenses	(8,724)	(12,007)	(15,939)
Purchases and changes in inventories	(257)	(146)	(375)
Other operating costs	(2,418)	(3,810)	(4,125)
Taxes and levies	(116)	(171)	(271)
Payroll costs	(4,790)	(6,515)	(9,087)
Depreciation, amortization and provisions	(1,143)	(1,365)	(2,081)
Total operating income	(1,074)	(1,765)	(845)
Income before tax	(1,061)	(1,785)	(863)
Net income for the year	(1,113)	(1,683)	(1,050)
Net earnings per share	(0.314)	(0.420)	(0.260)

Selected financial information from the income statement:

Audited consolidated data	Financial year 2015	Financial year 2016	Financial year 2017
in €000s	12 months	12 months	12 months
Total assets	17,022	17,769	22,060
Fixed assets	4,348	5,610	6,925
Of which, intangible assets	3,667	4,619	5,805
Of which, property, plant and equipment	286	762	773
Of which, long term investments	395	228	346
Current assets	12,674	12,159	15,135
Of which, cash and marketable securities	8,769	5,938	6,981
Total liabilities	17,022	17,769	22,060
Shareholders' equity	10,575	8,927	8,120
Provisions	161	237	650
Payables at more than one year	608	1,098	1,563
Current liabilities and accruals	5,678	7,507	11,727

Selected financial information from the balance sheet:

Selected financial information from the cash flow statement:

Audited consolidated data	Financial year 2015	Financial year 2016	Financial year 2017
in €000s	12 months	12 months	12 months
Net operating cash flow	775	(854)	3,380
Of which, self-generated cash flow	14	(331)	970
Of which, change in WCR	762	(523)	2,411
Net cash flow from investing activities	(1,924)	(2,238)	(2,855)
Net cash flow from financing activities	8,762	262	517
Change in cash flow	7,613	(2,830)	1,043

The Group's level of indebtedness:

Audited consolidated data	Financial year 2015	Financial year 2016	Financial year 2017
in €000s	12 months	12 months	12 months
Financial liabilities	937	1,572	1,950
Of which, longer than one year	608	1,098	1,563
Of which, shorter than one year	329	474	387
Cash and marketable securities	8,769	5,938	6,981
Total net debt	(7,832)	(4,366)	(5,030)

4. RISK FACTORS

Before deciding to subscribe for or purchase the Group's shares, investors are asked to consider all the information set out in this Registration Document, including the risk factors described in this chapter. The Group has reviewed the risks that may have a material adverse effect on the Group, its business, financial condition, results, outlook, or ability to achieve its objectives. At the date of this Registration Document, the Group is not aware of any significant risks other than those presented in this chapter.

However, investors are reminded that the list of risks and uncertainties set out below does not purport to be exhaustive. Additional risks and uncertainties which, at the date of this Registration Document, are not known to the Group or the occurrence of which the Group does not deem to be likely to have a material adverse effect on the Group, its business, financial condition, results or outlook, may in fact exist or become important factors likely to have a material adverse effect on the Group, its business, financial condition, results, development, or outlook.

In each section below, the risk factors are presented in decreasing order of importance, according to the Group's assessment on the date on which this Registration Document is filed. The occurrence of new facts, both internal and external to the Group, may therefore, in the future, alter this order of importance.

4.1 Risks related to the Group's activities and the markets in which it operates, and to the implementation of its strategy

4.1.1 Risks related to software reliability and security
Risks related to software errors and faults

The Group's software suite, Wallix Bastion, is sophisticated and highly technical. It incorporates complex engineering elements that could contain errors, faults or other performance problems particularly when launched or when new versions and/or updates are released (for more information on the Group's products and solutions, see Chapter 6 of this Registration Document). Such errors, faults or performance problems may only be detected after a certain operational period has elapsed, particularly after the release of specific corrective updates or patches and new minor versions.

The Group strives to reduce this risk through thorough testing before releasing any new major versions introducing new features or new minor versions including updates or corrections. In 2008, a software testing unit was set up to test software before it is released. These preventive measures fit in to the broader commitment and steps taken by the Group to work together with its customers to guarantee the successful implementation of its solutions. In addition, the Group ensure that its software solutions audited on a regular basis by an independent service provider accredited as an IT Security Evaluation Center (Centre d'évaluation de la sécurité des technologies de l'information (CESTI)) by the French National IT Security Agency (Agence Nationale pour la Sécurité des Systèmes d'information française (ANSSI)), which enables the Group to obtain official certification from ANSSI as to the safety of its software solutions.

Notwithstanding these measures taken to prevent or limit them, the Group may not be able to correct, in whole or in part, any future errors or faults discovered in its current or future products and to remedy the same within a timeframe which meets the requirements or expectations of its customers. Such events could also delay the Group in its development of additional product features. The Group could also be required to allocate significant financial, technical and managerial resources, including resources that had been set aside for development, to mitigate or resolve such faults, errors or any other problems encountered, or to respond to additional requests from its customers. The occurrence of these events could in turn result in an increase in costs linked to the maintenance of, and warranties for, its products.

To the extent that the purpose of the Group's software suite is to protect its customers' information systems, any data leak or loss caused by an error or fault may result in the loss of customers. Technical problems or the loss of a "major" customer could have adverse consequences on the Group's image and reputation and could lead to the loss of further customers and/or cause the Group to lose out on business opportunities. The occurrence of all or some of the aforementioned adverse events could thus have a material adverse impact on the Group's business, results, financial condition and/or revenue.

• Risks related to information systems

The Group operates in a sector characterized by the fast paced technological change, which means that it is continuously exposed to the risk of industrial or information hacking or to cyber-attack by way of computer virus or software bugs.

Managing these risks requires a very good understanding of technical and functional environments, an understanding which, however, can never be complete given, in particular, the speed of technical development and of changes in relevant participants involved in the distribution and support chains for software solutions (e.g. system integrators, equipment suppliers, distributors).

Like other groups operating in the IT sector, and particularly as software publishers, the Group may be subject to with fraud risk, scams, hacking and piracy, even though the Group has security and data backup systems in place and only has limited access to critical and sensitive information in order to reduce such risks.

In order to minimize the impact of security breaches and, in the event of such a breach occurring at its client's premises, to reduce its response times, the Group has, through a service provider, set up an operational incident processing center which gathers all support requests and coordinates the corrective actions process, while also providing expertise in and the ability to investigate, deal with and resolve such threats.

Also, the Group has its own internal monitoring system that enables it to resolve directly any incidents affecting its own IT system.

Additionally, the entirety of its development and production data is backed up daily on the Group's servers, which are owned by Wallix Group, and copied onto separate protected data storage locations in order to maximize security and strength of protection.

Notwithstanding all the precautions it has taken, the Group cannot guarantee that its information and backup systems will not fail. Even though the Group believes that the existing safeguards it has in place would ensure business continuity, if any of the events described above were to occur, the resulting damage, loss or delays could have an adverse impact on the Group's business, operational results, financial condition and projections.

4.1.2 Risks related to markets, competition and technological development

• Competitive environment

Within the Identity and Access Management (IAM) field, the Group currently operates in the Privileged Account Management (PAM) sector, which is the target segment for the Wallix Bastion software suite published by the Group. The Group's software suite falls within two large categories of products that have historically addressed the requirements of corporations and organizations:

Password vaults, which are offered mainly by the traditional players in the field and which address the requirements of large companies that rely on identity management systems, particularly within the banking sector;
Privileged account monitoring, a product on which second generation publishers are directly positioned including, since its inception, the Wallix Group.

The Group has roughly 20 direct competitors in the PAM sector, which include PAM specialists (of which the main ones are CyberArk, BeyondTrust, and Balabit-One Identity) and general-purpose publishers who offer a PAM solution as part of their broad range of cybersecurity and network products (such as Computer Associate (CA) Technologies, or IBM). Additional information related to relevant markets targeted by the Group and its competitors are set forth in Chapter 6 of this Registration Document.

At the date of this Registration Document, the Group is the leading European operator in the PAM market, in that its main competitors are primarily US companies, and is present in both product categories (see Chapter 6 of this Registration Document, and sections 6.1 and 6.4 in particular, for a description of the PAM market and the Group's positioning). Changes in the types of products and services the Group offers, as well as the extension of its marketing of Wallix Bastion into new geographic regions, will open up new opportunities for the Group to gain market share.

Competitive pressure could have various adverse effects on the Group, including in causing additional pricing pressure, potential loss of market share, a need for increased marketing expenditure to stay competitive, and the need for faster development of products to achieve the same. As a result, there could be a material adverse effect on the Group's business, revenue, results or financial condition.

The Group plans to penetrate other high-growth markets in the next few years. In fact, the cloud-based security services sector is very close to the PAM sector and is delivered in the cloud. This high-growth market segment can be described as the cloud component of the IAM market and provides potential growth prospects for the Group (see paragraph 6.2.5 of the Registration Document).

Furthermore, the data encryption market continues to grow and the Group intends to take advantage of this market opportunity to launch an end-to-end encryption offering (a recent sector that has caught the interest of many companies) called "DataPeps" (see paragraphs 6.2.5, 6.5.4 and 6.11.2 of the Registration Document).

• Development of technology and new offerings

Within the context of fast technological developments, fast changes within companies themselves and constant emergence new products on the market, businesses such as the Group, which operate in the IT sector, face the risk of overlooking technological change, failing to adapt in a timely manner to such change, and ignoring the radical changes and transformation of economic models of the sector in which they operate. Such risks may cause the Group to lose out on opportunities, as well as prevent it from accessing other profitable or growing markets.

Continuous innovation and responsiveness to market demands are key factors that the Group has to take into consideration when defining its strategy.

To this end, the Group's Strategy Committee (see paragraph 16.3.2.2 of the Registration Document) is tasked with proactively monitoring third-party technologies in the Group's sector and discussing major changes to its roadmap by incorporating feedback from the market and the Group's customers. The Group has even strengthened its ability to predict market developments and respond to these accordingly by creating, in 2018, a Strategy Department headed by an experienced director, Didier Cohen.

Notwithstanding the efforts made by the Group to limit the risk of failing, wholly, partly or with delay, to take into account the emergence of new technologies or new offerings, any delay or lack of timely response by the Group to market developments could have a material adverse effect on the Group's business, revenues, financial results or financial position1 .

¹ WALLIX is the European leader in Privileged Access Management: it is the only company in this industry that is recognized by analysts such as Gartner (source: Market Guide for Privileged Access Management - August 2017) and Kuppingercole (source: Leadership Compass Privilege Management, 2017) whose registered office is in Europe (Paris). The other competitors in this industry have their head offices in the United States or Israel. The only European competitor that was still on the market until 2017 was acquired by the US company One Identity in January 2018.

The Group also faces the ongoing challenge of integrating increasingly complex functionalities to respond to the expectations of its customers. This results in increased complexity in the development of new releases or solutions, and in restrictions in relation to third party systems used by its customers. In this context, the Group is making numerous investments in R&D to maintain and strengthen the comparative advantages of its software solution, to mitigate the impact of competition on its prices, and to ensure a functional coverage that conforms to market standards. The Group's software solutions are characterized by the utilization of rapidly evolving technologies and by the frequent introduction of new products or improvements to existing products.

If the Group fails to anticipate technological leaps and to develop new solutions and services to meet growing customer and market expectations, the demand for its products could decrease and in turn this could affect its financial results and financial condition.

Finally, the growing importance of Cloud services (see paragraph 6.2.5 of the Registration Document) could lead to a change in the types of demand from the Group's customers and to a necessary modification of service offerings via the Cloud by operators in the PAM market.

To reduce this risk and predict technological developments, the Group devotes significant resources to developing new services, and plans to expand its range of software solutions to address the security problems identified for the Cloud (see paragraph 6.2.5 of Chapter 6 of this Registration Document). In this regard, the Group does not exclude the acquisition of targeted companies and/or innovative third party technology companies in order to enhance and/or strengthen its technology offering. The Group is also in continuous discussions with its main customers in order to identify and understand their needs as they emerge and to offer the most appropriate solutions to these.

Notwithstanding the measures and strategy deployed to address this, if the Group fails to introduce appropriate solutions for the Cloud market, in a timely manner and with appropriate pricing and quality models, this could affect the Group's growth, financial performance and results in a long term basis, as well as its competitive position and reputation, particularly if it encounters difficulties in the set up or provision of such new services and solutions to its customers.

4.1.3 Risks related to dependence on the Wallix Bastion software suite

In the first quarter of 2018, the Company was marketing two offers:

the Wallix Bastion solution, which is a software suite available in several forms of commercial offerings and which accounts for 96% of the Group's consolidated turnover; and
the historic "IF-Research" service solution, which consists of an offering of professional and managed services for large industrial companies and which accounts for 4% of the Group's consolidated turnover.

In this respect, in order to limit its exposure to its main offering, the Group plans to broaden its current range by launching additional packages, starting in the second quarter of 2018 with its independent DataPeps service (for a description of DataPeps and the Group's development strategy, see paragraph 6.11 of the Registration Document), taking into account that the development of new solutions relies on new technological layers that require a learning process for the Group's technical teams, which, in turn, provides a risk of delay in bringing these new functionalities to the market.

4.1.4 Risks related to external acquisition transactions

Depending on the opportunities available, the Group may need to acquire companies, assets or technical staff with skills that match the Group's requirements, or to enter into transactions to broaden its customer base.

The implementation of this strategy depends, in part, on the Group's ability to identify attractive targets, to complete these acquisitions on satisfactory terms, and to successfully integrate them into its operations, technology or teams.

For this purpose, the Company sets aside resources for its participation in the innovation ecosystem, particularly through its partnership with the HexaTrust Club, an association which gathers in Europe several companies operating in the cybersecurity sector and of which Wallix is an active founding member (with Jean-Noël de Galzain as its President), and its participation to numerous events and at important meetings (conferences, workshops, working groups with the French government) concerning cybersecurity. The Group is also involved in several joint R&D projects (see Chapters 6 and 11 of this Registration Document), which affords it the opportunity to work closely with academic and industrial partners as well as start-ups, and to seize opportunities. This proximity to the cybersecurity ecosystem has enabled Wallix to identify and acquire XLab in 2006, as well as the assets of MLState in 2016, the latter of which has enabled the Group to build its DataPeps solution (see Chapters 9 and 10 of this Registration Document for more information on this acquisition).

All ML State assets were transferred to the Group in 2016. The acquisition was financed by two (2) bank loans: the first from Bpifrance Financement on July 27, 2016 for €72,000 (40%), and the second from BNP Paribas on August 30, 2016 for €108,000 (60%).

The Company cannot, however, guarantee that it will be able to identify the best acquisition opportunities nor that it will conclude such opportunities on favorable terms, nor that it will be able to successfully integrate every other technology, activity, or skilled staff that it has acquired or hired.

Any new acquisition may entail a dilution of the Company's current shareholding, reliance on financial indebtedness, potential losses, or the need to account for depreciation of the value of the various assets resulting from such acquisitions. Accordingly, these may adversely impact the Group's profitability.

Any problem encountered by the Group in financing such acquisitions, or in integrating other companies, or other technologies, may have a material adverse effect on the Group's activity, financial condition, results, growth, or outlook.

4.1.5 Risks from protectionism

Taking into account that the Group operates in the IT security sector, the possible introduction of protectionist measures by governments with the intention of reserving certain markets for domestic products, could hinder the Group's geographic deployment and hinder the growth of its.

4.1.6 Risks of dependence on customers and risks associated with suppliers

The Group makes every effort not to be dependent on individual customers. In this regard, the Group's top ten customers in 2017 accounted for 35% of its turnover (the single biggest customer accounting for 8%), a list which, it should be noted, differs from that of its top ten customers in 2016. The Group therefore believes that it does not faced with the risk of having significant dependence on particular customers.

The Group also does not believe that it faces any risk of being dependent on particular suppliers, since its Wallix Bastion software solution is compatible with a wide range of standards used by many manufacturers, and the main computer hardware it uses, currently supplied by Dell, can be replaced at any time by other substitute suppliers.

Similarly, the Group believes that it is not exposed to a risk of dependence in relation Oracle, whose database system (MySQL) is used by Wallix Bastion, since the Company remains free to choose to use any available technology that is commercially available and, the Company, could, considering market availability, quickly find a replacement supplier.

4.2 Legal and regulatory risks

The Group is not exposed to specific legal risks apart from those related to intellectual property and, in general, to civil liability. Current litigation related to the Research Tax Credit (Crédit d'impôt Recherche or CIR) is set out in paragraph 20.11 of this Registration Document. There are no other governmental, judicial or arbitration proceedings, including any proceedings of which the Group is aware, that are pending or threatened and which, over the past 12 months, are likely to have, or are having had, a significant impact on the Company's and/or Group's financial condition or profitability.

4.2.1 Litigation risks

To finance its activities, the Group received a Research Tax Credit ("CIR"), consisting of a tax credit for companies investing in research and development. It takes the form of a repayable tax deduction, calculated on the basis of the company's R&D spending.

Expenditure on scientific and technical research, whether basic or applied research, or experimental development work is eligible for the CIR. In the legislation, these expenses are exhaustively listed. They include wages and salaries, depreciation of research equipment, technology monitoring, and intellectual property expenses.

Wallix Group has been applying for the CIR since 2004 with assistance from a specialist consulting firm.

The accounting principles for the CIR are specified in section 20.10 of the consolidated financial statements in Chapter 20 of this Registration Document.

Wallix SARL has been the subject of an accounting audit covering all its tax returns for the period from January 1, 2012 to December 31, 2014, as well as its tax credits for the years 2011 to 2014. The result of the audit was a reassessment requiring the Company to pay an additional €586,000.

At the date of the Registration Document, the Group is contesting this reassessment and an appeal is in progress. A provision of € 69,000 was nevertheless recorded.

The risk that the tax authorities may in future dispute a CIR application cannot be excluded.

4.2.2 Risks related to intellectual property rights

In terms of intellectual property, the Group's intangible assets consist primarily of its Wallix Bastion software suite and related documentation, which are protected by copyright and by three patents.

Additional factors pertinent to the protection of the Group's intellectual property are set out in Chapter 11 of this Registration Document.

For the development of its software suite, the Group only relies on developers employed by them and, as such, it benefits from the provisions of Article L. 113-9 of the Intellectual Property Code, pursuant to which the Group, amongst other things, owns the copyright to all components developed by its employees for its software suite.

Additionally, certain components of the Group's software suite have been registered with the French source-code protection agency (Agence de Protection des Programmes or APP); three out of the eight registrations are currently pending patent approval and two now being patents issued in France (for more information see Chapter 11 of this Registration Document).

Much like all software industry players, the Group is exposed to counterfeiting issues in relation to its software suite. To limit this risk, the Group has put in place various diverse technical solutions: technical (anti-copying) protection measures, a unique key-based activation system, or use of several of these methods between themselves or with further protection methods. Furthermore, in practice and in the majority of cases, the speed of technological change provides limits to the risks of counterfeits: the time required to duplicate software having extensive lines of code and to ensure compatibility with hardware is such a time-consuming process that the counterfeit version would almost be out of date when released.

Wallix Bastion's current solution is the outcome of ten years of addressing requirements of customers and of thousands of prospective clients in Europe and the Middle East. As its technology is recent, the Company believes that it can address new technical challenges, in particular through the unique knowhow it has gathered and its ability to analyze RDP and SSH sessions in real time. Each year the Group releases one major version and at least two minor versions and, as such, believes that it can continue to develop its solution with such strong differentiating features as to push back the technological barriers to entry. As indicated in Chapter 6 of this Registration Document, a number of consecutive versions of the same software may be released throughout its life. A distinction is therefore drawn between:

"major" versions, including major changes in the architecture and/or in the data model and new major features (reflected in the name: V1, V2);
"minor" versions or releases that include functional changes and/or technical improvements (reflected in the name: V2.1, V2.2).

However, the Group cannot guarantee that the provisions put in place in order to protect its intellectual property rights will prevent the misappropriation or illegal use of its know-how by third parties, nor that its competitors will not develop technologies similar to its own.

The Group is not aware of the existence of any software developed by a third party integrated in its Wallix Bastion software solution, which could lead to a lawsuit against it.

The occurrence of any such adverse events could therefore have a significantly adverse impact on the Group's business, results, revenues, financial condition, or growth.

Finally, it should be noted that a license agreement was signed with Oracle for the integration of the MySQL database into the Wallix Bastion solution and was renewed on January 31, 2018. The Company, however, believes that even if this license agreement were not to be renewed and, as a result, its right to use this software were lost, this would only have a limited impact on the business, revenue and prospects of the Group, as another partner's software solution could be substituted for it.

4.2.3 Risks related to non-compliance with legislative and regulatory restrictions

Processing of personal data

The French Data Protection Act (Loi informatique et Libertés) of January 6, 1978, and the European General Data Protection Regulation (GDPR) no. 2016/679, effective May 25, 2018, provides that all processing of personal information is subject to information and transparency obligations (profiling, systematic monitoring of persons), or so-defined "sensitive data" (health, religion, offenses, exclusion of rights, etc.), including the obligation to carry out impact studies, the appointment of Data Privacy Officers (DPOs), and the prior consultation of the French national data protection commission (Commission nationale informatique et libertés or CNIL). These obligations, however, fall primarily on the person responsible for processing the data, that is the person authorized to determine the purpose and method of the processing the data, which, in this case, is in relation to the Group's customer.

Failure by any of its customers to comply with this obligation would, after formal notice, expose the customer to an administrative fine by the CNIL (Article 83 of the GDPR), or even criminal penalties (Articles 226-16 et seq. of the French Criminal Code).

• The Group's obligations and responsibilities as a service provider under the data regulation

In relation to the French Data Protection Act and the GDPR, the Group acts solely as in a capacity as technical services provider or subcontractor. The Group therefore has to help minimize processing and the data processed, and comply with the instructions of the person processing the data, that is the customer, and take the necessary precautions to protect the security and confidentiality of the personal data that it processes, to prevent the processed data from being corrupted, damaged or communicated to unauthorized persons (Article 32 of the GDPR).

If it fails to comply with these obligations, the Group itself may also be liable, if it can be shown that it has failed to inform, or influenced the actions of, the data processor (Article 28 of the GDPR).

Finally, if personal data is transferred outside the European Union, the customer responsible for processing it, must obtain adequate legal assurances from the recipient of the data (generally, through signing a contract including the standard provisions as approved by the European Union), provided that the recipient country does not have equivalent or adequate data protection laws (Articles 44 and 46 of the GDPR). Once personal data has been authorized for transfer, its processing is additionally subject to more stringent level of security and confidentiality obligations. Such obligations fall on the customer in its capacity as data processor, and not on the Group.

If it fails to comply with these obligations, the client may also, after formal notice, face administrative sanctions from the French CNIL, or even criminal liability. The Group may also be liable, if it is proved that it failed to advise its clients or was aware of or agreed with actions of the data processor.

• Group's compliance with the data regulation

Under existing data protection regulations, companies must put in place adequate security measures to prevent personal data that they hold from being misused.

The Group operates precisely within this field and must therefore ensure that it is not caught out by legislative changes governing the protection of personal data. That said, the Group believes that it complies with all the new personal data protection regulations that will come into effect on May 25, 2018. In fact, in the summer of 2017, the Group set up a GDPR team in for the implementation of the GDPR, which reports to a project manager. Among other things, it set up a data processing register.

Legislative changes in relation to the protection of personal data and changes to the Group's software suite could therefore eventually lead to an incompatibility between the Company's software suite and personal data protection regulations. The Company believes that the Group is currently not exposed to the risk of such incompatibility to the extent that its Wallix Bastion software has received the highest security accreditation (Certification de Sécurité de Premier Niveau or CSPN) since November 25, 2013 from ANSSI for its trustworthiness, and was awarded the France Cybersecurity label in January 2015 by a panel of industry representatives for its sector (ACN, HEXATRUST), users (CESIN, CIGREF, GITSIS) and public bodies (ANSSI, DGA, DGE). The Company also believes that, given its monitoring of regulatory changes and its contribution over many years to the French government's work on cybersecurity and data protection, it finds itself in a favorable position to adapt its solutions to address the development of personal data protection regulaiton.

Regarding export control

Exports are a major aspect of the Group's activities as the Wallix Bastion software solution, along with other future software solutions, are designed to be available and installed for customers outside of France.

As the Wallix Bastion software solution uses advanced encryption systems (dual use goods), the Group must comply (see detailed note on version 6.0 of Wallix Bastion in Chapter 11 of this Registration Document) with appropriate export procedures managed by the Dual Use Goods Service (SBDU)1 of the Directorate General for Enterprise (GDE), which in turn reports to the Minister of the Economy and Finance. Consequently, exports of this software solution outside of the Group's domestic markets may be restricted or subject to obtaining licenses and special export controls. The risks incurred by the Group are thus linked to the classification of Wallix Bastion as a "Dual Use Good".

To export an encryption method from France, ANSSI formalities have to be completed prior to an application for the requisite license to do so.

At this stage, the Group believes that it is in compliance with SBDU and ANSSI requirements.

Furthermore, for certain target countries, the Group may apply for individual export licenses for each customer (valid for 24 months from its issues date).

Due to the complexity of some global license applications and the number of verifications required (technical, administrative and legal), licenses may take a relatively long time to be issued (this can be a matter of weeks. or even months if lists of goods or recipients are long or require major amendments). Thus, when a global license is about to expire, it is standard practice to allow sufficient time for filing the application and, in so doing, avoid disruptions and ensuring that the license is renewed before the existing one expires.

Also, there can be no guarantee: (i) that the level of export controls to which the Group is subject will not increase, (ii) that new generations of products or solutions developed by the Group will not be subject to similar or even more stringent controls, and (iii) that geopolitical factors will not make it impossible for the Group to obtain export licenses for certain customers nor restrict the Group's ability to perform its obligations under existing contracts.

Finally, in the event of non-compliance with the legislation, a fine of capped amount and without major impact on the Group, may be imposed for exporting without due authorization, in particular contrary to the provisions of the Customs Code.

4.2.4 Risks related to compliance with laws and regulations

The Group operates in a complex, strict and evolving legal and regulatory environment both domestically and internationally: in particular, in relation to anticorruption regulations, exchange controls, export controls, as well as regulations governing competitive practices, employment law, and security. By virtue of its international activity, the Group strives to monitor and comply with changes in the legal and regulatory framework within which it operates, without, however, being able to foresee all outcomes, and to that extent its activities or results may be affected.

In most cases, legal and regulatory bodies may file proceedings against the Group or its employees, which could result in civil, administrative or criminal judgments against it, which may adversely impact the Group's image, profitability and financial condition.

Furthermore, although the Group's activities (excluding exports) are not usually regulated, some of its customers' activities, particularly those within the banking sector, sometimes require the Group to comply with regulations that govern it as a result of the performance of contractual obligations. Accordingly, audits may be conducted by affected business partners of the Group to assess its compliance with the specific regulations governing such contractual obligations. Although the Group strives to take the necessary legal precautions to ensure that its employees comply with applicable regulations, as rigorous as these may be, the Group can only provide a reasonable assurance of compliance and cannot in any circumstances guarantee complete security. In any event, the main risk incurred by the Group from non-compliance is limited to the loss of the business contract in question.

¹ In France, the Dual Use Goods Department (Service des Biens Double Usage or SBDU) is the competent authority for issuing licenses.

4.3 Risks related to the Group's organization

4.3.1 Risks of dependency on key personnel and skilled staff

The Group's success largely relies on the work and expertise of its executives, in particular the Chairman of the Management Board, Jean-Noël de Galzain, and certain qualified staff. The Group has not taken out keyman insurance.

The departure of one or more members of its Management Board, or certain key staff could lead to:

loss of know-how and vulnerability of certain of its solutions, all the more so in the event of a move to a competitor, or
a shortage of technical skills that may slow its activity and may eventually affect the Group's ability to achieve its objectives.

Faced with this risk, the Group has put in place contractual provisions specific to its activities and consistent with employment law: non-compete clauses for some staff (see Chapter 15 of this Registration Document).

In connection with its growth, the Group has offered profit-sharing schemes to certain staff and corporate officers, as a result of which some have become shareholders.

The Group has also put in place staff incentive and loyalty schemes in the form of performance-based variable compensation (for example, a share award scheme was set up in 2017 for all Group employees; see Chapter 21.1.4.3 of the Registration Document).

Furthermore, given the complexity of its software, the Group's success depends on its ability to ensure a harmonious workforce and loyalty of employees skilled in the Group's software.

A significant reduction in the number of experienced employees, particularly, if leaving to join a competitor, could have an adverse impact on the Group's business, results, financial condition or turnover.

4.3.2 Risks related to the control of growth

The Group's ability to manage its growth effectively requires it to implement, improve and utilize all its resources efficiently. All significant business growth risks subjecting the Group, its executives and staff to significant pressure. In particular, the Group will have to continue to develop its infrastructure and financial and operating procedures, replacing or upgrading its information systems, and engaging in extensive hiring, training, motivation, management and retention of key staff. The inability of the management team to manage growth effectively could have a major adverse impact on the Group's turnover, results and financial condition.

The Group has recently made a number of hires (see Chapter 6 of this Registration Document) in order to consolidate its existing growth and anticipate the expansion opportunities. In addition to the arrival of Didier Lesteven as Chief Operating Officer, in the past two years the Group has also welcomed: (i) a head of sales for France and Western Europe (VP Sales EMEA), (ii) a head of marketing, (iii) "customer success" manager, (iv) a head of innovation, (v) a quality manager, (vi) a head of strategy, and (vii) several sales and marketing staff. Moreover, the Group already foresees that it will have to hire additional staff in the coming months to support its growth and the development prospects abroad.

Finally, in January 2018, the Group restructured itself as two business units (see Chapter 6.12 of the Registration Document) supported by three cross-functional business services to optimize the management of its physical and human resources.

The Group's inability to manage stronger growth and to hire and retain skilled staff, could adversely impact its future business, results, financial condition, and growth.

4.4 Insurance and risk cover

The Company has put in place an insurance policy to cover the main insurable risks for amounts that it considers to be compatible with its cash flow requirements and its business activities.

The total of premiums payable for all the insurance policies set out below amounts to €58,939 for 2017.

The Group has subscribed to a number of insurance policies, the main ones being:

• Civil, professional, and operational liability policy with AXA

Wallix SARL has subscribed to a civil, professional, and operational liability policy for itself and for the Wallix Group, with AXA France IARD through the insurance broker LSN Assurances.

• Professional multi-risk policy with Allianz

The Group has also subscribed to a multi-risk policy with Allianz to cover its head office premises against fire, theft, water damage, glass breakage, electrical damage, attacks, natural disasters, operating losses, and criminal defense.

This policy includes civil operational liability cover, although this risk is also covered by the AXA civil, professional and operational liability policy. However, the general terms of the multi-risk office policy stipulate that the civil operational liability cover will not apply if another insurance policy is in force offering the same cover.

4.5 Risks related to disputes to which the Group is party

At the date of this Registration Document, there are no other governmental, judicial or arbitration proceedings, or any other proceedings of which the Group is aware, that are pending or threatened and likely to have, or have had over the past 12 months, a significant impact on the Group's financial condition or profitability, with the exception of the R&D Tax Credit (crédit impôt-recherche or CIR) litigation described below and in section 20.10 of this Registration Document.

4.6 Financial risks

4.6.1 Risks related to research tax credits

Please refer to section 4.2.1 of this Registration Document.

4.6.2 Risks related to historical losses

Having posted net losses in recent years, the Group may be forced to post further losses given future expenditures particularly for strengthening its staff, business development and marketing, and opening up new countries and penetrating new markets particularly through the launch of new products or services.

Such further losses could adversely impact its financial condition, growth, and outlook.

4.6.3 Risks related to access to public advances and subsidies

Since 2008, the Group has implemented a deliberate innovation policy in which collaborative research and development projects funded by public authorities play a major role. This policy has resulted in the Group receiving significant subsidies, spread over the term of relevant projects. Subsidies are usually structured as an advance upon signing (30%), followed by gradual payments, and the balance (minimum 20%) on project completion.

From all the financial aid and support agreements signed, the Group has received over the past three years (2015 to 2017) an estimated €782,629 in subsidies.

The principles for recognizing subsidies are explained in the section on "Research tax credit and operating subsidies" (part 3, pages 16-18) of the consolidated financial statements in Chapter 20 of this Registration Document.

Like all publicly funded research programs, the Group faces the risk of having to repay some or all of these grants in the event of non-compliance with its commitments, as well as the risk of no longer receiving them in future. This situation could deprive the Group of the funding it needs to carry out its R&D projects.

4.6.4 Dilution risk

Since its formation, the Group has awarded stock warrants (BSAs), founder's warrants (BSPCEs), stock options (SOs) and share award schemes (AGAs).

The dilution of voting rights is not identical due to the presence of double voting rights within the Company (see section 21.1.4 of this Registration Document).

As part of its incentive scheme for executives and employees and to attract additional skills, the Group may in future issue or award shares or new financial instruments conferring access to Company capital, which may result in additional and potentially significant dilution affecting the Company's existing and future shareholders.

Moreover, before the summer of 2018 and subject to market conditions, the Company plans to issue shares as part of a capital increase in the region of €30 million with waiver of existing shareholders' preferential subscription rights, in the form of a public offering with a priority subscription period. This transaction may result in a dilution for the Company's shareholders.

4.6.5 Exchange rate risk

In 2017, approximately 5% of the Group's turnover was in a foreign currency, primarily in US dollars, pounds sterling, or Canadian dollars. The Group remains very focused on exchange rates, but their impact over the past three years has been insignificant and Wallix Group has therefore not entered into in foreign exchange hedging arrangements.

With its international business intensifying in the Middle East Region and the United States, the Group will probably decide to enter into currency hedging agreements in the years ahead.

At the end of the financial year as of December 31, 2017, receivables denominated in foreign currencies amounted to €396,000, compared to €252,000 in the year ending December 31, 2016 and €242,000 in the year ending December 31, 2015. No significant foreign currency liability is appears in the financial statements for the period under review.

4.6.6 Financing and liquidity risks

Prior to its IPO on the Alternext (now known as Euronext Growth) Market in June 2015, the Group funded its growth by boosting its equity through capital increases from "Business Angels" and venture capital funds.

Through raising approximately €10 million from existing shareholders and new institutional and retail investors, the Company was able to strengthen its European presence and increase its international growth (expanding the international sales force and increasing marketing production globally (in English, French and German) for the English-speaking, French-speaking and German-speaking markets, resulting in growth in export turnover from €1,260K at the end of 2014 to €2,956K at the end of 2017).

The Company believes that its existing financial indebtedness from Bpifrance (formerly OSEO) and BNP Paribas does not expose the Group to liquidity risk resulting from the early repayment terms of such debt. In connection with these borrowings, the Group has made declarations, guarantees and undertakings to the banks that are usual for this type of financing, particularly with regard to its legal and financial situation (the contracts do not provide for non-compliance with financial ratios) as well as restructuring, acquisitions, asset disposals, payment incidents and insolvency proceedings.

(€ thousands)	31/12/2017	< 1 year	> 1 year & < 5 years	> 5 years

Loans from credit institutions (fixed rates)	1,691	273	1,248	170
Bank overdrafts	1	1
Finance leases	258	113	145
Other financial borrowing & debt
Total	1,950	387	1,393	170

The following table shows a breakdown of financial debt by maturity:

At December 31, 2017, the Group's gross cash amounted to €7 million and net cash to €5 million.

The Group carried out a specific review of its liquidity risk and concluded that it would be able to meet its future repayment commitments over the 12 months following the date of this Registration Document.

Details of borrowings are set forth in paragraph 10.3 of this Chapter 4 of the Registration Document.

4.6.7 Interest rate risk

As of December 31, 2017, the Group's financial indebtedness consists of five bank loans totaling €1,691,000, including a €850,000 loan entered into on March 22, 2017. These various loans were arranged either without interest rates from Bpifrance Financement or with fixed rates (from 0.96% to 2.99%) from BNP Paribas and Bpifrance Financement.

Consequently, the Group believes that it is not exposed to interest rate risk.

4.6.8 Credit risk and counterparty risk

For its funding, the Group relies on financings from Bpifrance Financement (formerly OSEO) and BNP Paribas (see Note 5 "Financial liabilities" in the consolidated financial statements in paragraph 20.1 of the Registration Document related to the consolidated financial statements and paragraph 4.6.6 of the Registration Document for repayment schedules).

Given the nature of its customers, and the type of credit institutions used by the Group, the Company believes that counterparty default risk is low.

4.6.9 Risk related to equities and other financial instruments

At the date of this Registration Document, the Company has no equity interests in any listed company and is therefore not exposed to equity risk.

4.6.10 Geopolitical risks

Outside France, the Group operates in the United Kingdom, a country with a low risk of political instability. In the Europe Middle East Africa (EMEA) region, the Group trades with some countries that may experience periods of political instability (notably Maghreb, Arabian Peninsula and Russia). In the event of instability, the risk is solely of loss in turnover and relates to countries which do not account for a significant percentage of the Group's turnover. Also, as it is not directly present in these countries, in that it operates through resellers, partners or integrators, the Group believes that such risk is limited solely to a decrease in its business for the region concerned.

Finally, in a global economic, trade, social and geopolitical environment that remains uncertain at global level, the Group's growth in turnover, in net earnings and in cash flow, could slow down on an annual basis.

4.6.11 Risks related to the impairment of intangible assets

As indicated in Note 2 on page 12 of the Notes to the 2017 consolidated financial statements presented in paragraph 20.1 of this Registration Document, development costs corresponding mainly to personnel expense, are capitalized when they satisfy the activation criteria stated in the accounting principles. Such development costs are amortized over five years.

The net carrying value of these assets amounted to k€5,677,645 at December 31, 2017 or 25.7% of the consolidated balance sheet total.

If an impairment indicator were to be identified in the future, an impairment test would be carried out and could lead to a writing down of these intangible assets and a deterioration of Group equity. The Group has not encountered such a situation to date.

4.6.12 Off balance sheet commitments

At December 31, 2017, there were no significant off balance sheet commitments.

5. INFORMATION ABOUT THE COMPANY

5.1 History and development of the Company

5.1.1 Corporate name and commercial name of the Company

The corporate name of the Company: WALLIX GROUP.

5.1.2 Registration place and number of the Company

The Company is entered in the Trade and Companies Register of Paris under number 428 753 149.

5.1.3 Date of incorporation and term

The Company was incorporated on December 28, 1999 for a period of 99 years starting from its entry in the Trade and Companies Register, namely until December 28, 2098, unless extended or dissolved early.

5.1.4 Registered office of the Company, legal form, legislation governing its activities

Initially created in the form of a société par actions simplifiée (simplified joint stock company) under the corporate name of If Research, on May 6, 2015 the Company was transformed into a société anonyme (joint stock company) and the corporate name was changed to WALLIX GROUP. It is governed by French law, and mainly subject to Articles L.225-1 et seq. of the French Commercial Code, in terms of its operations.

The Company's registered office is located at 250 bis, Rue du Faubourg Saint-Honoré, 75008 Paris. The Company's contact details are as follows:

Telephone:	+ 33 1 53 42 12 81
Fax:	+ 33 1 43 87 68 38
Email:	[email protected]
Website:	www.wallix.com

5.1.5 Important milestones in the growth of the Group's business activities

1999	- Creation of IF Research
2003	- IF Research is renamed WALLIX GROUP - Launch of the Total Secure offering, a security service for the remote entities, subsidiaries or sites of major account customers
2006	- Launch of Proxy SSH for in-house needs: governance tool for access and traceability
2007	- First fund raising for €550,000 (including convertible bonds, converted in 2011 and 20121 ) and entry of Sopromex and Access2Net into the Company's equity capital, at the price of €15 per share
2008	- Repositioning of the offering towards the management of privileged accounts or PAM (Privileged Access Management)
2009	- Launch of the Wallix AdminBastion (or WAB) software - Change of the distribution model with the adoption of indirect sales

¹ Conversion ratio determined on the basis of several criteria such as the number of shares held by the founders, an accretion coefficient, the number of shares held by investors, and so on. Thus for 2011: 1 share for 4 bonds, and for 2012: 1 share for 1 bond

2010	- Successive fund raisings between 2008 and 2010 from private individuals, under the ISF or Wealth Tax scheme offering deductibility for tax of investments in small companies, for a total of €879,000 at an average price of €36.8 per share.
2011	- Fund raising of €1,790,000 to launch the development plan in Europe (UK, Benelux, Switzerland, North Africa); entry by TDH, Thierry Dassault, and Auriga Partners in the Company's equity capital, at the price of €36.86 per share.
2012	- Fund raising of €2,120,000 to boost the company's international development from historic funds and the entry by FSN PME – now known as Ambition Numérique de BPI France – in the Company's capital, at the price of €36.86 per share. - Arrival of Serge Adda as Chief Technical Officer
2013	- CSPN (First level security certification) issued by the ANSSI - Additional fund raising of €1,132,000 from long standing investors, and from employees, at the price of €28 per share - October: Best Product of the Year 2014 at the Infosecurity trade show in Moscow
2014	- November: Computing Security Awards for WAB On-demand, in London
2015	- January: France Cybersecurity label - Broadening of the offering with the launches of: WAB On Demand (WOD), the world's first solution for the security and o traceability of Privileged Access Management On Demand accounts
	WAB Access Manager (WAM), the first unified access website portal o dedicated to all organizations
	- June 15, 2015: Initial Public Offering on Euronext's Alternext market in Paris; capital increase of €10.1 million and market capitalization of €42.0 million on the basis of the offering price
	- Strengthening of the sales force with the appointment of Xavier Lefaucheux as Vice President of Sales, Southern Europe (including France) and the signature of a commercial partnership in Germany with the company SoftShell
2016	- Launch of the new software suite "Wallix Admin Bastion Suite", including two modules, "WAB Password Manager" and "Bastion Access Manager", described as a "Best Buy" by SC Magazine
	- Broadening of the Group's presence in Germany, Austria and Switzerland with the recruitment of Marcus Westphal as Head of the Central and Eastern Europe region
	- Strengthening of technological expertise in the Cloud with the strategic acquisition of the assets of ML STATE, developer of the Peps secure communication solution and winner of a French Ministry of Research Innovation Award
	- Signing of a distribution partnership with Distology, a British company
	- Development of strategic alliances with WAP partners (WALLIX Alliance Partner) such as IBM, Dell, Oracle, SailPoint, Bmc Software, Lieberman Software, Logpoint, VMware and Watchguard
	- Appointment of Edwige Brossard as Head of Marketing and Philippe Guerber as Channel Manager for Western and Southern Europe
	- 2016 Cyber Security Award in the "Identity and Access Management" (IDAM) category
	- 2016 Award for the best "Identity and Access Management" solution at the Computing Security Awards
2017	- Issuance of patents entitled "Secure transfer of authentication information" and "Secure connection process, from a client IT equipment to an IT resource" in February and October 2017 respectively
	- Partnership agreement signed with Schneider Electric concerning the WAB Suite in

	the Schneider Electric service catalogue, allowing Schneider Electric customers to protect access to industrial computer systems and to trace the actions of users with privileges
	- FORBES FUTUR40 Award
	- BFM Business "Cercle de l'Intérêt Général" Award
	- Inclusion in the Enternext® PEA-PME 150 index of Euronext
	- Arrival of Gregory Rousseau as Head of Customer Success, Henri Binsztok as Head of Innovation and Frédéric Philippe as Quality Manager
	- Awarded the Trophée de la Sécurité du Cercle de l'Entreprise et de l'Intérêt Général
	- Launch of the "Bastion as a Service" offering, in partnership with AntemetA
2018	- Restructuring of the Group with
	- Creation of a strategy department
	- Launch of the WALLIX DataPeps solution, an end-to-end encryption platform that helps secure data, and launch of the new WALLIX Discovery module for vulnerability analysis in dormant or unidentified privilege accounts
	- Partnership agreement signed with Bertin IT (CNIM Group) and launch of CryptoCrossinG® combining WALLIX DataPeps® encryption technology with CrossinG®, the new generation trusted gateway designed by Bertin IT

5.2 Investments

5.2.1	Main investments (net of disposals) made during the previous two financial years
-------	----------------------------------------------------------------------------------	--	--	--	--	--

Investments	Financial year 2015	Financial year 2016	Financial year 2017
(French GAAP in € 000s)	12 months	12 months	12 months
Intangible assets	1,456	2,080	2,583
Property, plant and equipment	205	557	210
Long term investments	314	(167)	118
Total investments	1,975	2,470	2,911

Investments in intangible assets mainly consist of research and development costs, franchises, patents, licenses and goodwill. Capitalized R&D costs amounted to €2,575,000 in 2017, €1,896,000 in 2016 and €1,456,000 in 2015. For the 2016 financial year, the acquisition of ML State was accounted for as an increase in concession, patents and similar rights.
Investments in property, plant and equipment mainly consist of fixtures and installations, office equipment and furniture, and computer hardware. In 2016, these were due to the Company's relocation.
Long-term investments mainly consist of deposits and sureties for premises and for the liquidity agreement.

Their breakdown for the fiscal year ended December 31, 2017 is presented in Note 2 of the Notes to the financial statements prepared according to French GAAP and set forth in Chapter 20 of the Registration Document.

5.2.2 Main ongoing investments

The Company intends to continue investing in R&D with, in particular, six new vacancies in the WALLIX Bastion development teams and one additional vacancy in the WALLIX DataPeps R&D teams. The R&D efforts regarding WALLIX Bastion will enable the Group to improve the sessions management function, to open the product to password controlled external vaults, to develop the interconnection with SCADA protocols, and to bolster the offering in cloud mode. In connection with DataPeps, the R&D team will focus on end-to-end data encryption in SaaS mode.

Future investments in property, plant and equipment are not significant, since they mainly concern office fixtures linked to the development of the Group. Future financial investments are not significant.

No signed investment program will result in the acquisition of minority interests or earn-outs on acquisition.

5.2.3 Main future investments

Building on the technology and human investments made in recent years, the Group has developed a strategic plan for major future investments. The Group intends to increase its support for companies and organizations in protecting their digital assets, particularly by taking advantage of the opportunities offered by their obligation to comply with the new European regulations that come into effect in May 2018 (the NIS Directive and the General Data Protection Regulation, or GDPR).

Organic investments will foster the development and marketing of new technology solutions, complementary to WALLIX BASTION, in the sector of Cloud Based Security Services distributed in SaaS (Software as a Service) mode. In this connection, on March 23, 2018 WALLIX announced the launch of DataPeps, an end-to-end data encryption platform used for data security.

The Group will also concentrate on forming strategic alliances with other industry and digital players in order to propose bundled offers and new cybersecurity solutions adapted to the protection of operational technology (OT), to the identities management market, the Cloud, IoT, data repositories and Artificial Intelligence.

As part of its strategic plan for the period 2018-2021, the Group wants to increase the resources dedicated to its external growth and accelerate its global investments with a strong concentration in the DACH region (Germany, Austria and Switzerland) and North America. This ambition will entail the opening of new sales offices in these priority regions and increase the coverage provided by the network of partner integrators/resellers.

As part of its strategic plan covering the period from 2018 to 2021, the Group wants to step up the pace of its international investments and increase the resources allocated to its external growth. In light of this program to step up the pace of its development plan, the Group intends to use a capital increase to finance this new strategic plan, as announced at the publication of the press release for the 2017 annual results, after the market close on March 28, 2018 (see section 4.6.4 of this Registration Document).

If market conditions do not permit the planned capital increase, the Group will consider the following alternatives: (i) search for new investors through a private placement, (ii) bank financing, (iii) selffinancing on a more selective development plan, or (iv) refinancing by the Group's financial shareholders, without appealing to new investors. As of the date of this Registration Document, no decision had been taken.

6. OVERVIEW OF ACTIVITIES

6.1 Company Presentation

WALLIX is a cybersecurity software publisher and Europe's leading player in Privileged Access Management (PAM)1 .

Privileged access is used to run equipment, applications, and data of IT infrastructures, including enabling access to equipment keys, applications, and of enterprise information systems data. As a result, these are primary targets of most cyber-attacks that lead to the theft of sensitive and strategic data, fraud, and the sabotage of corporate information systems.

Used by more than 577 customers and recipient of multiple awards2 , the Group's WALLIX Bastion software suite enables its customers to manage, control, supervise and track privileged access, which are critical in responding to threats to their IT infrastructure.

Privileged access protection: a key requirement when faced with cyber risk

Cyber risk is one of the greatest threats facing businesses and organizations. In 2017, cyberattacks accounted for the theft of the financial information of 143 million Equifax customers in the United States alone and the hacking of 57 million Uber accounts.3

In many instances, hackers start by taking control of a privileged account,4 then they proceed to escalate the privileges of such account. They can then explore the infrastructure and take control of the equipment, applications and databases that they are seeking to attack.

Threats can come from both outside and inside an organization. PAM solutions make it possible to protect access and ensure the ability to track privileged access users for audit purposes and for investigating who or what was responsible for an attack, human error, or incident.

The PAM market

Privileged Access Management is a market segment that covers the management of identities and access (Identity and Access Management or IAM), estimated by Forrester to be worth US\$7.7 billion in 2016.5 According to Gartner, the PAM market is set to grow by 27% a year, from US\$690 million in 2015 to US\$2.274 billion in 20206 .

Another study done by Technavio7 in 2016 estimated the global PAM market to be worth US\$1.170 billion in 2020, with US\$430.8 million of that in Europe. This study estimated the PAM market in 2015 to be worth US\$503 million, with US\$196.6 million of that in Europe. According to this study, the average annual growth rate of the PAM market between 2015 and 2020 is 18.39% globally and

https://www.lesechos.fr/22/11/2017/lesechos.fr/030911942376_uber-victime-d-un-piratage--57-millions-de-comptes-hackes.htm

² See Section 6.4.2.

³ https://www.lesechos.fr/27/09/2017/lesechos.fr/030625552832\_vol-de-donnees---equifax-debarque-son-pdg.htm;

⁴ Privileged accounts are accounts that offer privileged access to all or part of an infrastructure.

⁵ https://go.forrester.com/blogs/17-04-27-security_challenges_drive_growth_for_iam_solutions/

⁶ Source: Gartner Forecast Snapshot: Privileged Access Management, Worldwide (March 2017)

⁷ Source: Technavio Global Privileged Identity Management – 2016

21% in Europe (see Section 6.2.1 Cybersecurity, identity management, privileged access management).

Among others, the following underlying trends are expected to lead businesses and organizations to devote an increasingly large proportion of their capital investment to protecting access to, the identity of and the content of their underlying infrastructure:

the development of cloud-based Information Technology (IT) and Operational Technology (OT)1 infrastructures;
the hyperconnectivity of networks connecting increasing numbers of mobile devices and other equipment;
the outsourcing of IT infrastructure, access to which is managed by external service providers via privileged accounts;
the emergence of the Internet of Things (IoT), which increases the number of connected devices;
the massive increase in the volume of the data processed by infrastructures, integral to Artificial Intelligence, and which must therefore be protected;

and, more broadly, the digitalization of businesses and organizations.

The Company believes that the European market offers major growth opportunities for PAM, given the degree to which it lags behind other geographic regions such as North America.

Such opportunities will be driven by new regulations governing businesses and organizations operating in the European Union:

the General Data Protection Regulation (GDPR),2 effective May 25, 2018, which imposes infrastructure security and content protection requirements on organizations in respect of the personal data that they hold;
the NIS Directive,3 which is to be transposed into domestic law by no later than May 9, 2018 and which imposes new security and notification requirements on Essential Services Operators (ESOs) and digital services providers.

The Group's software solutions

The WALLIX Bastion software suite allows for the management, control, supervision and tracing of activities of privileged access users whilst protecting passwords for the computer equipment and software of the underlying infrastructure. Its tracking feature allows administrators to see user sessions live, log their activity for audit or compliance purposes, filter user activities to prevent malicious acts or human error, and prevent data leaks whilst providing alerts in the event of any risks or malicious behavior.

The WALLIX Bastion software suite is certified by ANSSI,4 which makes it one of the best solutions in France for Vital Operators (VOs)5 and places it in an ideal position to address the requirements of Essential Services Operators (ESOs) in Europe, which are required to rely on certified solutions to comply with the NIS Directive.

¹ IT : Information Technology, OT : Operational Technology

² General Data Protection Regulation (GDPR) no. 2016/679 of April 27, 2016.

³ See Section 6.6.5 on how the implementation of these Directives will affect WALLIX .

⁴ The French national information systems security agency (Agence nationale de la sécurité des systèmes d'information). For more on this topic, see Sections 6.4.4 and 6.6.4.

⁵ For details of the ISO/ESO classification and the estimated number of ESOs in Europe, see Section 6.6.2

The WALLIX Bastion software suite consists of three modules:

Session Manager, a module for controlling access privileges, and watching and recording user sessions;
Password Manager, a module for protecting passwords, with a password vault and a mechanism for password rotation;
Access Manager, a web-based application that allows administrators to log-in to the resources to be administered and allows auditors to review and supervise the administrators' actions as logged by the Session Manager.

The technical advantages of the WALLIX Bastion software suite are: an integrated proxy-based architecture that permits simple and non-disruptive rollout onto information systems, the innovative type of Session Manager particularly for monitoring and recording sessions,1 the modularity of its architecture which allows each module to be used independently from others, and its cloud-based accessibility on the Amazon Web Services (AWS) and Microsoft Azure platforms.

On March 23, 2018, WALLIX further announced the launch of WALLIX DataPeps, a new End-to-End Encryption (E2EE) solution that allows for securing inter-user communication, protecting data from attacks, and ensuring that applications comply with the GDPR. The DataPeps solution supplements WALLIX Bastion and expands the scope of encryption and data protection possibilities to many other uses (file sharing, email, social networks and online platforms, connected devices, home automation).

Financial overview

Through its Initial Public Offering on Alternext (now Euronext Growth) in Paris in 2015, WALLIX raised €10.1 million to fund its 2015-2018 business development plan.

In 2017, sales of software licenses and maintenance and support services for the WALLIX Bastion suite accounted for 96% of Group consolidated turnovers2 totaling €11.56 million, up 57% on 2016 (versus €5.3 million in 2015 and €4 million in 2014), of which 71% were sales of software and 29% was linked to maintenance agreements.

Subject to market conditions and AMF approval of its prospectus and offering documents, WALLIX plans to make a public offering before the summer of 2018, to increase its share capital by approximately €30 million to finance its new strategic plan as announced upon publication of the press release on March 28, 2018 after the stock market close, showing the 2017 annual results (see Chapter 12.3 of this registration document, Objectives at 2021). The purpose of this call for funds is to give it the resources to become a European cybersecurity champion, positioned in strategic technologies for the protection of access to information systems, identities and data. Approximately one third of the amount raised will be allocated to funding internal development, with the rest earmarked for acquisitions. More details can be found in section 12.3, Objectives to 2021.

WALLIX has ambitious growth plans for the period 2018-2021 with a consolidated turnover target of €50 million in 2021. This information is provided in Chapter 12.3, Objectives at 2021.

WALLIX is headquartered in Paris. The Group has 83 employees, and offices in Germany, the UK, the Maghreb, in Africa, the Middle East, and North America, via a network of value-added resellers, integrators and distributors in 55 countries.

6.2 The WALLIX market

An overview of WALLIX markets is presented below: MARKET DESCRIPTION SIZE Average rate of WALLIX targets

¹ "In the area of session monitoring and recording, Wallix clearly is among the leading-edge vendors in the market", Kupingercole, 2017

² The remaining 4% was delivered by IF-Research, which provides professional services and managed services for major corporations.

			annual growth	this market with:
PAM	Privileged Access Management Management, control and traceability of privilege access. This market is included in the IAM market below Note : the PAM market is a sub-segment of the IAM market	\$2.274 billion in 2020 on the global level, according to Gartner \$1.170 billion in 2020 on the global level, according to Technavio (including \$430.8 million for Europe alone)	27% per year between 2015 and 2020, according to Gartner 18.39% per year between 2015 and 2020 according to Technavio (21% for Europe alone)	WALLIX addresses this market today by offering the WALLIX Bastion Suite product
IAM	Identity and Access Management Identity management, user authentication, PAM NB: the PAM market is part of the IAM market	\$13 billion in 2021on the global level, according to Forrester US\$14.82 billion globally in 2021 according to MarketsandMarkets	11.5% per year between 2016 and 2021 according to Forrester, 12.9% per year between 2016 and 2021 according to MarketsandMarkets 12.9% per year between 2016 and 2021, according to MarketsandMarkets	WALLIX plans to see technology partnerships and strategic alliances with players in this market
CBSS	Cloud Based Security Services CBSS / Data encryption	\$9 billion in 2020 on the global level, according to Gartner \$3.7 billion in 2019 on the global level, according to Technavio	17% per year between 2017 and 2019 according to Technavio	WALLIX targets the two sub segments of this market as shown below WALLIX released its WALLIX DataPeps product in March 2018 to address this market starting from that date
	CBSS / Identity as a Service and cloud based authentication	\$3.4 billion in 2020 on the global level, according to Gartner	20.7% per year between 2016 and 2020 according to Gartner	WALLIX plans to form technological partnerships and strategic alliances with market players in order to address this market

6.2.1 Cybersecurity, identity management, privileged access management

WALLIX is positioned in the cybersecurity market, estimated by Gartner1 to be worth US\$96.3 billion globally in 2018. In this market, 60% of spending is set aside for cybersecurity services with the

¹ Source: Gartner https://www.gartner.com/newsroom/id/3836563, 2017

remaining 40% going to IT security software solutions. With a more optimistic outlook, MarketsandMarkets™ has estimated this market to be at US\$137 billion in 2017 and predicted an annual growth of 11% until 2022, where it should reach US\$231.94 billion by 2022.1

In the cybersecurity market, WALLIX currently responds to market demand for the management, control, supervision, and tracing of access to privileged accounts, known as Privileged Access Management (PAM). This market segment has been identified by analysts as an integral part of the Identity and Access Management (IAM) segment which, according to Forrester,2 is set to grow by 11.5% per year from US\$7.7 billion in 2016 to US\$13.3 billion in 2021.

The PAM market is seeing an accelerated growth phase. Gartner3 predicts that it will grow by 27% a year from US\$690 million in 2015 to US\$2.274 billion by 2020 (see chart below). This growth is more than twice that of the cybersecurity market and IAM market.

The Company believes that the European market offers significant growth opportunities for PAM given the degree to which it lags behind other geographic regions such as North America. In that respect, the new NIS and GDPR Directives (see Section 6.6 of this Registration Document) should encourage investment by European businesses and organizations.

Another study done by Technavio4 in 2016 estimated the global PAM market to be worth US\$1.170 billion in 2020, with US\$430.8 million of that in Europe. This study estimated the PAM market in 2015 to be worth US\$503 million, with US\$196.6 million of that in Europe. According to this study, the average annual growth rate of the PAM market between 2015 and 2020 is 18.39% globally and 21% in Europe.

When WALLIX went public in 2015, the Company was positioned within PAM on the global segment of Privileged Session Management (PSM), which at the time represented 50% of the global PAM market according to Group estimates, i.e., US\$225 million worldwide in 20135 . Since 2015, and in line with the Group's forecasts reported that year, WALLIX has been developing a software module called Password Manager6 , which addresses the other 50% of the PAM market, thus supplementing its offer and allowing it to position itself on the entire global PAM market.

¹ Forrester, Gartner et MarketsandMarkets

² https://go.forrester.com/blogs/17-04-27-security_challenges_drive_growth_for_iam_solutions/

³ Source: Gartner Forecast Snapshot: Privileged Access Management, Worldwide 2017 (March 2017)

⁴ Source: Technavio Global Privileged Identity Management – ²⁰¹⁶

⁵ Source: Base Document for WALLIX's IPO in 2015.

⁶ See Section 6.3 "The WALLIX Bastion solution," especially Section 6.3.6 "The Password Manager software module."

6.2.2 Why protect privileged access?

Privileged access permissions are necessary entry points for users1 to be able to manage the components that make IT infrastructure, such as servers, routers, firewalls, applications, databases and other functionalities, all of which having privileged access granting users the highest access rights. Used by administrators in performing their tasks, privileged access permissions permit them to do anything, including shutting down the system or extracting sensitive information from databases or devices.

Privileged access accounts are the primary targets of cyberattacks. Hackers start by trying to take control of a privileged account and use that to then get into the information system to increase their permissions and open further doors to access more functionalities and devices. Their goal is to access sensitive information and/or take control of devices, applications, databases, and the entire information system that they are trying to attack.

Information piracy has very often been traced to weak security on privileged accounts, such as the Snowden case in June 2013, the theft of financial information of 143 million Equifax clients in the United States,2 and the hacking of 57 million Uber accounts in November 2017.3

A Forrester4 study reports that some 80% of cyberattacks succeed by, at some time or other, hacking a privileged account. Privileged accounts are IT security nerve centers, and the protection, control and tracking of privileged access are key factors in any cybersecurity strategy.

6.2.3 Growth factors and outlook for PAM

Growth in the PAM market is sustained by numerous factors, the most important being:

the increasing digitalization of corporate functions, which magnifies the business impact of cyberattacks. The dematerialization of processes makes companies critically dependent on the proper operation of their IT infrastructure. In manufacturing, with the automation of production chains that use computerized and connected equipment, a cyberattack can shut down a company's core business. Indeed, production machines are also equipped with privileged access and may become targets for cyberattack. For example, in a 2017 study of cybercrime, Accenture estimates that the average cost of cybercrime5 around the world had climbed to US\$11.7 million per company in 2017, 23% up on 2016 (survey of seven European countries, including France).
the development of cloud-based IT infrastructures and the interconnection of networks being accessed by increasing numbers of mobile devices and other equipment. The networks of businesses and other organizations no longer have physical limits; increasing volumes of data are being stored in the cloud and data exchange is proliferating. Cisco predicts that Cloud Data Centers will account for 94% of global data processing capacity by 2021, versus 6% for traditional Data Centers.6 As a result, the attack surface of IT infrastructures is growing.
the trend to IT outsourcing, connected with the fact that companies lack the expertise or budgets for rolling out, managing and operating IT solutions themselves or make a strategic choice to entrust their IT to specialized third-party firms. Such companies

¹ Users with privileged access can interact with systems to obtain sensitive information, which presents the risk of theft, compromise or accident or even the destruction of the information system. In that respect, the accounts of system and network administrators, database managers, and cloud administrators are privileged permissions that present the highest risk level.

² https://www.lesechos.fr/27/09/2017/lesechos.fr/030625552832_vol-de-donnees---equifax-debarque-son-pdg.htm

³ https://www.lesechos.fr/22/11/2017/lesechos.fr/030911942376_uber-victime-d-un-piratage--57-millions-de-comptes-hackes.htm

⁴ Source: Forrester, The Forrester Wave: Privileged Identity Management Q3 2016

⁵ Source: Accenture, The Cost of Cybercrime in 2017, 2017

⁶ Source: Cisco, Cisco Global Cloud Index Forecast 2016-2021, 2017

outsource the management of all or part of their requirements to external providers (such as services operators) whose privileged access has to be managed, controlled and supervised.

• the advent of the Internet of Things (IoT), which increases by several orders of magnitude the number of devices connected to the infrastructures. According to a Gartner study,1 there were 8.4 billion connected things in 2017, 3.1 billion of them in corporations. The new connected devices are, however, still very vulnerable to attack. The need to manage them will create further requirements for privileged access which will therefore have to be protected by PAM solutions.

PAM solutions are able to meet these problems but businesses and organizations are still too weakly equipped. For example, the world leader in the PAM market, CyberArk, claims to have 3,700 customers around the world, while the leading providers in the mature segments of the IT security market – Symantec, Fortinet and Barracuda – report 370,000, 290,000 and 150,000 global customers, respectively. These figures suggest the scale of the potential customer base in the years ahead.

6.2.4 The Identity and Access Management (IAM) market

The PAM market is a sub-segment of the corporate Identity and Access Management (IAM) market. The IAM market has a number of sub-segments:

the IAM market segmentation proposed by MarketsandMarkets defines the market as the sum of the following segments: Provisioning (identity creation), Directory Services, Password Management, Single Sign-On (SSO), Audit, Compliance, and Governance. 2
the IAM market segmentation proposed by Forrester defines the market as the sum of the following segments: Web Single Sign-on (Web SSO), Identity as a Service (IDaaS), Two-Factor Authentication (2FA), Risk Based Authentication (RBA), Privileged Identity Management (the other name for PAM), Identity & Governance Administration (IGA), and Customer IAM.3

These two organizations believe that the IAM market will be worth between US\$13 and 14.8 billion by 2021.

MarketsandMarkets believes that the IAM market was US\$8.09 billion in 2016 and is set to grow by an average 12.9% a year to US\$14.82 billion by 2021.
Forrester believes that the IAM market was US\$7.7 billion in 2016 and is set to grow by an average 11.5% a year to US\$13 billion by 2021.

This growth reflects the substantial increase in the number and type of connected players, and thus of identity depositories, connected with the digital transition. In addition to the traditional physical persons inside a corporation, from now on the following identities also have to be managed:

identities of physical persons outside the corporation such as subcontractors, suppliers, and the technicians of service providers, who need to be granted privileged access;
identities of apps that autonomously connect to cloud-based infrastructure;
identities of connected devices (IoT infrastructure);
identities of production tools and equipment connected to infrastructures (Operational Technology – OT).

¹ Source: Gartner, https://www.gartner.com/newsroom/id/3598917, 2017

² Source: MarketsandMarkets classification

https://www.marketsandmarkets.com/Market-Reports/identity-access-management-iam-market-1168.html

³ Source: CIO online, https://www.cio-online.com/actualites/lire-forrester-attend-un-doublement-du-marche-de-l-iam-dans-les-quatre-ans-9608.html

PAM solutions can advantageously connect with the solutions of other IAM sub-segments, in particular solutions for creating and managing the identities of all users of an infrastructure, as PAM-IAM integration enables consistent automation of the relationship between the digital identities generated by IAM solutions and the digital identities of administrators managed by PAM solutions.

Some IAM players are developing PAM modules that are directly integrated into their identity management solution, such as CA Technologies and Hitachi ID. Others opt for an acquisition strategy, such as the American publisher of the IAM One Identity solution which bought the Hungarian PAM software publisher Balabit, or Bomgar which bought Lieberman Software.

WALLIX has chosen to adopt a strategy of technological partnerships1 with IAM players, an approach also adopted by the market leader, CyberArk.

6.2.5 The cloud-based encryption and security services market

After a long time working to put in place firewall and antivirus solutions to prevent external threats from penetrating their infrastructures, IT departments now realize that these perimeter security solutions no longer suffice. With infrastructures migrating to cloud-based hosting (Cloud Data Centers), increasing volumes of data are being transmitted beyond corporations' physical boundaries. Data therefore becomes much more difficult to protect with traditional perimeter security solutions.

To strengthen the security of the data and content stored in their infrastructures, and to withstand attacks aimed at exfiltrating data, IT departments are increasingly adopting data encryption solutions. Thus, even if their data is stolen, encryption will prevent it from being exploited by third parties.

The encryption market is expected to continue growing. Technavio2 predicts that it will grow by an average 17.5% a year, from €2.5 billion in 2017 to €3.7 billion in 2019.

Within this market, the recent End-2-End Encryption (E2EE) segment is attracting interest from many corporations:

in April 2016 the Whatsapp messenger service announced that its users' communication would now be fully encrypted end-to-end;3
in 2016, Gemalto launched its Ncryptify service permitting application developers to add an end-to-end encryption system to it;4
the American company Symphony, which offers cloud-based collaborative messaging with end-to-end encryption keys, raised approximately US\$100 million in October 2015 and a further US\$63 million in May 2017.5

End-to-end encryption guarantees that only the sender and the legitimate recipient(s) of a message know its content. Once encrypted, a message is inaccessible and unreadable by a third party. For example, corporations using this type of encryption are unable to send a decrypted version of messages to the authorities. Encryption is via a specific cryptographic key, shared solely between the two parties who are exchanging the message, and no certification authority holds the master key. For this reason, this technology is also simpler to implement.

The cloud-based security services market is the market for security solutions that are supplied, updated, and managed via the cloud. Such solutions have the advantages of SaaS solutions, such as low implementation and maintenance costs and a price that is based on usage.

¹ See Section 6.5 for details of WALLIX's development strategy

² Source: Technavio, Global Encryption Software Market 2015-2019, 2015

³ Source: Les Echos, https://www.lesechos.fr/06/04/2016/lesechos.fr/021821127828\_chiffrement-de-bout-en-bout-de-whatsapp---comment ca-marche--.htm, 2017

⁴ Source: Gemalto, https://ncryptify.gemalto.com

⁵ Source: Crunchbase, https://www.crunchbase.com/organization/symphony-3#section-locked-marketplace, 2017

Gartner estimates the cloud-based security services market at US\$5.9 billion in 2017 (up 21% on 2016) and US\$9 billion in 2020.1

In addition to the encryption market, the cloud-based IAM, IDaaS and authentication (cloud-based) segment is also of great interest to WALLIX since it is close to the PAM segment (see Section 6.2.4) and is delivered in cloud mode. According to Gartner, it was worth US\$1.65 billion in 2016 and likely to reach US\$3.4 billion by 2020. This market segment can also be seen as the cloud-based component of the IAM market.

WALLIX intends to take advantage of the opportunities in this market to launch its new end-to-end encryption service in SaaS mode: WALLIX DataPeps.

6.3 The WALLIX Bastion solution

6.3.1 Overview

WALLIX Bastion is a technology for protecting, securing, and tracking privileged access. It is aimed at the Privileged Access Management (PAM) market described in Sections 6.2.2 and 6.2.3 of this document. This technology permits:

identification of privileged account users;
management of their permissions and access rights;
implementation of a password vault for equipment and applications;
tracking of the activities of privileged account users:
o viewing in real-time and recording log users' activities for audit or compliance purposes;
o filtering these activities to avoid malicious acts or human error and prevent data leaks;
o generating alerts in the event of malicious behavior.

This technology comes as part of the WALLIX Bastion software suite, which contains three software modules: Session Manager, Password Manager and Access Manager. This document refers to the WALLIX Bastion software suite as the "WALLIX Bastion solution".

These software modules are marketed in the form of the following three offerings: Basic (entry-level), Professional, and Enterprise. They are available in "on-premises" versions and "cloud" versions on the Amazon AWS and Microsoft Azure platforms. For a detailed description of these packages (content, target markets, marketing approach), see Section 6.8 of this document.

6.3.2 The WALLIX Bastion solution secures information systems.

The WALLIX Bastion solution reduces the risk of technical error and counters malicious acts on IT infrastructures. With WALLIX Bastion:

it is no longer possible to access critical infrastructure servers without undergoing strict access control; this control applies to internal and external users;
the supervisor can see in real-time what privileged account users are doing and can filter sessions to prevent errors and attacks;
the supervisor can replay admin sessions on video or in text format for command lines; in the event of a server incident, it becomes easier and quicker to identify the origin of the malfunction;

¹ Source: Gartner press release, June 13, 2017: https://www.gartner.com/newsroom/id/3744617

it is easy for the supervisor to produce proof of an action and pursue malicious perpetrators, as all connections to the web interfaces of equipment or applications are logged. An integrated search engine can be used to quickly find the events corresponding to an incident;
it is not necessary for administrators to know the passwords of the systems to which they have access rights; thus, equipment password management is not impacted by administrator staff changes.

The WALLIX Bastion solution secures the information system by protecting confidential information against data leaks and against various threats such as industrial espionage:

external or internal administrators have access only to the authorized systems and not to the files and data that they contain;
every access to critical servers containing sensitive data is time-stamped and the actions are recorded, so they can serve as proof and be used for post-mortem analyses;
a system of alerts informs the supervisors of any unauthorized event or any attempt to access confidential and/or sensitive data (such as a prohibited download).
6.3.3 The WALLIX Bastion solution can be configured for compliance

The traceability function of the WALLIX Bastion software suite enables user sessions to be viewed in real time and their activity to be recorded for audit or compliance purposes, particularly in view of the NIS Directive. The privilege access control function of the WALLIX Bastion software suite filters these activities to avoid abuses or human error and prevent data leaks, allowing businesses and organizations to meet their requirements under the GDPR.

The WALLIX Bastion software suite is certified by ANSSI. This makes it the PAM solution of choice for Vital Operators (VOs) in France and places it in an ideal position to address the requirements of Essential Services Operators (ESOs) in Europe, who are required to use certified solutions to comply with the NIS Directive.

The WALLIX Bastion software suite therefore enables ESOs, and VOs in France, to meet the new compliance requirements imposed by the GDPR and the NIS Directive (see sections 6.6.1 and 6.6.2 of this document).

In addition, the WALLIX Bastion software suite enables companies and organizations:

to comply with applicable legislative, regulatory or professional frameworks (ISO 27001 recommendations, Basel rules, Sarbanes-Oxley Act, Arjel gaming rules, audit rules for computer-based accounting, regulations governing the hosting of health data, etc.);
to monitor on a daily basis the actions of external service providers via a tracking tool and to react more quickly in the event of an incident;
to be more credible when applying for professional certification to, for example, host health data.

With WALLIX's PAM solutions, content becomes inaccessible to users who access servers, applications and databases for management or administrative tasks.

6.3.4 The WALLIX Bastion solution and its architecture

The WALLIX Bastion solution enables IT departments to protect privileged access by managing how privileged accounts operate. Instead of connecting directly to the machine to be configured, a depositary administrator of a privileged account has to go through Bastion which takes charge of performing the necessary verifications of that administrator's rights. It then authorizes – or not – the administrator's connection to the machine and records the session.

The WALLIX Bastion solution thus sits between the resources to be protected and the persons who have access to these resources, like a proxy security gatekeeper. In this way, it secures access to organizations' critical machines (central servers, routers, firewalls, etc.) and plays this role for all enterprise resources such as business applications, industrial machinery control chains, and databases that contain sensitive information (personal data, manufacturing secrets, etc.).

The WALLIX Bastion solution also ensures the traceability of administrators' sessions by offering the ability to review privileged sessions for audit purposes, troubleshooting, or identifying responsibilities for malicious events, for example. The product also has a real-time alert system to flag users breaching corporate security policy.

In March 2010 and April 2014, WALLIX registered earlier versions of its solution with the French source-code protection agency (Agence Pour la Protection des Programmes) under the name of WAB (Wallix Admin Bastion). To protect its technology, the Company filed a patent application in March 2015 entitled "Secure Transfer of Authentication Information" (for details of the Group's intellectual property, see Chapter 11 of this Registration Document, and Section 4.1.5 on the risks associated with the uniqueness of the product).

The WALLIX Bastion solution consists of the following three functional modules:

Session Manager, a module for controlling privileged access, without knowing resources' passwords, for viewing and recording privileged sessions (historically, the company's core product);
Password Manager, a module for implementing a password rotation policy governing administrators' access to IT resources (which enables system security to be strengthened with respect to password modification and manipulation, and to prevent the risk of password leaks);
Access Manager, a web administration console for supervising and auditing all actions by administrators and recorded by the Session Manager. This console also makes it possible to aggregate the data recorded by multiple instances of WALLIX Bastion in the case of "large" infrastructures.

Session Manager and Password Manager rely on a highly secure password vault based on AES 256 (256-bit Advanced Encryption Standard) technology.

Figure 1: Description of WALLIX Bastion

The WALLIX Bastion solution protects privileged account access to cloud-based infrastructures hosted by Microsoft Azure or by Amazon Web Services with a version of the product available specifically for these environments (in the form of a dedicated Virtual Machine).

Also, the combination of multiple instances of WALLIX Bastion in cloud mode and in on-premises mode enables protection of access to hybrid infrastructures with an overall view of the information coming from the various instances of the product deployed in the infrastructure and permits the administrator to manage these instances in a simple and consolidated way.

6.3.5 The Session Manager module

Session Manager handles access to privileged accounts by permitting the enterprise to define security access levels. Users connect to their individual single account that gives them access to all the data they need, thereby mitigating the risk of error and malicious actions while maximizing their productivity.

Session Manager records sessions graphically, capturing keystrokes as well as the applications used. It monitors and tracks the activities of users who have logged in and shows which administrator accounts logged in when and for how long, and to which resources (machine, application, data).

Session Manager permits user sessions to be viewed in real-time to analyze their content. The system generates alerts of incidents or human error. A search engine can be used to find proof of an incident or for audit purposes.

Session Manager also provides the capability to prove that the rules governing privileged account access comply with applicable industry standards and regulations. This is extremely useful for corporations as well as for users regularly accessing sensitive data (IT departments, IS security officers, security executives, risk executives, etc.) who can thereby prove their actions to their employer, company, or customers.

Session Manager has the following functionalities:

manage and control (govern) privileged accounts: by directly accessing resources via native clients (putty, winscp, openssh, etc.) using connection rules and access-authorization workflows;
view sessions in real-time: watch Remote Desktop Protocol (RDP) sessions, Secure Shell (SSH) sessions, and application sessions; operate "4-eyes supervision" (two remote users for the same session: one working, the other supervising);
alerts: post alerts, and shut down remote sessions based on numerous criteria including whitelisting/blacklisting, optical character recognition (OCR), widget events, and analysis of keyboard patterns;
reporting and audit: identify perpetrators of actions, track logins, generate statistical reports of activity and audit logs, replay user sessions and generate session scripts and metadata;
interoperability: provide a library of scripts for consoles, web applications, and fat business clients (Salesforce, Sage, Fortinet, McAfee, etc.)

6.3.6 The Password Manager module

Password Manager secures passwords and SSH keys in an ANSSI-certified vault1 (AES 256 encryption algorithm) and manages administrator password rotation within the infrastructure. It also implements application password management, to permit applications that have to connect to critical resources to do so securely and without using unencrypted versions of the passwords of these target resources in their source code (unfortunately all too often the case in application development

¹ Source: ANSSI, https://www.ssi.gouv.fr/entreprise/certification\_cspn/wallix-adminbastion-version-3-1-9-avec-correctifs-de-securite-3354- 5420-et-5435/, 2017

environments). Thanks to this new functionality, WALLIX addresses the enterprise application developer (DevOps) market.

Password Manager has the following functionalities:

governance and security: schedule the rotation and cancellation of passwords and SSH keys, set up a configurable, granular security policy per workflow;
Application-to-Application Password Management: ensure secure application connections to critical resources by controlling passwords and SSH authentication keys to the target resources. Hardcoded passwords and identification configuration files are totally dispensed with;
interoperability: an Application Programming Interface (API) permits developers to build and make available a library of password management plugins that support industry-standard hardware (Microsoft, Linux/Unix).
6.3.7 The Access Manager module

Access Manager is a web platform that permits an environment running multiple instances of WALLIX Bastion , each controlling a part of the infrastructure. This module permits the use of privileged accounts, and control from a single point, of an entire multi-instance Bastion infrastructure. The solution has the following functionalities:

administration and organization: communicate with multiple Bastion targets via an encrypted https channel. The portal is customizable (design, file classification, etc.) and permits file transfers between the workstation and the target Windows resource;
authentication: in addition to standard "directory" authentications, Access Manager supports Security Assertion Markup Language (SAML) 2.0 so it can integrate easily into all infrastructures that have identity federation mechanisms;
multi-tenant architecture & scalability: breach-proof instances of multi-tenant architecture. In cases where a resource is accessible by more than one instance of Bastion, Access Manager allows you to define clusters of active Bastions;
audit and compliance: to supplement Bastion, Access Manager has its own audit functionalities that provide an overview of all the sessions that it enables. The audit log has a multi-criteria search engine that facilitates searches in scripts and session metadata. Sessions can be replayed in full.

6.4 The competitive advantages of WALLIX

6.4.1 Recognized technological leadership in the market

A PAM solution includes two main modules: a Session Management module and a Password Management module (see Section 6.3.4). Session Manager is the most technologically complex component1 as fine-tuning it requires excellent technical knowledge and in-depth understanding of the protocols for connecting to resources such as RDP and SSH. WALLIX is one of only two market players2 to have specialized, since 2008, in Session Management, most other players having opted to focus on Password Management first.

WALLIX's expertise enables it to market advanced functionalities such as:

¹ The Password Management component now requires more process management and integration skills.

² The second-largest player is Balabit, which has just been bought by the American company One Identity.

proxy-based and agent-free architecture: the WALLIX Bastion solution requires no rollout agents1 onto user workstations, nor on servers to protect. Thanks to its architecture, it is nonintrusive and transparent for administrators (it integrates seamlessly into existing tools and does not require to changes any of them), rolls out into information systems easily and fast, and costs less to implement and maintain than solutions that necessitate that an agent be installed onto every resource to be protected;
automatic rollout of session probes: a functionality based on a WALLIX patent issued in 2017;2
flexibility of management rules: for example, the WALLIX Bastion solution can be configured to prohibit privileged login obtained through an intermediate resource;
transparent mode which permits Bastion to be rolled out and used without affecting users' existing access configurations (IP addresses of target resources, for example) and thus make Bastion virtually transparent for them;
protocol transcoding which permits Bastion to adjust to any method for accessing targeted machines and resources while requiring a single method to access Bastion (SSH, for example) for administrators.
6.4.2 Excellent brand image in France and internationally

WALLIX is a respected player in the cybersecurity sector in France and in many countries where its solutions are sold (France, Switzerland, Benelux, Germany, UK, Maghreb, Africa, Middle East, and Russia).

The first French cybersecurity "pure player" to be listed on Euronext Growth in Paris following its IPO in 2015, WALLIX is also a founding member of the HEXATRUST club of software developers and vendors, and as such helps promote French cybersecurity firms in France and abroad. WALLIX is also a member of French Tech and of the Cybersecurity Council of Germany.

The Company is also a member of the Systematic Paris Region competitiveness cluster and was named "Cluster Champion" in 2011, making it the very first promotion of the Cluster. This label identifies pre-midsize companies at a mature stage of development achieving 50% annual growth.

WALLIX Bastion is cited by CIGREF3 (French association of IT user companies) as an example of a solution that successfully incorporates GDPR requirements by using centralized and tracked for administrator accounts, a functionality identified as one of the technical measures to combat administrator-identity theft.4

Also, in 2017 WALLIX was admitted by Forbes France (in association with Paris Europlace, Morningstar, PME finance – Europe Entrepreneurs and F2iC) into the Futur40, the forty fastest growing companies listed on the Paris stock exchange.5 This recognition identifies companies with the potential for very strong growth, such as Amazon, Google, or Facebook, particularly in their ability to establish a new growth model based on criteria such as business volume, sales, or number of users. The criteria used to identify these Futur40 are:

• cumulative sales growth of more than 15% over the past three years;

¹ An agent is a software component that forms part of a PAM software solution and has to be installed on every piece of equipment that the solution secures. Agent-free solutions do away with the often burdensome and expensive need for IT departments to roll out and maintain agents.

² https://bases-brevets.inpi.fr/fr/document/FR3041492.html

³ An association of large companies and public administrations in France, Cigref's mission is to develop their ability to integrate and master digital technology.

⁴ Document CIGREF 2017: Entreprises, les clés d'une application réussie du GDPR [Corporations: The Key to Successful Implementation of GDPR]

⁵ For more details about Futur40, see: https://www.forbes.fr/entrepreneurs/forbes-futur40-les-champions-de-la-croissance/

minimum €5 million sales;
must be listed on the Paris stock exchange with a minimum footprint (floating, volumes traded) to have its data publicly certified.

Figure 2: Awards and prizes received by WALLIX

The WALLIX Bastion solution has received multiple awards, including:

named 2016 Best Buy by America's leading cybersecurity magazine SC Media, 1 which annually evaluates the products in the sector;
the 2016 prize for the best "identity and access management" solution at the prestigious Computing Security Awards event. Computing Security Awards are organized by a panel of industry experts, with winners in each category determined by Computing Security magazine reader votes. At that ceremony, the panel said it was "impressed by the easy-to-deploy architecture of the WALLIX Bastion solution,2 and by its latest major release in early 2016 (....)."3

The rich functionality of the WALLIX Bastion solution led the independent Analyst organization KuppingerCole to rank the Company as a "technology leader", i.e., a leading supplier of PAM solutions on two grounds: product and innovation (see chart below).

Figure 3: 2017 Classification of PAM players based on product leadership and technological leadership

¹ "For its unique approach to the entire privileged account management problem, we make Wallix our Best Buy" https://www.scmagazine.com/wallix-adminbastion-suite/review/7083/.

² Under its previous name, still used in 2016: WALLIX ADMINBASTION Suite

³ Source: http://www.computingsecurityawards.co.uk/?page=winners2016

⁴ Source : KuppingerKole, Leadership Compass Privilege Management, 2017

The concept of "leader" in this list is described in the KuppingerCole analysis methodology.

Companies whose products are advanced products in the market segment concerned are regarded as "product leaders". These products largely provide what is expected by KuppingerCole's experts from products in this market segment. They are mature and are "exceptionally strong in particular fields" (see page 48 of the KuppingerCole analysis).

Suppliers who drive innovation in the market segment are considered "innovation leaders". They provide many of the most innovative and upcoming features that KuppingerCole's experts hope to see in the market segment in future.

KuppingerCole uses the following categories to evaluate products: security, features, integration, interoperability and ease of use.

Last but not least, WALLIX's cloud expertise was recognized by the leading magazine Infoworld, with the "Bossie Award 2017" for its Open Source DevOps Awless CLI application, which rewards the world's best cloud-based1 open source solution. This award was handed out at re:Invent, the largest cloud-computing conference in the world, organized by AWS.

6.4.3 A solution adopted by Large Accounts and mid-size companies

The Company believes it has an excellent image among large and mid-size companies. Of WALLIX's portfolio of customers, 15 are represented in the CAC 40, and 11 in the SBF 120.

PSA Group

PSA Group's internal security policy requires that actions with strong privileges be tracked to be able to detect potential threats. The main risks identified are identity theft or permissions theft. Additionally, in its banking activities, PSA Group is subject to the standards of the Basel II Agreement and is audited annually. Initially installed in 2011 as an experiment, WALLIX Bastion is now fully deployed in an industrial environment and perfectly integrated with PSA's existing business solutions

¹ Source: WALLIX press release, available at the following link, among others: https://www.euronext.com/fr/cpr/wallix-re%C3%A7oit-le bossie-award-2017-pour-son-application-devops-open-source-awless-cli-ainsi-que-

such as Identity Access Management for rights and equipment management (Configuration Management Database / CMBD).

"We continue to deploy Bastion as we have demonstrated that the solution is reliable, that the integration is seamless, and that it meets all our tracking and automation requirements." Thierry Hec – PSA Group Security Expert.

PSA Group's security expert has recognized the versatility of the tool and its ability to maintain service quality in all circumstances: in normal operating mode as well as in disaster recovery mode. On the strength of this success, in early 2017 PSA migrated to the latest, more powerful version of the solution which features faster response time, and set up a project to roll it out on several thousand Windows servers.

Claranet

Claranet's Security and Compliance Division, led by its Chief IS Security Officer, ensures that security standards and best practices are followed in the operation of and changes to the information system and platforms hosted for its customers, to ensure the integrity, availability and protection of data.

Claranet initially used WALLIX services as part of its e-Health offering in order to obtain health data hosting certification (Hébergeur de Données de Santé / HDS) from the French shared health information systems agency (Agence des Systèmes d'Information Partagés de Santé / ASIP) which requires a system for tracking access to platforms via a single interface that centralizes all access. The installation of this system in 2012 enabled it to set up and run a large-scale project for a major municipal hospital (Centre Hospitalier Intercommunal de Créteil), the first-ever outsourcing of all the information of a hospital by a healthcare data hosting provider. All access traffic to the platform by the hospital's administrators is now tracked.

"Bastion has become the standard in the e-health market. It's a sign of trust that reassures customers." Emmanuel Novice – Director, e-Health Services, Claranet.

SIAAP

SIAAP is the wastewater treatment consortium for the Paris region (Syndicat Interdépartemental d'Assainissement des eaux de l'Agglomération Parisienne). It is not classified as a Vital Operator (VO) but strives to follow the rules issued by ANSSI. In particular, as some of its sites are classified Seveso "High Threshold", infrastructure security, and in particular the control of access to water treatment equipment, is a major challenge for SIAAP.

The management of VPN access for external service providers and the introduction of rules for machinery and equipment were becoming a heavy workload for IT teams. Access to SCADA1 supervision had to be secured for certain agents, particularly when on standby. As they would log in via RDP on a workstation situated between the IT firewalls and industrial firewalls, there had to be better visibility. SIAAP ultimately wanted to implement a solution that was fast to deploy and easy to administer. WALLIX Bastion was rolled out at SIAAP in 2016 to meet these requirements.

"Thanks to its functionalities for access control and tracking of administrative operations, Bastion has enabled us to substantially strengthen the security of our infrastructures and equipment." Stéphane Corblin – Head of Network and Security Architecture at SIAAP.

CASDEN – Banque Populaire

For some years, the growing threat of cybercrime associated with the digitalization of work methods (e.g.: advent of tablets, mobile phones) and the use of external service providers led CASDEN's Information Systems (IS) Security team to rethink its IS strategy and governance. Its first action was to put in place a privileged access management solution.

¹ SCADA: Supervisory Control And Data Acquisition. These are data acquisition and control systems for remote control of industrial and technical facilities.

CASDEN naturally turned to WALLIX Bastion. For CASDEN's relatively small operations team and an infrastructure running several types of operating systems, Bastion's ease of installation, efficient deployment methodology and fast support response proved to be an ideal cost control and time control solution. Technical integration proceeded in 2012 with no problems. Hundreds of Linux servers are now administered by Bastion and dozens of users are involved.

"It's about raising awareness among users, administrators and service providers rather than repressing them. Without trust, you can't do business." Benoit Fuzeau – Head of IS Security, CASDEN – Banque Populaire.

6.4.4 A technology certified by ANSSI

In November 2013, the WALLIX Bastion solution obtained the highest level security certification (Certification de Sécurité de Premier Niveau / CSPN) from ANSSI.1 This certification, introduced in 2008, recognizes a high level of trust in a security product.

The CSPN is important because it qualifies the security products that Vital Operators (VOs) in France and Essential Services Operators (ESOs) have to implement in order to comply with GDPR and NIS regulations which come into effect in May 2018 (see Sections 6.6.1 and 6.6.2 of this Registration Document).

The WALLIX Bastion solution is, to the best of the Company's knowledge when drafting this Registration Document, the only product on the PAM market to have this level of CSPN accreditation from ANSSI (the list of certified products is available at www.ssi.gouv.fr)2 .

Given that this certification takes uncompressible time and relies on testing, the fact that the WALLIX Bastion solution is already CSPN-certified gives it a competitive time-to-market advantage in terms of compliance with NIS and GDPR regulations for VOs and ESOs.

Bastion is also certified in Russia since March 2015 (FSTEK product certification).

6.5 WALLIX's development strategy

WALLIX's goal for the period 2018-2021 is to become the European cybersecurity champion positioned on strategic technologies for the protection of access, identities, and data of information systems (see section 12.2, Known trend, uncertainty, commitment request or event reasonably likely to influence the Group's outlook).

To do so, WALLIX intends to use its position as European leader in the privileged access management market to become a global cybersecurity player, specializing in PAM and able to help businesses and other organizations protect their essential digital assets: access, identities and data.

With a 2021 sales target of €50 million (see section 12.3, Objectives to 2021), WALLIX intends to deploy a strategy that combines organic growth and accelerated development in certain segments through targeted acquisitions or by buying specific assets. This strategy consists of the following aspects, to:

continue its international growth in the PAM market by developing its distribution network in Europe, Middle East and Africa (EMEA), and in North America;
develop technological partnerships and alliances intended to create new sales opportunities for WALLIX software, particularly in the IAM market;

¹ For more information on the French regulatory framework and the role of ANSSI, see also Section 6.6.4.

² Many other IT solution publishers are certified by ANSSI in numerous sub-segments of cybersecurity (erasure of data, secure storage, operating and virtualization systems, internet firewall, identification and access control, secure e-mail, etc.). However, as far as the Company knows, no other PAM solution is certified by ANSSI as of the writing of this Registration Document. The certified solution that is most similar to WALLIX Bastion is Balabit's Shell Control Box, but the certification applies only to the SSH protocol filtering function.

increase its presence in the new markets for cloud-based infrastructure, platforms for the management of the Internet of Things (IoT1 ), and industrial IT infrastructures (OT2 or ICS3 market with SCADA4 systems);
launch Cloud Based Security Services, for example its DataPeps offering, launched on March 23, 2018.

To finance this development plan, to equip itself with the resources to seize external growth opportunities and, particularly, to accelerate its international deployment and enhance its offer, WALLIX plans to raise funds by increasing its share capital by roughly €30 million. About one third of the funds raised will be allocated to financing the plan for organic growth, and the remaining balance to acquisitions (see section 12.3, Objectives to 2021).

The Group is currently on stand-by with regard to its external growth plans and does not have a specific target at this time.

6.5.1 Continue its international development in the PAM market

With the PAM market growing by an average 27% a year over the period 2015-2020,5 WALLIX's first strategic goal is to accelerate the distribution of its WALLIX Bastion solution by extending its scope to new regions.

Accordingly, the Company intends to target new geographic regions with international growth aimed particularly at all the EMEA zones and North America. WALLIX thereby intends to increase its market coverage from 20% to nearly 80% of the worldwide PAM market6 in the period 2018-2021.

Indeed, WALLIX estimates that it currently covers half the EMEA region, namely 20% of the global market. By extending its distribution network across the entire EMEA region and North America, WALLIX believes it will be able to access approximately 80% of the global market.

	2015 (\$M)	2020 (\$M)	2015 (%)	2020 (%)
AsiaPac	93.6	248	18.6%	21.2%
EMEA	196.6	430.8	39.1%	36.8%
Americas	212.8	491.5	42.3%	42.0%
Total	503	1,170.3	100%	100%

PAM market development (2018-2021)

Source: Technavio Global Privileged Identity Management – 2016, and the Company (for percentages)

¹ IoT: Internet of Things

² OT: Operational Technology; it refers to IT applied in the industrial world (control of production lines, automation of robots and other machinery), in which data management is becoming increasingly important.

³ ICS: Industrial Control Systems

⁴ SCADA: Supervisory Control And Data Acquisition. These are data acquisition and control systems for remote control of industrial and technical facilities.

⁵ Source: Gartner, Forecast Snapshot: Privileged Access Management, Worldwide 2017 (March 2017)

⁶ Figures based on the July 2016 report by Technavio Global Privileged Identity Management;

In order to achieve these objectives, WALLIX intends to:

Target large and mid-size enterprises in all regions while enhancing its offering to continuously meet their requirements;
Invest in the development of its distribution network in France and internationally, with an acceleration in Germany, Austria and German-speaking Switzerland (DACH region), as well as North America;
Boost the visibility of its solutions through strategic alliances with major players in manufacturing and digital technology;
Improve the way its sales forces are structured by investing in hiring sedentary sales staff, regional managers, and indirect channel sales managers.

The current WALLIX distribution network has 160 partners and covers 55 countries. It is described in section 6.9, Distribution channels.

6.5.2 Develop technology partnerships and alliances

PAM solutions complement IAM solutions (see Section 6.2.4): they have to interconnect easily so that identity and privileged access management is seamless and automated. WALLIX intends to take advantage of this technological and operational proximity to open new market gateways for its WALLIX Bastion solution by developing new technology partnerships1

To do so, the Company intends to:

Develop an ecosystem of IAM sector partners to facilitate the integration of the WALLIX Bastion solution with its partners' IAM solutions (an approach that can also be extended to Security Information and Event Management (SIEM) and Identity Governance and Administration (IGA) solutions);
Develop strategic partnerships with players in the authentication market to complete the WALLIX Bastion offering;
Target organizations that are already equipped with a password vault solution and offer to interconnect WALLIX Bastion Session Manager with their system.

6.5.3 Undertake development for new types of infrastructure such as the cloud

Based on its expertise in traditional IT infrastructures (the IT market), the Company intends to target new types of IT infrastructures with its WALLIX Bastion solution, such as:

industrial infrastructures (Operational Technology or OT);
IoT (Internet of Things) infrastructures;
cloud-based infrastructures used by service providers on the Infrastructure as a Service (IaaS) model;
data collection infrastructures in Artificial Intelligence.

This approach should open up new business segments such as suppliers of cloud-based infrastructures and services, telecoms, healthcare, and the services industry in broad terms.

To achieve these goals, WALLIX intends to:

• Extend its product offering to enable it to adapt to the specifics of cloud-based infrastructures and make it scalable;

¹ The number of current technology partnerships is not significant.

Develop WALLIX Bastion interconnections with industrial robots (ICS) and SCADA systems1 to enable it to secure companies' industrial networks;
Forge strategic and technological partnerships with SaaS application publishers, and cloud, IoT and OT players, to expand the scope of the WALLIX Bastion solution and add to it the end-to-end encryption offered by the WALLIX DataPeps solution.
6.5.4 Enter the market in cloud-based security services

On March 23, 2018, WALLIX announced the launch of a new Cloud Based Security Services offering aimed at protecting the data of businesses and other organizations. This offering, WALLIX DataPeps, provides application developers with an end-to-end data encryption solution to meet the demand for protecting and securing data exchanged in on-premises, cloud-based, or hybrid infrastructures.

Simple to implement, thanks to its SaaS distribution mode, WALLIX DataPeps is the first cloud-based security service in the market, as described in Section 6.2.5.

It targets the encryption market but with a differentiating technology: end-to-end encryption (see Section 6.2.5).

WALLIX's development strategy for encryption consists of targeting two types of customers:

publishers of solutions (software and/or equipment) who want to enhance their products by adding end-to-end encryption to them, thus strengthening the security of their applications and data exchanges in a cloud environment;
integrators who want to add encryption to their products and thus will act as distribution channels to their own customers, businesses and other organizations.

WALLIX's sales effort in this market will mainly be made in France and Europe, to enable this new initiative to benefit from feedback acquired in these regions by the company using its PAM.

WALLIX also intends to implement a marketing and communications approach targeted at specifiers and other interest groups2 who can spread its messages on SaaS-based encryption. The marketing approach consists in highlighting the value to organizations of their being able to comply with the GDPR without any software development effort, by integrating the DataPeps technology to protect personal data.

6.6 The regulatory framework

The proliferation of large-scale attacks and the resulting risks are driving governments and regulators to frame new legislation in Europe, America, Asia Pacific, Middle East and Africa, mainly to protect personal and confidential data.

The global cybersecurity market will directly benefit from the momentum of such regulations.

The law transposing the NIS Directive and the GDPR, which are expected to come into effect in May 2018, will require businesses and organizations operating in the European Union to invest in new cybersecurity solutions certified by the regulators so as to comply with these directives.

These regulatory changes offer major growth opportunities for the PAM and encryption solutions marketed by the Company.

6.6.1 The General Data Protection Regulation (GDPR)

Regulation (EU) no. 2016/679, known as the General Data Protection Regulation (GDPR) has replaced the 1995 Directive Governing the Protection of Personal Data. Since its adoption on April 14,

¹ SCADA: Supervisory Control And Data Acquisition. These are data acquisition and control systems for remote control of industrial and technical facilities.

² For example (non-exhaustive list): Hexatrust, the Atena Forum, Pole Systematic, Cap Digital.

2016, it constitutes the European benchmark text for the protection of personal data. It applies to all organizations (responsible for processing data or subcontracting) based in, or trading with, a Member State of the European Union.1 2

Until now, each country had its own rules, which could create competitive distortions in the context of data monetization. This regulation was adopted by the European Parliament on April 14, 2016 and will come into effect on May 25, 2018.

The GDPR imposes infrastructure security and content protection requirements on organizations in respect of the personal data that they host. It also requires businesses and organizations to put in place mechanisms designed to protect the personal data of third parties (employees, customers, etc.) to ensure control and tracking of their usage.

The main objectives of the GDPR are:

transparency of information collection: obligation to provide customers and users with information on the identity and contact details of the processor and of the purposes of this processing. In the event of data leaks, the company must notify the competent authorities (the CNIL in France) within 72 hours in order to take collective remedial action;
the introduction of data protection mechanisms "by Design": the company will have to provide proof that the personal data that it holds is protected and unusable if stolen. This is achieved by putting protection mechanisms in place at the design stage of a product or service;
the creation of new rights for consumers: the Regulation strengthens the requirement to obtain consent for the processing of personal data, the right to be informed within 72 hours in the event of a data leak, the right to access their data, the right to have it deleted, and the right to refuse to participate in data collection.

The aim of the GDPR is to strengthen personal data protection by creating a more stringent framework for organizations and penalizing data loss. Organizations and persons who compromise the personal data that they hold, risk paying a fine of up to €20 million or 4% of worldwide annual turnover for corporations.

However, many organizations have been late in implementing these measures: according to an AFCDP survey in France, 44% of French companies think that they will not be in full compliance with the GDPR by May 25, 2018.3 This is a big opportunity for data security and encryption software publishers such as WALLIX: the cost of upgrading to compliance with the GDPR is estimated to be in the region of €30 million for a typical CAC 40 company.4

6.6.2 The Network & Information Security (NIS) Directive

The Network and Information Security Directive (EU) 2016/1148 ("NIS Directive") was adopted in July 2016 by the European Parliament, and the Member States have until May 9, 2018 to transpose it into their national law.5

¹ This Regulation applies to the processing of personal data in connection with the activities of an

establishment of a controller or a processor of data on Union territory, whether or not this processing takes place in the Union ² This Regulation applies to the processing of personal data relating to data subjects, who are in the Union territory, by a controller or processor who is not established in the Union, when the processing activity relates to:

a) the offering of goods or services to these concerned persons in the Union, whether or not such persons are required to pay; or

b) the monitoring of their behavior to the extent that their behavior takes place within the Union. ³ Source : AFCPD (Association Française des Correspondants aux Données Personnelles / French Association of Data Protection Officers), https://www.afcdp.net/IMG/pdf/barome\_tre\_rgpd\_re\_sultats\_q1\_afcdp.pdf, 2017

⁴ Source: Les Echos, https://www.lesechos.fr/0301308653687/lesechos.fr/021821127828-donnees-personnelles-beaucoup-dentreprises-en retard-sur-le-nouveau-reglement-europeen-2154550.php, 2018

⁵ The NIS Directive was transposed into French law by Law no. 2018-133 of February 26, 2018 laying down various provisions for adaptation to European Union law in the field of security.https://www.legifrance.gouv.fr/eli/loi/2018/2/26/INTX1728622L/jo/texte/

The aim of this Directive is primarily to establish "security and notification requirements for operators of essential services and for providers of digital services" (Article 1). These measures relate to the prevention of incidents and their notification to competent authorities who have the power to control and audit the measures put in place.

The NIS Directive contains essentially two measures:

the obligation to report any cyberattack targeting the information systems of European businesses and organizations, stating the geographic scope and number of persons affected;
the standardization of organizations' cybersecurity resources, so as to prevent threats.

This obligation applies to Essential Services Operators (ESOs) 1 who meet the following identification criteria:

the company provides a service that is essential for maintaining critical social and economic activities;
the provision of this service is dependent on information networks and systems;
an incident would have a major disruptive effect on the provision of that service.

These operators fall within the seven sectors defined by the EU: energy, transportation, banking, financial market infrastructures, healthcare, potable water supply and distribution, digital infrastructures.

Very many organizations will therefore be considered Essential Services Operators in Europe. To guarantee the resilience2 of their infrastructures considered as essential and to meet the requirements of this Directive, these ESOs will have no choice but to put in place solutions for the management, control and tracking of privileged accounts, such as the WALLIX Bastion solution, and inform their competent authorities that they have done so.

The deadlines are:

May 9, 2018: transposition into national law;
November 9, 2018: identification and designation of ESOs;
May 9, 2019: review by the Member States of the list of ESOs.

In the Middle East and Africa region, similar regulations exist in the public service, healthcare and defense sectors.

Roland Berger estimates that this Directive will affect approximately 2,100 organizations in France and about 15,400 across the European Union and Russia.

6.6.3 Sectoral regulations

A number of regulations require players in certain sectors to put in place PAM solutions:

Regulations such as the Sarbanes-Oxley Act (US) for listed companies, or arising from the Basel II Agreement for the Banking and Insurance sector;
The Payment Card Industry Data Security Standard (PCI DSS) for the main payment card groups;
The Health Insurance Portability and Accountability Act, was passed by the US Congress in 1996. It defines US standards for the electronic management of health insurance, the transmission of electronic medical records, and all identifications required for electronic health insurance record keeping. HIPAA or Asip Santé for healthcare data hosting;

¹ For details of the ESO classification and the estimated number of ESOs in Europe, see Section 6.6.2

² Resilience means the ability of a digital infrastructure to provide continuous service 24/7.

Decree no. 2018-137 of February 26, 2018 defining the rules for hosting personal health data and specifying the scope of personal health data hosting activities that require a certificate of approval issued by the government minister for health, or a certification;
French online gaming authority regulations (Autorité de Régulation des Jeux En Ligne ARJEL);
ISO 27000, SAE-11 regulations, etc.

Many other European, Mediterranean, Asia Pacific, and emerging countries have in recent years also adopted new standards involving privileged account management or the protection of sensitive data in strategic sectors (defense, government in particular).

6.6.4 The special case of France

In France, the public authorities have recognized the importance of cybersecurity by creating the national information systems security agency (Agence Nationale de la Sécurité des Systèmes d'Information – ANSSI) in 2009. ANSSI is a nationwide agency attached to the General Secretariat for national defense and security (Secrétariat Général de la Défense et de la Sécurité Nationale – SGDSN), which assists the Prime Minister in the exercise of his responsibilities in the field of national defense and security.1 It is tasked with proposing the rules to be applied for the protection of State information systems and to verify that the adopted measures are being implemented. It provides a monitoring, detection, alert, and response service against cyberattacks, particularly on State networks.

ANSSI has defined 18 activity sectors of "vital importance" which were the subject of implementing decrees gazetted in 2016 and 2017:

State sector: State civil, State military, judicial, aerospace and research activities;
Public protection sectors: health, water management, power; and
National social and economic sectors: energy, communication, electronic, audiovisual and information, transportation, finance, industry.

This decree lists 2492 operators of vital importance,3 defined as difficult for the nation to replace or substitute, due to their economic, social, defense or security aspects, which will now have to meet the new security standards defined by the NIS Directive.

In a case of non-compliance with the decree, ANSSI may levy a €150,000 fine on the natural-person executives of the company concerned. They also face possible imprisonment.

Additionally, the law recommends that Vital Operators (VOs) use solutions certified by ANSSI (CSPN) to ensure compliance.

These provisions demonstrate the growing importance in States' eyes (European, in particular) of the need to structure their positions and responses against cyber risk with a view to keeping control of their digital sovereignty.

In February 2018, the Strategic Review of Cyber Defense published by SGDSN,4 identified three technologies "the control of which is considered essential for France's digital sovereignty". It is precisely on two of these technologies that WALLIX's activities are situated:5

¹ Source: www.ssi.gouv.fr

² Source: Secrétariat Général de la Défense et de la Sécurité Nationale (SGDSN), Revue Stratégique de Cyberdéfense / Strategic Review of Cyber Defense, February 2018

³ https://www.ssi.gouv.fr/entreprise/protection-des-oiv/protection-des-oiv-en-france/

⁴ Source: Secrétariat Général de la Défense et de la Sécurité Nationale (SGDSN), Revue Stratégique de Cyberdéfense / Strategic Review of Cyber Defense, February 2018

⁵ The third technology is Professional Mobile Radio, which does not fall within the scope of WALLIX solutions.

The detection of cyberattacks: WALLIX develops and markets the WALLIX Bastion solution, which forms part of the products required for detecting attacks by persons inside a company who have privileged access (network administrators, for example) as well as persons outside a company who have the same access due to the nature of what they do (service providers offering administration of customer networks, for example);
Encryption of communications: WALLIX is developing the most recent version of this technology as "end-to-end data encryption" in the form of WALLIX DataPeps. This software offering is offered as an SaaS-based API to application and website developers.

6.6.5 Consequences for WALLIX

To comply with the GDPR, companies will be required to protect the personal data of persons who interact with their IT infrastructure (employees, customers, etc.). Liability for any leak of personal data may be imputed to the company that is the victim of this attack. To avoid such a situation, companies must invest in data protection solutions (such as WALLIX DataPeps) and access management solutions (such as WALLIX Bastion).

To comply with the legislation transposing the NIS directive, companies must implement access traceability solutions so as to be able to report to the competent authorities, particularly ANSSI, any successful or failed attempt at intrusion. PAM solutions are capable of collecting the information that needs to be sent to ANSSI in such cases.

In light of the substantial investments required to comply with the legislation transposing the NIS directive and with the GDPR, these investments will be planned over time, and not all companies have equipped themselves yet. For example, a survey that NetApp conducted in March 2018 of companies set up in the United States, France and Germany and employing more than 100 people each found that 67% believe they are not prepared to meet the May 25, 2018, deadline.

WALLIX believes that investment should be gradually stepped up when these European provisions enter into force, that is, starting in May 2018.

6.7 The WALLIX customer portfolio

As of December 31, 2017, the Company had 577 customers.

Average revenue per new customer was €46,727 in 2017, up 17% on 2016.

WALLIX's 10 biggest customers in 2017 accounted for 35% of Group billing. Its biggest customer accounted for 8% of the Group's total billing.

WALLIX was able to attract a total of 27 big customers (see Section 6.4.3), representing 18% of its 2017 billing.

The following shows 2017 consolidated revenue broken down by various criteria (French accounting standards, percentages calculated on values rounded to thousands of euros).

Among the highlights of the fiscal year ended December 31, 2017 for WALLIX's business, was the signing of 28 new contracts, each exceeding €100,000, versus 13 in 2016, as well as, for the first time, two contracts each worth more than €1 million.

6.8 WALLIX's economic model

The WALLIX Bastion software suite is offered in the form of two commercial packages:

The "Basic" (entry level) offering for small and pre-mid-size companies (less than 500 resources1 ) and the "Professional" offering for mid-size companies (up to 1,000 resources): these packaged offerings provide the basic functionality required to secure privileged accounts:
o Session Manager: view activities in real-time; record sessions; collect and export data to a SIEM solution;
o Password Manager: password rotation and SSH keys for users;
o Access Manager: privileged account management and governance, contextual configuration.
The "Enterprise" offering for "Large Accounts" with more than 1,000 resources. This à la carte tailorable offering provides the same functionality as the Professional offering but with additional features:
o Open architecture for integration with third-party vaults;
o Application-to-Application Password Management (AAPM): secures authentication between applications by giving them access to credentials stored in the vault;
o Access to WALLIX Bastion APIs and Plugins to permit integration with third-party applications in markets such as Identity Governance and Administration (IGA), Security Information and Event Management (SIEM), Business Intelligence (BI), and Hardware Security Modules (HSM).

WALLIX solutions are also available in cloud form on the Amazon AWS and Microsoft Azure platforms.

¹ A "resource" in the sense of WALLIX's pricing structure, is anything that needs to be protected: routers, IT equipment, servers, databases, and applications are all "resources".

The WALLIX Bastion software suite is marketed as two models:

The perpetual license model: payment for a perpetual license gives the customer the right to use the product for an unlimited period of time. The license fee is paid once, and a service agreement is signed with the customer to cover the associated software maintenance and support as well as upgrades (standard 12-36 month service agreements). The service agreement price depends on the service level chosen, the typical agreement per level being:
o Bronze: 9 a.m. to 7 p.m., 5 days a week, 20% of the license fee
o Silver: 9 a.m. to 7 p.m., 7 days a week, 25% of the license fee
o Gold: 24/7, 365 days a year, 30% of the license fee
o Platinum: 24/7, 365 days a year, with a dedicated contact (TAM), 35% of the license fee.
The subscription model: a subscription payment gives the customer the right to use the product and access the support service for a limited period of time. All subscriptions include gold level support as described above. The subscription period can vary from 24 to 36 months.

For both models, the license or subscription fee is based on two criteria:

the number of targeted resources to be managed (servers, databases, telecoms, security, etc);
the number of simultaneous sessions that the WALLIX Bastion solution has to manage.

The fee is digressive based on the number of resourcesv and/or simultaneous sessions.

Minor and major updates are provided as part of the maintenance agreement and are not billed extra.

WALLIX also offers a range of hardware to support the particular WALLIX Bastion solution ordered (Bastion Hardware License). Hardware prices vary depending on power and disk space (disk space primarily used for recording sessions).

6.9 Distribution channels

WALLIX's distribution model consists of indirect sales via a network of value-added resellers (VAR), integrators and distributors who currently cover 55 countries.

The Company adopts two approaches in its sales model:

The "direct-touch" approach, with a major accounts team that targets big customers;
The "channel" approach for mid-size companies, the healthcare sector and, more generally, public sector, with a network of certified partners (VARs and integrators).

In all cases, the sale is signed in association with the certified partner who will deploy the solution at the customer's facility and benefit from the business terms agreed upon the sale of the software.

For the "direct-touch" model, WALLIX has set up a regionally based sales structure: France and Western Europe, the United Kingdom and Nordic countries, DACH1 and Eastern Europe, Middle East and Africa, North America and Rest of the World.

This sales force targets big corporations (CAC 40, SBF 250, Fortune 1000) and central governments directly. These teams are aided by sedentary prospecting sales staff.

For the "channel" model, WALLIX structures and runs a network of 160 identified partners in France and internationally. These partners are Value Added Distributors (VAD) and Value Added Resellers (VAR) or major international integrators.

¹ DACH: Germany, Austria, German-speaking Switzerland

They invest in the WALLIX solution and technology by training their teams in the Company's products, enabling them to develop distribution close to end users.

To expand its distribution network, WALLIX has developed a partnership program called the WALLIX Alliance Partner Channel Program. It has four components:

The Elite System Integrators Program, primarily for the large accounts market;
The Premier System Integrators Program, structured to cover mid size companies and public bodies;
The Initial System Integrators Program, a basic entry level offering for partners;
The Managed Services Providers Program, created for cloud players who integrate the WALLIX Bastion solution into their hosting services primarily for small businesses.

The Company has also set up a certification and accreditation system for its partners.

certifications for the consulting engineers of its resellers and integrators;
accreditation for resellers confirming their qualifications to act in accordance with WALLIX rules and procedures to deliver support (level 1 maintenance), training, and professional services.

Depending on their certification and accreditation level, WALLIX Partners receive marketing support (joint marketing campaigns and events) and financial support (discounts).

WALLIX has formed strategic partnerships with players that are positioned on markets related to the PAM market, namely:

Evidian, a subsidiary of the Atos Group that markets Identity and Access Management (IAM) solutionswith which WALLIX Bastion is now interconnected;
IBM on the SIEM IBM Security QRadar offer, which WALLIX Bastion may now supply with data to provide administrators with real-time visibility of alert detection and prioritization;
LogPoint, publishers of an SIEM solution; WALLIX Bastion supplies LogPoint's SIEM with data in order to enhance dashboards that may be configured based on the specific roles and responsibilities of each user;
RSA on the RSA SecurID two-factor authentication offer, which is now integrated into WALLIX Bastion, which gives it a strong authentication mechanism helping to transparently improve security for WALLIX customers;
SailPoint on their IdentityIQ solution, which, combined with WALLIX Bastion, offers a unified solution to monitor and control all the identities and accesses of privileged accounts, thus allowing companies to protect their critical IT assets.

6.10 WALLIX competitors in the PAM market

Worldwide, there are some 20 competitors including PAM specialists (such as CyberArk, BeyondTrust, and WALLIX) and general purpose publishers who offer a PAM solution as part of their universe of cybersecurity and network products (Computer Associates (CA) Technologies, IBM).

According to a 2017 KuppingerCole study1 which ranks these companies, there are 7 major players in the PAM market (CyberArk, BeyondTrust, CA Technologies, Thycotic, Lieberman Software, IBM and Centrify) and 11 challengers (Hitachi-ID, WALLIX, Osirium, Bomgar, Microfocus, One Identity, Balabit, MT4 Software, EmpowerID, SSH Communication Security and ManageEngine).

¹ Source: KuppingerCole, Leadership Compass Privilege Management, 2017

Of these players, CA Technologies, IBM and One Identity (a Quest Software subsidiary) are generalists who have a PAM solution, the others being specialists in the PAM or IAM segment.

WALLIX is identified by KuppingerCole as the number 2 challenger in terms of the criteria used in this study. WALLIX is also ranked as one of the leaders in the "Products" category and "Innovation" category although still ranked as a challenger in the "Market Share" category.

In the PAM market, WALLIX's goal is to improve its "market share" ranking to become the PAM leader worldwide, while maintaining its leadership in products and technology.

WALLIX differentiates itself from all other PAM competitors by its approach to the markets adjacent to PAM. To the company's knowledge, none of them has an end-to-end encryption offering like the one that WALLIX launched on March 23, 2018 (see Section 6.11.2).

CyberArk

CyberArk is an Israeli company formed in 1996 and listed on Nasdaq since September 2014. It reported US\$262 million sales for 2017,1 making it the market leader, with a global presence and customers in every market segment.

Present in 12 countries, CyberArk says it has approximately 3,700 customers worldwide.2

Its standard products offer privileged account password management, application-to-application password management (AAPM), and privileged account user behavior analysis. As options, it offers session supervision (basic functionality of the WALLIX solution), management (restriction) of privileges escalation, and management of SSH keys. Its PAM product is called CyberArk Privileged Account Security Solution.

Thycotic

Thycotic is a private American company formed in May 2000. It was originally positioned in the entry range of the market and is now trying to upscale into the enterprise market.3

It has offices in the USA (Washington D.C.), the UK (London) and Australia (Sydney).4

The commercial name of Thycotic's PAM product is Thycotic Secret Server.

Bomgar/Lieberman Software

Bomgar is an American company that reported US\$74 million revenue in 2016 from its range of products. It has offices in Atlanta, Jackson, Washington, Frankfurt, London, Paris and Singapore.5

Bomgar products primarily offer session supervision but according to KuppingerCole lack the functionality expected by the market. Bomgar bought the Lieberman Software company in February 2018 to supplement its range.

Name of the PAM product: Bomgar Privileged Access Management Solution.

¹ Source: CyberArk – press release, February 15, 2018:

² Source: CyberArk

³ Source: KuppingerCole, Leadership Compass Privilege Management, 2017

⁴ Source: Thycotic

⁵ Source: Thycotic

Lieberman Software (bought by Bomgar on February 1, 2018)

Lieberman Software is a private joint-stock company formed in 1978 and launched its first product in 1994. Lieberman Software is virtually unknown in Europe1 .

Its products address privileged account password management and privileged account discovery. However, KuppingerCole31 rates its session supervision (basic WALLIX functionality) and its SSH key management as weak, and its partner ecosystem is limited.

Its PAM product is called Lieberman Enterprise Random Password Manager.

The company was bought by Bomgar in February 2018 to supplement its session supervision solution.

Balabit / One Identity

Balabit is a Hungarian company formed in 2000. On January 17, 2018, Balabit was acquired by One Identity, a subsidiary of software generalist Quest Software.

One Identity products address privileged account password management. According to the KuppingerCole study31, they integrate well with other One Identity products and its partner network is relatively strong. However, according to KuppingerCole,31 the solution is not adaptable and fails to address the cloud-based infrastructure market (the WALLIX solution is available on Microsoft Azure and Amazon Web Services).

The commercial names of Balabit's PAM products are One Identity Privileged Management Solution and Balabit Privileged Access Management.

6.11 WALLIX innovation and new products for 2018

6.11.1 Version 6 of the WALLIX Bastion solution

Launched in the first half of 2018, WALLIX Bastion v6 offers the following new functionality:

SSH key rotation is a natural addition to the password rotation for PAM systems, raising the security level of access to the equipment and machines that use the SSH protocol. Since most virtual machines2 use SSH, this functionality is essential to address the cloud infrastructure market, by being deployed non-disruptively in cloud environments;
data and event searches, previously available only per product instance, will now be extended to search all instances, boosting the value of its product for establishing decisionmaking criteria for large accounts (who need to run multiple instances of the product to manage their infrastructures) and for providers of managed services (who have a multitenant architecture);
the ability to interface with third-party password vaults, an essential functionality of the product strategy that enables WALLIX to offer its Session Manager software to organizations which already have their own password vaults without having to replace them.

WALLIX Bastion v.6 will also benefit from the Company's major investment in improving the product's performance, reflected in:

• greater scalability for large projects with a more modular architecture;

¹ Source: KuppingerCole, Leadership Compass Privilege Management, 2017

² Virtual Machines (VM) can be regarded as the cloud equivalents of machines deployed in traditional infrastructures.

increased security of the product itself, with the latest version offering continuous Linux kernel hardening;
improved product functionality to connect to increasingly more, and different, equipment, with more simultaneous sessions possible per piece of equipment;
ability to collect more data points to be able to drill down further when analyzing supervised sessions.

Version 6 of WALLIX Bastion is in the process of being certified by ANSSI.

6.11.2 The WALLIX DataPeps end-to-end data encryption solution

Launched on March 23, 2018, WALLIX DataPeps is an End-to-End Encryption (E2EE) solution that satisfies the new data protection requirements for organizations to ensure data confidentiality and infrastructure security to comply with the GDPR. It works on the data encryption principle that only the data recipient can decrypt it.

WALLIX DataPeps is an end-to-end encryption technology. It uses the most advanced type of encryption, elliptical encryption, which protects data even in an attack on the server infrastructure, and eliminates the risk of internal threats. DataPeps offers proven security properties, including formal verification of integrity and authentication, which is one of its unique features. It also protects data during transmission and when stored on a server.

These features enable organizations to simplify their upgrades to comply with the GDPR since, even in the event of a successful attack, the pirated data will not be readable and will remain unusable by the perpetrator.

WALLIX DataPeps is a SaaS solution. This software architecture strengthens service robustness when faced with system break-downs, and reduces costs as calculation and storage resources can be sized exactly to suit requirements (demand-based allocation). Encryption occurs on the client side, while key management is SaaS-based, developed on Docker and orchestrated by Kubernetes.1

WALLIX DataPeps is marketed as an Original Equipment Manufacturer (OEM) product in the form of an API and an SDK. This product format which allows developers to integrate end-to-end encryption into their applications and devices without requiring any understanding of encryption and without the risk of making cryptographic errors when compiling it, expands the scope of encryption and data protection to many more uses, such as software security, file-sharing security, social network conversations, connected things, and home automation.

6.11.3 Collaborative R&D and innovation projects

WALLIX's participation in various French and European collaborative R&D and innovation projects enables the Company to enrich its technological assets and obtain funding to develop its innovation capabilities.

WALLIX is participating in the FENTEC research project on functional encryption. This project brings together major private and academic partners such as l'École Normale Supérieure, the Catholic University of Leuven, and the University of Edinburgh.

Its aim is to develop functional encryption, which would allow encrypted data to be processed (over the Internet, for example) by obtaining a partial view of the message in unencrypted form. The project was selected as part of the Horizon 2020 program for funding research and innovation in the European Union for the period 2014-2020 and has a budget of €4.2 million. For its participation in this project, WALLIX received a €388,000 subsidy from the European Union.

¹ Docker and Kubernetes are the two main technologies used in the cloud computing world.

WALLIX also runs the ANBLIC project, partnering the Ecole Normale Supérieure (ENS), the Atomic Energy Commission (AEC), Ingenico, Sogeti and Atos. The aim of this project is to demonstrate the effectiveness of blind data processing, which consists of encrypting data in such a way that it is possible to search and run statistical and other analyses on it without decrypting it.

ANBLIC is an R&D project accredited by the Systematic Paris-Region Cluster officially adopted at the 24th call for FUI (Single Interministry Fund) projects. It has a €4.18 million budget spread over 3 years.

For its participation in this project, WALLIX received a €654,000 subsidy.

These research programs are concerned with risk factors related to access to the public subsidies and advances described in section 4.6.3.

The rights and obligations depend on and vary according to the collaborative projects involved.

With regard to the ANBLIC project, which involves the industrial development of homomorphic encryption, WALLIX is required as project leader to facilitate the employment and recruitment of trainees and interns, draft the consortium agreement between the various participants, compile an interim progress report and produce a final report at the end of the program.

With regard to the FENTEC project, WALLIX, as a simple member of the consortium, has no specific rights or obligations beyond those traditionally incumbent on consortium members (collaboration, participation, deliverables, etc.).

Grants and subsidies for collaborative projects are recognized as detailed in section 3 of the notes to the consolidated financial statements in Chapter 20 of this Registration Document. Capitalized project subsidies are recognized in prepaid income and spread over the amortization period of the development costs. Project subsidies that are not capitalized are recognized according to the stage of completion of the projects.

6.11.4 Loss-leader products: WALLIX Discovery, GPRD SOS and awless CLI

The goal of these products and services is to boost the Company's reputation and generate interest in communities that can specify or buy our other business solutions. The Company does not expect any direct revenue from these three products.

The WALLIX Discovery solution was unveiled in the first quarter of 2018 at the 2018 International Cybersecurity Forum (FIC) in Lille. WALLIX Discovery is a software solution for identifying vulnerabilities associated with privileged accounts. With WALLIX Discovery, a user can easily see a list of the privileged accounts installed on a set of machines and verify that they are all known and valid. WALLIX Discovery offers this classic industry functionality packaged as ready-to-use USB sticks.

The goal of WALLIX Discovery is to draw users' attention to the need to put in place solutions like WALLIX Bastion, by making them aware of the possible existence of privileged accounts that may be unknown to the administrator.

The GDPR SOS service offering was developed at HEXATRUST by WALLIX and its partners to offer organizations a GDPR compliance assessment. The compliance audit is performed by security experts brought in specifically to assess information system vulnerabilities in terms of the GDPR.

The aim of GDPR SOS is to raise awareness among small and mid-size businesses and other organizations of the shortfall between their existing information systems and GDPR requirements and to encourage them to commit to upgrading.

The WALLIX awless CLI solution is a command-line interface service aiming at driving tasks in Amazon Web Services (AWS) in a way that strengthens the security and administration of DevOps infrastructures. Launched in February 2017, this solution was recognized by the leading magazine Infoworld, with the "Bossie Award 2017", which rewards the world's best cloud-based open source solution.1 The awless solution is also ranked by StackShare as one of the Top 50 DevOps Tools.2

The awless CLI solution aims to provide the DevOps community with an easy-to-use and effective tool to manage their cloud infrastructure on AWS.

6.12 Organizational structure

6.12.1 Organization chart

Figure 5: WALLIX organization chart

In January 2018, WALLIX's product activities were reorganized around the products of two business units and three cross-sector corporate functions.

The "Bastion" business unit includes R&D, Marketing and Sales (EMEA and other regions) dedicated to WALLIX Bastion. These three teams operate worldwide in the PAM market.

The "Venture" business unit covers the Company's latest innovations: DataPeps and IF Research. The DataPeps team is in charge of the WALLIX DataPeps encryption product, and the IF Research team is in charge of the Company's traditional products.

The Corporate Departments include the General & Administrative, Customer Success and Corporate Strategy teams:

The General & Administrative (G&A) team is in charge of Administration, Financing, Legal, HR, IT, and General Services.
The Customer Success team is in charge of delivery, support, after-sales service, professional services, and customer and partner training.

² https://stackshare.io/posts/top-developer-tools-2017

• The Corporate Strategy team is in charge of strategic alliances, Group communications, and cybersecurity product strategy.

6.12.2 The Bastion business unit

The Bastion business unit is in charge of Bastion product sales, marketing and development. It reports to Didier Lesteven and includes the following divisions:

The EMEA sales division, headed up by Xavier Lefaucheux, in charge of developing and strengthening WALLIX's presence in the Europe and Middle East regions through its partner network;
The Germany and North America sales division, reporting directly to Didier Lesteven;
The Marketing division develops WALLIX Bastion marketing campaigns at world level to generate leads, digital marketing, product marketing, business alliances and communication. The Marketing division reports to Edwige Brossard;
The R&D department: R&D is in charge of designing and developing products that will enable WALLIX to fully control the entire development chain. It reports to Serge Adda.
o The R&D team consists of project managers, developers, and experts in charge of creating a product roadmap for the Company.
o The "Quality" team works closely with the R&D team. It consists of a project manager and experts who check the quality of the Company's software development. Products are tested on an in-house virtual IT infrastructure administered by WALLIX.
6.12.3 The Venture business unit

The Venture business unit has two departments reporting directly to Jean-Noël de Galzain:

DataPeps, headed up by Henri Binsztok, is in charge of developing WALLIX's new encryption solution;
IF-Research, reporting to Jean-Christophe Denis, is in charge of the Company's historical activity, services. This department is also in charge of IT operations.

With the exception of IF Research revenues, there have been no Venture business unit sales to date.

6.12.4 Corporate functions

The corporate functions consist of three departments:

The Group's Administrative and Financial Department reports to Amaury Rosset, who is also head of Wallix's Legal Department, Human Resources, and Information System. The contents of the Group's information system are backed up daily with automated tools and are duplicated in a remote backup system at a Datacenter in the Paris region.
The Strategy Department, reporting to Didier Cohen, was formed in 2018 to launch the 2018-2022 strategic development plan. In particular, it is in charge of defining product strategy, forging strategic alliances, and analyzing external growth opportunities.
The Customer Success Department, headed by Grégory Rousseau, is in charge of monitoring customer satisfaction and includes:
o Administrative back-office and delivery (hardware, and software licenses);
o 24/7/365 Customer Support (maintenance);
o "Training" includes developing training modules and training courses for partners and customers;
o "Expert" professional services to supplement the integration services of our network of integrators/resellers.

6.13 The senior management team

Jean Noël de Galzain – Chairman of the Management Board and founder of WALLIX

After beginning his career in the production of audiovisual entertainment (documentaries, historical fiction), followed by multimedia productions, Jean-Noël de Galzain became project manager and then IT director for the Santé CLIHOP & Medinweb websites for three years.

In 1999, he took the helm of a services company for the founder of Aurora which soon became one of the French specialists in free software – a free software services provider. The company was sold in 2003 to Business & Decisions Group.

In October 2003, he founded WALLIX which he still heads up today. Jean-Noël de Galzain is also:

President and founder of HEXATRUST (a club of 24 French SME experts in cybersecurity);
Vice President of the Systematic Paris Region Competitiveness Cluster (a competitiveness hub of 800 firms offering security, IT, cloud, and digital services to industry);
Director and treasurer of Revital Emploi fund;
Director of Auriga Bioseed; and
Member of the Telecom Paris Tech School Board.

He has a degree in mathematics and economics from the University of Paris X Nanterre.

Amaury Rosset – Chief Financial and Administrative Officer and co-founder of WALLIX

Amaury Rosset has 15 years' experience as an entrepreneur.

From 1995 to 1999 he worked for Hachette Filipacchi Medias where he held a series of positions as management controller, projects head for Asia Pacific (in Hong Kong) and director of the Group's Hong Kong and Chinese titles.

In 2000, he helped create and then as Managing Partner develop a multimedia communication agency, XLAB.

In October 2003, he co-founded WALLIX GROUP and is now in charge of the Group's administrative and financial issues.

He has a degree in economics and management from Euromed-Marseille Business School.

Didier Lesteven – Chief Operations Officer

Didier Lesteven joined the Supervisory Board of WALLIX in 2011 and was its Chairman until 2017. In April 2017, he became the Company's Chief Operations Officer in charge of developing Bastion worldwide.

With more than 30 years' experience in the world of IT, Didier has held senior management positions at many American companies (HP, 3Com, Sterling Commerce). He also worked at Infovista from 2000 to April 2004 where he was Deputy CEO in charge of Sales & Marketing Operations. From 2004 to 2010, he was CEO of Medialive, a company developing protection technologies for digital content which was later bought by Kudelski Group. From 2013 to 2016, he was Chairman of Total Immersion which provides augmented reality solutions.

He has a Master's degree in economics and financial management from EDC Paris Business School.

Didier Cohen – Strategy Director

After beginning his career in R&D at Matra Communication, Didier Cohen held a series of product management positions at Nortel Networks before moving to Nokia as Head of Marketing. In 2004, he joined Oberthur Technologie as Marketing Director before founding Anthalia, a Product Management and Product Marketing consultancy firm. After some years at the helm of the consultancy, in 2015 Didier joined Qosmos, a firm specializing in network intelligence solutions, as Vice President, Product Management. In early 2018, he was appointed Strategy Director at WALLIX.

Didier is a graduate of Ecole Polytechnique and of Ecole Telecom ParisTech.

Serge Adda – Vice President, Products

Serge Adda has more than 20 years' experience in the IT world and software publishing. For 15 years he was Vice President, R&D at Infovista, a software developer/publisher.

He is Vice President, Products, at WALLIX GROUP since 2012 in charge of R&D, roadmaps, and product lifecycle.

Serge Adda is a graduate of Ecole Nationale des Mines de Saint-Etienne.

Xavier Lefaucheux – Vice President Sales EMEA

Xavier Lefaucheux joined the WALLIX management team in September 2015. He heads up sales and marketing for Western and Southern Europe. With extensive experience in the sector, he contributed to the development of Telindus (Arche Communications), Infovista in Europe, and more recently Stormshield.

Before joining WALLIX, Xavier was Regional Director at Stormshield where for nine years he was head of strategy and development for marketing activities in France, and participated in the merger of NETASQ, Arkoon and SkyRecon to form Stormshield, a subsidiary of AIRBUS Group.

Xavier Lefaucheux has an MBA from an HEC.

Edwige Brossard – Director, Marketing EMEA

Edwige Brossard began her career at Cap Gemini Group, a world leader in consulting, IT services and information management. In 2002, she joined the American software publisher EMC² where she promoted numerous lines of software products on the global market as Head of Product Marketing. In 2007, she joined a smart-city IT startup, which was bought three years later by ENGIE INEO, a subsidiary of ENGIE Group (formerly GDF SUEZ) dedicated to energy and digital transition in territories and organizations. She was then appointed Deputy Managing Director at ENGIE INEO, a position she held until 2016 before joining WALLIX GROUP.

Gregory Rousseau – Vice President Customer Success

Having joined WALLIX in 2017, Gregory is a customer support specialist in the software sector.

He had five years' experience at Reuters where he was in charge of developing an online customer support platform as well as the Professional Services business for software. From 2001 to 2004 he was Customer Support Director at InfoVista. From 2004 to 2011 he was Director, Technical Division, at DL Santé (part of DL Software Group), in charge of customer services and R&D organization. Before joining WALLIX, Gregory was Chief Technical Officer at Pharmagest Interactive, a French company developing IT solutions in the healthcare sector.

Gregory is a graduate of Ecole Nationale d'Ingénieurs de Brest.

Henri Binsztock – Chief Innovation Officer

Henri joined WALLIX after the acquisition of MLstate in 2016, a company which he founded and ran for eight years. Awarded the Prize for Innovation in France by the Ministry of Research in 2008 and a finalist at GigaOM Structure in 2012, Henri is the creator of Awesome (http://awless.io), a CLI for AWS, winner of the InfoWorld Best of Open Source 2017 prize, and the prize for Top Developer Tool for StackShare and for the DataPeps solution, an end-to-end encryption platform.

He co-authored the O'Reilly book: "Opa: Up and Running".

Henri has a doctorate in informatics from Université Pierre et Marie Curie, Paris, where he also began his career as a researcher in Machine Learning and a lecturer in computing.

7. ORGANIZATION CHART

7.1 Legal organization chart

Voting right percentages correspond to percentages of ownership.

7.2 List of subsidiaries, branches and secondary establishments

WALLIX GROUP SA is the parent company of the Group. It is in charge of the Group's historic activity and of the Services activity (secure hosting of sensitive applications). As at December 31, 2017, it had total staff of five people, two of whom are members of the Management Board and founders of the Group.

WALLIX SARL is a French company with headquarters located at 250 bis, rue du Faubourg Saint-Honoré 75008 Paris. WALLIX SARL develops and implements security management software solutions for networks and systems infrastructures. It is the vendor of the Group's software user licenses and the related maintenance services. As at December 31, 2017, it had total staff of 78 people, one of whom is a member of the Management Board.

WALLIX US CORP is an American corporation with its headquarters at c/o KVB PARTNERS, World Financial District, Suite 3502, 60 Broad Street, New York, NY 10004 in the United States. Its business activity is the publishing of cyber security software. Its task is to develop this activity with North American players. However, as of the date of this Registration Document, the company had not yet registered any orders and has no employees.

All these companies are fully consolidated.

As of the date of this Registration Document, the Group has no branches.

The scope of consolidation, as detailed in the notes to the consolidated financial statements in Chapter 20 of this Registration Document, consists of the following companies:

Companies	Country	Registered Office	SIREN	Method	% control December 31, 2017	% control December 31, 2016
Wallix GROUP	France	250 Bis rue du Faubourg Saint-Honoré - 75008 PARIS	428 753 149	GC	Parent	Parent
Wallix	France	250 Bis rue du Faubourg Saint-Honoré - 75008 PARIS	450 401 153	GC	100%	100%
Wallix US	United States	60 Broad Street - Suite 3502 NEW YORK 10004		GC	100%	100%

GC = Global Consolidation

7.3 Main intra-group exchanges

On November 28, 2016, WALLIX GROUP SA arranged a forgiveness of debt, with a claw back provision (return to better fortune), in favor of its subsidiary WALLIX SARL, for an amount of €300,000. No return to better fortune was recorded in financial year 2016. WALLIX GROUP SA did not forgive a debt in favor of its subsidiary, either in 2017 or in 2015.

WALLIX GROUP SA (the lender) has entered into a current account advance agreement with its subsidiary WALLIX SARL. WALLIX SARL has requested cash on the shareholders' current account for an amount of €2,826,266.71 in financial year 2016. At December 31, 2016, the WALLIX GROUP current account presented a balance of €6,364,215.48. At December 31, 2017, the WALLIX GROUP current account presented a balance of €5,629,813.40. This current account does not bear interest.

WALLIX GROUP SA sub-leased its premises to WALLIX SARL, for up to 50% of the rents due on Building A and 100% of the rent due on Building B of the offices located at 118 rue de Tocqueville 75017 PARIS until the lease expiry date, namely February 29, 2016. WALLIX GROUP SA recorded €19,523.79 for rental payments, charges included, €1,085.39 for re-billed taxes for the financial year 2016.

As from January 1, 2016, WALLIX SARL sub-lets to WALLIX GROUP SA 105.30 sq.m of the 527 sq.m of premises it occupies on the 4th floor of the offices located at 250 bis, rue du Faubourg Saint Honoré, 75008 Paris. This agreement was signed on December 30, 2015 for 32 months. It may be renewed by implicit agreement for a period of 36 months to match the term of WALLIX SARL's lease. WALLIX SARL has recognized €65,636 in rental payments, with charges and taxes included, for financial year 2016, and €64,192 for financial year 2017.

There is a contract under which WALLIX GROUP SA markets the WAB product, published by WALLIX SARL. Under the terms of this marketing agreement, WALLIX SARL charges WALLIX GROUP SA an amount equal to 75% of the sales billed by WALLIX GROUP SA to the end customer, it being understood that WALLIX GROUP SA will also pay for the cost of the hardware, which is slightly less than the amount charged to the end customer. This contract has not generated any billable transaction, either in 2016 or in 2017.

WALLIX GROUP SA is in charge of the "WEB MANAGED SERVICES" (WMS) under the WMS contracts signed by WALLIX SARL. In this regard, WALLIX GROUP SA invoices WALLIX SARL 30% of the amount of the signed WMS contract. In 2015, a WMS contract was signed with EFISENS (BPI), with services scheduled to start on April 1, 2015. This contract is still ongoing as of the date of the Registration Document. The part re-billed by WALLIX GROUP SA to WALLIX SARL is €12,250 in respect of 2016 and €12,251 in respect of 2017.

WALLIX GROUP SA undertakes to provide services to WALLIX SARL and to handle all the tasks related to the administrative and financial management function. For its subcontracting operations, WALLIX GROUP SA re-bills WALLIX SARL for the exact amount of the personnel costs incurred for the performance of these duties. This agreement was signed in 2015, for financial year 2015. It may be renewed by tacit agreement and may be canceled at any time subject to a notice period of three months. WALLIX GROUP SA re-billed €73,239 to WALLIX SARL for financial year 2015, €76,583 for financial year 2016 and €85,394.38 for financial year 2017.

WALLIX SARL undertakes to provide services to WALLIX GROUP SA and to handle all the tasks related to the accounts function. For its subcontracting operations, WALLIX SARL will re-bill WALLIX GROUP SA to the exact amount of the expenses linked to the staff hired to perform these duties. This agreement was signed in 2015, for financial year 2015. It may be renewed by tacit agreement and may be canceled at any time subject to a notice period of three months. WALLIX SARL re-billed €35,866 to WALLIX GROUP SA for financial year 2015, €35,334.65 for financial year 2016 and €42,866.45 for financial year 2017.

8. REAL ESTATE ASSETS, PLANTS AND EQUIPMENT

8.1 Description of real estate assets

The Group rents space for its business:

250 bis, rue du Faubourg Saint Honoré, 75008 Paris: office space on the 4th floor of the Saint Honoré building, 527 sq.m, under a 3-6-9 years lease. Effective date: November 1, 2015. Lease expiry date: October 31, 2024;
250 bis, rue du Faubourg Saint Honoré, 75008 Paris: office space on the 5th floor of the Saint Honoré building, 519 sq.m, under a 3-6-9 years lease. Effective date: November 1, 2015. Lease expiry date: October 31, 2024;
250 bis, rue du Faubourg Saint Honoré, 75008 Paris: office space on the 6th floor of the Saint Honoré building, 490 sq.m, under a 3-6-9 years lease. Effective date: August 1, 2017. Lease expiry date: July 31, 2026;
1 Farnham Road, Guildford, Surrey, GU2 4RG (United Kingdom): use of two offices in a Regus business center, under an annual tenancy agreement renewable by tacit agreement. Effective date: February 1, 2017. Expiry date: January 31, 2018

8.2 Environmental issues

The nature of the Group's activities does not generate any material risk for the environment.

The Group is not subject to any particular CSR obligations.

9. EXAMINATION OF RESULTS AND FINANCIAL POSITION

The financial information presented in this chapter is based on the Group's annual consolidated financial statements prepared in accordance with French GAAP for financial years 2015, 2016 and 2017.

Readers are requested to read this analysis of the Group's financial position and results for the financial years ended December 31, 2015, 2016 and 2017, along with the Group's financial statements and notes attached to the financial statements presented in Chapter 20 of this Registration Document, and any other financial information appearing in this Registration Document, as well as the consolidated financial statements and corporate financial statements from 12/31/2016 and the corresponding reports from our statutory auditors as presented on pages 35 to 37 and 62 to 64, respectively, of the Company's 2016 Annual Report, published on its website (www.wallix bourse.com) and the consolidated and corporate financial statements of 12/31/2015 and the corresponding reports from our statutory auditors, presented on pages 29 to 32 and 62 to 64, respectively, of the Company's 2015 Annual Report, published on its website (www.wallix bourse.com).

9.1 General presentation

9.1.1 Introduction

WALLIX specializes in the business of publishing computer security software, more specifically access control and privileged account tracking or PAM (Privileged Access Management), in business information systems.

Driven by sales efforts outside France which were started in 2012 in several countries of the EMEA region (using distribution agents), 26% of the Group's business was concluded outside France in 2017.

In terms of distribution, the Group relies on a model combining a direct sales approach towards major customers (CAC40, SBF250, Fortune500, Central Administrations) and indirect sales through a network of certified reseller partners and integrators.

9.1.2 Main factors affecting activity and results

The consolidated turnover achieved by the Group comes from the following activities:

Software licenses: licensing turnover amounted to 69% of the Group's total turnover in 2017, 66% in 2016 and 57% in 2015;
Related maintenance services: technical support and upgrades, which accounted for 28% of the Group's total turnover in 2017, 29% in 2016 and 29% in 2015;
Managed services: secure hosting of critical applications, which represented 4% of turnover in 2017, 5% in 2016 and 13% in 2015.

Revenue from sales under license is recognized on the date when the software is made available. Turnover from maintenance is recognized in a straight-line manner, depending upon the term of the maintenance contract. Turnover resulting from the provision of services is recognized when these services are performed.

The Bastion offer is the Group's major product offering. It makes it possible to secure, audit and track all Privileged User access to a company's critical resources (servers, networks, applications, databases, etc.). In 2017, the Bastion offer represented more than 96% of the Group turnover. 71% of the turnover related to the Bastion offer is attributed to the Software branch, while the remaining 29% forms part of the Maintenance and Services branch.

The DataPeps SaaS software line, which is being developed, did not contribute directly to the Company's results.

Thanks to growth in the Software Licenses activity (+63% in 2017 and +61% in 2016), the Group's turnover is up sharply. It totaled over €11.5 million in 2017, versus €7.4 million in 2016. Given its ambitions in terms of geographic expansion and the expansion of its customer and partner base, growth in the Software Licensing activity is expected to remain steady. The requirements for compliance with the 2016 law on Vital Operators also created opportunities for growth for the Software business.

In terms of costs, the Group intends to continue its R&D and commercial investment efforts. The future profitability of the Group will depend on the increasing strength of the sales team and, ultimately, its productivity. Moreover, marketing efforts will continue to raise awareness of the Group's brand and products, as it participates, particularly, in international trade shows.

Lastly, in connection with its development projects, the Group benefits from a tax credit for research (CIR) (€974,000 expected for 2017) and operating subsidies (€220,000 for 2017). Recognition of the research tax credit (CIR) and subsidies is explained in Chapter 2, in the section on "Research tax credit and operating subsidies", and in Note 6 to the consolidated financial statements for the year ended December 31, 2017, contained in Chapter 20 of this Registration Document. Details of CIR funding and subsidies can be found in sections 10.1.2 and 10.1.3 of this Registration Document. Details of the current dispute relating to the research tax credit can be found in section 20.11 of this Registration Document. This does not affect the amount of the CIR expected for the 2017 financial year.

9.2 Presentation and analysis of the operating accounts

9.2.1 Turnover and operating revenue

Over the past three financial years, turnover by revenue type has evolved as follows:

Audited consolidated data	Financial year 2015	Financial year 2016	Financial year 2017
(in €000s)	12 months	12 months	12 months

Licenses	3,035	4,879	7,937
Maintenance	1,547	2,118	3,197
Managed services	713	367	410
Total turnover	5,295	7,364	11,545

Consolidated turnover totaled €11,545,000 in 2017 versus €7,364,000 in 2016, up some 57%.

License turnover contributed sharply to the Group's solid performance, up 63% to €7,937,000 demonstrating the commercial success of WALLIX's Bastion offer. In fact, the Group has strengthened its position as an expert in Privileged Account Management (PAM) and this position has enabled the Group to continue growing its key account customers and to win major contracts with multinational companies in sectors such as Banking & Finance, Industrials, Defense and Distribution. The successful launch of new modules, particularly its vault and password management products, has afforded the Group a leading position in the Product and Innovation categories of the 2017 KuppingerCole Leadership Compass award for privileged access management1 .

Finally, this positioning has enabled the Group to multiply its commercial success, particularly with large accounts in France, Germany and throughout the EMEA (Europe, Middle East and Africa) region. In 2017, 24 contracts larger than €100,000 each were signed, versus 13 in 2016. For the first time, the Group was awarded two contracts larger than €1 million.

Maintenance contributed €3,197,000 to its activity, and the Group now has a large installed customer base, with solid recurring revenue and visibility. Turnover from maintenance is recognized on a straight-line basis, depending upon the term of the maintenance contract. The term of these contracts varies between 1 and 3 years.

Other managed services activities totaled €410,000 during the year.

Ordinary business revenue by geographic region over these three financial years was as follows:

Audited consolidated data	Financial year 2015	Financial year 2016	Financial year 2017
(in €000s)	12 months	12 months	12 months

France	3,725	5,283	8,589
International	1,570	2,081	2,956
Total turnover	5,295	7,364	11,545

Business volume in France totaled €8,589,000 in 2017 and represented 74% of the Group's turnover during the period. In its domestic market, the Group has benefited from an increase in its existing clients and gains in new clients, posting growth in turnover of some 63% during financial year 2017.

International activity was up 42% and represented 26% of the Group's turnover in financial year 2017. The Group has a network of distributors, integrator partners and retailers in the Europe, Middle East and Africa region, who promote its international activities. In 2017, the major accounts in Germany and throughout the EMEA region (Europe, Middle East and Africa), contributed to growth outside the domestic borders.

The Group's other operating income for the years ended December 31, 2015, December 31, 2016 and December 31, 2017 breaks down as follows:

Audited consolidated data	Financial year 2015	Financial year 2016	Financial year 2017
(in €000s)	12 months	12 months	12 months

Capitalized production	1,456	1,896	2,575
Operating subsidies	731	959	813
Reversals of provisions, depreciation, transfers	169	23	27
Other income	0	0	134
Total Other operating revenue	2,356	2,878	3,549

¹ Founded in 2004, KuppingerCole is a global analyst firm headquartered in Europe with expertise in information security and in identity and access management (IAM).

The balance of the fixed production account corresponds to wage costs posted under development expenses. Capitalized production totaled €2,575,000 in 2017 versus €1,896,000 in 2016, up by approximately 36%.

In financial year 2017, a €123,000 advance from Coface was definitely acquired and is included under other operating revenue.

Subsidies include the Research Tax Credit and subsidies related to research programs. Under the general principle that substance prevails over appearances in the consolidated financial statements (Regulation 99-02, § 300), the Group opted to post the Research Tax Credit as follows:

As an operating subsidy, for the portion that cannot be directly attributable to fixed development costs,
As prepaid revenue, for the portion directly attributable to fixed development costs, then posted to income at the same rate as these development costs are amortized.

Operating subsidies may be broken down as follows:

Audited consolidated data	Financial year 2015	Financial year 2016	Financial year 2017
(in €000s)	12 months	12 months	12 months

Operating subsidies not applied	134	215	69
RTC treated as a Subsidy	220	247	247
Share of RTC distributed over five years (pre-paid revenue)	239	294	369
Share of subsidies distributed over five years (pre paid revenue)	137	123	128
Total operating subsidies	731	959	813

The fluctuation in subsidies is partly due to the pace of the associated projects. The amount of subsidies in 2016 was higher due to the number of projects under way (HUMA and PMAIL) and completed or nearing completion in 2016 (SAFEPYTHON, PMUP). The 2017 financial year saw the introduction of new subsidies (PCUv2 and CAAS PME) for lower amounts and a slowdown in the implementation of the HUMA project.

9.2.2 Operating expenses by type

Operating expenses posted as expenses during the financial years in question may be broken down as follows:

Audited consolidated data	Financial year 2015	Financial year 2016	Financial year 2017
(in €000s)	12 months	12 months	12 months

Purchases and changes in inventory	257	146	375
Other operating expenses	2,418	3,810	4,125
Taxes and levies	116	171	271
Payroll costs	4,790	6,515	9,087
Depreciation and provisions	1,143	1,365	2,081

Total operating expenses	8,724	12,007	15,939
--------------------------	-------	--------	--------

Operating expenses consisted of the following:

purchases and changes in inventory, mainly comprising materials delivered to customers, which are relatively stable over time because customers are increasingly opting for virtual solutions (no physical materials); The growth in purchases and changes in inventory reflect the preferences of Group clients who wish to purchase their licenses on physical media or virtual media. In 2016, there was little demand for licenses on physical media, hence the low year-end inventories. In 2017, demand for licenses on physical media was robust, particularly in the last two months of the year. Consequently, demand could not be entirely fulfilled before year-end and physical inventories in progress were recognized.
other operating expenses: lease payments and expenses, auditing, legal and consulting fees, prospecting costs, market studies, marketing, etc. Other operating expenses, up 8% and representing 36% of turnover in 2017, compared to 52% in 2016 and 46% in 2015. Under other operating expenses, marketing expenses were a key item, including not only digital marketing activities, but also participation at various professional events and trade shows, as well as an ongoing commitment to major analysts (Gartner, IDC, KuppingerCole, Forrester, etc.). Marketing expenses were also incurred in launching the WALLIX Channel program and for Group partner certification campaigns begun in 2017: Wallix Professional Training & Wallix Expert Training. This certification campaign led to the training of 49 individuals among 22 of the Group's retail partners;
duties and taxes;
payroll costs, which were up 39% in 2017 and 36% in 2016, due to increased staff (the Group's average total headcount was 73 persons in 2017, 64 in 2016 and 44 in 2015), and "mixed" effects (recruitment of senior executives and recruiting abroad);
depreciation, amortization and provisions consisting essentially of the amortization of development costs. Development costs are amortized over five years from the year following their capitalization. Allowances for amortization of development costs amounted to €1,357,000 for 2017, €1,103,000 for 2016, and €934,000 for 2015.

9.2.3 Calculation of operating income

The operating income generated over the last three financial years grew as follows:

Audited consolidated data	Financial year 2015	Financial year 2016	Financial year 2017
(in €000s)	12 months	12 months	12 months

Total operating revenue	7,651	10,242	15,094
Turnover	5,295	7,364	11,545
Capitalized production	1,456	1,896	2,575
Operating subsidies	731	959	813
Reversals of provisions, depreciation, transfers	169	23	27
Other revenue	0	0	134
Total operating expenses	(8,724)	(12,007)	(15,939)
Purchases and changes in inventory	(257)	(146)	(375)

Operating income	(1,074)	(1,765)	(845)
Contributions to depreciation and provisions	(1,143)	(1,365)	(2,081)
Personnel expenses	(4,790)	(6,515)	(9,087)
Duties and taxes	(116)	(171)	(271)
Other operating expenses	(2,418)	(3,810)	(4,125)

With growth of 47% in total operating revenue in 2017, and after accounting for hiring, research and development efforts and commercial investments, operating income posted a loss of €845,000 in 2017, i.e. a 52% improvement over the previous year.

The 2017 improvement in operating income is directly related to the gap between accelerating growth in operating revenue (up 47% in 2017, i.e. +€4.9 million, versus 34% in 2016), and the control of growth in operating expenses (up 33%, i.e. +€3.9 million, versus 38% in 2016). Growth in consolidated turnover (up 57%, i.e. +€4.2 million versus the previous financial year), as detailed below in Section 9.2.1, was due to the increase in operating revenue. At the same time, the slowdown of growth in operating expenses was due to the maturing of the Group's activities and is related to enhanced efficiency in the principal operating expense items. Thus, payroll costs (+39% after the hiring of nine new employees in 2017) and other operating expenses (+8%) saw lower growth with respect to operating revenue, thereby yielding a higher operating margin.

Although financial year 2016 was marked by accelerating activity and growth in total operating revenue of some +34%, this performance was accompanied by operating expenses that were higher by some 38%. In fact, the Group has continued its human development plan with the hiring of 20 new employees in 2016, increasing its headcount to 64 employees, and specifically strengthening its top and middle management. At the same time, the Group has strengthened its investments in marketing, aiming to support its network of retail partners and integrators and develop the Group's reputation and visibility. These factors automatically affected 2016 operating income, which totaled -€1,765,000

The 2015 financial year saw the Group's IPO in June and a sharp acceleration in business, taking annual turnover to €5,295,000, corresponding to annual growth of +33%. In parallel, 2015 was a year of significant HR investment, particularly in the Sales & Marketing and R&D functions. The Group also embarked on a major communications campaign to raise its profile. These cost factors weighed on operating income, which stood at -€1,074,000 at December 31, 2015.

9.2.4 Calculation of net income

9.2.4.1 Financial income and expenses

Audited consolidated data	Financial year 2015	Financial year 2016	Financial year 2017
(in €000s)	12 months	12 months	12 months

Financial expenses	(17)	(40)	(20)
Interest and similar expenses	(7)	(9)	(10)
Negative exchange rate differences	(10)	(31)	(10)
Financial income	29	20	1
Other interest and similar income	11	7	1
Income from other securities and	1	0	0

Total financial income and expenses	13	(20)	(19)
Net revenue from disposal of investment securities	4	0	0
Positive exchange rate differences	14	12	0
receivables from fixed assets

Net financial expenses totaled €19,000 in 2017, versus expenses of €20,000 in 2016, and positive net financial income of €13,000 in 2015.

The Group's principal financial instruments consist specifically of negotiable Medium Term Notes for €3.1 million maturing in July 2018, as well as 3,236 BNP mutual fund shares totaling €3.3 million. The purpose of the management of these instruments is to enable the Group's activities to be financed. The Group's policy is to not purchase financial instruments for speculative purposes. The Company does not use options or financial derivatives.

Interest income and similar income mainly relates to the negotiable Medium Term Notes and the Mutual Fund mentioned above. Financial expenses from interest and similar sources are related to the Group's financial liabilities, which as of December 31, 2017 consisted largely of loans from banks totaling €1,691,000. Some 79% of the value of the Group's borrowings from banks are zero interest loans. The interest rate risk is therefore considered to be limited.

Internationally, a portion of the Group's turnover and expenses is invoiced in foreign currency, particularly US dollars or pounds sterling. Exchange rate fluctuations have an effect on consolidated turnover but little impact on operating income, since consolidated revenue and its related costs are essentially realized in the same monetary region. The Group therefore does not consider it useful to hedge for this risk. Exchange rate fluctuations had a negative effect of some €10,000 in financial year 2017, a negative effect of €19,000 in 2016 and a positive effect of €4,000 in 2015.

9.2.4.2 Corporate taxes

The Group posted a tax charge of €5,000 in 2017, and there was no corporate tax charge in 2016. The corporate tax charge for financial year 2015 was €1,000.

The Group had tax losses capable of being carried over indefinitely in France. However, because of the Group's lack of earnings outlook in the medium term, deferred tax assets have not been recognized, beyond the deferred tax liabilities. Tax losses amounted to €11,054,000 at December 31, 2017 and €9,951,000 at December 31, 2016.

Allocation of this loss is capped at 50% of taxable profits for the year, with this restriction applying to the fraction of profits that exceeds €1 million. The unused balance of the loss may be carried over to subsequent financial years and may be allocated in the same manner, with no restrictions as to time.

Audited consolidated data	Financial year 2015	Financial year 2016	Financial year 2017
(in €000s)	12 months	12 months	12 months

Extraordinary income	7	421	5
On equity transactions	7	421	5
Extraordinary expenses	(60)	(319)	(187)

English free translation of the French-language 2017 Reference Document – not binding, for information purposes only

On management transactions	(2)	(1)	(180)
On equity transactions	(33)	(311)	(5)
Contributions to provisions	(24)	(7)	(2)
Total extraordinary income and expenses	(53)	102	(182)

The Group posted extraordinary income of -€182,000 for 2017, €102,000 for 2016 and -€53,000 in 2015.

In 2017, this consisted largely of extraordinary expenses on management transactions related to extraordinary fees from ROLAND BERGER, which participated in a strategic orientation process.

In 2016, the extraordinary income was linked to equity transactions. The Group also received an eviction penalty from its former landlord for breaking the commercial lease on its premises at Rue de Tocqueville. Further, the Group posted extraordinary income (€316,000) and expenses (€303,000) for disposals of fixed materials.

In 2015, extraordinary income was due to equity transactions and contributions to provisions.

9.2.4.4 Earnings per share

Net earnings per share is calculated by dividing the Group share of net income by the weighted average number of common stock outstanding during the financial year.

Audited consolidated data	Financial year 2015	Financial year 2016	Financial year 2017
	12 months	12 months	12 months

Net income (in €000s)	(1,113)	(1,683)	(1,050)

Weighted average number of shares outstanding	3,547,701	4,005,858	4,035,134
Net earnings per share (€)	(0.314)	(0.420)	(0.260)

Diluted net earnings per share (€)	(0.314)	(0.420)	(0.260)

Deferred equity instruments (stock warrants and founder's stock warrants)1 are not included in the calculation of diluted net earnings per share, since the net income is negative,

9.3 Balance sheet presentation and analysis

9.3.1 Fixed assets

Audited consolidated data	Financial	Financial	Financial
	year 2015	year 2016	year 2017
(in €000s)	12 months	12 months	12 months

¹ See Section 21.1.4 of this Registration Document for a breakdown of potential share capital

Total net fixed and long-term assets	4,348	5,610	6,925
Long-term financial assets	395	228	346
Property, plant and equipment	286	762	773
Intangible fixed assets	3,667	4,619	5,805

Intangible fixed assets correspond to research and development expenses (€5,678,000 net as of December 31, 2017), concessions, patents, licenses and goodwill (€126,000 net). They are posted at acquisition cost, including purchasing price and associated expenses.

The Group conducts development activities in order to design and develop computer security software.

Research expenses are posted to expenses when incurred. Development expenses on individual projects are posted when the project's feasibility and profitability can be reasonably considered as assured. Given the above, development expenses are fixed in the form of intangible assets when the Group can demonstrate:

its intention to make this asset and its ability to use or sell it;
its financial and technical capacity to complete the development project;
the availability of resources to complete the project;
that it is likely that future economic benefits attributable to the development expenses will accrue to the Group;
and that the cost of this asset may be reliably determined.

In accordance with this standard, as of December 31, 2017, the Group had capitalized a total of €11,408,000 in development expenses, i.e. €5,678,000 net of depreciation.

For financial year 2017, the Group considered that €2,575,000 could be capitalized under the capitalization criteria described above. This amount was €1,896,000 for 2016 and €1,456,000 for 2015.

Capitalized development costs consist largely of personnel costs, which are assessed as a function of hours worked on development projects. Capitalized development costs are amortized over five years. Net of amortization, development costs amounted to €5,678,000 in 2017, €4,459,000 in 2016, and €3,666,000 in 2015. The increase in net development costs is directly linked to the activities of the R&D department and explains the increase in intangible assets (+€1,186,000 in 2017 and +€952,000 in 2016).

In addition, all ML State assets were transferred to the Group in 2016 and recognized in concessions, patents and similar rights in the same year. The acquisition was financed by two bank loans: the first from Bpifrance Financement for €72,000, and the second from BNP Paribas for €108,000.

Property, plant and equipment consists largely of fixtures and facilities, office materials and furnishings, and computer hardware. The increase in property, plant and equipment is due to equipment for new recruits (with recruitment up 50% in 2016 and 40% in 2017), mainly consisting of furniture and computer hardware. The Group also upgrades its computer hardware every three years. In addition, the Company's relocation in 2016 resulted in significant new furniture expenses and the disposal of some of its existing furniture. In 2017, unlike in previous years, the Group did not transfer these acquisitions in order to arrange 3-year financing. Therefore, these have been recognized in property, plant and equipment at their purchase value.

Property, plant and equipment financed by leasing amounted to €253,000 as of December 31, 2017. It was posted to assets on the balance sheet at its contract value. It is depreciated according to the same rules as if it had been acquired outright in full ownership. These fixed assets are considered as purchased on credit; the corresponding debt is thus posted to liabilities and is subject to financial expenses.

Long-term financial assets correspond primarily to deposits and security guarantees for the Group's premises as well as treasury shares managed by LCM under a liquidity agreement.

Audited consolidated data	Financial year 2015	Financial year 2016	Financial year 2017
(in €000s)	12 months	12 months	12 months

Inventory	8	3	66
Trade receivables	2,093	4,699	6,377
Other receivables and accruals	1,804	1,519	1,711
Cash and marketable securities	8,769	5,938	6,981
Total current assets	12,674	12,159	15,135

9.3.2 Current assets

Inventory consists largely of computer equipment provided as customer support. Its growth is therefore linked to growth in these activities.

Trade receivables as of December 31, 2017 were €6,377,000 versus €4,699,000 in 2016 and €2,093,000 in 2015. This growth is directly related to growth in the activity.

As of December 31, 2017, other receivables and accruals primarily included Research Tax Credits totaling €910,000 and subsidies receivable totaling €186,000.

As of December 31, 2017, cash and marketable securities consisted of current assets totaling €570,000 and investment securities totaling €6,412,000, including €3,100,000 in a negotiable Medium Term Note maturing in July 2018 and 3,236 BNP mutual fund shares totaling €3,312,000. The change in cash between December 31, 2016 and December 31, 2017 (+€1,043,000) was due largely to the generation of cash related to business activity (€3,380,000), less investments (€2,855,000 in 2017), plus net issuances of bond borrowings and a capital increase (€517,000 in 2017) (see cash flow table in Chapter 10 of this Registration Document).

9.3.3 Equity

Audited consolidated data	Financial year 2015	Financial year 2016	Financial year 2017
(in €000s)	12 months	12 months	12 months
Share capital	400	401	404
Premiums	14,768	14,798	14,917
Consolidated reserves	(3,473)	(4,572)	(6,149)
Currency translation reserve	(7)	(17)	(2)
Income, Group share	(1,113)	(1,683)	(1,050)
Shareholders' equity, Group share	10,575	8,927	8,120

Minority interests	0	0	0
Total shareholders' equity	10,575	8,927	8,120

As of December 31, 2017, shareholders' equity totaled €404,471. It is divided among 4,044,710 shares with a par value of €0.10, fully subscribed and paid-in, all of the same class.

This number excludes stock warrants awarded to employees and consists solely of common stock.

As part of its policy of incentivizing its senior executives and senior managers, the Group issued stock warrants (BSAs) in 2012, stock options in 2012, and founder's stock warrants (BCEs) in 2012 and 2014. The Group also awarded bonus shares in 2016. All of these transactions are described in Section 21.1.4 dealing with Potential Capital.

The change in the Group's share capital has been marked by the following events:

First round of capital increase in 2007, of €550,000,
Several rounds of fundraising under the ISF-PME system for a total of €879,000 between 2008 and 2010,
In 2011, raising of €1,790,000,
Raising of €2,120,000 in 2012,
Raising of €1,132,000 in 2014,
On June 16, 2015, listing on the Alternext market (which became Euronext Growth) in Paris and capital increase of €10.1 million, corresponding to the issuance of 962,500 new shares. On completion of these transactions, the WALLIX GROUP's share capital consisted of 3,997,180 shares, with a stock market capitalization of €42.0 million, based on the offering price,
In 2016, exercise of 10,810 founder's stock warrants, with a par value of €0.10 each, awarded in 2014,
In 2017, exercise of 22,500 options and 14,220 stock warrants awarded in 2012, with a par value of €0.10 each.

On December 31, 2017, the group's stock market capitalization totaled €70.1 million, with a price at the close on December 29, 2017 of €17.56 per share.

Audited consolidated data	Financial year 2015	Financial year 2016	Financial year 2017
(in €000s)	12 months	12 months	12 months

Provisions for risks	83	85	85
Provisions for expenses	77	151	565
Total provisions for risks and expenses	161	237	650

9.3.4 Provisions for risks and expenses

Provisions for risks consist largely of a provision of €69,000 corresponding to Research Tax Credits. The Company has been the object of an investigation by the tax authorities corresponding to the RTC for 2011 to 2014. On completion of this audit, the tax authorities proposed a correction in the amount of €586,000, out of a total of €1,873,000 already paid to the Company. The Company has challenged most of this proposal and has set aside a provision of €69,000. This ongoing dispute is detailed in sections 4.2.1 and 20.10 of this Registration Document.

The provisions for expenses correspond mainly to pensions and retirement benefits for WALLIX SARL and WALLIX GROUP SA totaling €211,000 in 2017, as well as a provision for the specific employer contribution on awards of free shares totaling €354,000. This contribution will be payable at the end of the vesting period. The provision has been valued based on the average share price for the last 30 trading days preceding the valuation date.

9.3.5 Financial expenses

Audited consolidated data	Financial year 2015	Financial year 2016	Financial year 2017
(in €000s)	12 months	12 months	12 months

Loans from banks	720	1,055	1,691
Bank overdrafts	1	1	1
Finance leases	89	393	258
Sundry loans and financial liabilities	127	123	-
Total financial liabilities	937	1,572	1,950

A new loan was contracted in 2017 from BPI France, totaling €850,000. Three loans were contracted in financial year 2016 totaling €479,000, including one of €300,000 to finance the renovation of the corporate headquarters, and two others to finance the acquisition of MLstate.

As of December 31, 2016, the "Sundry financial liabilities" item consisted of an advance from Coface totaling €123,000 granted in 2017.

Details of these loans are explained in Chapter 10 of this Registration Document, and more specifically in Section 10.1.4 "Debt Financing."

The Group has contracted several lease commitments in the past three financial years, specifically for the following equipment:

Technology solutions in the form of DELL servers, switches and VMWARE valued at €40,000 leased through Factum Finance for 36 months from June 1, 2015 with a monthly rent of €1,143 excluding taxes. On December 14, 2017, i.e. six months before the end of the contract, the Group sent Factum Finance a letter canceling the contract and activating the purchase option for the hardware in question.
Technology solutions in the form of DELL servers valued at €11,000 leased from Factum Finance for 36 months from July 1, 2015, with a monthly rent of €325 excluding taxes. On December 14, 2017, i.e. six months before the end of the contract, the Group sent Factum Finance a letter canceling the contract and activating the purchase option for the hardware in question.
Computer equipment and office furnishings valued at €188,000 leased from Natiocrédimurs (BNP Paribas Group) for 60 months from April 15, 2016, with a monthly rent of €3,228 excluding taxes;
Telephone hardware valued at €12,000, leased from Natiocrédimurs (BNP Paribas Group) for 39 months from March 15, 2016, with a monthly rent of €321 excluding taxes;
Computer equipment, office furnishings and videophone equipment valued at €55,000 leased from Natiocrédimurs (BNP Paribas Group) for 48 months from June 22, 2016, with a monthly rent of €1,175 excluding taxes;
Computer equipment (work stations, monitors, portable computers) from Factum Finance for 36 months from July 1, 2016 with a monthly rent of €1,775 excluding taxes.

Leased property, plant and equipment (Amounts in €000s)	Gross value		Amortiza tion	Net value
Statement of financial position as of January 1, 2015	181	Statement of financial position as of January 1, 2015	81	100
Acquisition	51	Increase	63
Disposal and reclassification		Reduction

The Group's leasing commitments have evolved as follows:

Statement of financial position as of December 31, 2015	232	Statement of financial position as of December 31, 2015	145	87
Acquisition	402	Increase	101
Disposal and reclassification		Reduction
Statement of financial position as of December 31, 2016	634	Statement of financial position as of December 31, 2016	245	389
Acquisition		Increase	136
Disposal and reclassification		Reduction
Statement of financial position as of December 31, 2017	634	Statement of financial position as of December 31, 2017	381	253

9.3.6 Operating payables

Audited consolidated data	Financial year 2015	Financial year 2016	Financial year 2017
(in €000s)	12 months	12 months	12 months

Trade payables	478	523	868
Tax and social security payables	1,438	1,945	2,973
Other payables	125	14	17
Deferred income	3,308	4,660	7,628
Total operating payables	5,349	7,142	11,486

Operating payables have a maturity of less than 1 year.

The Company is subject to the VAT system on receipts. Tax payables include VAT on outstanding trade receivables of €821,000 at December 31, 2017, €629,000 at December 31, 2016, and €248,000 at December 31, 2015.

Deferred income relates to the different categories of products, which are broken down as follows:

Audited consolidated data	Financial year 2015	Financial year 2016	Financial year 2017
(in €000s)	12 months	12 months	12 months

Deferred income, relating to revenue	1,964	3,059	5,645
Deferred income, relating to RTC	995	1,225	1,583
Deferred income, relating to subsidies	349	377	400
Total prepaid income	3,308	4,660	7,628

Prepaid income posted under revenue corresponds to turnover items invoiced and posted for the financial year, but in respect of which the supply or service will occur after the end of the year (e.g. maintenance paid for in advance).

Prepaid revenue posted under RTC and under subsidies corresponds to the part of fixed research tax credits and subsidies attributable to projects.

10. CASH AND SHARE CAPITAL

See also Note 5 of the notes to the financial statements prepared in accordance with French GAAP and described in Chapter 20 of the Registration Document.

10.1 Information on share capital, liquidity and sources of financing

Cash and marketable securities include cash and current financial instruments held by the Group, consisting of money market funds. These cash and investment securities are used to finance the Group's activities. As of December 31, 2017, the cash and investment securities held by the Group totaled €6,980,000.

Audited consolidated data	Financial year 2015	Financial year 2016	Financial year 2017
(in €000s)	12 months	12 months	12 months
Cash and cash equivalents	236	264	570
Investment securities Bank overdrafts and equivalents	8,533 (1)	5,674 (1)	6,412 (1)
Total cash and investment securities	8,767	5,938	6,980
Financial debts maturing within one year	329	474	387
Financial debts maturing in over one year	608	1,098	1,563
Total financial liabilities	937	1,572	1,950
Net financial debt	(7,832)	(4,366)	(5,030)

The analysis of net financial debt is as follows:

The Group's total cash increased between December 31, 2016 and 2017, from €6 million to €7 million, due in part to a zero-interest loan of €850,000 granted by BPI.

Financial debt maturing within one year largely consists of the short-term portion of the loans from BPI France, Oseo and BNP Paribas. In 2016, the debt at less than one year also included a Coface advance definitively acquired in 2017.

Financial debt maturing after one year consists of the long-term portion of the loans from BPI France, Oseo and BNP Paribas.

Net financial debt as of December 31, 2017 totaled -€5,030,000.

The existence of covenants is explained in section 10.3 "Information on the terms and conditions of borrowing and the financing structure".

10.1.1 Capital Financing

The following table summarizes capital increases by value up to December 31, 2017.

Period	Total amounts raised (€000s)	Transaction
--------	---------------------------------------	-------------	--

Total	16,832
2017	135	Creation of 36,720 shares in connection with the incentive policy for senior executives and managers (at a price of €3.686 per share)
2016	30	Creation of 10,810 shares in connection with the incentive policy for senior executives and managers (at a price of €2.80 per share)
2015	10,106	Issuance of 962,500 shares (at a price of €10.50 per share) in connection with the listing on the Euronext Growth market in Paris
2014	1,132	Capital increase from Auriga, TDH, the employees and certain historic investors (at a price of €28 per share*)
2012	2,119	Capital increase and entry of TDH (Thierry Dassault Holding) and Auriga in the capital of FSN (BPI) at a price of €36.86 per share*
2011	1,790	Capital increase and entry of TDH (Thierry Dassault Holding) and Auriga in the capital (at a price of €36.86 per share*)
2008-2010	870	Successive capital increases under the ISF tax exemption regime (retail investors, with an average price of €36.8 per share)
2007	550	Capital increase (to €15 per share) and convertible bond (50/50) and entry of Sopromec and Access2Net in the capital
2003	100	Incorporation of the Company

*Before division of the par value of the shares by 10, by resolution of the Extraordinary General Meeting of May 6, 2015.

(1) 10,810 founders' warrants for 2014 exercised on September 26, 2016 by Dominique Meurisse (see section 21.1.4.1)

(2) 36,720 shares composed of 22,500 options for 2012 exercised on September 21, 2017 by Serge Adda (see section 21.1.4.2) and 14,220 stock warrants exercised on October 6, 2017 by Didier Lesteven (see section 21.1.4.4)

Since its creation, the Group has received a total of €16.8 million (before deduction of expenses related to capital increases) from founders' contributions and several successive rounds of fundraising from individual and institutional investors.

10.1.2 Financing from refundable advances and subsidies

Since 2008, WALLIX has been implementing a voluntary innovation policy, in which government funded collaborative R&D projects have a decisive role. In this connection, the Group benefits from subsidies that are not refundable (the "other" column in the table below) and are spread out over time. These subsidies are linked to the research projects Résilience Ung, Seed4c, Safepython, Pm'UP, Huma, Aima Wabfullpam, Pmail, Pcu, Caas-PME, Anblic and Fentec. They have been obtained from BPI France, from the Ile de France Region, from the Département of Paris, from a European joint venture forming part of the Horizon 2020 program for 2014-2020 research and innovation, and from the FCE (Fonds de Compétitivité des Entreprises – Business Competitiveness Fund).

The subsidies outstanding at December 31, 2017 amount to €186,000, as detailed in note 3 "Other receivables" of the notes to the consolidated financial statements in Chapter 20 of this Registration Document.

(in €000s)	Subsidies	COFACE
Financial year 2015
Receipt	189
Refund	-
Financial year 2016

Receipt	263
Refund		3
Financial year 2017
Receipt	330
Refund	-

The insurance-prospection policy entered into with the insurance company COFACE on January 11, 2010, amended by amendment of January 18, 2011 and then by a COFACE letter dated 2/7/2012, intended to cover the US geographic region, ended on 10/31/2016.

10.1.3 Funding from the research tax credit

To finance its activities, the Group received a Research Tax Credit ("RTC"), consisting of a tax credit for companies investing amounts in research and development. The research tax credit for financial year 2017 totaled €974,000. The research tax credit remaining to be received as of December 31, 2017 totaled €910,000.

The CIR figure mainly takes into account the R&D payroll and IT equipment for eligible activities and projects. The number of staff in the R&D department has increased each year (+35% in 2016 and +22% in 2017). Since 2016, the Group has also included subcontracting costs in the CIR figure for an annual amount of approximately €85,000.

In 2014, the Group began a patent filing process which has expanded each year. In 2017, the Group filed its ninth patent, resulting in an increase in R&D expenditure (€10,000 in 2015 for €51,000 in 2017). These expenses are also included in the CIR figure.

	12/31/2015	12/31/2016	12/31/2017
(in €000s)	12 months	12 months	12 months

Research tax credit	624	851	974

Details of an ongoing dispute in relation to the research tax credit (CIR) can be found in sections 4.2.1 and 20.10 of this Registration Document. This does not affect the amount of the CIR expected for the 2017 financial year.

10.1.4 Debt financing

The Group has had recourse to various loans and credits for financing. The largest, as of the date of this Registration Document, are as follows:

Zero-interest loan for innovation, totaling €700,000, contracted in 2013 from Oseo and repayable in March 2020,
Loan totaling €300,000 contracted in 2016 from BNP Paribas and repayable in March 2021, to finance the renovation of the Group's offices,
Loan totaling €108,000 contracted in 2016 from BNP Paribas and repayable in August 2022, to finance the purchase of the assets of MLstate,
Loan totaling €72,000 contracted in 2016 from BPI France and repayable in October 2022, to finance the purchase of the assets of MLstate,
Zero-interest loan for innovation, totaling €850,000 contracted in 2017 from BPI France and repayable in December 2023, to finance the development of a privileged access security system for cloud-based applications or information systems.

The Group also received an advance from COFACE totaling some €123,000 awarded in 2017 and reclassified as other operating revenue.

The Group's debt financing over the past three financial years is broken down as follows:

Amounts (in €000s)	Total loans	Oseo 2013 loan (€700,000)	BNP Paribas 2016 loan (€300,000)	BNP Paribas 2016 loan (€108,000)	BPI France 2016 loan (€72,000)	BPI France 2017 loan (€850,000)	Other
		Borrowing situation as of January 1, 2015
	927	700					226 (1)
Received	-						-
Repaid	80						80
		Borrowing situation as of December 31, 2015
	847	700					147
Received	480		300	108	72		-
Repaid	148	75	44	6			23
		Borrowing situation as of December 31, 2016
	1,178	625	256	102	72		123
Received	850					850
Repaid	337	138	59	17			123 (2)
		Borrowing situation as of December 31, 2017
	1,691	487	197	85	72	850	0
(1) including an advance from Coface of €123,000 and a loan of €400,000 at 4.52% to finance

international commercial development, contracted in April 2010 from Oseo and repayable in 20 quarterly installments, the last one paid in January 2016.

(2) €123,000 corresponding to an advance from Coface, awarded in financial year 2017 and reclassified as other operating income.

10.1.5 Off balance sheet commitments

• Commitments given

The Group has issued stock warrants and tradable securities giving access to its share capital. These commitments as at December 31, 2017 are as follows:

Gen. Mtg.	Board Mtg	Type	Number of units authorize d	Number of units issued	Unites expired / canceled	Warr/Opt ions exercized	Units in circulatio n	Number of potential shares*	Strike price in euros (1)	Exercise date
04/30/2012	12/21/2013	BSA 2012	1,422	1,422	0	1,422	0	0	3,686	10/21/2018
04/30/2012	10/21/2013	BCE 2012	9,800	9,800	0		9,800	98,000	3,686	10/21/2018
04/30/2012	10/21/2013	Options 2012	6,316	5,400	3,166	2,250	900	9,000	3,686	10/21/2018
06/12/2014	11/28/2014	BCE 2014	5,835	5,835	0	1,081	4,754	47,540	2,800	11/28/2019

* Taking into account the 1 for 10 split of the par value of each share decided by the Annual General Meeting of May 6, 2015

The potential number of shares shown in the table above corresponds to shares allotted for founders' warrants and stock options which are still in effect and have not yet been subscribed for by the beneficiaries. The outstanding value is the value assigned to these shares, knowing that the par value is €0.10.

The arrangements for exercising these instruments are described in section 21.1.4.

Recipients	Group Employees	Group Employees serving in strategic positions	Board Members
Extraordinary Shareholders' Meeting	06/03/2016	06/03/2016	06/03/2016
Allocation date / Board Number of shares allocated during the year	07/06/2017 54,800	07/06/2017 18,200	07/06/2017 39,699
Number of shares cancelled Total number of shares subject to issuance	4,300 50,500	18,200	39,699
Performance conditions	no	yes / satisfied	yes / satisfied
Attendance conditions	yes	yes	yes
Vesting period	20% at 1 year 35% at 2 years 45% at 3 years	1 year	1 year
Holding period	1 year / 1st tranche	1 year	1 year
Total charge posted during fiscal year (in € thousands)	7	114	232

In 2017, the Group also awarded bonus shares giving access to its share capital. These commitments as at December 31, 2017 are as follows:

The vesting of the bonus shares awarded is contingent on the beneficiary remaining in post and on the achievement of the performance criteria relating to 2017 consolidated turnover. These criteria were established by the Management Board at its meeting on July 6, 2017 and are not disclosed for confidentiality reasons. The bonus share plan is detailed in section 21.1.4.3 of this Registration Document.

To guarantee a loan of €72,000 from BPI France, WALLIX GROUP SA took out a "borrower guarantee" insurance policy in the name of Jean-Noël de Galzain against Death-Total and Irreversible Loss of Autonomy, from BPI Financement's insurance company C.N.P. This policy runs from July 18, 2016 and the insured amount is equal to €72,000 covering the loan entered into with BPI France for the same amount.

WALLIX GROUP SA is thus joint and several guarantor of the zero interest loan contracted in 2017 with BPI France totaling €850,000.

• Commitments received: n/a

10.2 Cash flow

10.2.1 Cash flow from operating activities

The generation of operating cash flow for the financial year ended December 31, 2017 totaled €3,381,000, compared to consumption of €854,000 as of December 31, 2016. The cash flows generated by the business activity are detailed in the table below:

Audited consolidated data (in €000s)	Financial year 2015 12 months	Financial year 2016 12 months	Financial year 2017 12 months
Net income Amortization, depreciation and reversal of provisions	(1,113) 1,127	(1,683) 1,364	(1,050) 2,020
Other	0	(12)	0
Cash flow	14	(331)	970
Change in Working Capital Requirement	762	(523)	2,411
Operating cash flow	775	(854)	3,381

With business activity growing rapidly (+57%) compared to the previous financial year and a consolidated losses/turnover ratio that is sharply down, the Group has improved its net income by €633,000 thus favorably impacting its cash flow. This increase in activity also resulted in high yearend billings and the client receivables situation at December 31 thus increased by €1,678,000 between 2016 and 2017, growing from €4,699,000 at December 31, 2016 to €6,377,000 at December 31, 2017. At the same time, operating payables increased by €4,344,000, i.e. faster than trade receivables. This was due to the increase in prepaid income resulting from deferred revenue under maintenance contracts, which led to a mechanical reduction in working capital requirement. The increase in operating payables is underpinned by the growth of €2,968,000 in prepaid income and the increase of €1,373,000 in trade payables and tax and social security liabilities due to the increase in the Group's activity.

Consequently, the Group posted a sharp fall in its working capital requirement for financial year 2017 (-€2,411,000).

10.2.2 Cash flow associated with investment activities

Cash consumption associated with investment activities net of disposals for the financial years ended December 31, 2017, 2016 and 2015 totaled €2,855,000, €2,238,000 and €1,924,000 respectively.

Cash flow linked to investment activities during the past three financial years is broken down below:

Operations (€000s)	Financial year 2015	Financial year 2016	Financial year 2017

Capitalization of development costs	(1,456)	(1,896)	(2,575)
Acquisition of other intangible fixed assets	(7)	(185)	(13)
Disposal of other intangible fixed assets	7	2	6
Acquisition of property, plant and equipment by leasing	(51)	(402)	-
Acquisition of other property, plant and equipment	(154)	(541)	(217)
Disposal of property, plant and equipment	0	386	10
Other	(263)	398	(66)
Total cash flow from investing activities	(1,924)	(2,238)	(2,855)

The Group's activity requires R&D investment relating to costs of wages for work teams, mainly for the Software business, for which the feasibility and profitability of project development are reasonably assured (intangible assets). Cash flow linked to investment activities thus includes the capitalization of development expenses totaling €2,575,000 for financial year 2017, €1,896,000 for financial year 2016, and €1,456,000 for financial year 2015. These sums represent 93% of the cash flows from investment activities in 2017, 85% in 2016, and 76% in 2015.

The acquisition of all MS State assets was recognized under acquisitions of concessions, patents and similar rights in 2016.

Acquisitions of property, plant and equipment under leasing agreements are broken down above in Section 10.1.5 of this Registration Document.

Investments in tangible assets mainly correspond to office and computer facilities and equipment.

10.2.3 Cash flow associated with financing activities

The Group has made several capital increases since its creation in 2003 (see Section 10.1.1), and has received loans from BPI France, BNP Paribas, Oseo and Coface (see Section 10.1.2).

The cash flow associated with financing transactions over the past three financial years are shown below:

Operations (€000s)	Financial year 2015	Financial year 2016	Financial year 2017

Capital increase	8,905	30	134

Net cash flow from financing activities	8,762	262	517
Loan repayments	(143)	(247)	(474)
Loan issues	-	479	857

The capital increase of €8,905,000 posted in 2015 corresponds to the Group's listing on the Euronext Growth market in June 2015. This listing resulted in the issuance of 962,500 shares at a par value of €0.10, plus an issuance premium of €10.40 each. The final amount of this capital increase was set at €10,106,000. Capital increase expenses, charged to the issuance premium, totalled €1,201,000.

The capital increases recorded in 2016 and 2017 resulted from the exercise of stock warrants and options granted in 2012 and founders' warrants granted in 2014. These instruments are detailed in section 21.1.4 of this Registration Document.

Loan issues posted in 2017 consisted mainly of a new zero-interest loan of €850,000 contracted from BPI France and described in detail in Sections 10.1.4 above and 10.3 below. The principal loan repayments posted in 2017 relate to the €700,000 OSEO loan contracted in 2013 and the BNP Paribas loan of €300,000 contracted in 2016 to finance office renovation.

Borrowings posted in 2016 consisted mainly of a new loan of €300,000 contracted from BNP Paribas to finance office renovation, as well as two loans of €108,000 and €72,000 contracted from BNP Paribas and BPI France, respectively, to finance the acquisition of MLstate, described in Section 10.1.4 above and 10.3 below. The principal loan repayments posted in 2016 are the repayment of €75,000 for the OSEO loan of €700,000 contracted in 2013, and the initial repayment installments for the loans contracted in 2016.

The Group did not record a new issue of debt in 2015. The principal loan repayment in this financial year concerns the loan of €400,000 at 4.52% to finance international commercial development, contracted in April 2010 from Oseo and repayable by 20 quarterly installments, the last of which was paid in January 2016.

10.3 Information on the terms and conditions of borrowing and the financing structure

The terms and conditions of borrowing for the main loans outstanding as of the date of this Registration Document, described in Section 10.1.4 above, are as follows:

Zero-interest loan for innovation totaling €700,000 contracted in 2013 from Oseo and due for repayment on March 31, 2020:
o Payment: all the funds were made available in one installment.
o Rate: 0%
o Repayment schedule: the term of the loan includes a grace period followed by straight-line repayment, with the first repayment due in arrears on June 30, 2016.
o Repayment: linear, by 16 equal quarterly installments payable in arrears at the end of March, June, September and December of each year.
o As of December 31, 2017, this loan appears in the Group's financial statements in the amount of €487,000.
Loan totalling €300,000 contracted in 2016 from BNP Paribas and due for repayment on March 29, 2021:
o Payment: all the funds were made available in one installment.
o Rate: 0.960%
o Repayment schedule: the term of the loan is 60 months, with a first repayment due on the day of the month following the loan execution date, i.e. on April 29, 2016.
o Repayment: linear, by 60 equal monthly installments payable in arrears on the 29th of each month of the year.
o As of December 31, 2017, this loan was shown on the Group's financial statements in the amount of €197,000.
Loan totalling €108,000 contracted in 2016 from BNP Paribas and due for repayment on August 30, 2022:
o Payment: all the funds were made available in one installment.
o Rate: 1.200%
o Repayment schedule: the loan term is 72 months with a first repayment due on the day of the month following the loan execution date, i.e. September 30, 2016.
o Repayment: linear, by 72 equal monthly installments payable in arrears on the 30th of each month of the year.
o As of December 31, 2017, this loan was shown on the Group's financial statements in the amount of €85,000.
Loan totalling €72,000, contracted in 2016 from BPI France Financement and due for repayment on October 30, 2022:
o Payment: all the funds were made available in one installment.
o Rate: 2.99%
o Repayment schedule: the term of the loan includes a grace period followed by a straight-line repayment period, with the first repayment due in arrears on July 30, 2018.
o Repayment: linear, by 18 equal quarterly installments payable in arrears at the end of April, July, October and January of each year.
o As of December 31, 2017, this loan was shown in the Group's financial statements in the amount of €72,000.
Zero-interest loan for innovation totaling €850,000 contracted in 2017 from BPI France Financement and due for repayment on December 31, 2023.
o Payment: all the funds were made available in one installment.
o Rate: 0%
o Repayment schedule: the term of the loan includes a grace period followed by a straight-line repayment period, with the first repayment due in arrears on July 30, 2018.
o Repayment: linear, by 20 equal quarterly installments payable in arrears at the end of March, June, September and December of each year.
o As of December 31, 2017, this loan was shown on the Group's financial statements in the amount of €850,000.

In arranging these borrowings, the Group made statements, guarantees and undertakings to the banks that are usual for this type of financing, particularly with regard to its legal and financial situation (no provision being made for financial ratios), as well as restructuring, acquisitions, asset disposals, payment incidents and collective proceedings.

10.4 Restriction on the use of the loan capital

None

10.5 Sources of financing

In 2017, the Group's business momentum and the technology and HR investments made in recent years allowed it to generate cash flow from operating activities of €3,380,000. This covered the Group's loan repayments (€474,000) and cash flow used in investing activities (€2,855,000), mainly in R&D. As a result of new bank financing arranged during the year, the Group's cash and investment securities rose by €1,043,000 over the year to nearly €7 million at December 31, 2017.The Group has €200,000 available in authorized overdraft lines at BNP.

Cash, net of financial debt, increased by €665,000 to reach €5,031,000 at the end of 2017. Thanks to this position, along with shareholders' equity of €7,974,000, the Group has a solid financial position that will allow it to make the main future investments outlined in Section 5.2.3 of this Registration Document and to honor its commitments, particularly its lease agreements as outlined in Section 8.1 of this document, and to make a targeted portion of its main future investments outlined in Section 5.2.3 of this document. The planned fund-raising will allow it to complete its entire strategic plan as outlined in Section 6.5.

If market conditions do not permit the planned capital increase, the Group will consider the following alternatives: (i) search for new investors in connection with a private placement, (ii) bank financing, (iii) self-financing on a more targeted development basis, or (iv) refinancing through the Group's financial shareholders without inviting new investors. As of the date of this Registration Document, no such decision had been made.

11. INNOVATION, PATENTS, LICENCES, TRADEMARKS AND DOMAIN NAMES

11.1 Innovation policy

The research & development policy begins with technology monitoring. For effective and permanent monitoring, the Group has placed itself at the core of the digital innovation ecosystem in France, particularly through substantial investment in France's leading competitiveness cluster, Systematic Paris-Regions. Jean-Noël de Galzain is a member of Systematic's Executive Committee and is Vice-President, SMEs.

Regular attendance at the meetings of the various Thematic Groups, and in particular at the CN&S GT's collaborative project emergence sessions, enables the Group to keep abreast of emerging technologies and upstream research projects, to meet startups and organize presentation sessions for our innovative technology teams, and enables us to maintain close links with various laboratories, in particular CEA LIST and INRIA.

For the Group, this active technology monitoring policy means taking part in collaborative innovation projects, which are mainly used to test emerging technologies or to develop functionality models which represent technological obstacles and/or differentiation factors.

Thanks to the monitoring and innovation, which lead to applied research and development works, we are able to add innovative functionalities to the Group's software solutions by industrializing and scaling up the codes developed in pilot format to overcome identified technological obstacles. Note that occasionally the solutions found for making the models cannot be industrialized or do not support the load required in actual operation, whence the need to find new solutions through new phases of pure research.

Since 2015, WALLIX has been taking part in such collaborative research projects, often as project owner. Particular examples include:

The Resilience project, led by NEXEDI, in which WALLIX acted as partner and which led to the development of a model of a log collection product to be rolled out dynamically in a secure and redundant public Cloud.
The SEED4C project, a European project, the French leader of which was Alcatel-Lucent. WALLIX has developed a WAB pilot that can be rolled out in a secure public or private Cloud using adapted hardware resources (Secure Elements).
The HUMA project, in partnership particularly with the French digital science and technology research body INRIA. With Big Data and the multiplication of hardware, software and services, log analysis has become a major challenge for IT security. HuMa is an abstraction language-based software solution for analyzing large volumes of heterogeneous logs and identifying security related problems.
The ANBLIC project, led by WALLIX. The ANBLIC project will demonstrate the effectiveness, on a large scale, of blind processing which consists in encrypting data in such a way as that it is possible to do research, create statistics, and even data analysis, without the need to decrypt the data. This means that all the foregoing operations can be performed by cloud servers without fear of revealing our data in the event of a breach by hackers.
The FENTEC project, a European H2020 project concerning functional encryption (or FE). This process was recently introduced as a new paradigm for encryption systems to overcome the "all or nothing" limitations of classic encryption.

11.2 Protection of intellectual property

The Group protects its intangible assets through a combination of various intellectual property rights, especially in terms of copyright, patents, trademarks and know-how.

11.2.1 Patents and patent applications, Nature and coverage of patents

As far as possible, the Group protects the essential functionality of its software programs through patents, whenever the various requirements for patent protection are fulfilled. The Group has filed several patent applications with the Institut National de la Propriété Industrielle (INPI, the French patent and trademark office) and, on the basis of these national applications, has also filed for international extensions (PCT filing).

Evolution des brevets depuis 2015	Changes in patents since 2015
2015	2015
Brevets déposés	Patents filed
2018-04-26	2018-04-26
Brevets Publiés	Patents registered

In 2015, WALLIX filed its first patent with the INPI. Since then, investment in research and development has allowed WALLIX to markedly expand its patent portfolio, as the graphic above illustrates. Currently, WALLIX has a total of eight filings pending, three patents have been registered, and two of them have been officially issued in France by the INPI:

(i) The patent entitled Transfert sécurisé d'information d'authentification (secure transfer of authentication information) was registered on September 9, 2016 under number FR 30/33434 and was issued on February 17, 2017; and

(ii) The patent entitled Procédé de connexion sécurisé, depuis un équipement informatique client, à une ressource informatique (secure connection process, from a client IT equipment to an IT resource) was registered on March 24, 2017 under number FR 15/58890 and was issued on October 6, 2017.

The first invention presents a secure connection to an application run on a server from a client IT hardware by a user who does not have authentication data for the account declared in the said application.

The second patent seeks to protect the process that allows a system and network administrator to administer an application by using an administration fat client without the need for further authentication so long as the administrator has already authenticated him/herself on Bastion.

A third patent, entitled Procédé d'alimentation automatique d'un proxy de connexion sécurisée (process for the automatic population of a secure connection proxy) was registered on January 25, under number WO/2018015681. Based on privileged account data, this invention, thanks to various stages, enables the automatic population of a secure connection proxy to remote targets.

Other patents are pending with the competent Industrial Property Offices.

11.2.2 Patents currently in use

None.

11.2.3 Protected territories

The Group does not restrict itself to the national protection of its patents and intends to cover other territories, primarily those in which its main customers are located and in which it has business operations.

11.2.4 Other items of intellectual property

11.2.4.1Software

The source code of the Group's various software programs is protected by a third-party custodian. In this respect, and no later than within three (3) months of their general availability, the major versions of WALLIX software programs are deposited with the Agency for the Protection of Programs ("APP"). The filiation of the successive versions of the deposited software programs is handled by the APP through an Inter Deposit Digital Number ("IDDN") associated with each deposit. With regard to the filing of "minor" versions of the Group's various software programs, these have also been filed with the APP, albeit less frequently than the major versions, which are more systematic.

These successive deposits at regular intervals enable the Group to provide its handful of customers benefiting from a source access clause with access to the most recent versions of its software programs in escrow. These access clauses are granted under very strict conditions, particularly if the Group goes into liquidation or ceases trading, so that, in such event, its handful of customers will be able to continue enjoying their right to limited use of the deposited software programs.

11.2.4.2Trademarks, domains and know-how

The semi-figurative "WALLIX" trademark and all the territories designated, will be renewed at the latest in 2019 before the relevant Offices (the French Institut National de la Propriété Industrielle "INPI" and the European Union Intellectual Property Office "EUIPO"). The Group already prepares the renewal of its trademark registrations by anticipating the legal steps necessary to this end. Below is a summary table of the portfolio of trademarks held by the Group in different countries:

MARQUE	SOCIETE DEPOSITAIRE	NUMERO	STATUT	DATE DE DEPOT	ECHEANCE	TERRITOIRES	CLASSES
Data Peps	WALLIX SARL	4421757	ENREGISTREE	22-01-2018	22-01-2028	FRANCE	9, 16, 35, 41, 42, 45
$\blacksquare$ W $\lhd$ LLiX	WALLIX SARL	3629864	ENREGISTREE	13-02-2009	13-02-2019	FRANCE	9, 35, 37, 38, 39, 41, 42, 45
L W ⊲ LLIX	WALLIX SARL	8486557	ENREGISTREE	12-08-2009	12-08-2019	UNION EUROPEENNE	9, 35, 39, 42, 45
$\blacksquare$ W $\triangleleft$ LLiX	WALLIX SARL	3949744	ABANDONNEE	12-08-2009	$01 - 12 - 2017*$	ETATS-UNIS	9, 35, 39, 42, 45

MARQUE	TRADEMARK
SOCIETE DEPOSITAIRE	FILING COMPANY
NUMERO	NUMBER
STATUT	STATUS
DATE DE DEPOT	FILING DATE
ECHEANCE	EXPIRY
TERRITOIRES	COUNTRIES
ENREGISTREE	REGISTERED
FRANCE	FRANCE
UNION EUROPEENNE	EUROPEAN UNION
ETATS-UNIS	UNITED STATES
*Date de l'abandon de la marque	*Date trademark abandoned

Regarding the protection of the American WALLIX trademark, such national protection is conferred under U.S. federal law, which significantly differs from European and international legislations in requiring a Declaration of use in commerce. This Declaration is required upon the 6th anniversary of the trademark and the United States Patent and Trademark Office ("USPTO") requires from the right holder the production of relevant specimen showing the use of the trademark in the commerce in connection with each class of goods and/or services within the American territory. In 2017, the Group deliberately decided not to submit the said specimen to the USPTO, estimating there was a high chance that the Office would reject them for material alteration. This decision was made on one hand in light of the Group's study of multiple precedents rendered by the USPTO regarding this matter, and on the other hand according to the advice of its own industrial property attorney. Fully aware of the impact of this decision, the Group has developed in the meantime a strategy to remedy this abandonment but also to seize the opportunity to expand the geographical coverage of its trademark protection.

In 2018, the Group also broadened its trademark portfolio by filing on its own the semi-figurative French trademark "DataPeps" with the INPI in six products and services classes (9, 16, 35, 41, 42, and 45). This application was published in the BOPI (the Bulletin Officiel de la Propriété Industrielle, INPI's official gazette for patents) on February 16, 2018. At the registration date of this Reference Document, no prior right holder has filed for opposition, which might have resulted in rejection of its trademark application, as the imperative deadline of 2 months to file for opposition expired on April 16, 2018. This national trademark application will serve as the basis of the Group's will to file for international and European extension within the priority period granted by International Treaties in this matter. This extension of trademark protection to countries other than solely France is a must for the Group in order to ensure an effective protection of its rights in essential regions where it already operates or intends to operate in the future.

Domains:

The Group holds more than fifty domain names. The portfolio of domain names requires active management, which means that the Group closely monitors the renewal dates.

The Group also retains the right to take advantage of the Trademark Clearing House, a service that enables it to benefit (i) from a priority registration phase for the purpose of booking domain names prior to the opening of any new personalized generic extension and (ii) from a notification in the event of reservation by a third party of domain names likely to be of interest to the Group.

Furthermore, the Group is currently performing the necessary formalities with its registration office to update the domain names that it holds legally pursuant to disposal agreements in its favor.

11.2.4.3Disputes

None.

12. TRENDS

12.1 Main trends since the end of the financial year ended December 31, 2017

During the International Cybersecurity Forum which took place from January 23 to 24, 2018, the Group unveiled its new WALLIX Discovery module for the vulnerability analysis of dormant or unidentified privilege accounts

On March 23, 2018, WALLIX launched its WALLIX DataPeps range of products (see Chapter 6 of this Registration Document). WALLIX DataPeps, an end-to-end encryption platform that helps secure data.

On April 3, 2018, the Group announced the signing of a partnership agreement with Bertin IT (CNIM Group) and the launch of CryptoCrossinG®, combining WALLIX DataPeps® encryption technology with CrossinG®, the new generation trusted gateway designed by Bertin IT.

12.2 Known trend, uncertainty, commitment request or event reasonably likely to influence the Group's outlook

The Group's activity is buoyed by a regulatory environment conducive to its business operations, both in France and at European level:

The Directive on the security of network and information systems (EU) 2016/1148 or the NIS (Network & Information Security) Directive1 , adopted on July 6, 2016 and due to be transposed into national laws no later than May 9, 2018, seeks in particular to establish "security and notification requirements for operators of essential services and for digital service providers" (Article 1). These measures concern the prevention of incidents and notification of them to the competent authorities which have a power to control and audit the measures introduced;
The General Data Protection Regulation no. 2016/679 of April 14, 2016 and directly applicable starting on May 25, 2018 lays down obligations for organizations in terms of the security of infrastructures and the protection of their contents, especially with respect to the personal data that they host. In this way, the GDPR obliges companies and organizations to update the mechanisms set up to protect third-party personal data (employees, customer, etc.) to ensure control and traceability of the use of such data.

Compliance with these two regulations involves privilege access management, which supports the Group's revenue stream.

Furthermore, the Group will expand its geographical scope. The major international growth zones include:

Germany, Austria, Switzerland and Central and Eastern Europe;
The Middle East and Africa.

In terms of distribution, the Group will continue, in future years, to forge partnerships with the entire Cyber Security ecosystem, especially in the following areas:

Access management;
Identity management;

¹ (EU) Directive 2016/1148 of the European Parliament and of the Council of July 6, 2016 concerning measures for a high common level of security of network and information systems across the Union.

• Protection of sensitive data.

WALLIX also plans to enter into partnerships in which its technology might be included as a white label in third-party solutions, and conversely where it might be possible for the Group to include thirdparty technologies to increase its functional scope or address specific markets (countries or sectors).

12.3 Objectives at 2021

On March 28, 2018, the Group issued the press release detailing its objectives to 2021:

2021 AMBITION: TO COMBINE STRONG INTERNATIONAL EXPANSION WITH FUTURE PROFITABILITY

The management of WALLIX has created a new strategic plan in order to facilitate the change of scale and to guide the Group through the period from 2018 to 2021.

The aim of the new plan is to transform WALLIX from a European expert in Privileged Access Management (or PAM) into a developer of world class cyber-security software. While maintaining its leadership in PAM, WALLIX intends to increase its assistance to companies and organizations in protecting their digital assets, particularly by taking advantage of the opportunities offered by their obligation to comply with the new European regulations that come into effect in May 2018 (the NIS Directive and the General Data Protection Regulation, or GDPR).

This new road map will be executed by implementing three development drivers, namely to:

Develop and market new trust-based solutions, complementary to WALLIX BASTION, in order to expand its market in the sector of Cloud Based Security Services distributed in SaaS (Software as a Service) mode. In this connection, on March 23, 2018, WALLIX announced the launch of DataPeps, an end-to-end data encryption platform used for data security;
Extend the international presence of WALLIX on the PAM market with strong acceleration in the DACH zone (Germany, Austria and Switzerland) and in North America. This ambition will entail the opening of new sales offices in these priority zones and increasing the coverage provided by the network of partner integrators/resellers;
Forge strategic alliances with other industry and digital players in order to propose bundled offers and new cyber-security solutions adapted to the protection of operational technology (OT), to the identities management market, the Cloud, IoT, data repositories and Artificial Intelligence.

WALLIX plans on becoming, by 2021, a mid-cap cyber-security company (ETI)1 with 250 employees on its payroll, turnover in excess of €50 million, and a double digit operating margin2 . These objectives will be achieved mainly through organic growth.

Operating income will be the indicator used to measure the profitability mentioned.

¹ An Entreprise de Taille Intermédiaire (literally an intermediate size business)

² Operating revenue / Turnover

FUND RAISING PLANNED BEFORE THE SUMMER OF 2018

Depending on market conditions and subject to approval of the offering prospectus by the AMF (the French financial markets authority), WALLIX plans to complete this transaction before the summer of 2018 by way of a public offer with the suppression of pre-emptive rights but with a priority subscription period granted to the shareholders.

English free translation of the French-language 2017 Reference Document – not binding, for information purposes only

13. PROFITS FORECASTS OR ESTIMATES

The Group does not intend to issue profit forecasts or estimates.

14. ADMINISTRATIVE, MANAGEMENT AND SUPERVISORY BODIES AND EXECUTIVE MANAGEMENT

14.1 Executives and members of the Supervisory Board

WALLIX GROUP is a joint stock company with a Management Board and Supervisory Board, operating in accordance with the articles of association as described in Chapter 16 and Section 21.2 of this Registration Document.

The Group is managed by Jean-Noël de Galzain in his capacity as Chairman of the Management Board, and by Amaury Rosset and Didier Lesteven in their capacity as members of the Management Board.

14.1.1 Composition of the Management Board and the Supervisory Board

At the date of this Registration Document, the Company's Management Board and Supervisory Board were composed as follows:

Name	Position held	Principal role in the Group	Principal role outside the Group	Date of start and end of term of office
Jean-Noël de Galzain	Chairman of the Management Board	Chairman	n/a	First appointed as Chairman on: October 21, 2011 Reappointed on: May 26, 2017 Term of office: 3 years.
Amaury Rosset	Member of the Management Board	Chief Financial Officer	n/a	First appointed on: October 21, 2011 Reappointed on: May 26, 2017 Term of office: 3 years.
Didier Lesteven	Member of the Management Board	Chief Operating Officer	n/a	First appointed on: March 30, 2017 Reappointed on: May 26, 2017 Term of office: 3 years.

• Management Board:

• Supervisory Board

Name	Position held	Principal role in the Group	Principal role outside the Group	Date of start and end of term of office
Jacques Chatain	Chairman of the Board and Chairman of the Compensatio n Committee	n/a	Chairman of the Management Board of Auriga Partners	First appointed as Chairman of the Board on: March 30, 2017 First appointed as member of the Board on: June 12, 2014 Reappointed on: AGM of June 1, 2017 Term of office expires: following the Annual General Meeting held in 2020 to approve the financial statements for the previous financial year
Pierre-Yves Dargaud	Deputy Chairman	n/a	Chairman of AP Management	First appointed as Deputy Chairman of the Board on: March 30, 2017 Date of first appointment as a member of the Board (co-opted by the Board meeting of March 30, 2017 to replace the company Access2Net, which resigned): ratified by the AGM of June 1, 2017 Term of office expires: following the Annual General Meeting held in 2020 to approve the financial statements for the previous financial year
TDH represented by Thierry Dassault	Member of the Board and member of the Compensatio n Committee	n/a	Deputy Chief Executive Officer of Groupe Industriel Marcel Dassault	First appointed on: October 21, 2011 Reappointed on: AGM of June 1, 2017 Term of office expires: following the Annual General Meeting held in 2020 to approve the financial statements for the previous financial year
Jean-Pierre Brulard	Independent member (see section 16.3.1 of this document)	n/a	Senior Vice President & General Manager EMEA of VMware (Dell Company)	Co-opted by the Board meeting of July 6, 2017 to replace the company Auriga Partners, which resigned. Term of office expires: following the AGM held in 2018 to approve the financial statements for the previous financial year. The 2018 Annual General Meeting will be asked to ratify the co-option of Jean Pierre Brulard and to reappoint him.

The members of the Supervisory Board have as their business address the registered office of the Company.

14.1.2 Other corporate appointments
Other current appointments:

Name	Type of appointment	Company
Jean-Noël de	Director	Revital Emploi (Association)
Galzain	Member and Deputy Chairman	System@tic competitiveness center
	Director	Auriga Initiatives
	Chairman	Hexatrust (Association)
	Member of the Board of Governors	Telecom ParisTech
	Member of the Supervisory Board	Scientipôle Capital
	General Manager	JINCO INVEST
Amaury Rosset	n/a	n/a
Didier Lesteven	Chairman of the Board of Directors	NETEVEN
	Director	Compario
	Sole shareholder	DLC&S
Jacques Chatain	Chairman of the Management Board	Auriga Partners SA
	Representing Auriga Partners as	Miliboo*
	director

Thierry	Non-voting director	Gaumont SA*
Dassault	Non-voting director	Immobilière Dassault
	Director and Chairman of the Board	Dassault Immobilier Canada Inc.
	of Directors
	Director	Artcurial SA
	Director	Gstaad Palace SA
Pierre-Yves	Chairman of the Management Board	Access2Net
Dargaud	Chairman	AP Management
	Director	Beqom


	as representative of Access2Net
	Director	Sidetrade*
	Member of the Supervisory Board	WALLIX GROUP*
Jean-Pierre	General Manager	SCI du 5 rue Rapin
Brulard

* Listed company

• Previous appointments held in the last five years:

Name	Type of appointment	Company
Jean-Noël de	Director	Polinvest (NGO)
Galzain
Amaury Rosset	n/a	n/a

Didier Lesteven	Chairman of the Supervisory Board	WALLIX GROUP*
	Chairman of the Board of Directors	Stantum SA
	Chairman of the Board of Directors	Total Immersion SA
	Chairman of the Board of Directors	New Media Plus

	Chairman of the Board of Directors	Crédit Mutuel de Draveil
	Director	Crédit Mutuel de Draveil

Jacques Chatain	Deputy Chairman of the Supervisory Board	WALLIX GROUP*
	Representing Auriga Partners as director	Availpro

Thierry	Member of the Board of Directors	Gaumont SA*
Dassault

Pierre-Yves	Vice-Chairman of the Supervisory Board	Navigaia
Dargaud	Director representing Access2Net	Sidetrade*

	As representative of Access2Net:
	Member of the Supervisory Board	WALLIX GROUP*
Jean-Pierre	n/a	n/a
Brulard

* Listed company

14.1.3 Biographies of the members of corporate bodies

Biographies of the members of the Management Board and of the Supervisory Board:

• Jean-Noël de Galzain – Founder and Chairman of the Management Board, French, 46

After starting out in audiovisual production with cultural content (documentaries, historical drama) and multimedia publishing, Jean-Noël de Galzain became project leader and then IT manager of the Santé CLIHOP & Medinweb portals. In 1999, he took over a service company in order to set up Aurora, which swiftly became one of the leading French specialists in open-source software. The company was sold in 2003 to Groupe Business & Décisions. He founded the WALLIX GROUP and has led the Company since October 2003. He holds a degree in Mathematics and Economics from the University of Paris X Nanterre.

• Amaury Rosset – Member of the Management Board and Chief Financial Officer, French, 47

Amaury Rosset is head of the administrative and financial sides of the business. Prior to Wallix, he worked for Hachette Filipacchi Medias from 1995 to 1999, where he successively held the posts of management controller, Asia Pacific project leader (in Hong Kong) and head of the Group's Hong Kong and Chinese publishing division. In 2000, he became involved in the creation and subsequent development of a multimedia communication agency, XLAB. He co-founded WALLIX GROUP in October 2003. He holds a degree in Economics and Management from Euromed-Marseille Business School (ESCMP). Amaury Rosset has 15 years of experience as an entrepreneur.

• Didier Lesteven – Chairman of the Supervisory Board, French, 58

Didier Lesteven began his career at Hewlett Packard, before going on to hold management and executive posts with companies in the IT sector: Cipcom Corporation (Ethernet network equipment) as Chief Executive Officer France, Sterling Commerce (software publisher) as International Vice President, Infovista (software publisher) as Chairman and Chief Executive Officer, Medialive (protection of digital audiovisual content) as Chairman and Chief Executive Officer, Global SP (cloud computing) as Chief Executive Officer, and finally Total Immersion (augmented reality and 3D solutions) as Chairman and Chief Executive Officer. Didier Lesteven joined the Supervisory Board of WALLIX GROUP in 2011 and served as its Chairman until 2017. In April 2017, he became the company's Chief Operating Officer, in charge of developing Bastion.

• Jacques Chatain – Chairman of the Supervisory Board, French, 65

Jacques Chatain worked for Groupe IDI in various financial and administrative roles between 1975 and 1998. During this time, he was also an investor in, and company secretary of, Finovelec (a venture capital firm). In 1998 he co-founded Auriga Partners, where he is now Chairman of the Management Board. He is behind numerous investments in the funds managed by Auriga in the IT sector. He is also in charge of investor relations and public relations at Auriga Partners. He is a graduate of the Business School at the Paris Chamber of Commerce and Industry.

• Pierre-Yves Dargaud – Deputy Chairman of the Supervisory Board, French, 53

Coming from a financial background, Pierre-Yves Dargaud began his career in management control and financial management in the IT services sector. He went on to hold senior management positions at MJ Informatique, a holding company for firms active in software publishing, IT services, training and distribution. In 1992, Mr. Dargaud founded Euro Fi Conseils, an M&A consultancy specializing in the IT services sector, before joining Groupe Apax Partners in mid-1999, where he was responsible for the IT sector. From mid-2000 onwards, Mr. Dargaud served as Chairman of Access2Net, a fund specializing in enterprise software. In early 2003, he founded AP Management to advise IT companies on acquisitions and equity structuring. Pierre-Yves Dargaud represented Access2Net as a member of the Supervisory Board of WALLIX GROUP from 2011 to 2017. He holds a Master's degree in Management and a Postgraduate Diploma in Financial Management from ESC Lyon.

• Thierry Dassault, permanent representative of the company TDH – Member of the Supervisory Board, French, 61

Thierry Dassault began his career in media and multimedia, notably serving as Chairman of Dassault Multimédia until 2006. Following the creation of the holding company TDH in October 2006, he built up equity investments in companies of various sizes across a wide range of sectors, including Aquarelle.com (online flower delivery), Bernadaud (porcelain manufacturer), Halys, OpenTrust (digital identity and transaction security), which he founded, and YouScribe (platform for publishing, sharing and selling digital documents).

• Jean-Pierre Brulard – Member of the Supervisory Board, French, 59

Jean-Pierre Brulard has over 25 years' experience working for global technology powerhouses such as IBM, Sun Microsystems and Unisys. During his seven years at Business Objects, his responsibilities ranged from General Manager France to Senior Vice-President and General Manager EMEA. He left Business Objects after overseeing the acquisition of SAP. In 2009, he joined VMware as Vice President Southern Region, EMEA, in charge of development and growth in France, Italy, Spain, Turkey, South Africa and the Middle East. He is now Senior Vice President and General Manager EMEA, in charge of VMware's strategy and operations in the Europe, Middle East and Asia region. Jean-Pierre Brulard holds a Master's degree from the Le Havre Graduate Business School.

14.2 Executive management

The Management Board is responsible for the Company's executive management.

14.3 Statements concerning the Company's administrative and management bodies

To the best of the Company's knowledge and at the filing date of this Registration Document, members of the Management Board and Supervisory Board have no conflict of interest between their obligations towards the Group and their private interests and/or other obligations, as described in Section 14.1 above.

To the best of the Company's knowledge and at the filing date of this Registration Document, there is no arrangement or contract with major shareholders, customers, suppliers or others under which any member of the Company's Management Board or Supervisory Board was appointed.

To the best of the Company's knowledge and at the filing date of this Registration Document, there is no restriction accepted by the persons referred to in Section 14.1 "Managers and members of the Supervisory Board" of this Registration Document concerning the disposal of their shareholding in the Company.

To the best of the Company's knowledge and at the filing date of this Registration Document, no member of the Management Board or Supervisory Board has in the last five years been convicted of fraud, been placed in bankruptcy, receivership and/or liquidation, been charged or publicly sanctioned by a statutory or regulatory authority (including designated professional bodies), or been barred by a court from acting as a member of an administrative, management or supervisory body or from participating in the management or governance of an issuer.

Furthermore, to the best of the Company's knowledge and at the time of preparation of this document, no family relationship exists between the members of the Management Board and the members of the Supervisory Board.

14.4 Supervisory Board's report on corporate governance

In accordance with Article L225-68 of the French Commercial Code, the Supervisory Board has prepared the following report on corporate governance.

14.4.1 List of all appointments and positions held in any company by each of the corporate officers during the financial year

Please refer to Section 14.1.1 of this document.

14.4.2 Agreements between a corporate officer or shareholder holding more than 10% of the voting rights and a subsidiary (excluding standard contracts)

Didier Lesteven, member of the Management Board of WALLIX GROUP (since March 30, 2017), has a contract of employment with WALLIX SARL as Chief Operating Officer since April 3, 2017. In this capacity, he received gross fixed compensation for 2017 of €97,500 and gross variable compensation of €55,305.

14.4.3 Summary of current delegations of authority granted by the Annual General Meeting for capital increases

Please refer to Section 21.1.5 of this document.

14.4.4 Supervisory Board's comments on the Management Board report and financial statements for the year

At its meeting on March 28, 2018, the Supervisory Board reviewed the Group's consolidated financial statements and the Company's corporate accounts prepared in accordance with French GAAP for the year ended December 31, 2017.

The Board has reviewed the main items of the statement of financial position and the income statement, and has heard the Statutory Auditor.

The Board has also taken note of the Management Board's report for the year ended December 31, 2017.

Having carried out the necessary checks, the Supervisory Board informs the shareholders that it has no particular observations to make on the report of the Management Board, on the Group's consolidated financial statements and on the Company's corporate accounts audited by the Statutory Auditor, as presented to you.

Furthermore, the Board has considered the proposals for resolutions to be put to the Annual General Meeting convened to approve the financial statements for the year ended December 31, 2017, and asks that you adopt these resolutions to enable the Management Board to implement its strategy.

In accordance with legal requirements and apart from reviewing the annual financial statements and the report of the Management Board on which it has just commented, the Supervisory Board receives regular updates from the Management Board on the Company's performance. It authorizes major investments, the constitution of sureties, the partial or total disposal of shareholdings and of assets and rights in real estate.

Independently of these tasks, the main deliberations of the Supervisory Board since the last Annual General Meeting have concerned:

the quarterly financial statements;
the half-yearly financial statements;
the progress of the business plan;
the budget for the 2018 financial year;
major investment projects, including the review of international investments, advances in product development, and investments in marketing (visibility, brand, etc.);
the compensation policy for members of the Management Board;
the authorization given to the Management Board to award bonus shares of the company to Group employees and to the Company's corporate officers.

We have no further comments to make.

Paris, March 28, 2018.

Supervisory Board

15. COMPENSATION AND BENEFITS

15.1 Compensation for members of the Management Board and the Supervisory Board

For the last three financial years the Company has been incorporated in the form of a société anonyme à Directoire et Conseil de surveillance (a joint stock company with a Management Board and Supervisory Board).

The compensation indicated below includes compensation due from, or paid by, all the companies of the Group:

• Table 1: Summary of the compensation and of the options and shares awarded to each executive corporate officer

In €	2015 financial year	2016 financial year	2017 financial year
Jean-Noël de Galzain – Chairman
Compensation due for the period	189,783	165,000	238,500
Value of multi-annual variable compensation awarded during the financial year	-	-	-
Value of options, stock warrants and founders' warrants granted during the financial year	-	-	-
Value of shares awarded free of charge in respect of the financial year (3) (on the basis of the opening price of €15.70 on 7/6/2017)	-	-	344,945
Total	189,783	165,000	583,445
Amaury Rosset – Member of the Management Board and Chief Financial Officer
Compensation due for the period	152,106	146,250	184,563

Total	152,106	146,250	385,680
Value of shares awarded free of charge in respect of the financial year (3) (on the basis of the opening price of €15.70 on 7/6/2017)	-	-	201,117
Value of options, stock warrants and founders' warrants granted during the financial year	-	-	-
Value of multi-annual variable compensation awarded during the financial year	-	-	-
Compensation due for the period	152,106	146,250	184,563

Dominique Meurisse (1) – Member of the Management Board and Chief Operating Officer

Compensation due for the period	177,970	175,549	110,000
Value of multi-annual variable compensation awarded during the financial year	-	-	-
Value of options, stock warrants and founders' warrants granted during the financial year	-	-	-
Value of bonus shares awarded in respect of	-	-	-

the financial year (on the basis of the opening price of €15.70 on 7/6/2017)
Total	177,970	175,549	110,000
Didier Lesteven (2) – Member of the Management Board and Chief Operating Officer
Compensation due for the period	18,000	24,000	158,805
Value of multi-annual variable compensation	N/A	N/A	-
Value of options, stock warrants and founders' warrants granted during the financial year	N/A	N/A	-
Value of free shares awarded for the period (3) (on the basis of the opening price of €15.70 on 7/6/2017)	N/A	N/A	110,183
Total	18,000	24,000	268,988
TOTAL	537,859	510,799	1,348,113

(1) Resignation of a member of the Management Board in February 2017.

(2) Appointment as member of the Management Board in March 2017.

(3) On July 6, 2017, the Supervisory Board, under a scheme to award bonus shares to employees, managers and members of the Management Board, approved the plan for the award of 21,971 bonus shares to Jean-Noël de Galzain, 12,810 bonus shares to Amaury Rosset and 7,018 free shares to Didier Lesteven, contingent on the beneficiary still being with the Group and on the achievement of performance objectives relating to the consolidated turnover in 2017, which is not disclosed for reasons of confidentiality.

• Table 2: Summary of compensation for each executive corporate officer

The following tables show the compensation due to and received by members of the Management Board for the financial years ended December 31, 2015, 2016 and 2017.

In €	2015 financial year		2016 financial year		2017 financial year
Name	Amounts due (1)	Amounts paid (2)	Amounts Amounts due (1) paid (2)		Amounts due (1)	Amounts paid (2)
Jean-Noël de Galzain –	Chairman
Fixed compensation	120,000	120,000	135,000	135,000	180,000	180,000
Annual variable compensation (3)	41,783	39,000	30,000	41,783	58,500	30,000
Multi-annual variable compensation	-	-	-	-	-	-
Exceptional compensation (4)	28,000	28,000	-	-	-	-
Directors' fees	-	-	-	-	-	-
Benefits in kind	-		-		-	-
Total	189,783	187,000	165,000	176,783	238,500	210,000
Amaury Rosset –	Member of the Management Board and Chief Financial Officer
Fixed compensation	100,000	100,000	120,000	120,000	150,000	150,000
Annual variable compensation (3)	24,106	24,688	26,250	24,106	34,563	26,250

In €	2015 financial year		2016 financial year		2017 financial year
Name	Amounts due (1)	Amounts paid (2)	Amounts due (1)	Amounts paid (2)	Amounts due (1)	Amounts paid (2)
Multi-annual variable compensation	-		-	-	-	-
Exceptional compensation (4)	28,000	28,000	-	-	-	-
Directors' fees	-		-	-	-	-
Benefits in kind	-		-	-	-	-
Total	152,106	152,688	146,250	144,106	184,563	176,250

Dominique Meurisse (5) – Member of the Management Board and Chief Operating Officer

Total	177,970	174,000	175,549	177,970	110,000	102,217
Benefits in kind	-	-	-		-	-
Directors' fees	-	-	-		-	-
Exceptional compensation (4)	5,000	5,000	-		-	-
Multi-annual variable compensation	-	-	-		-	-
Annual variable compensation (3)	67,970	64,000	65,549	67,970	-	65,549
Fixed compensation	105,000	105,000	110,000	110,000	110,000	36,668

Didier Lesteven (6) – Member of the Management Board and Chief Operating Officer

TOTAL EXECUTIVES	537,859	531,688	510,799	522,859	691,868	591,967
Total	18,000	18,000	24,000	24,000	158,805	103,500
Benefits in kind	N/A	N/A	N/A	N/A	-	-
Directors' fees (7)	18,000	18,000	24,000	24,000	6,000	6,000
Exceptional compensation	N/A	N/A	N/A	N/A	-	-
Multi-annual variable compensation	N/A	N/A	N/A	N/A	-	-
Annual variable compensation (3)	N/A	N/A	N/A	N/A	55,305	-
Fixed compensation	N/A	N/A	N/A	N/A	97,500	97,500

(1) The amounts due are the amounts proposed by the Compensation Committee and approved by the Supervisory Board.

(2) The actual amounts paid depend on whether or not the criteria proposed by the Compensation Committee and approved by the Supervisory Board have been met.

(3) The terms of the award are not disclosed for confidentiality reasons. Jean-Noël de Galzain's annual variable compensation (€60,000 gross maximum for 2016 and 2017) is subject to two financial criteria – consolidated turnover (50%) and EBITDA* (25%) – and a specific technical criterion relating to the achievement of the product roadmap (25%). If the consolidated turnover criterion is less than 75% achieved, then the corresponding bonus will be zero; if higher than 75%, the bonus will be paid proportionately;

Amaury Rosset's variable compensation (€35,000 gross maximum for 2016 and 2017) is subject to three financial criteria: consolidated turnover (25%, on the same terms as Jean-Noël de Galzain), EBITDA* (37.5%) and cash flow (37.5%);

A part of Dominique Meurisse's variable compensation (€90,000 gross maximum for 2016 and 2017) is subject to two

financial criteria: billing** (75%) and EBITDA (25%). Since 2016, two other mechanisms have been in place: i) in the event of a sales contract being signed with a European manufacturer resulting in more than €1.8 million being billed** in 2016, Dominique Meurisse is entitled to an additional variable bonus equal to 1% of the 2016 net margin resulting from this contract; ii) if the WALLIX billing target is 100% achieved (€11.2 million for 2016), the commission due on surplus billing is accelerated, potentially leading to additional commission of €120,000;

Didier Lesteven's variable compensation (€75,000 gross maximum for 2017) is subject to two financial criteria: billing** (75%) and EBITDA* (25%).

* EBITDA means earnings before interest, taxes, depreciation, and amortization. It refers to the Group's pre-tax profit before interest, depreciation, amortization and provisions for capital assets are deducted (but after provisions for inventories and trade receivables). It shows the profit generated by the business, regardless of financing terms, tax constraints and equipment upgrades.

** The term "Billing" means the total amount of sales invoices issued to third parties during a given period in respect of the sales activity of the company and may differ from turnover, in particular because of the variation in prepaid income from one financial year to another..

(4) In July 2015, the Supervisory Board decided to award exceptional compensation of €28,000 to Jean-Noël de Galzain and Amaury Rosset and €5,000 to Dominique Meurisse, amounts that were disbursed in 2015, in recognition of the successful capital increases carried out on the Euronext Growth market on June 11 and July 16, 2015.

(5) Resignation of a member of the Management Board in February 2017.

(6) Appointed as member of the Management Board in March 2017 and an employee of WALLIX SARL since April 2017. Pro-rated amount in view of his employee status, on the basis of gross fixed annual compensation of €130,000.

(7) The directors' fees received by Didier Lesteven correspond to his term as Chairman of the Supervisory Board.

• Table 3: Directors' fees and other compensation received by non-executive directors

In €
Name	2015	2016	2017

Didier Lesteven (2) – Chairman of the Supervisory Board – Member of the Management Board

Total	18,000	39,000	119,800
Other compensation (1)	-	15,000	113,800
Supervisory Board members' fees	18,000	24,000	6,000

Jean-Pierre Brulard (3) – Member of the Supervisory Board

TOTAL		18,000	39,000	124,800
Total		N/A	N/A	5,000
Other compensation		N/A	N/A	-
Supervisory members' fees	Board	N/A	N/A	5,000

(1) The Group has signed a service contract with the company D.L.C&S, represented by Didier Lesteven. Under the terms of this contract, D.L.C&S provides the Group with independent cloud consulting. The fee for these services amounted to €15,000 in 2016 and €16,300 in 2017 (see Chapter 19 of this Registration Document). This contract ended in 2017. In addition, Mr. Lesteven received compensation of €97,500 in 2017 under the terms of his employment contract.

(2) Mr. Lesteven resigned as Chairman of the Supervisory Board on March 30, 2017 to join the Management Board.

(3) Jean-Pierre Brulard joined the Supervisory Board on July 6, 2017.

No other members of the Supervisory Board receive directors' fees.

• Table 4: Stock warrants or stock options awarded during the period to each executive corporate officer by the issuer and by any Group company

Not applicable.

• Table 5: Stock options for new or existing shares exercised during the year by each executive corporate officer

Not applicable.

• Table 6: Shares awarded free of charge to each officer by the issuer and by any Group company (list of names)

Name of executive director	Date of award (1) (2)	Number of shares awarded during the financial year	Valuation of the shares on the basis of the opening price of €15.70 on 7/6/2017	Vesting date	Availability date (end of holding period)	Performance criteria
Jean-Noël de Galzain –			Chairman of the Management Board
	July 6, 2017	21,971	344,945	July 6, 2018	July 6, 2019	(1)

Amaury Rosset –			Member of the Management Board
	July 6, 2017	11,610	182,277	July 6, 2018	July 6, 2019	(1)
	July 6, 2017	1,200	18,840	(3)	(3)	(3)

Didier Lesteven –			Member of the Management Board
	July 6, 2017	6,118	96,053	July 6, 2018	July 6, 2019	(1)
	July 6, 2017	900	14,130	(3)	(3)	(3)

TOTAL		41,799	656,244

(1) The awards of these shares to members of the Management Board are contingent on the presence of the beneficiary and subject to performance criteria relating to 2017 consolidated turnover. These criteria were established by the Management Board at its meeting on July 6, 2017 and are not disclosed for reasons of confidentiality. At its meeting on July 6, 2017, the Supervisory Board also decided that 10% of the bonus shares awarded to members of the Management Board should be held in registered form by each beneficiary for the duration of his or her term of office.
(2) Under the bonus share plan approved by the Combined Ordinary and Extraordinary General Meeting of June 3, 2016 and awarded by the Management Board on July 6, 2017, Amaury Rosset and Didier Lesteven may receive bonus shares on the same terms as employees who are beneficiaries. At its meeting on July 6, 2017, the Supervisory Board also decided that 10% of the bonus shares awarded to members of the Management Board should be held in registered form by each beneficiary for the duration of his or her term of office.
(3) 240 shares will vest on July 6, 2018 (provided that the beneficiary is still with the Group on that date). These must be held until July 6, 2019; 420 shares will vest on July 6, 2019 (provided that the beneficiary is still with the Group on that date). These shares are not subject to a holding period; 540 shares will vest on July 6, 2020 (provided that the beneficiary is still with the Group on that date). These shares are not subject to a holding period.
(4) 180 shares will vest on July 6, 2018 (provided that the beneficiary is still with the Group on that date). These must be held until July 6, 2019; 315 shares will vest on July 6, 2019 (provided that the beneficiary is still with the Group on that date). These shares are not subject to a holding period; 405 shares will vest on July 6, 2020 (provided that the beneficiary is still with the Group on that date). These shares are not subject to a holding period.
Table 7: Bonus shares that have vested for each executive director

Not applicable.

• Table 8: History of stock warrants, stock options, and founders' stock warrants awarded to corporate officers during the years ended December 31, 2015, 2016 and 2017

Please refer to the tables in Sections 21.1.4.1, 21.1.4.2 and 21.1.4.4 of this Registration Document.

• Table 9: Stock options, stock warrants and founders' stock warrants awarded to the leading ten employees who are not corporate officers and exercised by them during the last financial year

On September 21, 2017, Serge Adda exercised all 22,500 stock options granted to him on October 21, 2013.

Name	Date of award	Total number of options subscribed for	Weighted average price
Serge Adda –	Technical Director
	October 21, 2013		3.686

• Table 10: History of bonus share awards

Please refer to the table in Section 21.1.4.3 of this Registration Document.

• Table 11: Details of the compensation and other benefits granted to executive directors

Executive directors	Employment contract		Supplementary pension plan		Severance other result termination change of office	or benefits due or likely to become due as a of or	Non-compete compensation
	Yes	No	Yes	No	Yes	No	Yes	No
Jean-Noel de Galzain		X (1)	X (2)			X		X
Appointed on:		October 21, 2011
Reappointed on:	May 26, 2017
Term of office:	3 years
Amaury Rosset	X			X		X	X (3)
Appointed on: Reappointed on:	October 21, 2011 May 26, 2017
Term of office:	3 years
Didier Lesteven	X			X		X	X
Appointed on:	March 30, 2017
Reappointed on:	May 26, 2017
Term of office:	3 years

(1) Jean-Noël de Galzain has had an employment contract as Export Sales Director since June 2, 2004. This was suspended on April 27, 2007 when he became Chairman of the SAS (simplified joint stock company).

(2) Jean-Noël de Galzain has a collective pension savings plan (PERCO) with a gross value of €3,600 in 2017.

(3) Amaury Rosset is bound by a 12-month non-compete clause. In return for this commitment, the Group has agreed to compensate him by paying him a monthly allowance for the duration of the non-compete clause, equal to 40% of his average gross monthly fixed compensation in the previous 12 months.

Didier Lesteven is bound by a non-compete clause for 6 to 12 months, at the option of his employer. In return for this commitment, the Group has agreed to compensate him by paying him an allowance equal to 60% of his average monthly fixed and variable compensation in the previous 12 months.

15.2 Amounts set aside by the Group to cover pensions and retirement and other benefits for corporate officers

For Amaury Rosset, the Group had set aside €40,568 to cover termination benefits at December 31, 2017.

The Group has not granted any signing or severance bonuses.

16. BOARD PRACTICES

16.1 Group management

The composition of the Management Board and information on its members, in addition to its description in the articles of association, are presented in Chapter 14 "Administrative, management and supervisory bodies and executive management" and in Section 21.2 "Memorandum and Articles of Association" of the Registration Document.

16.2 Information on service agreements between members of administrative, management or supervisory bodies and the Company

There are no service contracts between members of the administrative, management or supervisory bodies and the issuer or any of its subsidiaries that grant benefits at the end of the contract.

16.3 Supervisory Board and specialized committees – Corporate governance

16.3.1 Supervisory Board

The composition of the Supervisory Board and information on its members are presented in Chapter 14 "Administrative, management and supervisory bodies and executive management" and in Section 21.2 "Memorandum and Articles of Association" of this Registration Document.

Under Article 3 of the Supervisory Board's rules of procedure, the Board considers that it has an independent member in the person of Jean-Pierre Brulard, insofar as Mr. Brulard:

is not an employee or executive director of the Company or any company in the same group, nor has he been at any time in the past five years;
does not have a material business relationship with the Company or any company in the same group (customer, supplier, competitor, service provider, creditor, banker, etc.), nor has he at any time in the past two years;
is not a major shareholder of the Company and does not hold a significant percentage of the voting rights;
has no close or family ties with a corporate officer or major shareholder;
has not been an auditor of the Company in the past six years.

It must be noted that the nature of the business relationship between the Company and Dell does not challenge the categorization of Jean-Pierre Brulard, who is also the Senior Vice President and General Manager for EMEA of VMware, a subsidiary of Dell, as an independent member of the Supervisory Board.

There is no connection between Wallix's purchases of computers and servers from Dell and Jean-Pierre Brulard's responsibilities at VMware.

Finally, Wallix's trade with VMware amounted to US\$750 (€656.52) in 2017.

The number of meetings of the Supervisory Board takes into account the various events in the life of the Group. For example, the Supervisory Board meets more frequently if required by the Group's activities.

During the year ended December 31, 2017, the Group's Supervisory Board met six times. The average attendance rate for Board members was 77.14%.

16.3.2 Specialized committees

16.3.2.1Executive Committee

An Executive Committee composed of the Company's senior operational and departmental managers meets once every three weeks. In addition to members of the Management Board, the committee is composed of the heads of R&D, customer delivery/support, marketing and the Company's core service business.

The role of the Executive Committee is to take part in and implement the Management Board's decisions, namely:

To examine, analyze, report to and assist the Management Board in its decision-making (for example through the presentation of indicators);
To advise the Management Board on matters requiring a decision;
To assist the Management Board in preparing the budget and managing its implementation.

The topics covered are tactical and organizational in nature. Each member of the Executive Committee reports to one of the members of the Management Board. He or she acts as a spokesperson with staff and must also submit "field" reports.

16.3.2.2Product Strategy Committee

The Product Strategy Committee meets every month.

It is composed of the Chairman of the Management Board, the Chief Operating Officer, the head of strategy, the head of R&D, the head of innovation, the head of marketing, the head of "customer success" and the product manager.

The role of the Product Strategy Committee is to examine major developments in the business plan, take on board feedback from the market and from customers, and tie this in with the Group's product marketing. The Product Strategy Committee also provides a link to the Company's development pipeline, predicting the medium and long-term trends that might inform the business plan in future.

16.3.2.3Nominations and Compensation Committee

16.3.2.3.1 Composition

Following a decision of the Supervisory Board dated December 7, 2011, the Company set up a Nominations and Compensation Committee.

At the date of this Registration Document, the members of the Nominations and Compensation Committee were Jacques Chatain, Chairman of the Supervisory Board and the Nominations and Compensation Committee, and the company TDH, member of the Supervisory Board, represented by Thierry Dassault.

The term of office of members of the Nominations and Compensation Committee is concurrent with their term of office as members of the Supervisory Board (see Chapter 14 of this document). Nominations and Compensation Committee members may be reappointed at the same time as they are reappointed to the Supervisory Board.

16.3.2.3.2 Responsibilities

The Nominations and Compensation Committee is responsible for reviewing and submitting proposals to the Supervisory Board on the following matters:

Compensation:

the amount of directors' fees for members of the Supervisory Board proposed at Annual General Meetings and their distribution among Supervisory Board members;
the compensation and benefits (variable portion and commission) for members of the Management Board;
the granting of stock warrants or stock options or the award of bonus shares in the Company to members of the Management Board;
the granting of stock warrants or stock options or the award of bonus shares in the Company to Group employees;
the guidelines to the Group's compensation policy.

Nominations:

the appointment and reappointment of members of the Management Board;
the appointment and reappointment of members of the Supervisory Board by co-opting or nominating them at the general meeting;
the appointment and removal of the Group's senior management;
the structure and composition of the Supervisory Board;
the structure and composition of the Supervisory Board's committees.

Finally, the Nominations and Compensation Committee ensures each year that the independence of Supervisory Board members as determined by the Supervisory Board meets the criteria set out in the Board's rules of procedure.

16.3.2.3.3 Operating procedures

The Nominations and Compensation Committee meets at least once a year, before the Board meeting convened to review the compensation of the Management Board members or to prepare the agenda for the Annual General Meeting convened to approve draft resolutions on matters within its remit.

16.3.2.3.4 Reports

The Chairman of the Nominations and Compensation Committee ensures that members of the Supervisory Board are fully informed of its opinions.

16.4 Corporate governance

The Company has decided not to refer to a corporate governance code, whose adoption is not mandatory for companies whose shares are traded on Euronext Growth.

However, the Company has set up specialized committees (see Section 16.3.2 of this document).

In addition, at its meeting on January 31, 2017, the Supervisory Board adopted its own rules of procedure, which were subsequently amended on February 14, 2018. This consists of the following sections:

role of the supervisory board and operations subject to its prior approval;
composition of the supervisory board including the independence criteria for members;
duties of members of the supervisory board (trustworthiness, confidentiality, attendance, record-keeping, obligations concerning the possession of inside information, disclosure of

conflicts of interest and share trading by corporate officers, senior managers and persons closely related to the corporate officers and senior managers);

board practices (frequency of meetings, convocation, information for members, selfassessment, use of videoconferencing and telecommunications means and resolutions);
role of specialized committees; and
principles governing the remuneration of members of the supervisory board;

More particularly, these state that each member of the Supervisory Board has an obligation to inform the Board of any conflict of interest, potential or otherwise, and to abstain from voting on the corresponding resolution.

Furthermore, as from the year ended December 31, 2017, the Supervisory Board is required to prepare a corporate governance report pursuant to Article L.225-68 of the French Commercial Code.

17. EMPLOYEES

17.1 Human resources

The Group had an average of 73 employees during the 2017 financial year, compared with 64 employees during the 2016 financial year and 44 employees during the 2015 financial year.

17.1.1 Organization chart at the filing date of the Registration Document

The Group is run by a Management Board composed of its Chairman, Jean-Noël de Galzain, its Chief Financial Officer, Amaury Rosset, and its Chief Operating Officer, Didier Lesteven. The Management Board is responsible for implementing the budget and for adopting major strategic decisions.

The Group's organization and its organization chart are presented in Section 6.12 of this Registration Document.

17.1.2 Number and distribution of employees

For each of the periods in question, the Group's average headcount has changed as follows:

Average headcount	December 31, 2015	December 31, 2016	December 31, 2017
Managerial and executive staff	40	63	72
Employees	4	1	1
Total	44	64	73

At the filing date of this Registration Document, the Group had an average headcount of 86 employees.

17.1.3 Employee representation

The Company noted a shortage of candidates during the elections for employee representatives in November 2015 and November 2016.

In 2017, the Company set up a sole employee representative body (DUP). In the first round of elections for employee representatives in December 2017, the Company again noted a shortage of candidates. However, during the second round held on December 22, 2017, five candidates with no formal trade union affiliation were nominated on a single list and were elected unanimously from the 43 votes cast (out of 65 registered voters) to fill the five seats available.

Similarly, during the first round of elections for alternate employee representatives in December 2017, the Company again noted a shortage of candidates. In the second round held on December 22, 2017, four candidates with no formal trade union affiliation were nominated on two lists and were elected.

The Group believes that it has a good relationship with its employees.

17.2 Shareholdings and stock options of corporate officers

Please refer to Sections 15.1, 18.1.1 and 21.1.4 of this Registration Document.

17.3 Employee participation in the Company's share capital

The Combined General Meeting of June 3, 2016 approved a bonus share plan for all Group employees. At the date of this Registration Document, the Management Board, following authorization from the Supervisory Board, had thus awarded 66,900 free shares to the Group's employees (excluding the performance shares of members of the Management Board), representing 1.55% of the fully diluted capital.

17.4 Incentive and profit-sharing contracts

Not applicable.

18. MAIN SHAREHOLDERS

18.1 Breakdown of the capital and voting rights

18.1.1 Breakdown of the capital and voting rights at the filing date of this Registration Document

The table below gives a breakdown of the Group's share capital and voting rights.

	basis	Situation at the filing date of the Registration Document on an undiluted					Situation at the filing date of the Registration Document on a fully diluted basis*
	Number of shares	actual voting rights	theoretical voting rights	% of capital	% of actual voting rights	% of theoretical voting rights	Number of shares that can be subscribed for by exercising founders' warrants	Number of shares that can be subscribed for by exercising stock options	Number of bonus shares awarded that are likely to be vested	Total number of shares after founders' warrants and stock options have been exercised and after the final vesting of bonus shares	% of capital	% of actual voting rights	% of theoretical voting rights
Jean-Noël de Galzain	116,252	232,504	232,504	2.87%	4.44%	4.44%	103,290	-	21,971	241,513	5.61%	6.51%	6.51%
JINCO Invest(1)	488,842	488,842	488,842	12.09%	9.34%	9.33%	-	-	-	488,842	11.35%	8.90%	8.89%
Amaury Rosset	244,320	488,640	488,640	6.04%	9.34%	9.33%	42,250	-	12,810	299,380	6.95%	9.90%	9.89%
Didier Lesteven	14,220	14,220	14,220	0.35%	0.27%	0.27%	-	-	7,018	21,238	0.49%	0.39%	0.39%
Total executive corporate officers 863,634		1,224,206	1,224,206	21.35%	23.40%	23.37%	145,540	-	41,799	1,050,973	24.41%	25.70%	25.67%
TDH(2)	433,170	866,340	866,340	10.71%	16.56%	16.54%	-	-	-	433,170	10.06%	15.77%	15.75%
Access2Net(3)	14,000	28,000	28,000	0.35%	0.54%	0.53%	-	-	-	14,000	0.33%	0.51%	0.51%
Total non executive corporate officers	447,170	894,340	894,340	11.06%	17.10%	17.07%	-	-	-	447,170	10.39%	16.28%	16.26%
Employees	32,550	42,600	42,600	0.80%	0.81%	0.81%	-	9,000	64,800	106,350	2.47%	2.12%	2.12%
Treasury shares	6,390	-	6,390	0.16%	-	0.12%	-	-	-	6,390	0.15%	0.00%	0.00%

Free float	2,694,966	3,070,263	3,070,263	66.63%	58.69%	58.62%	-	-	-	2,694,966	62.59%	55.90%	55.83%
Total	4,044,710	5,231,409	5,237,799	100.00%	100.00%	100.00%	145,540	9,000	106,599	4,305,849	100.00%	100.00%	100.00%

* the figures in this column are disclosed on the basis of fully diluted capital; i.e., by assuming that all outstanding founders' warrants have been exercised, that all stock warrants and all bonus shares have vested (see Section 21.1.4 "Potential capital").

(1) Family holding company owned by Jean-Noël de Galzain.

(2) Company controlled by Thierry Dassault.

(3) Access2Net, represented by Pierre-Yves Dargaud, resigned from the Supervisory Board on March 30, 2017. Pierre-Yves Dargaud was appointed member and Deputy Chairman of the Supervisory Board on that date.

The difference between the number of shares and voting rights is due to the existence of double voting rights (see Section 18.3 of this document).

The difference between theoretical voting rights and actual voting rights is due to the number of treasury shares held by the Company.

To the Company's knowledge, no other shareholder directly or indirectly holds, alone or in concert, more than 5% of the Company's capital or voting rights.

At the date of this document, there have been no significant changes in the distribution of the Company's capital and voting rights.

During the 2017 financial year, Jean-Noël de Galzain notified the Company that he had dropped below the statutory thresholds of 15%, 10% and 5% of the capital and 20%, 15%, 10% and 5% of the voting rights, having forfeited his double voting rights when the 500,000 shares he held were transferred to his family holding company, JINCO Invest.

During the 2017 financial year, the family holding company JINCO Invest notified the Company that it had exceeded the statutory thresholds of 5% and 10% of the capital and 5% of the voting rights due to Jean-Noël de Galzain transferring 500,000 shares to his family holding company (effected on May 29, 2017 and registered on June 1, 2017).

During the 2017 financial year, Auriga Partners notified the Company that it had dropped below the statutory thresholds of 5%, 10% and 15% of the capital and voting rights, having sold all its shares.

Based on the survey of identifiable bearer securities carried out by Euroclear in early April 2018, and by adding registered shares, the Company comprises 2263 shareholders holding 4,039,136 shares (for a total of 4,044,710 shares at the date of the Registration Document), representing 99.86% of the share capital (on an undiluted basis). According to the information from the TPI and consolidated with the shares held in registered form, the distribution of capital by major geographical regions is as follows: Europe: 99.90% (of which, metropolitan France and DOM COM: 83.33%), United States: 0.04% and other countries: 0.06%. In addition, the TPI survey, globalized with registered shares, showed that 29.36% of shareholders are private individuals and 70.64% of shareholders are not individuals (including private institutional investors, financial intermediaries, investment funds and others).

At December 31, 2017, there were no treasury shares or cross-holdings.

			12/31/2015						12/31/2016						12/31/2017
	Number of shares	Number of actual voting rights	Number of theoretical voting rights	% of capital	% of actual voting rights	% of theoretica l voting rights	Number of shares	Number of actual voting rights	Number of theoretical voting rights	% of capital	% of actual voting rights	% of theoretica l voting rights	Number of shares	Number of actual voting rights	Number of theoretical voting rights	% of capital	% of actual voting rights	% of theoretica l voting rights
Jean-Noël de Galzain(1)	702,410	1,404,620	1,404,620	17.57%	21.29%	21.24%	627,410	1,254,820	1,254,820	15.65%	19.02%	18.98%	116,252	232,504	232,504	2.87%	4.44%	4.43%
JINCO Invest													488,842	488,842	488,842	12.09%	9.33%	9.32%
Amaury Rosset	244,320	488,440	488,440	6.11%	7.40%	7.39%	244,320	488,640	488,640	6.10%	7.40%	7.39%	244,320	488,640	488,640	6.04%	9.33%	9.32%
Dominique Meurisse(2)	17,850	17,850	17,850	0.45%	0.27%	0.27%	19,046	36,896	36,896	0.48%	0.56%	0.56%
Didier Lesteven(3)													14,220	14,220	14,220	0.35%	0.27%	0.27%
Total executive corporate officers	964,580	1,910,910	1,910,910	24.13%	28.96%	28.90%	890,776	1,780,356	1,780,356	22.23%	26.98%	26.93%	863,634	1,224,206	1,224,206	21.35%	23.38%	23.34%
AURIGA PARTNERS (4)	603,690	999,440	999,440	15.10%	15.15%	15.11%	603,690	1,078,005	1,078,005	15.06%	16.34%	16.30%
TDH (5)	433,170	717,130	717,130	10.84%	10.87%	10.85%	433,170	866,340	866,340	10.81%	13.13%	13.10%	433,170	866,340	866,340	10.71%	16.54%	16.52%
ACCESS2NET (6)	127,000	254,000	254,000	3.18%	3.85%	3.84%	45,000	90,000	90,000	1.12%	1.36%	1.36%	14,000	28,000	28,000	0.35%	0.53%	0.53%
SOPROMEC PARTICIPATIONS (7)	100,010	200,020	200,020	2.50%	3.03%	3.02%						0.00%
Didier Lesteven (3)	4,000	8,000	8,000	0.10%	0.12%	0.12%	4,000	8,000	8,000	0.10%	0.12%	0.12%
Jean-Pierre Brulard (8)
Total non-executive corporate officers	1,267,870	2,178,590	2,178,590	31.72%	33.01%	32.95%	1,085,860	2,042,345	2,042,345	27.09%	30.95%	30.89%	447,170	894,340	894,340	11.06%	17.08%	17.05%
FPCI FSN PME / Bpifrance
Investissement (9)	350,000	700,000	700,000	8.76%	10.61%	10.59%	350,000	700,000	700,000	8.73%	10.61%	10.59%
Employees	55,050	99,420	99,420	1.38%	1.51%	1.50%	10,050	20,100	20,100	0.25%	0.30%	0.30%	32,550	42,600	42,600	0.80%	0.81%	0.81%
WALLIX GROUP Treasury shares	13,511		13,511	0.34%	0.00%	0.20%	13,232		13232	0.33%		0.20%	8,166		8,166	0.20%	0.00%	0.16%
FREE FLOAT	1,346,169	1,709,913	1,709,913	33.68%	25.91%	25.86%	1,658,072	2,056,096	2,056,096	41.37%	31.16%	31.10%	2,693,190	3,075,795	3,075,795	66.59%	58.73%	58.64%
TOTAL	3,997,180	6,598,833	6,612,344			100.00% 100.00% 100.00%	4,007,990	6,598,897	6,612,129			100.00% 100.00% 100.00%	4,044,710	5,236,941	5,245,107		100.00% 100.00% 100.00%

18.1.2 Changes in the distribution of capital and voting rights over the last three financial years

(1) At December 31, 2017, Jean-Noël de Galzain held 116,252 shares directly and 488,842 via his family holding company JINCO Invest, corresponding to 232,504 and 488,842 voting rights respectively.

(2) Dominique Meurisse has not been a member of the Management Board since February 13, 2017.

(3) Didier Lesteven has been a member of the Management Board since March 30, 2017, when he resigned as Chairman of the Supervisory Board.

(4) Company controlled by Jacques Chatain, Patrick Bamas and Bernard Daugeras.

(5) Company controlled by Thierry Dassault.

(6) A company controlled by Fondinvest FCPR VIII, the company Access2Net represented by Pierre-Yves Dargaud, resigned from the Supervisory Board on March 30, 2017. Pierre-Yves Dargaud was appointed member and Deputy Chairman of the Supervisory Board on that date.

(7) Company controlled by Pelican Ventures, the Gorgé family holding company.

(8) Mr. Brulard has been a member of the Supervisory Board since July 6, 2017.

(9) Company controlled by the Caisse des Dépôts and the State.

The difference between theoretical voting rights and actual voting rights is due to the number of treasury shares held by the Company.

The difference between the number of shares and voting rights is due to the existence of double voting rights (see Section 18.3 of this document).

18.1.3 Summary of trading in the Company's securities under Article L.621-18-2 of the French Monetary and Financial Code

For the year ended December 31, 2017, the following transactions were disclosed to the AMF:

Full name	Jean-Noël de Galzain	Jacques Chatain
Position held within the issuer	Chairman of the Management Board	Chairman of the Supervisory Board
Transactions performed by a person related to the above person	-	Auriga Partners SA
Description of the financial instrument	Shares	Shares
Disposal of financial instruments:	11,158	623,140
Total amount of disposals:	€186,450.18	€10,331,661.20
Purchases of financial instruments:
Total amount of purchases	-	-
Transfer of financial instruments to a family holding company:	500,000
Total amount of the transfer:	€4,560,000.00	-

18.2 Significant shareholders not represented on the Supervisory Board

Not applicable

18.3 Voting rights of the principal shareholders

At the filing date of the Registration Document, the voting rights of each shareholder were equal to the number of shares they each held, except for the double voting right conferred on fully paid-up shares, for which proof is available of registered ownership in the name of the same shareholder for at least two years, introduced by the Combined General Meeting of May 6, 2015.

18.4 Control of the Company

At the filing date of the Registration Document, the Group is not controlled within the meaning of Article L. 233-3 of the French Commercial Code.

To the Group's knowledge, no action in concert between its shareholders exists.

18.5 Agreements that could lead to a change in control

To the Group's knowledge, there are no agreements that could result in a change of control of the Company.

18.6 Statement of Company share pledges

Not applicable as far as the Company is aware.

19. RELATED-PARTY TRANSACTIONS

19.1 Related-party agreements

Not applicable.

19.2 Regulated agreements

The statutory auditors' special report on regulated agreements and commitments within the scope of Articles L. 225-38 et seq. of the French Commercial Code for the 2017 financial year can be found in Section 19.3 of this chapter.

Moreover, to the knowledge of WALLIX GROUP, no agreement exists other than standard business agreements concluded at arm's length, directly or through an intermediary, between a director or shareholder holding more than 10% of the voting rights of WALLIX GROUP and a company in which WALLIX GROUP directly or indirectly owns more than half the capital.

19.3 Statutory auditors' report on regulated agreements

Regulated agreements are described in the statutory auditors' special report for 2017, presented below.

Since the statutory auditors' special report for 2017 was produced, a new regulated agreement was submitted for the approval of the Supervisory Board at its meeting on March 28, 2018. This consists of an amendment to Amaury Rosset's employment contract to increase his fixed annual gross compensation. This agreement will be submitted for shareholder approval at the Annual General Meeting in 2019.

KPMG AUDIT PARIS ET CENTRE Tour EQHO 2 Avenue Gambetta CS 60055 92066 Paris la Défense Cedex France

Telephone: +33 (0)1 55 68 86 66 Telefax: +33 (0)1 55 68 98 29 Internet: www.kpmg.fr

Error! Unknown document property name.

Error! Unknown document property name.Error! Unknown document property name.

Error! Unknown document property name. Error! Unknown document property name. Error! No document variable supplied. This report contains !Undefined Bookmark, APPXPAGES pages reg 232 Reference : Error! Unknown document property name. appx Error!

131

KPMG Audit Paris et Centre, a French limited liability entity and a member firm of the KPMG Network of independent member firms affiliated with KPMG International Cooperative, a Swiss entity.

Simplified joint-stock company registered at the Compagnie Régionale des Commissaires aux Comptes de Versailles.

KPMG AUDIT PARIS ET CENTRE

Tour EQHO 2 Avenue Gambetta CS 60055 92066 Paris la Défense Cedex France

Telephone: +33 (0)1 55 68 86 66 Telefax: +33 (0)1 55 68 98 29 Internet: www.kpmg.fr

132

KPMG Audit Paris et Centre, a French limited liability entity and a member firm of the KPMG Network of independent member firms affiliated with KPMG International Cooperative, a Swiss entity.

Simplified joint-stock company registered at the Compagnie Régionale des Commissaires aux Comptes de Versailles.

KPMG AUDIT PARIS ET CENTRE Tour EQHO 2 Avenue Gambetta CS 60055 92066 Paris la Défense Cedex France

Telephone: +33 (0)1 55 68 86 66 Telefax: +33 (0)1 55 68 98 29 Internet: www.kpmg.fr

Error! Unknown document property name.

Registered office: Error! No document variable supplied. Share capital: €.Error! No document variable supplied.

Error! Unknown document property name.Error! Unknown document property name. Error! Unknown document property name.Error! Unknown document property name. Error! Unknown document property name.

Error! Unknown document property name.,

1 In our capacity as the statutory auditors of your company, we hereby present to you our report on the regulated agreements.

We are required to inform you, on the basis of the information provided to us, of the nature and essential terms and conditions of the agreements that have been disclosed to us or identified in the course of our work, as well as the reasons given justifying their benefit to the company. It is not our role to determine whether they are beneficial or appropriate, nor to ascertain whether any other agreements exist. It is your responsibility, pursuant to Article R.225-58 of the French Commercial Code, to assess the benefits associated with the conclusion of these agreements with a view to their approval.

In addition, we are required, where applicable, to inform you, in accordance with Article L. 225- 88 of the French Commercial Code about the performance during the year of agreements previously approved by the Annual General Shareholders'Meeting.

We performed the procedures we deemed necessary for the completion of this engagement, in accordance with the professional guidance provided by the Compagnie nationale des commissaires aux comptes (France's national organization of the Statutory Auditors). Our work consisted in verifying the consistency of the information provided to us with the source documents on which it was based.

Agreements subject to the approval of the Annual General Shareholders' Meeting

Pursuant to Article L. 225-88 of the French Commercial Code, we have been informed of the following agreement, authorized by your Supervisory Board.

Agreement relating to the compensation of the Chief Financial Officer:
Agreement with Mr. Amaury Rosset, Chief Financial Officer and member of the Management Board of Wallix Group;

133 KPMG Audit Paris et Centre, a French limited liability entity and a member firm of the KPMG Network of independent member firms affiliated with KPMG International Cooperative, a Swiss entity.

Simplified joint-stock company registered at the Compagnie Régionale des Commissaires aux Comptes de Versailles.

Nature and purpose: amendment to employment contract of Amaury Rosset, Chief Financial Officer of Wallix Group;
Terms and conditions:
o the annual gross fixed compensation has been increased from €120,000 to €150,000;
o the amounts received during the financial year was €179,645, comprising €150,000 in fixed compensation and €29,645 in variable compensation;
Reason justifying the agreement: the increase in the compensation, started in 2016, is motivated by the challenges associated with the management of a company listed on Euronext Growth.

This agreement was authorized by the Supervisory Board on March 30, 2017.

Agreements already approved by the General Shareholders' Meeting

We inform you that we have not been advised of the implementation, during the financial year, of any agreements already approved by the Shareholders' General Meeting in previous financial years.

Error! Unknown document property name., on the Error! Unknown document property name. Error! Unknown document property name.

Error! Unknown document property name. Error! Unknown document property name.

20. FINANCIAL INFORMATION

20.1 Annual consolidated financial statements prepared under French GAAP for the year ended December 31, 2017

Consolidated Financial Statements December 31, 2017

250-bis rue du Faubourg Saint Honoré 75008 PARIS

CONTENTS	136
CONSOLIDATED BALANCE SHEET	138
NOTES TO THE CONSOLIDATED ACCOUNTS	142
1 – ACTIVITY AND HIGHLIGHTS 142
• GROUP ACTIVITY 142
• GOING CONCERN AND FINANCING 142
• HIGHLIGHTS OF THE YEAR 142
• POST BALANCE SHEET EVENTS 142
2 – ACCOUNTING STANDARDS AND CONSOLIDATION METHODS 142
• DECLARATION OF COMPLIANCE WITH GROUP REPORTING STANDARDS 142
• BASIS OF CONSOLIDATION 143
• CHANGE OF METHOD 143
• JUDGMENT AND ESTIMATES USED BY THE GROUP'S MANAGEMENT 143
• CONSOLIDATION METHODS 143
• SIGNIFICANT INFORMATION ABOUT THE SCOPE OF CONSOLIDATION 143
• ENTITIES BELONGING TO THE SCOPE OF CONSOLIDATION 144
• FUNCTIONAL AND REPORTING CURRENCY 144
• REPORTING DATE OF THE ACCOUNTS 144
• CONVERSION OF ACCOUNTS EXPRESSED IN FOREIGN CURRENCY 144
• ELIMINATION OF INTRA-GROUP TRANSACTIONS 145
3 – MEASUREMENT METHODS AND RULES	145
• INTANGIBLE ASSETS 145
• GENERAL 145
• RESEARCH AND DEVELOPMENT COSTS 146
• PROPERTY, PLANT AND EQUIPMENT 146
• FIXED ASSETS FUNDED BY FINANCE LEASES 146
• LONG-TERM INVESTMENTS 146
• IMPAIRMENT OF ASSETS 147
• PROVISIONS FOR RISKS 147
• INVENTORIES 147
• TRADE RECEIVABLES AND OTHER ACCOUNTS RECEIVABLE 147
• MARKETABLE INVESTMENT SECURITIES 147
• FOREIGN CURRENCY TRANSACTIONS 147
• PENSION COMMITMENTS 148
• TAXES PAYABLE AND DEFERRED 148
• SECTORAL INFORMATION 148
• RESEARCH TAX CREDIT AND OPERATING SUBSIDY 149
• RESEARCH TAX CREDIT AND OTHER SUBSIDIES 149
• OPERATING SUBSIDIES RESTATED IN PREPAID INCOME (PI): 150
• ACCOUNTING TREATMENT OF THE CICE 150
• EXTRAORDINARY INCOME AND EXPENSES 150
• EARNINGS PER SHARE 150
4 – NOTES TO THE CONSOLIDATED ACCOUNTS 151

WALLIX Group Consolidated Financial Statements at December 31, 2017

NOTE 11 - EXTRAORDINARY INCOME AND EXPENSES…………………………………160
NOTE 12 - TAX ANALYSIS……………………………………………………………………160
NOTE 13 - COMPENSATION FOR CORPORATE OFFICERS……………………………….163
NOTE 14 STATUTORY AUDITOR FEES…………………………………………………….165
NOTE 15 OFF BALANCE SHEET COMMITMENTS………………………………………165
	NOTE 1 - SHARE CAPITAL…………………………………………………………………151 • CAPITAL OWNERSHIP 151 • POTENTIAL CAPITAL 151 • AWARD OF BONUS SHARES TO BE ISSUED 151 NOTE 2 - FIXED ASSETS & AMORTIZATIONS…………………………………………….152 • SUMMARY 152 • INTANGIBLE ASSETS 153 • PROPERTY, PLANT AND EQUIPMENT 153 • LONG-TERM INVESTMENTS 153 NOTE 3 - RECEIVABLES……………………………………………………………………154 • PROVISION ON CURRENT ASSETS 154 NOTE 4 - PROVISIONS………………………………………………………………………. 155 • PROVISIONS FOR RISKS AND LIABILITIES .155 NOTE 5 - FINANCIAL LIABILITIES………………………………………………………….156 NOTE 6 - OPERATING LIABILITIES…………………………………………………………157 NOTE 7 - TURNOVER…………………………………………………………………………158 NOTE 8 - OTHER OPERATING INCOME…………………………………………………….159 NOTE 9 - PAYROLL COSTS…………………………………………………………………159 NOTE 10 - FINANCIAL RESULT………………………………………………………………160

CONSOLIDATED STATEMENT OF FINANCIAL POSITION

In thousands of euros

ASSETS	Note	12/31/2017	12/31/2016
Intangible assets	2	5,805	4,619
Property, plant and equipment	2	773	762
Long-term investments	2	346	228
Fixed assets		6,925	5,610
Inventories		66	3
Trade and other accounts receivable	3	6,377	4,699
Other receivables and accruals	3	1,711	1,519
Deferred tax assets	12		0
Cash and marketable securities	CFS	6,981	5,938
Current assets		15,135	12,159
Total assets		22,060	17,769

LIABILITIES	Note	12/31/2017	12/31/2016
Share capital		404	401
Premiums		14,917	14,798
Consolidated reserves		(6,149)	(4,572)
Translation adjustment		(2)	(17)
Net profit, Group share		(1,050)	(1,683)
Treasury shares		(146)	(110)
Shareholders' equity	1	7,974	8,817
Minority interests
Provisions for risks and liabilities	4	650	237
Deferred tax liabilities	12
Borrowings & financial debts	5	1,950	1,572
Trade and other accounts payable	6	868	523
Other liabilities and accruals	6	10,618	6,620
Total liabilities		22,060	17,769

CONSOLIDATED STATEMENT OF INCOME

In thousands of euros

	Note	12/31/2017	12/31/2016
Turnover	7	11,545	7,364
Other operating revenue Purchases & changes in inventory Other operating costs Taxes and levies Payroll costs Depreciation, amortization and provisions	8 9	3,549 (375) (4,125) (271) (9,087) (2,081)	2,878 (146) (3,810) (171) (6,515) (1,365)
Operating profit (loss)		(845)	(1,765)
Interest expense and financial income	10	(19)	(20)
Current profit (loss) of consolidated companies		(863)	(1,785)
Extraordinary expense and income Income tax	11 12	(182) (5)	102
Net profit (loss) of consolidated companies		(1,050)	(1,683)
Goodwill depreciation and amortization expense
Net profit (loss) of the consolidated entity		(1,050)	(1,683)
Minority interests
Net profit (loss) (Group share)		(1,050)	(1,683)
Earnings per share (in euros) Diluted earnings per share (in euros)		(0.260) (0.260)	(0.420) (0.420)
Number of shares at closing Weighted average number of shares over the period		4,044,710 4,035,134	4,007,990 4,005,858

CONSOLIDATED STATEMENT OF CASHFLOWS

In thousands of euros

	12/31/2017	12/31/2016
Net profit (loss) of consolidated companies	(1,050)	(1,683)
- Depreciations, amortizations and provisions (1) - Change in deferred taxes	2,020	1,364
- Capital gains on asset disposal		(12)
Gross cash flow from consolidated companies	970	(331)
- Change in business-related working capital requirement (2)	2,411	(523)
Net cash flow from operating activities	3,380	(854)
- Purchases of fixed assets - Disposals of fixed assets	(2,963) 108	(2,630) 392
Net cash flows from investing activities	(2,855)	(2,238)
- Capital increase in cash and share premiums - Loan issues - Loan repayments	134 857 (474)	30 479 (247)
Net cash flows from financing activities	517	262
Changes in cash flow	1,043	(2,830)
Cash at beginning of year	5,938	8,767
Cash at year end	6,980	5,938
(1) excluding provisions on current assets (2) mainly change in business-related receivables and liabilities
Analysis of cash at year end
Marketable securities	6,412	5,674
Cash and cash equivalents	570	264

Bank overdrafts (1) (1) Net cash 6,980 5,938

STATEMENT OF CHANGES IN CONSOLIDATED SHAREHOLDERS' EQUITY

		Share capital	Premiums	Reserves	Profit (loss)	Currency Translation	Treasury shares	TOTAL
Net position at	December 31, 2015	400	14,768	(3,473)	(1,113)	(7)		10,575
Appropriation of reserves	Change in the capital of the parent company	1	29	(1,113)	1,113			30
Profit (loss)					(1,683)			(1,683)
Changes in translation adjustment Acquisition or disposal of treasury shares				8		(10)	(110)	(1) (110)
Other changes				6				6

Net position at	December 31, 2016	401	14,798	(4,572)	(1,683)	(17)	(110)	8,817
Appropriation of reserves	Change in the capital of the parent company	4	131	(1,683)	1,683			134
Net profit (loss) (Group share)					(1,050)			(1,050)
Changes in translation adjustment Other changes	Acquisition or disposal of treasury shares (1)		(11)	103 3		14	(36)	14 67 0 (8)
Net position at	December 31, 2017	404	14,917	(6,149)	(1,050)	(2)	(146)	7,974

(1) The €103k correspond to the capital gain on treasury shares

NOTES TO THE CONSOLIDATED ACCOUNTS

1 – Activity and Highlights

Group activity

Historically present in managed security services (architecture, deployment, operation and support), the Group today is specialized in the IT security software publishing sector and, more specifically in the control of access to, and the traceability of, Privileged Access Management (PAM), in corporate information systems. Through its flagship solution, Wallix Bastion, the Group supports companies in their management of access to equipment and applications. Its solutions are distributed through a network of trained and certified resellers and integrators.

The parent company, Wallix Group, conducts the Group's historic business, namely the Services activity (secure hosting of sensitive applications). This business is not materially important at Group activity level since it only represents 4% of consolidated turnover.

Wallix, the French subsidiary, conducts the IT security software development activity.

WALLIX US CORP, the American subsidiary, also develops IT security software. The plan is for this US subsidiary to develop this activity with North-American players. However, so far, the American company has not recorded any orders.

Going concern and financing

The Group implements a prudent management of its available cash and monitors its financing sources on a regular basis in order to guarantee the availability of sufficient liquidity at all times.

The Group's financial debt is presented in Note 5.

The Group's cash requirements have, until now, been mainly covered by capital increase transactions and bank borrowings, and also by the Research Tax Credit.

With regard to these different sources of financing, and to its turnover growth objectives and cash forecasts, the Company considers that it is in a position to meet its commitments within a 12-month time frame, as from the reporting date of these consolidated accounts.

Highlights of the year

No significant events were reported during the period

Post balance sheet events

No significant events were reported after the reporting date

2 – Accounting standards and consolidation methods

Declaration of compliance with Group reporting standards

Pursuant to the French accounting principles laid out by the provisions of Regulation 99-02 of the Comité de la Réglementation Comptable (CRC – the French Accounting Regulation Board) of April 29, 1999 regarding the consolidated accounts of business corporations and amended by CRC Regulations no. 2000-07, no. 2002-10, no. 2002-12, no. 2004-03, no. 2004-14 and no. 2005-10, WALLIX GROUP has prepared consolidated accounts in respect of the financial statements as at December 31, 2017.

Basis of consolidation

The consolidated financial statements consist of the financial statements of WALLIX GROUP and its subsidiaries as at December 31, 2017 and December 31, 2016 on the basis of consistent accounting methods and according to the historic cost method.

Change of method

There was no change of accounting method during the financial year

Judgment and estimates used by the Group's management

Preparation of the financial statements requires Management to exercise judgment and use estimates and assumptions that have an impact on the amounts of assets and liabilities on the reporting date, as well as on profit and loss items for the period. These estimates take account of the economic data likely to vary over time and include unforeseen events.

The estimates and underlying assumptions are based on past experience and other factors considered as reasonable in light of the circumstances. Thus they serve as a basis for the exercise of the judgment required for determining the carrying value of assets and liabilities, which cannot be obtained directly from other sources. The actual values may be different from the estimated values.

The underlying estimates and assumptions are continually re-examined.

The impact of accounting estimate changes is recognized during the period in which the change occurred if it only affects such period, or during the period in which the change occurred and subsequent periods, if these periods are also affected by the change.

They primarily concern the appraisal of the value of capitalized assets, such as capitalized research and development costs, and operating assets.

Consolidation methods

All the companies directly owned by WALLIX GROUP are consolidated. The control exercised may be exclusive, joint or by significant influence.

The consolidation method is determined according to the type of control exercised.

• Exclusive control: exclusive control is presumed when the Group holds directly or indirectly more than 50% control, unless it is clearly demonstrated that this holding does not enable control. Exclusive control also exists when the Group holds half or less of the voting rights of a company, but has the power to direct the financial and operational policies of the company, to appoint or revoke the majority of the members of the Board of Directors or the equivalent decision-making body. The method applied is full consolidation.

The companies in the Group's scope of consolidation are all fully consolidated.

Significant information about the scope of consolidation

All the companies held directly or indirectly by WALLIX GROUP are consolidated.

Entities belonging to the scope of consolidation

The scope of consolidation consists of the following companies:

Companies	Countries	Registered office	Method	% of control at December 31, 2017	% of control at December 31, 2016
Wallix GROUP	France	250 Bis rue du Faubourg Saint-Honoré – 75008 PAR 428,753,149	FC	Parent	Parent
Wallix	France	250 Bis rue du Faubourg Saint-Honoré – 75008 PAR 450,401,153	FC	100%	100%
Wallix US	United State	60 Broad Street – Suite 3502 NEW YORK 10004	FC	100%	100%

FC = Full Consolidation

All companies are fully consolidated.

Functional and reporting currency

The consolidated financial statements are reported in euro which is the functional currency of the parent company and of its subsidiary WALLIX SARL. The functional currency of WALLIX U.S. CORP is the dollar.

Amounts in the consolidated accounts are reported in thousands of euros, unless otherwise indicated.

Reporting date of the accounts

The reporting date for the full year financial statements of all consolidated companies is December 31 and, for their half year consolidated accounts, June 30.

Conversion of accounts expressed in foreign currency

The balance sheets of foreign companies are converted into euro at the exchange rate on the reporting date, with the exception of shareholders' equity which is maintained at its historic exchange rate.

Income statements in foreign currency are converted at the annual average rate. Translation adjustments resulting from these different rates are recognized in shareholders' equity under the heading "Currency translation reserves".

The exchange rates used for the WALLIX US subsidiary are as follows (equivalent value in euro):

Closing date	Average rate	Closing rate

31/12/2016	1.1066	1.0541
31/12/2017	1.1293	1.1993

Elimination of intra-group transactions

Transactions, as well as reciprocal assets and liabilities between fully consolidated companies, are eliminated.

Similarly, the Group's internal results (provisions for risks and liabilities established to cover the losses suffered by consolidated companies) are neutralized. The elimination of internal results is split between Group share and minority interests in the company that achieved the results.

Losses resulting from the intra-group transactions between the consolidated companies are only eliminated if they do not require an impairment.

3 – Measurement methods and rules

The consolidated accounts are established in accordance with the following accounting principles:

going concern,
periods cut off,
consistency of accounting principles.

The application of the preferential methods of CRC Regulation 99-02 is as follows:

Application of preferential methods	YES – NO N/A
Recognition of finance lease	YES
Provisionning for pension and similar benefits	YES
Deferral of issuance costs and premiums and repayment of bonds over the life of the loan	N/A
Recognition of translation adjustments assets/liabilities in profit or loss	YES
Recognition on a percentage of completion basis of transactions partially completed at year end	YES

Intangible assets

General

Intangible assets correspond to research and development costs, concessions, patents, licenses and goodwill. They are recognized at their acquisition cost, including the purchase price and related costs.

These intangible assets are amortized on a straight-line basis over periods corresponding to their expected useful lives, namely:

for software: 1 year;
for development costs: over 5 years starting from the year following the capitalization.

At each reporting date, the company ensures that there are no indicators likely to indicate that an asset has been impaired.

Any positive difference between the net carrying value and the current value represents the amount to be amortized for the year.

Research and development costs

Research costs are expensed as they are incurred.

They concern the development of the functionalities of the Group's software which is designed for commercial use and mainly consists of staff costs which are measured on the basis of the hours spent on development projects.

Development expenses on an individual project are capitalized when the feasibility of the project and its profitability can be reasonably considered as achieved.

Pursuant to the foregoing, development costs are capitalized as intangible assets provided that the Group can demonstrate:

its intention to complete this asset, and its capacity to use or sell it;
its financial and technical capacity to complete the development project;
the availability of resources to complete the project;
the probability that the future economic benefits attributable to the development expenses will accrue to the Group;
and that the cost of this asset may reliably be measured.

Capitalized development costs are amortized over five years.

Property, plant and equipment

Property, plant and equipment are measured at their acquisition cost and depreciated according to the following average terms:

-	Fixtures and installations	10 years, straight line
-	Equipment and office furniture	5 to 10 years, straight line
-	IT equipment	3 to 5 years, straight line

Fixed assets funded by finance leases

Fixed assets funded by finance leases are recognized on the assets side of the balance sheet at the value stipulated in the lease. They are depreciated according to the same rules that apply to assets acquired outright.

These fixed assets are considered as being bought on credit; the corresponding debt is therefore recorded as a liability and recognized as a financial expense.

Long-term investments

Long-term investments are reported in the balance sheet at their acquisition cost and are, if necessary, depreciated to take account of their inventory value at the reporting date.

Impairment of assets

Where there is an indication showing that the value of property, plant and equipment and intangible assets is likely to raise questions at the reporting date, an impairment test is conducted.

The net carrying value of the capitalized asset is then compared to its current value and an impairment is recognized when the current value is lower than the net carrying value.

The current value is the higher of the fair value or the value in use. The latter is calculated through a multi-criteria approach, especially depending on the net cash flows expected from such assets.

Provisions for risks

Provisions are recorded when, at the reporting date, there is a Group obligation to a third party arising from a past event the settlement of which is likely to result for the Group in an outflow of resources representing economic benefits without at least equivalent consideration expected from this third party.

This obligation may be legal, regulatory or contractual. It may also stem from the Group's practices or public commitments which created a legitimate expectation of the third party affected by the fact that the Group will assume certain responsibilities.

The estimate of the amount shown as a provision corresponds to the outflow of resources that the Group will probably have to bear to extinguish its obligation. If no reliable estimate can be made, no provision is recognized. Information is then provided in the notes.

Inventories

Inventories are measured using the "first in, first out" method.

The gross value of goods and supplies includes the purchase price and incidental costs.

If applicable, inventories are written down for impairment to take account of their net realization value at the reporting date of the accounts.

Trade receivables and other accounts receivable

Receivables are measured at their par value. Losses in value are recognized in profit or loss as amounts considered to be unrecoverable, when there is objective evidence that the asset has lost value.

Marketable investment securities

Investment securities are recorded at their acquisition cost. An impairment is recorded if their realization value at the reporting date, generally determined by reference to the stock market price or to their net asset value, is lower than their acquisition cost.

Foreign currency transactions

Transactions denominated in foreign currency are converted at the exchange rate in force at the time of the transaction.

At the end of the financial year, receivables and liabilities denominated in foreign currency are converted on the basis of the exchange rate on the reporting date.

Pension commitments

Pension commitments are measured by the preferential actuarial method, as recommended by Regulation no. 2013-R-02 of the Conseil National de la Comptabilité, the French Accounting Standards Board.

The provision for retirement commitments on the balance sheet corresponds to the discounted value of the commitments.

Changes in actuarial assumptions are recognized in profit or loss.

The criteria used for these calculations are as follows:

• Economic parameters:

Annual increase of salaries of 1.5%,
Applied discount rate of 1.3%.
Social parameters:
Voluntary retirement at 65-67 years of age,
Average rate of social security liabilities between 42 and 47%
Collective bargaining agreement: SYNTEC Design offices
Technical parameters:
Applied turn-over table: DARES R&D (5.1%)
Mortality table: INSEE 2017

Retirement benefits are recognized as provisions.

Taxes payable and deferred

Income tax includes the expense (or income) of tax payable and the expense (or income) of deferred tax.

The tax payable is the estimated amount of the tax due on the taxable profit for a period.

Deferred taxes are recognized using the variable deferment method for all time-based differences between the carrying value of the assets and liabilities and their tax bases. A deferred tax asset is recognized only to the extent that it is probable that the Group will have taxable future profits to which this asset may be charged.

Profit for the year is affected by changes in the rate of income tax and/or a change of the tax rules on existing deferred tax assets and liabilities.

The deferred tax assets and liabilities are offset when the entity is entitled to offset tax assets and tax liabilities payable, and when they concern taxes on the earnings levied by the same tax authority, and when the Group plans to settle the tax assets and liabilities payable on the basis of their net amount.

Sectoral information

A business sector or a geographic region is defined as a homogeneous group of products, services, business lines or countries which is individualized within the company, its subsidiaries or business units. The segmentation adopted for sectoral analysis is derived from that used by the management for internal reporting.

The management considers that the Group is comprised of a single business sector, namely software publishing.

The Group's consolidated turnover corresponds mainly to the turnover generated by Wallix S.A.R.L. (96% of consolidated turnover).

The breakdown of turnover by geographic region corresponds to the original geographic region of the client, since all the means of production are concentrated at the headquarters in Paris. The senior management did not, as a result, consider it appropriate to make a breakdown of the assets used or of the operating profit or loss by geographic region, given that these indicators do not reflect the real organization of the Group and are not monitored in connection with the internal reporting used by management.

Research tax credit and operating subsidy

In connection with its development projects, WALLIX Group receives research tax credits (RTC) as well as operating subsidies.

For this purpose, it has recorded in its accounts:

In thousands of euros	12/31/2017	12/31/2016
RTC restated as deferred revenue	727	524
RTC restated as operating subsidy	247	327
Research Tax Credit	974	851

The operating subsidies are broken down as follows:

In thousands of euros	12/31/2017	12/31/2016
Subs. RTC restated as deferred income	151	150
Non restated subsidy	69	215
Operating subsidy	220	366

Research tax credit and other subsidies

The Group has continued its research and development efforts. A part of its expenses entitled the Group to receive research tax credits.

Under the general principle that substance prevails over appearances in the consolidated accounts (Regulation 99-02 § 300), the Group chose to recognize the research tax credit:

As an operating subsidy: for the part that is not directly attributable to capitalized development costs,
As deferred income: for the part directly attributable to capitalized development costs then recognized in income at the same pace as the amortization of these development costs.

The research tax credits restated in Deferred income (DI) are presented as follows:

In thousands of euros

WALLIX Group Consolidated Financial Statements at December 31, 2017

			Recorded in profit or loss over 5 years		DR outstanding on the balance sheet
Years	Total RTC	DR	12/31/2017	12/31/2016	12/31/2017	12/31/2016
2007	190	34
2008	184	65
2009	252	93
2010	410	128
2011	427	150		30
2012	427	281	56	56	0	56
2013	523	297	59	59	59	119
2014	496	339	68	68	136	204
2015	624	403	81	81	242	323
2016	851	524	105		419	524
2017	974	727			727
			369	294	1,583	1,225
			Note 8		Note 6

Operating subsidies restated in deferred income (DI):

In thousands of euros

			Recorded in profit or loss over 5 years		DR outstanding on the balance sheet
Years	Subsidies	DR	12/31/2017	12/31/2016	12/31/2017	12/31/2016
2007	19
2008	54
2009	366	172
2010	506	184
2011	382	125		25
2012	273	129	26	26		26
2013	323	189	38	38	38	76
2014	137	59	12	12	24	35
2015	246	112	22	22	67	89
2016	366	150	30		120	150
2017	220	151			151
			128	123	400	377
			Note 8		Note 6

The operating subsidies directly attributable to capitalized development costs are also reclassified under deferred income and recognized in income at the same pace as the amortization of these development costs.

Accounting treatment of the CICE

The tax credit for competitiveness and employment (CICE) has been recognized against the payroll costs for €52,000 at December 31, 2017.

Extraordinary income and expenses

The income and expenses which, by their nature, their occurrence, or their amount, are not considered to be part of the Group's ordinary activities, are recognized in extraordinary income or expense.

Earnings per share

The earnings per share is calculated by dividing the Group share of net income by the weighted average number of common stock in circulation during the financial year.

When the basic earnings per share is negative, the diluted earnings per share is identical to these basic earnings.

When the basic earnings per share is positive, the diluted earnings per share is determined by taking into account the maximum dilutive effect linked to the exercise of individual stock warrants, the exercise of founders' warrants, the exercise of free shares as well as of the various stock options issued.

4 – Notes to the consolidated accounts

Note 1-Share capital

Capital ownership

Share capital ownership	Number	Par value

Shares comprising the share capital at beginning of the year	4,007,990	0.10

Shares issued during the year	36,720	0.10

Shares redeemed during the year

Shares comprising the share capital at year end	4,044,710	0.10

The capital increase stems from the exercise of 14,220 stock warrants of 2012, and 22,500 stock options of 2012.

Potential capital

At the financial year end, the marketable securities issued and the stock options awarded by WALLIX GROUP giving access to its capital are as follows:

SM	Management Board	Nature	Number of authorized securities	Award	Lapsed & cancele d	Previousl y exercised securities	Securiti es exercise d during	Current securities	Number of potential shares (1)	Strike price in euros (1)	Exercise deadline
04/30/12	12/21/2013	BSA 2012 (Stock warran	1,422	1,422			1,422	0	0	3.686	10/21/2018
04/30/12	10/21/2013	BCE 2012 (Founders' sto	9,800	9,800				9,800	98,000	3.686	10/21/2018
04/30/12	10/21/2013	2012 stock options	6,316	5,400	3,166		2,250	900	9,000	3.686	10/21/2018
06/12/14	11/28/2014	BCE 2014 (Founders' sto	5,835	5,835		1,081		4,754	47,540	2.800	11/28/2019

(1) By taking account of the 1 for 10 split of par value of each share, decided by the Annual General Meeting of May 6, 2015

Award of Free Shares to be issued

At the end of the financial year, the free share awards to be issued by WALLIX GROUP giving access to its capital are as follows:

WALLIX Group Consolidated Financial Statements at December 31, 2017

Beneficiaries	Group employees	Group employees with strategic duties	Members of the Management Board
ESM	06/03/16	06/03/16	06/03/16
Award date / Management Board	07/06/17	07/06/17	07/06/17
Number of shares awarded during the year	54,800	18,200	39,699
Number of canceled shares	4,300
Total number of shares that can be issued	50,500	18,200	39,699
Performance conditions	no	yes/achieved	yes/achieved
Presence conditions	yes	yes	yes
	20% to 1 year
Vesting period	35% to 2 years	1 year	1 year
	45% to 3 years
Lock-in period	1 year / 1st tranche	1 year	1 year
Amount of the expense recognized during the year (in €k) see Note 4.	7	114	232

Note 2 - Fixed assets & amortizations

Summary

In thousands of euros

	Gross	12/31/2017 Depreciation and	Net	Gross	12/31/2016 Depreciation and	Net
Intangible assets Property, plant and equipment Long-term investments	11,607 1,291 346	(5,802) (518)	5,805 773 346	9,024 1,081 228	(4,405) (319)	4,619 762 228
Total	13,244	(6,319)	6,925	10,334	(4,724)	5,610

WALLIX Group Consolidated Financial Statements at December 31, 2017

Intangible assets

In thousands of euros

	12/31/2016	Increase	Decrease
		Immobilisations Incorporelles
Development costs (see note 8) Concessions, patents and similar rights Other	8,832 190 2	2,575 13	(6)	11,408 197 2
Gross intangible assets	9,024	2,589	(6)	11,607
		Amortization intangible assets
Development costs Concessions, patents and similar rights	4,373 31	1,357 40		5,730 71
Depreciation and amortizations	4,404	1,397		5,801
Other	1			1
Provisions	1			1
Net intangible assets	4,619			5,805

Property, plant and equipment

In thousands of euros

	12/31/2016	Increase	Decrease	Translation adjustment Other changes		12/31/2017
		Property, plant and equipment
Other property, plant and equipment	447	217	(10)	0	0	654
Other property, plant and equipment under finance lease	634	0	0	0	0	634
Fixed assets under construction	0	3			0	3
Gross property, plant and equipment	1,081	220	(10)			1,291
	Depreciation property, plant and equipment
Other property, plant and equipment	74	74	(11)			137
Other property, plant and equipment under finance lease	245	136				381
Depreciation and amortizations	319	209	(11)			518
Net Property, plant & equipment	762					773

Long-term investments

In thousands of euros

	12/31/2016	Increase	Decrease		12/31/2017
	Long-term investments
Loans	6	0	0	0	6
Other long-term investments (1)	222	154	0	(36)	340
Gross long-term investments	228	154		(36)	346
	Provisions Long-term investments
Other long-term investments
Provisions
Net long-term investments	228				346

(1) Long-term investments mainly correspond to deposits and security payments for premises as

well as for the liquidity agreement.

Note 3 –Receivables

In thousands of euros

	12/31/2017			12/31/2016
	Gross	Depreciation	Net	Net
Trade receivables (1)	6,446	(69)	6,377	4,699
Accounts receivable	6,446	(69)	6,377	4,699
Advances and payments on account Other receivables (2) Prepaid expenses	8 1,444 260		8 1,444 260	0 1,320 200
Other receivables	1,711		1,711	1,519
Deferred tax assets
Operating receivables	8,157	(69)	8,088	6,218

Receivables are due within one year.

(1) The sharp increase in trade receivables can be explained by the strong growth in activity concentrated at the end of the year.
(2) The other receivables at December 31, 2017 mainly include the RTC for €910k, the CII for €80k and receivable subsidies for €186k.

Provision on Current assets

In thousands of euros

	12/31/2016	Allocation	Reversal	12/31/2017
Accounts receivable	6	63		69
Other receivables	2		(2)
Total	8	63	(2)	69

Note 4- Provisions

Provisions for risks and liabilities

In thousands of euros

	12/31/2016	Allocation	Reversal used	Change in exchange rate	12/31/2017
Provisions for risks (1) Provisions for expenses (2)	85 151	414			85 565
Total	237	414			650

(1) Wallix was subject to an inspection by the French tax authorities concerning the Research Tax Credit (RTC) received from 2011 to 2014. On completion of this audit, the tax authorities proposed an adjustment of €586k over a total of €1,873k refunded. The Company has challenged most of this proposal and has set aside a provision of €69k.
(2) Provisions for liabilities concern the provisions for pensions and retirement as well as the provision for specific employer contribution to the bonus share awards.

The provisions for pensions and retirement were estimated solely for WALLIX SARL and WALLIX GROUP (Wallix US does not have any employee); the criteria adopted to determine these provisions for retirement are explained in section 2 "Retirement commitments".

A provision for liabilities of €354k was established in respect of the specific employer contribution on the free share awards owned by the employer of the beneficiary. This contribution will be payable at the end of the vesting period. The evaluation of the provision was based on the average share price over the last thirty trading days preceding the date of the estimate.

Note 5- Financial liabilities

In thousands of euros

	12/31/2017	12/31/2016
Loans from credit institutions (1)	1,691	1,055
Bank overdrafts	1	1
Finance leases	258	393
Other borrowings & financial debts (2)		123
Total	1,950	1,572

In thousands of euro

	12/31/2017	< 1 year	> 1 year & < 5 years	> 5 years
Loans from credit institutions (fixed rates)	1,691	273	1,248	170
Bank overdrafts	1	1
Finance leases	258	113	145
Other financial borrowings & debts
Total	1,950	387	1,393	170

(1) A new loan was contracted during the financial year for €850k.

(2) The "Other financial debts" item as at December 31, 2016 comprised an advance from Coface for €123k definitively acquired during the 2017 financial year, and therefore recorded in other operating profit (see Note 8).

At December 31, 2017, the Group's financial liabilities included:

A loan at the fixed rate of 0.96% for a total amount of €300k from BNP Paribas entered into by Wallix SARL, dated March 29, 2016 in order to refinance the refurbishment works of the Group's new headquarters. Balance to be repaid: €197k – Final repayment date at March 29, 2021
Zero-interest loan for a total amount of €700k from OSEO (now Bpifrance Financement) entered into by Wallix Group and Wallix SARL, on July 24, 2013 in order to finance the design and development of a centralized solution for management of privileged access to IT resources, combining the requirements of security and production. This loan is interest free. Balance to be repaid: €488k – Final repayment date at March 31, 2020
Zero-interest loan for an overall amount of €850k from Bpifrance Financement negotiated by Wallix Group and Wallix SARL on March 22, 2017 in order to finance the development of a securitization

system for privileged access to Cloud-based applications or IT systems. Balance to be repaid: €850k (currently in a grace period, followed by a period of repayment by equal installments with a first repayment date on March 31, 2019 and a final repayment date on December 31, 2023)

Fixed interest loan of 1.20% for a total amount of €108k with BNP Paribas negotiated by Wallix Group on August 30, 2016 to finance part of the acquisition of the assets of Proviciel (this loan was arranged in connection with a more comprehensive financing transaction with Bpifrance Financement with the following distribution percentages: 60% of the investment financed by BNP Paribas and 40% by Bpifrance Investissement, as described below): Balance to be repaid: €85k – Final repayment date at August 30, 2022
Fixed interest loan of 2.99% (average monthly rate of the yield on long-term Government bonds, increased by 2.74%) for an amount of €72k from Bpifrance Financement negotiated by Wallix Group on July 27, 2016 for the post-financing of the acquisition of assets from Proviciel (complementary to the BNP Paribas loan mentioned above). Balance to be repaid: €72k (currently in a grace period, followed by a period of repayment by equal installments with a first repayment date on July 31, 2018 and a final repayment date on October 31, 2022).

Note 6- Operating liabilities

In thousands of euros

	12/31/2017	12/31/2016
Trade payables	868	523
Trade payables	868	523
Tax and social security payables Other liabilities Deferred income	2,973 17 7,628	1,945 14 4,660
Other liabilities	10,618	6,620
Total	11,486	7,142

Operating liabilities mature within one year.

The Company is subject to VAT on receipts of cash. Tax liabilities include VAT on nonreceived trade receivables for €821k at December 31, 2017 versus €629k at December 31, 2016.

Deferred income concerns different categories of revenue which are presented as follows:

In thousands of euros

	PI outstanding on the balance sheet
Years	12/31/2017	12/31/2016
DI on revenue	5,645	3,059
DI on RTC (1)	1,583	1,225
DI on subsidies (1)	400	377
	7,628	4,660

(1) see RTC and subsidies page 17-18

Deferred income corresponds to the percentage of Turnover invoiced and recognized for the period but for which the product or service will be delivered or furnished after the balance sheet date (for example, maintenance paid in advance).

Prepaid income on the RTC and on the subsidies correspond to the capitalized part of the research tax credit and of the subsidies chargeable to projects.

Note 7- Turnover

The turnover reported by the Group comes from the following activities:

Software user licenses
Associated maintenance services: technical support and updates
Managed services: secure hosting of critical applications

Income from license sales is recognized on the date when the software is provided.

Turnover from maintenance is recognized on a straight-line basis depending on the term of the maintenance agreement.

The term of these contracts varies between one and three years.

The turnover from services provided is recognized when the services are performed.

In thousands of euros
Revenue	12/31/2017	%	12/31/2016	%
Licenses Maintenance	7,937 3,197	68.8% 27.7%	4,879 2,118	66.3% 28.8%
Managed services	410	3.6%	367	5.0%
Total	11,545	100%	7,364	100%

Geographic regions	12/31/2017	%	12/31/2016	%
France	8,589	74.4%	5,283	71.7%
International	2,956	25.6%	2,081	28.3%
Total	11,545	100%	7,364	100%

Note 8- Other operating income

In thousands of euros

	12/31/2017	12/31/2016
- Capitalized production (1) - Operating subsidy (2)	2,575 813	1,896 959
- Reversals of provisions, depreciations, amortizations, transfer	27	23
- Other operating income	134	0
Other revenue	3,549	2,878

(1) The balance of the capitalized production account corresponds mainly to payroll costs capitalized as development costs.

(2) The operating subsidies are broken down as follows:

	12/31/2017	12/31/2016

Non restated operating subsidy	69	215
RTC restated under Subsidy	247	327
Share of RTC deferred over 5 years (DI) (1)	369	294
Share of subsidies deferred over 5 years (DI) (1)	128	123

Operating subsidy	813	959

(1) see RTC and subsidies page 17-18

Note 9- Payroll costs

In thousands of euros

	Payroll costs	12/31/2017	12/31/2016
	Salaries and profit sharing	6,418	4,619
	Social security charges	2,669	1,896
Profit
Total		9,087	6,515
	Average staff for the year	12/31/2017	12/31/2016
	Executives		72	63
	Employees		1	1
	Total		73	64

Note 10- Financial result

In thousands of euros

	12/31/2017	12/31/2016
- Other interests and similar revenues	1	7
- Realized exchange gains		12
FINANCAL REVENUES	1	20
- Interests and similar expenses	(10)	(9)
- Realized exchange losses	(10)	(31)
INTEREST EXPENSE	(20)	(40)
FINANCIAL RESULTS	(19)	(20)

Note 11- Extraordinary income and expenses

In thousands of euros

	12/31/2017	12/31/2016
- On capital transactions (1)	5	421
EXTRAORDINARY INCOME	5	421
- On management transactions (2) - On capital transactions (3) - Provisions	(180) (5) (2)	(1) (311) (7)
EXTRAORDINARY EXPENSES	(187)	(319)
EXTRAORDINARY INCOME AND EXPENSES	(182)	102

(1) Of which €316k in 2016 corresponding to disposals of capitalized equipment (disposal price).

(2) These are non-recurring fees for a strategic study in 2017.

(3) €303k in 2016 corresponding to disposals of capitalized equipment (NAV).

Note 12- Tax analysis

In thousands of euros

DEFERRED TAXES RECOGNIZED IN THE BALANCE SHEET

	12/31/2017	12/31/2016
- Deferred tax assets - Deferred tax liabilities
Total
ANALYSIS OF TAX EXPENSE	12/31/2017	12/31/2016
- Taxes payable - Deferred taxes	5
Total	5

In thousands of euros

	12/31/2017
Taxes due	5
Deferred taxes	0
Total	5

Net profit (loss) of consolidated companies	(1,050)
Actual tax expense/revenue	5
Profit before tax of consolidated companies	(1,045)
Theoretical tax expense/revenue	(261)
Impact of definitely non-deductible expenses	38
Impact of rate difference	95
Capping of DTA at amount of DTL	107
Non-capitalized losses for the year	279
Tax credit	(254)
Actual tax expense/revenue	5

Theoretical tax rate	25%
Actual tax rate	0%

WALLIX Group Consolidated Financial Statements at December 31, 2017

In thousands of euros

	12/31/2016	Change	12/31/2017
Differences between the book and tax result	5	89	94
Restatement of finance lease	1	0	1
Recognition of pension commitments	50	2	53
Restatement of operating subsidies	126	(26)	100
Capping of DTA at amount of DTL	(168)	(67)	(235)
Deferred tax assets (1)	15	(2)	13
Cancellation of internal provisions	14	(2)	12
Cancellation of the provision on treasury shares	1	0	1
Deferred tax liabilities (2)	15	(2)	13

Net deferred tax balance (1)-(2)	0	0

In thousands of euros

NON-CAPITALIZED TAX LOSSES

Companies	Amount (1)	Tax rate	Unrecognized deferred tax asset (in local currency)	Unrecognized deferred tax asset (in € thousands)	Limit of allocation to future profits
Wallix Group	6,354	25%	1,589	1,589	No limit
Wallix	4,700	25%	1,175	1,175	No limit
Total in euros				2,764

(1) It consists of the tax debt at December 31, 2017

Note 13- Compensation for corporate officers

The amount of compensation awarded to senior managers, for their duties in controlled companies, is presented as follows:

WALLIX Group Consolidated Financial Statements at December 31, 2017

In thousands of euros Compensation 12/31/2017 12/31/2016 Corporate officers' compensation 617 496 Supervisory board members' fees 9 24 Total 626 520

Note 14- Statutory Auditor fees

In thousands of euros

Statutory Auditor fees	12/31/2017
Statutory audit	47
Services other than the certification of accounts	21

Total	68

Note 15- Off balance sheet commitments

No material off balance sheet commitment has been identified.

20.2 Statutory auditor's report on the consolidated 2017 financial statements

KPMG AUDIT PARIS ET CENTRE Tour EQHO 2 Avenue Gambetta CS 60055 92066 Paris la Défense Cedex France

Telephone: +33 (0)1 55 68 86 66 Telefax: +33 (0)1 55 68 98 29 Internet: www.kpmg.fr

Error! Unknown document property name.

Error! Unknown document property name.Error! Unknown document property name.

Financial year ended December 31, 2017 Wallix Group S.A. 250 bis, rue du Faubourg Saint Honoré – 75008 Paris This report contains 5 pages reg 5 Reference: CF-182-24

166

KPMG Audit Paris et Centre, a French limited liability entity and a member firm of the KPMG Network of independent member firms affiliated with KPMG International Cooperative, a Swiss entity. Simplified joint-stock company registered at the Compagnie Régionale des Commissaires aux Comptes de Versailles..

KPMG AUDIT PARIS ET CENTRE Tour EQHO 2 Avenue Gambetta CS 60055 92066 Paris la Défense Cedex France

Telephone: +33 (0)1 55 68 86 66 Telefax: +33 (0)1 55 68 98 29 Internet: www.kpmg.fr

Error! Unknown document property name. Registered office: Error! No document variable supplied. Share capital: €.Error! No document variable supplied.

Error! Unknown document property name.Error! Unknown document property name. Error! Unknown document property name.Error! Unknown document property name.

Error! Unknown document property name.

Error! Unknown document property name.,

Opinion

In compliance with the engagement entrusted to us by your annual general shareholders' meeting, we have audited the accompanying consolidated financial statements of Wallix Group S.A. for the year ended 31 December 2017.

In our opinion, the consolidated financial statements give a true and fair view of the assets and liabilities and of the financial position of the Group as at 31 December 2017 and of the results of its operations for the year then ended in accordance with French accounting principles.

Basis for Opinion

Audit Framework

We conducted our audit in accordance with professional standards applicable in France. We believe that the audit evidence we have obtained is sufficient and appropriate to provide a basis for our opinion.

Our responsibilities under those standards are further described in the Statutory Auditors' Responsibilities for the Audit of the Consolidated Financial Statements section of our report.

Independence

We conducted our audit engagement in compliance with independence rules applicable to us, for the period from 1 January 2017 to the date of our report and specifically we did not provide any prohibited non-audit services referred to in the French Code of ethics (code de déontologie) for statutory auditors.

Justification of Assessments

In accordance with the requirements of Articles L.823-9 and R.823-7 of the French Commercial Code (code de commerce) relating to the justification of our assessments, we inform you of the matters that, in our professional judgment, were of most significance in our audit of the consolidated financial statements of the current period.

167

Wallix Group S.A. Statutory auditors' report on the consolidated financial statements 6 April 2018

These matters were addressed in the context of our audit of the consolidated financial statements as a whole, and in forming our opinion thereon, and we do not provide a separate opinion on specific items of the consolidated financial statements.

• Development costs capitalized

Section 3 "Measurement methods and rules", paragraph "Intangible Assets" of the Notes to the consolidated financial statements presents the accounting rules and methods applied to capitalize and amortize development costs.

In connection with our assessment of the accounting principles followed by your Group, we reviewed the methods applied to capitalize development costs, their amortization and we checked that the Notes to the consolidated financial statements in section 3 – paragraph "Intangible Assets" and section 4 – Note 2 provide appropriate information.

• Research tax credit (RTC) and operating subsidies

Section 3 "Measurement method and rules", paragraph "Research tax credit and operating subsidies" of the Notes to the consolidated financial statements describes the accounting treatment of RTC and operating subsidies.

We checked that the accounting treatment followed by your Group is compliant with French accounting principles and that the Notes to the consolidated financial statements provides appropriate information in this respect.

• Revenue recognition

Note 7 "Turnover" of the Notes to the consolidated financial statements presents the accounting rules and methods followed for the recognition of revenue.

We checked that these policies for revenue recognition are appropriate, that they have been correctly applied by the group and that the Notes to the consolidated financial statements provide appropriate information in this respect.

Verification of the Information Pertaining to the Group Presented in the Management Report

As required by law we have also verified in accordance with professional standards applicable in France the information pertaining to the Group presented in the management report of the Board of Directors

We have no matters to report as to its fair presentation and its consistency with the consolidated financial statements.

Responsibilities of Management and Those Charged with Governance for the Consolidated Financial Statements

Management is responsible for the preparation and fair presentation of the consolidated financial statements in accordance with French accounting principles and for such internal control as management determines is necessary to enable the preparation of consolidated financial statements that are free from material misstatement, whether due to fraud or error.

In preparing the consolidated financial statements, management is responsible for assessing the Company's ability to continue as a going concern, disclosing, as applicable, matters related to going

Wallix Group S.A. Statutory auditors' report on the consolidated financial statements 6 April 2018

concern and using the going concern basis of accounting unless it is expected to liquidate the Company or to cease operations.

The consolidated financial statements were approved by the Board of Directors. Statutory Auditors' Responsibilities for the Audit of the Consolidated Financial Statements

Our role is to issue a report on the consolidated financial statements. Our objective is to obtain reasonable assurance about whether the consolidated financial statements as a whole are free from material misstatement. Reasonable assurance is a high level of assurance, but is not a guarantee that an audit conducted in accordance with professional standards will always detect a material misstatement when it exists. Misstatements can arise from fraud or error and are considered material if, individually or in the aggregate, they could reasonably be expected to influence the economic decisions of users taken on the basis of these consolidated financial statements.

As specified in Article L.823-10-1 of the French Commercial Code (code de commerce), our statutory audit does not include assurance on the viability of the Company or the quality of management of the affairs of the Company.

As part of an audit conducted in accordance with professional standards applicable in France, the statutory auditor exercises professional judgment throughout the audit and furthermore:

Identifies and assesses the risks of material misstatement of the consolidated financial statements, whether due to fraud or error, designs and performs audit procedures responsive to those risks, and obtains audit evidence considered to be sufficient and appropriate to provide a basis for his opinion. The risk of not detecting a material misstatement resulting from fraud is higher than for one resulting from error, as fraud may involve collusion, forgery, intentional omissions, misrepresentations, or the override of internal control.
Obtains an understanding of internal control relevant to the audit in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of the internal control.
Evaluates the appropriateness of accounting policies used and the reasonableness of accounting estimates and related disclosures made by management in the consolidated financial statements.
Assesses the appropriateness of management's use of the going concern basis of accounting and, based on the audit evidence obtained, whether a material uncertainty exists related to events or conditions that may cast significant doubt on the Company's ability to continue as a going concern. This assessment is based on the audit evidence obtained up to the date of his audit report. However, future events or conditions may cause the Company to cease to continue as a going concern. If the statutory auditor concludes that a material uncertainty exists, there is a requirement to draw attention in the audit report to the related disclosures in the consolidated financial statements or, if such disclosures are not provided or inadequate, to modify the opinion expressed therein.
Evaluates the overall presentation of the consolidated financial statements and assesses whether these statements represent the underlying transactions and events in a manner that achieves fair presentation.
Obtains sufficient appropriate audit evidence regarding the financial information of the entities or business activities within the Group to express an opinion on the consolidated financial statements.

Wallix Group S.A. Statutory auditors' report on the consolidated financial statements 6 April 2018

The statutory auditor is responsible for the direction, supervision and performance of the audit of the consolidated financial statements and for the opinion expressed on these consolidated financial statements.

Error! Unknown document property name., on the 6 april 2018

Error! Unknown document property name.

Error! Unknown document property name.

WALLIX GROUP

SIRET Number: 42875314900056

250 B rue du Faubourg Saint Honoré 75008 PARIS

ANNUAL FINANCIAL STATEMENTS

from 01/01/2017 to 12/31/2017

No table of contents entries found.
Balance sheet and Result 173
Notes178

Balance sheet and Result

ASSETS		Current year 31/12/2017 (12 months)			Past year 31/12/2016 (12 months)
	Brut	Depr.& prov.	Net	%	Net	%
(0) Uncalled capital
Fixed assets
Preliminary expenses Research and development expenses Concessions, patents and similar rights Goodwill Other intangible fixed assets Advances and prepayments on intangible fixed assets	180 800,00 4 000,00	61 836,67	118 963,33 4 000,00	1, 11 0,04	154 905,00 4 000,00	1,36 0,04
Land Buildings Industrial fixtures, fittings, plant machinery and equipment Other tangible fixed assets Fixed assets in progress Advances and prepayments	62 832,78 3 090,55	25 311,46	37 521,32 3 090,55	0,35 0,03	40 827,89	0,36
Long-term investments by "equivalence method" Other interest ownership Receivables related to interest ownership	122 755,00		122 755,00	1, 14	122 755,00	1,08
Capitalized securities	145 955,44	4 099,00	141 856,44	1,32	106 138,56	0,93
Loans Other fixed assets	157 777,05		157 777,05	1,47	97 366,36	0,86
TOTAL(I)	677 210,82	91 247,13	585 963,69	5,45	525 992,81	4,63
Current assets Raw materials and supplies Work in progress of goods Work in progress of services Semi-finished and finished goods Goods held for resale
Advances and down-payments to suppliers Trade and related accounts Other receivables . Debtors suppliers . Staff	314 861,83		314 861,83	2,93	272 516,48 2 220,00	2,40 0,02
. Payroll taxes . State, profit tax . State, turnover tax . Other Called but unpaid capital	4596,00 122 508,05 5 631 928,40		4 596,00 122 508,05 5 631 928,40	0,04 1,14 52,35	780,00 33 278,09 6 366 411,88	0,01 0,29 56,00
Investment securities Cash Instruments	3 973 866,02		3 973 866,02	36,94	4 081 584,89	35,90
Cash Prepaid expenses	89 948,16 34 069,85		89 948,16 34 069,85	0,84 0,32	66 822,27 19519,57	0,59 0,17
TOTAL (II)	10 171 778,31		10 171 778,31	94,55	10 843 133,18	95,37
Charges to be spread over several periods (III) Premium for redemption of bonds (IV) Unrealized exchange losses (V)
TOTAL ASSETS (0 à V)	10 848 989,13		91 247,13 10 757 742,00 100.00 11 369 125,99 100.00

ASSETS		Current year 31/12/2017 (12 months)		Past year 31/12/2016 (12 months)
	Brut	Depr.& prov.	Net	%	Net	%
Uncalled capital (0)
Fixed assets
Preliminary expenses Research and development expenses Concessions, patents and similar rights Goodwill Other intangible fixed assets Advances and prepayments on intangible fixed assets	180 800,00 4 000,00	61 836,67	118 963,33 4 000,00	1,11 0,04	154 905,00 4 000,00	1,36 0,04
Land Buildings Industrial fixtures, fittings, plant machinery and equipment Other tangible fixed assets Fixed assets in progress Advances and prepayments	62 832,78 3 090,55	25 311,46	37 521,32 3 090,55	0,35 0,03	40 827,89	0,36
Long-term investments by "equivalence method" Other interest ownership Receivables related to interest ownership	122 755,00		122 755,00	1,14	122 755,00	1,08
Capitalized securities Loans	145 955,44	4 099,00	141 856,44	1,32	106 138,56	0,93
Other fixed assets	157 777,05		157 777,05	1,47	97 366,36	0,86
TOTAL(I)	677 210,82	91 247,13	585 963,69	5,45	525 992,81	4,63
Current assets Raw materials and supplies Work in progress of goods Work in progress of services Semi-finished and finished goods Goods held for resale
Advances and down-payments to suppliers Trade and related accounts Other receivables . Debtors suppliers . Staff	314 861,83		314 861,83	2,93	272 516,48 2 220,00	2,40 0,02
. Payroll taxes . State, profit tax . State, turnover tax . Other Called but unpaid capital	4596,00 122 508,05 5 631 928,40		4 596,00 122 508,05 5 631 928,40	0,04 1,14 52,35	780,00 33 278,09 6 366 411,88	0,01 0,29 56,00
Investment securities Cash Instruments	3 973 866,02		3 973 866,02	36,94	4 081 584,89	35,90
Cash Prepaid expenses	89 948,16 34 069,85		89 948,16 34 069.85	0,84 0,32	66 822,27 19519,57	0,59 0,17
TOTAL (II)	10 171 778,31		10 171 778,31	94,55	10 843 133,18	95,37
Charges to be spread over several periods (III) Premium for redemption of bonds (IV) Unrealized exchange losses (V)
$TOTAI$ ASSETS $(0 \land V)$ 10 848 989 13			$21.247.13$ 10.757.742.00 $\sim$ 11.369.125.99 $\sim$

		Current year		Past year
EQUITY AND LIABILITIES		31/12/2017	31/12/2016
		$(12$ months)		$(12$ months)

Shareholders' equity Share capital (paid-up capital: 404 471,00) Premiums arising from shares issues, from merger Revaluation		404 471,00 14 916 822,90	3,76 138,66	400 799,00 14 797 584,63 130,15	3,53
Legal reserve Statutory reserve		13 909,00	0,13	13 909,00	0, 12
Regulated reserves Other reserves Retained (profits / losses) brought forward merger		11 270,00 -4 568 840,68	0, 10 $-42,46$	$-3511052,68$	$-30,87$
Net income or loss of the tax year				$-1$ 146 386,31 $_{10,65}$ -1 057 788,00	$-9,29$
Subsidies of investment Regulated provisions
	TOTAL(I)	9631245,91	89,53	10 643 451,95 93,62
Proceeds from the issuance of "participating titles" Conditional advances
	TOTAL(II)
Provisions for liabilities and charges Reserves for contingencies
Provisions for charges		199 086,00	1,85
	TOTAL (III)	199 086,00	1,85
Loans and debts Convertible debenture loans Other debenture loans Bank borrowing and bank overdrafts . Bank borrowing . Bank overdrafts Other financial borrowing and debts . Miscellaneous . Partners Advances and down-payments for work in progress		157 024,09 560,59 9 000,00	1,46 0,01	174 560,50 318,63 123 435,36	1,54 0,00 1,09
Trade notes and related accounts payable Tax payable and social liabilities		475 793,63	0,08 4,42	210 635,21	1,85
. Staff . Payroll taxes . State, profit tax		90 576,42 113 787,40	0,84 1,06	64 893,43 64 156,24	0,57 0,56
. State, turnover tax . State, guaranteed bonds		45 495,44	0,42	44 672,58	0,39
. Other taxes Liabilities on fixed assets and related accounts Other debts		1 191,00 4 086,00	0,01	447,00	0,00
Prepaid income		29 895,52	0,04 0,28	273,00 42 282,09	0,00 0,37
	TOTAL(IV)	927 410,09	8,62	725 674,04	6,38
Unrealized exchange gains	(V)
	TOTAL LIABILITIES (I à V) 10 757 742,00 $ 100,000 $ 11 369 125,99 $ 100,000 $

		Current year		Past year		Variation
INCOME STATEMENT		31/12/2017		31/12/2016		absolute	%
			(12 months)		(12 months)		(12/12)
	France	Export	Total	℅	Total	℅	Variation	%

Sales of goods	2 530,00	4 500,00	7 030,00	1,38	1 770,00	0,39	5 2 6 0	297,18
Sales of manufactured goods Sales of manufactured services	445 515,19	57 437,30	502 952,49 98,62		453 564,96	99,61	49 388	10,89

Net turnover	448 045,19	61 937,30	509 982,49 100,00		455 334,96 100,00		54 648	12,00

Stored production
Capitalized production Operating subsidies			2 000,00	0,39			2000	N/S
Recaptures on deprecations and reserves, expense transfer			50 307,60	9,86	60 821,58	13,36	$-10.514$	$-17,28$
Other operating income			123 490,84	24,21	2,50	0,00	123 488	N/S
		Total operating income	685 780,93	134,47	516 159,04	113,36	169 621	32,86
Purchase of goods (including customs duties)			3913,32	0,77	2 292,66	0,50	1 621	70,72
Variation on inventory (goods)
Purchase of raw materials and other supplies (including customs duties)
Variation in inventory (raw materials and supplies) Other purchases and external expenses			712 682,65 139,75		666 649,61	146,41	46 033
Taxes and assimilated payments			10 108,99	1,98	11 190,63	2,46	$-1082$	6,91 $-9,66$
Salaries and wages expenses			545 814,53	107,03	444 098,83	97,53	101 716	22,90
Social security expenses			221 367,93	43,41	190 640,35	41,87	30 727	16,12
Operating allowances on fixed assets : depreciation allowances			41 956,84	8,23	31 009,72	6,81	10 947	35,30
Operating allowances on fixed assets : reserve allowances Operating allowances on current assets : reserve allowances					2 220,00
Operating allowances for contingencies : reserve allowances			199 086,00	39,04		0,49	$-2220$ 199 086	$-100,00$ N _S
Other expenses			11 051,64	2,17	24 501,39	5,38	$-13450$	$-54,89$
		Total operating expenses	1 745 981,90 342,36		1 372 603,19	301,45	373 378	27,20
		OPERATING RESULT	$-1060200,97$ -207,88		-856 444,15	188,08	-203 756

Attributed income or transfered loss
Suffered loss or transfered profit
Financial income from interest ownership
Other holdings and capitalized receivables					70,25	0,02	-70	$-100,00$
Other interest and assimilated income			1 170,34	0,23	7 042,50	1,55	$-5872$	$-83,38$
Recaptures on provisions and expense transfer			3 496,00	0,69			3 4 9 6	N/S
Profits on foreign exchange Net gains on sales of portfolio securities			14,17	0,00	38,76 97,97	0,01 0,02	-38 -83	$-100,00$ $-85,56$
		Total financial income	4 680,51	0,92	7 249,48	1,59	$-2569$	$-35,43$

Financial allowances for depreciations and provisions Interests and assimilated expenses		4 099,00 3 282,42	0,80 0,64	3 496,00 300 977,36	0,77 66,10	603 $-297695$	17,25 $-98,90$
Loss on foreign exchange				51,19	0,01	-51	$-100,00$
Net loss on sales of portfolio securities
		Total financial expenses	7 381,42	1,45	304 524,55	66,88	$-297143$	$-97,57$
		FINANCIAL RESULT	$-2700,91$	$-0,52$	-297 275,07	$-65,28$	294 575	99,09
		Ordinary result before tax -1 062 901,88 $ _{208,41} $			$-1$ 153 719,22 $ _{253,37}$		90 818

INCOME STATEMENT (next)		Current year 31/12/2017 (12 months)		Past year 31/12/2016 $(12$ months)	Variation absolute (12/12)	$\frac{6}{6}$

Extraordinary operating gains Extraordinary capital gains Recaptures on reserves and expense transfers		102 995,36 20,20	106 021,02	23,28	$-3026$	$-2,84$
Total extraordinary income	102 995,36 20,20		106 021,02	23,28	$-3026$	$-2,84$
Extraordinary operating losses Extraordinary capital losses		180 000,00 35,30	360,00 2709,66	0.08 0.59	179 640 $-2709$	N/S $-100,00$
Depreciation and reserve extraordinary allowances	1938,79	0.38	7 020,14	1.54	$-5082$	$-72,38$
Total extraordinary expenses		181 938,79 35,68	10 089,80	2,22	171849	$N$ ^S
EXTRAORDINARY RESULT	$-78943,43$	$-15,47$	95 931,22	21,07	$-174874$ -182,28
Profit sharing scheme Income tax	4 541,00	0.89			4541	N/S
Total Income	793 456,80 155,59		629 429.54 138,23		164 027	26,06
Total expenses	1 939 843.11 380.37		1 687 217,54	370,54	252 626	14,97
NET RESULT	$-1$ 146 386,31 224.78 Loss		$-1057788,00$ $-232,30$ Loss		$-88598$

Including leasing of furnitures
Including leasing of real estate

Notes

To the balance sheet before appropriation for the financial year ended 12/31/2017 amounting to €10,757,742 and to the income statement for the year showing a loss of -€1,146,386.31, presented as a list.

The financial year covers 12 months, spanning the period from 01/01/2017 to 12/31/2017.

The notes and tables below are an integral part of the annual financial statements.

The prior financial year covered 12 months, spanning the period from 01/01/2016 to 12/31/2016.

ACCOUNTING RULES AND METHODS

Accounting rules and methods
Change of method
Additional information to convey a true image

ADDITIONAL INFORMATION ON THE BALANCE SHEET AND INCOME STATEMENT

Statement of fixed assets
Statement of depreciations and amortizations
Statement of provisions
Statement of due dates for receivables and payables

Information and comments on:

Items that concern several balance sheet line items
Goodwill
Accrued revenue and credit notes receivable
Accrued liabilities and credit notes to be issued
Prepaid expenses and deferred revenue
Share capital ownership
Potential capital
Statement of changes in shareholders' equity
Breakdown of net turnover

FINANCIAL COMMITMENTS AND OTHER DISCLOSURES

Financial commitments
Compensation for managers
Statutory Auditors' fees
Average staff
Commitments taken on pensions, retirements and similar commitments
List of subsidiaries and affiliates

Accounting rules and methods

The general accounting principles were applied in compliance with the principle of prudence, in accordance with the following basic assumptions:

going concern,
consistency of accounting principles from one year to the other,
separate time periods,

and in accordance with the generally accepted rules for the preparation and presentation of annual accounts.

The historic cost method is the basic method used to measure the items recorded in the accounts. The main methods used are the following:

INTANGIBLE ASSETS AND PROPERTY, PLANT AND EQUIPMENT

Property, plant and equipment are measured at their cost of acquisition or production, taking into account the cost required for making them ready for use, and after deducting sales discounts, rebates and discounts obtained on payments.

The following decisions were taken in the presentation of the annual accounts: - separable fixed assets: the company was unable either to define the fixed assets that can be separated into components or the separation of these assets has no material impact, - inseparable fixed assets: since the company is entitled to some leeway, it decided to apply the useful life for the depreciation of inseparable assets.

Depreciations for impairment are calculated according to the straight line or decreasing charge method, depending on the expected useful life:

IT software	1 year to 5 years
Office equipment and IT	3 years
Works of art	NA
Office furniture	from 5 to 8 years

LONG-TERM INVESTMENTS AND MAKETABLE SECURITIES

The gross value consists of the purchase cost excluding incidental expenses. Where the current value is less than the gross value, an impairment is recognized for the amount of the difference.

RECEIVABLES AND LIABILITIES

Receivables and liabilities are measured at their par value. An impairment is recognized when the inventory value is lower than the carrying value.

RECOGNITION, PRESENTATION OF THE CICE

The CICE tax credit (to boost business competitiveness) was recognized through the option of reducing payroll costs, credit of sub-account 64 (ANC, information note of February 28, 2013).

The impact of the recognition of the CICE on the financial statements, is as follows: - Reduction of payroll costs / Receivables from the French State: EUR 3,816

Pursuant to the provisions of Article 244-quater C of the French General Tax Code, we specify that since the CICE is supposed to be used by companies to finance improvement to their competitiveness, our entity uses it in its efforts, in particular:

to prospect for new markets
to reconstitute its working capital.

PROVISION FOR RISKS AND LIABILITIES

A provision was established to cover liabilities of €199,000 in respect of the specific employer contribution on the bonus share awards owed by the beneficiary's employer. This contribution will be payable at the end of the vesting period.

The evaluation of the provision was based on the average share price over the last thirty trading days preceding the date of the estimate.

TURNOVER

The turnover reported by the company comes from the following activity: Managed services: secure hosting of critical applications. Turnover from services provided is recognized when the service is performed.

EXTRAORDINARY INCOME AND EXPENSES

Income and expenses which, by their type, their occurrence, or their material nature, are not considered as recurring activities, are recognized as extraordinary income or expense.

The extraordinary income of €103,000 consists of gains from treasury share acquisitions made under the liquidity agreement.

The extraordinary expenses on management operations correspond to €180,000 of strategic study fees.

Change of method

The methods for measuring and presenting the annual accounts adopted for this financial year are the same as those used for the prior financial year.

Preparation of the financial statements in accordance with:

the General Chart of Accounts 2014 approved by the decree of September 8, 2014
articles L123-12 to L123-28 of the French Commercial Code

Additional information to convey a true and fair view

Under the liquidity agreement, Wallix Group holds 8,166 equity shares for a net amount of €141,856.

Transfers of expenses amount to EUR 42,000 of rebilling of various overheads to the Wallix subsidiary.

The loss carryforward for Wallix Group totals €6,354 thousand.

Statement of fixed assets

	Gross value of	Increases
	fixed assets at the start of the year	Revaluation during the financial year	Acquisitions, creations, item to item transfers
Establishment costs, research and development
Other intangible assets	185,415
Land
Buildings on own land
Building on third-party land
General fixtures, fittings, buildings
Technical fixtures, industrial machinery and
tools
Other fixtures, fittings, improvements
Transportation equipment
Office equipment, IT, furniture	68,377		4,647
Recoverable packaging and other
Investments in progress			3,091
Advances and payments on account
TOTAL	68,377		7,738
Equity interests accounted for using the equity
method
Other equity interests	122,755
Other capitalized securities	109,635		623,230
Loans and other long-term investments	97,366		686,772
TOTAL	329,756		1,310,002
GRAND TOTAL	583,548		1,317,740

		Decreases	Gross value	Leg. Reval.
	By item to item transfer	By disposal or decommissioning	fixed assets at year end	Original val. at year end
Establishment costs, research and development
Other intangible assets		615	184,800	180,800
Land
Buildings on own land
Buildings on third-party land
General fixtures, fittings, buildings
Technical fixtures, industrial machinery and tools
Other fixtures, fittings, improvements
Transportation equipment
Office equipment, IT, furniture		10,192	62,833	62,833
Recoverable packaging and other
Investments in progress			3,091
Advances and payments on account
TOTAL		10,192	65,923	62,833
Equity interests accounted for using the equity
method
Other equity interests			122,755	57,300
Other capitalized securities		586,909	145,955
Loans and other long-term investments		626,362	157,777
TOTAL		1,213,271	426,487	57,300
GRAND TOTAL		1,224,077	677,211	300,933

Statement of depreciations and amortizations

	Positions and changes during the year
	Start of year	Allocations for the year	Removed items reversals	End of year
Establishment costs, research
Other intangible assets	26,510	35,942	615	61,837
Land
Buildings on own land
Building on third-party land
General fixtures, fittings, buildings
Technical fixtures, industrial machinery and
tools
General fixtures,miscellaneous fittings
Transportation equipment
Office equipment, IT, furniture	27,549	7,954	10,192	25,311
Recoverable packaging and other
TOTAL	27,549	7,954	10,192	25,311
GRAND TOTAL	54,059	43,896	10,807	87,148

		Breakdown of amortization and depreciation expense for the year	Changes affecting the provision for additional deprec.
	Straight line	Decreasing charge	Extraordinary	Allowances	Reversals
Establishment costs, research
Other intangible assets	35,942
Land
Buildings on own land
Building on third-party land
General fixtures, fittings, buildings
Technical fixtures, industrial machinery
and tools
General fixtures, miscellaneous fittings
Transportation equipment
Office equipment, IT, furniture	7,954
Recoverable packaging and other
TOTAL	7,954
GRAND TOTAL	43,896

Changes during the financial year impacting expenses	Net amount at	Increase	Amort & dep.	Net amount at
deferred over several financial years	start		expense	end
Expenses to be deferred over several years Bond redemption premiums

Statement of provisions

PROVISIONS	Start of year	Increases in allocations	Decreases Reversals	End of year
For reconstitution of deposits For investments For price increases Additional tax allowable depreciation Of which, exceptional 30% increase For setting up abroad, before 1.1.92 For setting up abroad, after 1.1.92 For setting up loans Other regulated provisions
TOTAL Regulated provisions
For litigation For guarantees granted to customers For losses on futures markets For fines and sanctions For foreign exchange losses For pensions and similar obligations For taxes For renewal of fixed assets For major repairs For liabilities linked to paid leave Other provisions		199,086		199,086
TOTAL Provisions		199,086		199,086
For intangible assets For property, plant and equipment For securities accounted for using the equity method For securities representing controlling interests For other long-term investments For inventories and work in progress For trade accounts Other impairments	3,496 2,220	4,099	3,496 2,220	4,099
Total impairments	5,716	4,099	5,716	4,099
GRAND TOTAL	5,716	203,185	5,716	203,185
Of which, allocations to and reversals of: - operating items - financial items - extraordinary items		199,086 4,099	2,220 3,496

Statement of due dates for receivables and payables

STATEMENT OF RECEIVABLES	Gross amount	Within one year	More than one year
Loans to subsidiaries and affiliates
Loans
Other long-term investments	157,777	142,177	15,600
Doubtful or contested trade accounts
Other trade receivables	314,862	314,862
Receivables representing loaned securities
Payroll and other related accounts
Social security and other welfare schemes
State and other public authorities
- Income tax	4,596	3,816	780
- VAT	122,508	122,508
- Other taxes, levies, contributions, similar
payments
- Other
Group and associates	5,629,813	5,629,813
Other debts	2,115	2,115
Prepaid costs	34,070	34,070
GRAND TOTAL	6,265,741	6,249,361	16,380
Amount of loans granted in the year
Loan repayments in the year
Loans and advances granted to partners

STATEMENT OF LIABILITIES	Gross amount	Within 1 year	More than 1 year Within 5 years
Convertible bond issues
Other bond issues
Borrowings and loans from credit institutions:
- up to 1 year	561	561
- more than 1 year	157,024	26,103	130,921
Other financial borrowings and debts
Trade and other accounts payable	475,794	475,794
Payroll and other related accounts	90,576	90,576
Social security and other welfare schemes	113,787	113,787
State and other public authorities:
- Income tax
- VAT	45,495	45,495
- Guaranteed bonds
- Other taxes and levies	1,191	1,191
Payables on investments and related accounts
Group and associates
Other liabilities	4,086	4,086
Debt representing borrowed securities
Deferred revenue	29,896	29,896
GRAND TOTAL	918,410	787,489	130,921
Borrowings contracted during the year
Borrowings repaid during the year	17,535
Borrowings and debts contracted from
associates

Entries concerning several balance sheet items

(associated companies or companies with which the Company has a shareholding link)

	Amount concerning companies	Amount of
	Related parties	with which the Company has a shareholding link	liabilities and receivables represented by commercial paper
Unissued subscribed capital
Advances and down payments on intangible assets
Advances and down payments on property, plant
and equipment
Equity interests	122,755
Loans to subsidiaries and affiliates
Loans
Other capitalized securities
Other long-term investments
Advances and payments on account
Trade and other accounts receivable	179,790
Other receivables	5,629,813
Subscribed and issued capital, not paid-up
Marketable securities
Cash and cash equivalents
Convertible bond issues
Other bond issues
Borrowings and loans from credit institutions
Other financial borrowings and debts
Advances and down payments received on orders
in progress
Trade and other accounts payable	139,011
Payables for tax and social security
Payables on investments and related accounts
Other liabilities
Investment revenue
Other financial revenue
Interest expense

Goodwill

DESIGNATION	Purchased	Revalued	Received as asset contribution	Amount
Merger loss			4,000	4,000

Accrued revenue and credit notes receivable

Amount of accrued revenue included in the following balance sheet items	Amount inclusive of taxes
LONG-TERM INVESTMENTS
Loans to subsidiaries and affiliates
Other long-term investments
RECEIVABLES
Trade and other accounts receivable	16,639
Other receivables (of which, credit notes receivable:	2,115
MARKETABLE SECURITIES
CASH AND CASH EQUIVALENTS	161
TOTAL	18,915

Accrued liabilities and credit notes to be issued

Amount of accrued expenses and credit notes to be issued included in the following balance sheet items	Amount inclusive of taxes
Convertible bond issues
Other bond issues
Borrowings and loans from credit institutions	918
Other financial borrowings and debts
Payroll and other accounts payable	62,963
Payables for tax and social security	129,580
Payables on investments and related accounts
Other receivables (of which, credit notes to be issued:	4,086
TOTAL	197,547

Prepaid expenses and deferred revenue

	Expenses	Revenue
Operating expenses / revenue Interest expense / financial revenue Extraordinary expense / income	34,070	29,896
TOTAL	34,070	29,896

Comments:

Deferred revenue corresponds to percentages of turnover on invoiced services not yet performed.

Share capital ownership

	Number	Par value
Shares, or shares representing partnership interests, comprising the share capital at the start of the year	4,007,990	0.10
Shares, or shares representing partnership interests, issued during the financial year	36,720	0.10
Shares, or shares representing partnership interests, repaid during the financial year
Shares, or shares representing partnership interests, comprising the share capital at year end	4,044,710	0.10

Comments:

The capital increase stems from the exercise of 14,220 stock warrants and 22,500 stock options 2012.

Potential capital

At the financial year end, the marketable securities issued and the stock warrants awarded by WALLIX GROUP giving access to its equity capital is presented as follows:

AGM	Manageme nt Board	Type	number of authorize d securities	Award	lapsed & canceled securities	previously exercised securities	securities exercised during the period	current securiti es	Number of potential shares (1)	Strik e price in euro (1)	Time limit for exercise
04/30/20	10/21/201									3,68	10/21/20
12	3	BSA 2012 (stock warrants)	1,422	1,422	-		1,422	-	-	6	18
04/30/20	10/21/201	BCE 2012 (founders' stock								3,68	10/21/20
12	3	warrants)	9,800	9,800	-			9,800	98,000	6	18
04/30/20	10/21/201									3.68	10/21/20
12	3	2012 stock options	6,316	5,400	3,166		2,250	900	9,000	6	18
06/12/20	11/28/201	BCE 2014 (founders' stock								2,80	11/28/20
14	4	warrants)	5,835	5,835	-	1,081		4,754	47,540	0	19

(1) Taking into account the 1 for 10 split of the par value of each share decided by the Annual General Meeting of May 6, 2015

2017-1 Plan for the Award of Bonus Shares to be issued
Beneficiaries	Employees and Group employees	Group employees with strategic duties	Members of the Management Board
EGM	06/3/2016	06/3/2016	06/3/2016
Award date / Management Board	07/6/2017	07/6/2017	07/6/2017
Number of shares awarded during the year	54,800	18,200	39,699
Number of canceled shares	4,300
Total number of shares that may be issued	50,500	18,200	39,699
Performance conditions	no	yes/achieved	yes/achieved
Presence condition	yes	yes	yes

Vesting period	20% within 1 year 35% within 2 years 45% within 3 years	1 year	1 year
Lock-in period	1 year / 1st tranche	1 year	1 year
Amount of the expense recognized during the financial year	€6,869		€192,218

Statement of changes in shareholders' equity

	Amount

Shareholders' equity N-1 after income and before OGM - Distributions	10,643,452
Share capital at beginning of year	10,643,452

Changes in share capital	3,672
Changes on the drawing account
Changes in share, merger, contribution premiums, etc.	119,238
Changes in revaluation adjustments
Changes in legal, statutory, contractual and other reserves

Changes in regulated reserves	11,270
Changes in retained earnings	- 1 057 788
Changes in investment subsidies and regulated provisions
- Appropriation of N-1 income to shareholders' equity (excluding distribution)	1,057,788

Changes during the financial year	134,180

Shareholders' equity at year end, before result	10,777,632

	- 1 146
Net income for the year	386

Shareholders' equity at financial year end, after result and before Annual General
Meeting	9,631,246

Breakdown of net turnover

Breakdown by business sector	Amount
Sales of goods Sales of finished products	7,030
Services	502,952
TOTAL	509,982

	Breakdown by geographic market	Amount
France Abroad		448,045 61,937
	TOTAL	509,982

Financial commitments

Commitments given	Amount
Discounted notes not yet receivable
Endorsements and securities
Pension related commitments
Other commitments given:
- joint and several borrower OSEO loan	487,500
- Wallix joint and several guarantee / BPI loan	850,000
- finance leases	21,540
TOTAL	1,359,040
Of which, concerning:
- senior managers
- subsidiaries
- equity interests
- the other affiliates	1,337,500
Of which, commitments with security interests

Commitments received	Amount
Endorsements, securities and guarantees Other commitments received: Clawback provisions	1,096,536
TOTAL	1,096,536
Of which, concerning: - senior managers - subsidiaries - equity interests - the other affiliates	1,096,536
Of which, commitments with real surety interests

Compensation for managers

	Amount
COMPENSATION AWARDED TO MEMBERS:
- of boards of directors
- of management boards	401,285
- of supervisory bodies	8,500

Statutory Auditors' fees

	Amount
- Fees invoiced for the statutory audit of the accounts	29,100
- Fees invoiced for consulting and other services	15,000
TOTAL	44,100

Average staff

	Staff on payroll	Staff seconded to the Company
Executives Supervisors and technicians	3
Employees Workers	2
TOTAL	5

Commitments taken on pensions, retirements and similar commitments

Commitments	Senior managers	Other	Provisions
Pensions and similar benefits
Supplementary pension payments for current staff
Supplementary pension and related payments for retired staff
Retirement and related benefits for current staff		64,690
TOTAL		64,690

Comments:

Assumptions adopted to calculate end-of-career benefits:

Discount rate: 1.30%
Wage adjustment rate: 1.5%
Mobility: DARES R&D turnover table; 5.10% average exit rate
Rate of social security charges: 42-44%
Retirement age: voluntary retirement 65-67 years of age

At 12/31/2016, the evaluation of retirement benefits amounted to €49,410.

List of subsidiaries and affiliates

Subsidiaries and affiliates	Share capital	Reserves and retained earnings	% of capital held	Gross value of securities held	Net value of securities held	Loans and advances granted by the Company	Turnover excluding VAT for the previous financial year	Net income for the previous financial year
A –					Detailed information about subsidiaries & affiliates
- Subsidiaries (more than 50% ownership of equity capital)
WALLIX SARL	50,000	118,006	100.00	122,755	122,755	5,629,813	11,177,692	648,047
WALLIX US CORP		(39,523)	100.00					(13,089)


Affiliates (10 to 50% ownership of equity capital)




B –						Comprehensive information about subsidiaries & affiliates
- Subsidiaries not listed under A:
a) French
b) Foreign
- Affiliates not listed under A:
a) French
b) Foreign

Additional comments

in euro

Companies	Countries	Registered office	SIREN
Wallix	France	250-bis rue du Faubourg Saint-Honoré – 75008 PARIS	450 401 153
Wallix US Corp	United States	c/o KVB PARTNERS, Suite 3502, 60 Broad Street, NEW YORK 10004

KPMG AUDIT PARIS ET CENTRE Tour EQHO 2 Avenue Gambetta CS 60055 92066 Paris la Défense Cedex France

Website: www.kpmg.fr

Tel.: +33 (0)1 55 68 86 66 Fax: +33 (0)1 55 68 98 29

20.4 Statutory auditors' report on the corporate accounts for 2017

Wallix Group S.A.

Statutory Auditors' Report on the Financial Statements

Financial year ended December 31, 2017 Wallix Group S.A. 250 bis, rue du Faubourg Saint Honoré – 75008 Paris This report contains 5 pages reg 5 Reference: CF-182-25

197

KPMG Audit Paris et Centre, a French company, member of the KPMG network of independent firms belonging to the KPMG International Cooperative, a Swiss-law entity Headquarters: KPMG Audit Paris et Centre Tour Eqho 2 avenue Gambetta 92066 Paris la Défense Cedex Capital: €200,000. APE Code 6920Z 512 612 391 R.C.S. Nanterre European Union VAT FR 58 51 26 12 391

Simplified joint-stock company registered at the Compagnie Régionale des Commissaires aux

Comptes de Versailles..

KPMG AUDIT PARIS ET CENTRE Tour EQHO 2 Avenue Gambetta CS 60055 92066 Paris la Défense Cedex France

Tel.: +33 (0)1 55 68 86 66 Fax: +33 (0)1 55 68 98 29 Website: www.kpmg.fr

Error! Unknown document property name.

Registered office: Error! No document variable supplied. Share capital: €.Error! No document variable supplied.

Error! Unknown document property name.Error! Unknown document property name. Error! Unknown document property name.Error! Unknown document property name. Error! Unknown document property name.

Error! Unknown document property name.,

1 Opinion

In compliance with the engagement entrusted to us by your annual general sharehoders' meeting, we have audited the accompanying financial statements of Wallix Group S.A. for the year ended 31 December 2017.

In our opinion, the financial statements give a true and fair view of the assets and liabilities and of the financial position of the Company as at 31 December 2017 and of the results of its operations for the year then ended in accordance with French accounting principles.

Basis for Opinion

Audit Framework

Our responsibilities under those standards are further described in the Statutory Auditors' Responsibilities for the Audit of the Financial Statements section of our report.

Independence

198

KPMG Audit Paris et Centre, a French company, member of the KPMG network of independent firms belonging to the KPMG International Cooperative, a Swiss-law entity Simplified joint-stock company registered at the Compagnie Régionale des Commissaires aux 2 avenue Gambetta 92066 Paris la Défense Cedex Capital: €200,000. APE Code 6920Z 512 612 391 R.C.S. Nanterre European Union VAT FR 58 51 26 12 391

Headquarters: KPMG Audit Paris et Centre

Tour Eqho

Comptes de Versailles..

Justification of Assessments

In accordance with the requirements of article L.823-9 and R.823-7of the French Commercial Code ("Code de commerce") relating to the justification of our assessments, we inform you that the most important assessments made by us according to our professional judgment focused on the appropriateness of the accounting principles used, the reasonableness of the significant estimates and the presentation of financial statements taken as a whole.

These assessments were made in the context of our audit of the financial statements as a whole, and in forming our opinion thereon. We do not provide a separate opinion on specific items of the financial statements.

Verification of the Management Report and of the Other Documents Provided to the Shareholders

We have also performed, in accordance with professional standards applicable in France, the specific verifications required by French law.

Information given in the Management Report and in the other documents sent to shareholders on the financial situation and annual financial statements

We have no matters to report as to the fair presentation and the consistency with the financial statements of the information given in the management report of the Board of Directors and in the other documents provided to Shareholders with respect to the financial position and the financial statements.

Report on Corporate Governance

We attest that the Board of Directors' report on corporate governance contains the disclosures required by Article L.225-37-4 of the French Commercial Code.

Responsibilities of Management and Those Charged with Governance for the Financial Statements

Management is responsible for the preparation and fair presentation of the financial statements in accordance with French accounting principles and for such internal control as management determines is necessary to enable the preparation of financial statements that are free from material misstatement, whether due to fraud or error.

In preparing the financial statements, management is responsible for assessing the Company's ability to continue as a going concern, disclosing, as applicable, matters related to going concern and using the going concern basis of accounting unless it is expected to liquidate the Company or to cease operations.

The financial statements were approved by the Board of Directors.

Statutory Auditors' Responsibilities for the Audit of the Financial Statements

Our role is to issue a report on the financial statements. Our objective is to obtain reasonable assurance about whether the financial statements as a whole are free from material misstatement. Reasonable assurance is a high level of assurance, but is not a guarantee that an audit conducted in accordance with professional standards will always detect a material misstatement when it exists. Misstatements can arise from fraud or error and are considered material if, individually or in the aggregate, they could reasonably be expected to influence the economic decisions of users taken on the basis of these financial statements.

As part of an audit conducted in accordance with professional standards applicable in France, the statutory auditor exercises professional judgment throughout the audit and furthermore:

Identifies and assesses the risks of material misstatement of the financial statements, whether due to fraud or error, designs and performs audit procedures responsive to those risks, and obtains audit evidence considered to be sufficient and appropriate to provide a basis for his opinion. The risk of not detecting a material misstatement resulting from fraud is higher than for one resulting from error, as fraud may involve collusion, forgery, intentional omissions, misrepresentations, or the override of internal control.
Obtains an understanding of internal control relevant to the audit in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of the internal control.
Evaluates the appropriateness of accounting policies used and the reasonableness of accounting estimates and related disclosures made by management in the financial statements.
Assesses the appropriateness of management's use of the going concern basis of accounting and, based on the audit evidence obtained, whether a material uncertainty exists related to events or conditions that may cast significant doubt on the Company's ability to continue as a going concern. This assessment is based on the audit evidence obtained up to the date of his audit report. However, future events or conditions may cause the Company to cease to continue as a going concern. If the statutory auditor concludes that a material uncertainty exists, there is a requirement to draw attention in the audit report to the related disclosures in the financial statements or, if such disclosures are not provided or inadequate, to modify the opinion expressed therein.

Wallix Group S.A. Statutory auditors' report on the Financial Statements 6 April 2018

• Evaluates the overall presentation of the financial statements and assesses whether these statements represent the underlying transactions and events in a manner that achieves fair presentation.

Error! Unknown document property name., on the 6 april 2018

Error! Unknown document property name. Error! Unknown document property name.

20.5 Dividend distribution policy

Since its inception, the Company has not distributed any dividends.

Given the stage of the Group's development, there are no plans to start paying dividends in the near future.

Type of Items / Periods Duration of period	12/31/2017 12 months	12/31/2016 12 months	12/31/2015 12 months	12/31/2014 12 months	12/31/2013 12 months
I - Financial situation at year-end
a) Share capital b) Number of shares issued c) Number of stock warrants	404,471 4,044,710	400,799 4,007,990	399,718 3,997,180	303,468 30,468	263,035 263,035
II - Total operating income
a) Turnover excluding taxes b) Earnings before taxes, depreciation and provisions	509,982 (900,481)	455,335 (1,014,042)	795,269 (648,466)	482,292 (566,168)	371,939 (496,836)
c) Tax on earnings d) Earnings after taxes, but before	4,541 (905,022)	(1,014,042)	(780) (647,686)	(556,168)	(496,836)
depreciation and provisions e) Earnings after taxes, depreciation and provisions f) Total earnings distributed g) Employee profit sharing	(1,146,386)	(1,057,788)	(578,843)	(535,245)	(525,562)
III - Operating income per share
a) Earnings after taxes, but before depreciation and provisions	(0)	(0)	(0)	(18)	(2)
b) Earnings after taxes, depreciation and provisions c) Dividend paid per share	(0)	(0)	(0)	(18)	(2)
IV - Personnel:
a) Number of employees b) Total payroll c) Total paid for social benefits (Social security, social works, etc.)	545,815 221,368	444,099 190,640	478,349 204,293	382,656 169,486	322,980 147,403

20.6 WALLIX GROUP five-year financial summary

20.7 WALLIX GROUP non-deductible expenses under Article 39-4 of the French General Tax Code

Non-deductible expenses under Article 39-4 of the French General Tax Code amounted to €7,440 at the end of 2017.

20.8 Information on payment terms for WALLIX GROUP's suppliers and customers in 2017

In accordance with Articles L.441-6-1 and D.441-4 I of the French Commercial Code, the breakdown of payment terms for the Company's customers and suppliers is given below (in €):

	Article D.441-4 I. 1: Overdue invoices received and outstanding at year-end								outstanding at year-end	Article D.441-4 I. 2: Overdue invoices issued		and
	0 days (indicative)	1 to 30 days	31 to 60 days	61 to 90 days	91 days or more	Total (1 day or more)	0 days (indicative)	1 to 30 days	31 to 60 days	61 to 90 days	91 days or more	Total (1 day or more)
A) Aging bands
Number of	44						22
invoices
concerned Total amount of	181,360	227,544			3,926	231,470	90,231	173,529	2,376	0	32,087	207,992
invoices
concerned
(specify whether
exclusive or
inclusive of tax) Percentage of	15.31%	19.21%			0.33%	19.54%
total amount of	Inc. tax	Inc. tax			Inc. tax	Inc. tax
purchases for
the year
(specify whether
exclusive or
inclusive of tax)
Percentage of							18.37%	35.34%	0.48%		6.53%	42.36%
turnover for the							Exc. tax	Exc.	Exc.		Exc. tax	Exc. tax
year								tax	tax
(specify whether exclusive or
inclusive of tax)

B) Invoices excluded from (A) relating to payables and receivables that are contested or have not been recognized
Number of
invoices
excluded
Total amount of
invoices
excluded (specify
whether exclusive
or inclusive of
tax)
C)	Reference payment terms used (contractual or statutory payment terms –	Article L. 441-6 or Article L. 443-1 of the French Commercial
Code)
Reference
payment terms	X Contractual payment terms: (specify)	X Contractual payment terms: (specify)
used for	☐Statutory payment terms: (specify)	☐Statutory payment terms: (specify)
calculating late
payment

20.9 Internal control procedures

Accounting reports directly to the Chief Financial Officer, who supervises a senior accountant, an accountant and an HR administrative assistant.

Preparation of the budget starts at the end of the third quarter of each year and is usually completed in December. Final adjustments to the budget may be made at the start of the year.

The first stage begins in the Steering Committee where, depending on the performance in year N and the main guidelines for N+1 (objectives in terms of products, geographic sales coverage, etc.), managers are asked to work with the Chief Financial Officer on their team's budget for N+1.

After various discussions, the data are compiled and a N+1 beta budget is drawn up by the Management Board. Following further discussions with Steering Committee managers, the Management Board makes the necessary adjustments to the budget so as to end up with an acceptable draft version.

The Management Board then submits its monthly budget and quantitative assumptions to the Supervisory Board for review. The draft budget is presented by the Management Board at the next meeting of the Supervisory Board. The Supervisory Board examines the draft budget and may make comments or express reservations.

The budget is monitored at two levels:

by the Management Board on a monthly basis, in order to manage the Company's performance;
by the Supervisory Board, which produces a quarterly report outlining the key indicators for the Company together with budget variances and a comparison with the year N-1.

With regard to sales and the follow-up of sales operations and customers, the overall management of contacts, opportunities and forecasts is managed using CRM Salesforce. This allows the business development and sales activity of each region to be tracked for each partner and sales representative in charge of a particular sector or region. All orders and support for customers and partners are also handled via the Salesforce platform.

The Group allocates the following IT resources to accounting:

1- Sage Gestion Commerciale i7, to centralize customer orders and generate invoices (transfer of sales entries to Sage Comptabilité i7);
2- Sage Comptabilité i7, including two analytical plans. The first plan, entitled "Activities", allocates expenses by service and income by type (appliance, maintenance, services in France or for export); the second plan, entitled "Treasury", allocates banking entries according to the type of income or expense;
3- Paie SAGE i7 (compatible with the future formalization of social security declarations);
4- My Report, an Excel module that retrieves all Sage data for reporting purposes. My Report is currently used for cash flow management, monthly reporting, consistency checks between cost accounting and general accounting, calculating deferred income and sales figures;
5- Lucca applications for the planning and validation of absences with an export interface to Sage Paie, and the production and validation of expense reports with an export interface to Sage Comptabilité.

These resources are grouped into a dedicated infrastructure.

The Group's accounting department prepares the half-year and annual financial statements. These are reviewed first by the Chief Financial Officer and then by an independent firm of chartered accountants. The statutory auditors review the consolidated financial statements to 30 June and audit the corporate accounts and consolidated financial statements at year-end, once the accounts have been consolidated by an independent consolidation firm.

20.10 Legal and arbitration proceedings

At the filing date of the Registration Document, the Group is not exposed to specific legal risks apart from those related to intellectual property and civil liability in general.

The Group underwent a tax audit for the 2011, 2012, 2013 and 2014 financial years, mainly focusing on the research tax credit. The Group set aside €69,000 to cover any additional tax liability. During the period audited, the Group collected all of its research tax credits totaling €1,873,000. At the end of its audit, the tax authority proposed an adjustment of €586,000 which the Group is contesting. Tax administration has not issued the recovery notice today.

There are no other governmental, judicial or arbitral proceedings, including any proceedings of which the Group is aware, that are pending or threatened and which, over the past 12 months, are likely to have had, or are having, a significant impact on the Company's and/or Group's financial position or profitability.

20.11 Significant change in financial or trading position

As far as the Group is aware, there has been no significant change in its financial or trading position since December 31, 2017.

21. OTHER INFORMATION

21.1 Share capital

21.1.1 Amount of share capital

At the filing date of this Registration Document, the Company's share capital totaled €404,471, divided into 4,044,710 shares with a par value of €0.10, all in the same class.

21.1.2 Securities other than equity securities

Not applicable.

21.1.3 Company's buyback of its own shares

On June 4, 2015, the Company and Louis Capital Markets signed a liquidity contract in accordance with the AMAFI code of professional practice. The contract was filed with the supervisory authorities (Euronext Paris – AMF) and was implemented for the first time on July 20, 2015.

• Number of own shares bought and sold by the Company during the year

The Management Board was authorized by the Combined General Meeting of June 3, 2016 (in its seventh ordinary resolution) and by the Combined General Meeting of June 1, 2017 (in its ninth ordinary resolution) to purchase the Company's shares for a period of 18 months, subject to a limit of 10% of the number of shares comprising the share capital. The Management Board will ask shareholders to vote on the renewal of this share buyback authorization at the Annual General Meeting on May 9, 2018.

In the last financial year, the Company, pursuant to the abovementioned authorization, bought and sold its own shares on the following terms and conditions:

- Number of shares purchased: 43,508 Average purchase price: €14.33
- Number of shares sold: 48,574 Average selling price: €14.20
- Total amount of execution fees: €2,610.33 excluding tax.

At December 31, 2017, the Company held 8,166 treasury shares (0.20% of the share capital) valued at €117,018.78 based on the purchase price and with a nominal value of €816.60.

All purchases made during the past year (i.e. 43,508 shares) were for market-making purposes.

No shares were reallocated during the year ended December 31, 2017.

Since the authorization granted by the Combined General Meeting of June 1, 2017 expires on November 30, 2018, the next Annual General Shareholders' Meeting will be asked to renew the authorization on the terms described below.

• Description of the share buyback program

In accordance with Article 241-2 of the General Regulation of the AMF, the aim of this document is to outline the purpose and terms of the Company's share buyback program. This program will be submitted for the approval of the Annual General Meeting on May 9, 2018.

1) Number of equity securities held on February 28, 2018:
percentage of capital held directly or indirectly: 6,390 shares representing 0.16% of the share capital.
number of shares canceled during the past 24 months: 0
number of shares held in the portfolio at February 28, 2018: . securities recognized in short-term investments: 6,390 . securities recognized in long-term investments: 0
carrying value of the portfolio: €70,130.19
nominal value of the portfolio: €639

Number of securities held for each purpose:

To support the share price via an AMAFI (French Financial Markets Association) liquidity contract: 6,390
External growth transactions: 0
To hedge stock options and other employee share ownership schemes: 0
To hedge securities eligible for share allotment: 0
Cancellation: 0
2) New share buyback program
- Maximum proportion of share capital authorized for the buyback: 10% (or 404,471 shares at today's date), it being specified that this limit will be assessed on the repurchase date to take into account any capital increases or decreases during the program. The number of shares taken into account to calculate this limit corresponds to the number of purchased shares, less the number of shares resold during the program for liquidity purposes.

As the Company may not hold more than 10% of its own share capital, in light of the number of shares already held (6,390 shares or 0.16% of the share capital), the maximum number of shares that may be purchased is 398,081 shares (i.e. 9.84% of the capital), subject to the sale or cancellation of some or all of the shares already held.

- Repurchase conditions: These share purchases may be made using all available methods, including block purchases, and at such times as the Management Board sees fit. These transactions may not be carried out during a public tender period. The Company does not intend to use options or derivatives.
- Maximum purchase price and maximum program amount: The maximum purchase price is set at €100 per share. In the event of a corporate action such as a stock split, reverse stock split or bonus share award, the abovementioned price will be adjusted by a multiplication coefficient equal to the ratio between the number of shares forming the capital prior to the transaction and the number of shares following the transaction. The maximum amount would therefore be €40,447,100.
- Program objectives:
- to stimulate the secondary market or liquidity of WALLIX GROUP shares through an investment service provider under a liquidity contract in accordance with the AMAFI code of

professional practice as approved by the French Financial Services Authority, or any accepted market practice recognized by the AMF;

- to hold the repurchased shares for subsequent use in exchange or as payment for possible company acquisitions; shares purchased for this purpose may not exceed 5% of the Company's share capital;
- to provide coverage for stock option plans and/or bonus share plans (or similar plans) granted to employees and/or corporate officers of the Group, as well as any share awards as part of a company or group savings plan (or similar plan), employee profit-sharing and/or any other form of allotment of shares to employees and/or corporate officers of the Group;
- to provide coverage for securities eligible for the award of Company shares under applicable regulations;
- to implement any market practice approved by the AMF and in general execute any other transaction in compliance with applicable regulations;
- to cancel any shares purchased, subject to authorization being granted under the eighth extraordinary resolution of the Annual General Meeting of May 9, 2018.

Term of the program: a period of 18 months from the Annual General Meeting of May 9, 2018, i.e. until November 8, 2019 (subject to shareholder approval in the vote on the relevant resolution submitted to the Annual General Meeting due to take place on May 9, 2018).

21.1.4 Potential capital

At the date of this document, the Company has issued founders' warrants, granted stock warrants and awarded bonus shares as detailed below:

21.1.4.1Founders' warrants (BSPCEs)

At the date of this document, the exercise of all 9,800 founders' warrants for 2012 and 47,540 founders' warrants for 2014 issued and still outstanding could lead to the creation of 145,540 new ordinary shares.

	Founders' warrants for 2012	Founders' warrants for 2014
Date of AGM	April 30, 2012	June 12, 2014
Date of Management Board meeting	October 21, 2013	November 28, 2014
Number of founders' warrants authorized (by the AGM)	9,800	5,835
Total number of founders' warrants awarded (by the Management Board)	9,800	5,835
Total number of shares that can be subscribed for by exercising founders' warrants (after the 10-for-1 stock split approved by the Combined General Meeting of May 6, 2015)	98,000	58,350
all of which can be subscribed for by corporate officers	98,000	58,350
Jean-Noël de Galzain	72,720	30,570

Amaury Rosset	25,280	16,970
Dominique Meurisse	-	10,810(1)
Start date for exercising founders' warrants	October 21, 2013	November 28, 2014
Deadline for exercising founders' warrants	October 21, 2018	November 28, 2019
Subscription price of founders' warrants (for 1 share with par value of €0.10)	€3,686	€2.80
Method of exercising warrants	N/A	N/A
Number of shares subscribed for at the filing date of this Registration Document (after the 10-for-1 stock split approved by the Combined General Meeting of May 6, 2015)	0	10,810
Cumulative number of founders' warrants canceled or lapsed	0	0
Founders' warrants outstanding at the filing date of the Registration Document (after the 10-for-1 stock split approved by the Combined General Meeting of May 6, 2015)	98,000	47,540

(1) Dominique Meurisse exercised his founders' warrants on September 26, 2016.

21.1.4.2Stock option plan

At the date of this document, the exercise of all 9,000 options for 2012, granted and still outstanding, could lead to the creation of 9,000 new ordinary shares.

	2012 options*
Date of AGM	April 30, 2012
Date of Management Board meeting	October 21, 2013
Number of options authorized (by the AGM)	6,316
Number of options granted (by the Management Board )	5,400
Total number of shares that can be subscribed for (after the 10-for-1 stock split approved by the Combined General Meeting of May 6, 2015)	54,000
The number that can be subscribed for by corporate officers
Dominique Meurisse	22,500(1)
Number of beneficiaries who are not corporate officers
Serge Adda (Technical Director) Julien Patriarca (Head of Support)	22,500(2) 9,000
Subscription price of 2012 stock options (for 1 share with par value of €0.10)	€3,686
Start date for exercising the options	October 21, 2013
Expiration date	October 21, 2018

Procedures for exercising options	subject to remaining in post
Total number of shares that can be subscribed for at the date of the Registration Document (after the 10-for-1 stock split approved by the Combined General Meeting of May 6, 2015)	9,000
Cumulative number of stock options lapsed or canceled at the filing date of the Registration Document	22,500(1)
Number of stock options still to be subscribed for at the filing date of the Registration Document (after the 10-for-1 stock split approved by the Combined General Meeting of May 6, 2015)	9,000

* The 2012 options are all stock warrants.

(1) 2012 options which have lapsed due to Dominique Meurisse's departure from the Company.

(2) 2012 options exercised on September 21, 2017.

21.1.4.3 Bonus share award

The Combined General Meeting of June 3, 2016 delegated powers to the Management Board to award bonus shares. Accordingly, at its meeting on July 6, 2017, after prior authorization from the Supervisory Board which met on the same day, the Management Board decided to award new bonus shares as detailed below.

At the date of this document, the effective award of all bonus shares could lead to the creation of 106,599 new ordinary shares.

	2017-1 Plan	2017-1 Plan	2017-1 Plan
Date of AGM	June 3, 2016	June 3, 2016	June 3, 2016
Date of Management Board decision to award shares	July 6, 2017	July 6, 2017	July 6, 2017
Total number of free shares awarded	54,800	18,200	39,699
The total number of shares that can be subscribed for by corporate officers
Jean-Noël de Galzain	-	-	21,971(3)
Amaury Rosset	1,200(1)	-	11,610(3)
Didier Lesteven	900(1)	-	6,118(3)
Share vesting date	(1)	July 6, 2018(2)	July 6, 2018(2)
End of holding period	(1)	July 6, 2019	July 6, 2019
Number of shares subscribed for at the date of this Registration Document	0	0	0
Cumulative number of shares canceled or lapsed at the date of the Registration Document	6,100(4)	0	0
Bonus shares awarded and outstanding at the date of this Registration Document	48,700	18,200	39,699

(1) Under the terms of this plan, Amaury Rosset and Didier Lesteven are entitled to receive bonus shares on the same basis as all other beneficiaries. However, at its meeting on July 6, 2017, the Supervisory Board also decided that 10% of the bonus shares awarded to members of the Management Board should be held in registered form by each beneficiary for the period of his or her term of office.

The vesting of bonus shares is contingent upon the beneficiary remaining in post, the conditions being as follows:

Each employee of the Company and its affiliates, as defined in Article L. 225-197-2 of the French Commercial Code, (hereinafter a "Beneficiary") has been awarded N number of shares in the Company, calculated as follows: (i) if the Beneficiary is a member of the Steering Committee, N will be equal to 900; (ii) if the Beneficiary holds a management post but is not a member of the Steering Committee, N will be equal to 750; (iii) if the Beneficiary is not a member of the Steering Committee and does not hold a management post, N will be equal to 600.
- Each Beneficiary has been awarded an additional A number of shares depending on his or her seniority at June 30, 2017 (i) if this is less than 3 years, A will be zero; (ii) if it is at least three years, A will be equal to 100; (iii) if it is at least five years, A will be equal to 200; (iv) if it is at least seven years, A will be equal to 300.
- For the X shares awarded to each Beneficiary (X being equal to N+A), the vesting and holding periods are as follows: (i) for a number of shares X1 equal to 20% of X, the vesting period is one year and the holding period is also one year; (ii) for a number of shares X2 equal to 35% of X, the vesting period is two years and the holding period is waived; (iii) for a number of shares X3 equal to X – X1 - X2, or the balance, the vesting period is three years and the holding period is waived.

(2) The vesting of the bonus shares is contingent on the beneficiary remaining in post and on the achievement of the performance criteria relating to 2017 consolidated turnover. These criteria were established by the Management Board at its meeting on July 6, 2017 and are not disclosed for confidentiality reasons.

(3) At its meeting on July 6, 2017, the Supervisory Board decided that 10% of the bonus shares awarded to members of the Management Board should be held in registered form by each beneficiary for the period of his or her term of office.

(4) Shares that have lapsed following the departure of ten beneficiaries.

21.1.4.4 Stock warrants

At the date of this document, there are no longer any stock warrants issued and outstanding. On October 6, 2017, Didier Lesteven exercised all of the stock warrants of 2012 that he held.

	Stock warrants of 2012
Date of AGM	April 30, 2012
Date of Management Board meeting	October 21, 2013
Number of stock warrants authorized (by the AGM)	1,422
Number of stock warrants issued (by the Management Board)	1,422
Total number of shares that may be subscribed for by exercising stock warrants (after the 10-for-1 stock split approved by the Combined General Meeting of May 6, 2015)	14,220
The number that can be subscribed for by corporate officers
Didier Lesteven	14,220
Start date for exercising stock warrants	October 21, 2013
Deadline for exercising stock warrants	October 21, 2018

Issue price of stock warrants (€)	1.11
Exercise price of stock warrants (for 1 share with par value of €0.10)	€3,686
Method of exercising warrants	N/A
Number of shares subscribed for as at the filing date of this Registration Document	14,220
Cumulative number of stock warrants lapsed or canceled at the filing date of the Registration Document	0
Stock warrants outstanding at the filing date of the Registration Document	0

21.1.4.5 Summary of dilutive instruments

At the date of this Registration Document, the exercise of all rights conferring access to Group capital could lead to the creation of 261,139 new shares resulting in a maximum dilution of 6.06% on the basis of diluted capital. For the dilution of voting rights, please refer to the table in Section 18.1.1 of this document.

21.1.5 Authorized share capital

At the date of this Registration Document, the Management Board has the following financial authorizations:

Type of delegation or authorization	Date of the Extraordina ry General Meeting	Expiration date	Authorized ceiling	Use during the financial year ended December 31, 2017	Issue price of the shares
Authorization to increase the share capital through capitalization of reserves, profits or premiums (11th resolution)	06.01.2017	07.31.2019	€20,000,000	Not applicable	-
Authorization to issue ordinary shares and securities with preemptive rights for shareholders (12th resolution)	06.01.2017	07.31.2019	€300,000 for shares €20,000,000 for debt securities*	Not applicable	The issue price will be determined by the Management Board subject to the ceiling set by the AGM
Authorization to issue ordinary shares and transferable securities without preemptive rights for shareholders through a public offering (13th resolution)	06.01.2017	07.31.2019	€300,000 for shares €20,000,000 for debt Not applicable securities*		(1)
Authorization to issue ordinary shares and	06.01.2017	07.31.2019	€300,000 for shares* (Maximum of 20% of the share capital	Not applicable	(2)

Type of delegation or authorization	Date of the Extraordina ry General Meeting	Expiration date	Authorized ceiling	Use during the financial year ended December 31, 2017	Issue price of the shares
securities, without preemptive rights for shareholders, via a private placement (14th resolution)			per year) €20,000,000 for debt securities**
Authorization to increase the amount of issuance in the event of surplus demand (15th resolution)	06.01.2017	30 days from the closing date for the capital increase provided for in the 12th, 13th and 14th resolutions of the General Meeting of June 1, 2017	Subject to the ceiling of the delegation used and 15% of the amount of the initial issue	Not applicable	-
Authorization to issue stock options (10th resolution)	06.03.2016	08.02.2019	3% of the share capital existing on the day of the AGM of June 3, 2016***	Due to the use of the authorization to award bonus shares, the remaining ceiling is 0.18% of the share capital existing on the day of the AGM of June 3, 2016.	the share subscription and/or purchase price for beneficiaries will be set on the date on which the options are granted by the Management Board in accordance with the provisions of Article L. 225-177- 4 of the French Commercial Code
Authorization to award bonus shares (11th resolution)	06.03.2016	08.02.2019	3% of the share capital existing on the day of the AGM of June 3, 2016***	At its meeting on July 6, 2017, the Management Board used this authorization and reached 2.82% of the ceiling. The remaining ceiling is therefore 0.18% of the share capital existing on the day of the AGM of June 3, 2016.	-
Authorization to award stock warrants (BSAs), stock warrants for the subscription or purchase of new or existing shares (BSAANEs), or redeemable stock warrants (BSAARs) (17th resolution)	06.01.2017	11.30.2018	2% of the share capital on the day of the AGM of June 1, 2017	Not applicable	the subscription and/or purchase price of the shares to which the warrants give entitlement, after taking into account the issue price of the warrants, will be at least equal to the average closing price of WALLIX GROUP shares over the 20 trading

Type of delegation or authorization	Date of the Extraordina ry General Meeting	Expiration date	Authorized ceiling	Use during the financial year ended December 31, 2017	Issue price of the shares
					days preceding the date of the decision to issue the warrants

* combined ceilings / ** combined ceilings / *** combined ceilings

(1) the issue price of the shares and securities which may be issued pursuant to this authorization will be set by the Management Board as follows:

in accordance with Article L. 225-136-2 of the French Commercial Code, the price of ordinary shares issued pursuant to this authorization will be at least equal to the average of the volume-weighted average price in the five trading days prior to the fixing date, less, where appropriate, a maximum discount of 20%, after adjusting the average in the event of a difference in dividend entitlement dates. The issue price of the securities convertible to equity will be such that the amount immediately received by the Company, plus, where appropriate, the amount it is likely to receive on the exercise or conversion of the securities is, for each share issued as a consequence of the issuance of those securities, at least equal to the issue price defined above;
for securities convertible to equity, including detachable warrants, the issue price will be set by the Management Board in such a way that amounts immediately received by the Company on issuing the securities in question, plus the amounts that the Company is subsequently likely to receive for each share attached to and/or underlying the securities issued, are at least equal to the minimum price provided for above;
the conversion, redemption and transformation into shares of each security convertible to equity will, taking into account the par value of that security, involve a number of shares such that the amount received by the Company for each share is at least equal to the minimum price referred to above.

(2) the issue price of the shares and securities which may be issued pursuant to this authorization will be set by the Management Board as follows:

in accordance with Article L. 225-136-2 of the French Commercial Code, the price of ordinary shares issued pursuant to this authorization will be at least equal to the average of the volume-weighted average price in the five trading days prior to the fixing date, less, where appropriate, a maximum discount of 20%, after adjusting the average in the event of a difference in dividend entitlement dates. The issue price of the securities convertible to equity will be such that the amount immediately received by the Company, plus, where appropriate, the amount it is likely to receive upon the exercise or conversion of the securities is, for each share issued as a consequence of the issuance of those securities, at least equal to the issue price defined above;
for securities convertible to equity, including detachable warrants, the issue price will be set by the Management Board in such a way that amounts immediately received by the Company upon issuing the securities in question, plus the amounts that the Company is subsequently likely to receive for each share attached to and/or underlying the securities issued, are at least equal to the minimum price provided for above;
the conversion, redemption and transformation into shares of each security convertible to equity will, taking into account the par value of that security, involve a number of shares such that the amount received by the Company for each share is at least equal to the minimum price referred to above.

(3) the beneficiaries of these options may only be (i) employees, or certain employees, or certain categories of employees, of WALLIX GROUP, and if applicable, companies or economic interest groups affiliated to it within the meaning of Article L. 225-180 of the French Commercial Code, and (ii) corporate officers, within the meaning of Article L. 225-185 of the French Commercial Code

(4) bonus shares may be awarded for the benefit (i) of employees of the company or companies affiliated directly or indirectly therewith, as defined in Article L. 225-197-2 of the French Commercial Code, (ii) and/or corporate officers who satisfy the conditions laid down by Article L. 225-197-1 of the French Commercial Code.
(5) Stock warrants, stock warrants for the subscription or purchase of new or existing shares and redeemable stock warrants may be issued for the benefit of the following categories of people: (i) employees and/or corporate officers of the Company or a group company within the meaning of Article L.233-3 of the French Commercial Code; (ii) and/or service providers or consultants who have signed a contract with the Company or a group company within the meaning of Article L.233-3 of the French Commercial Code.

It is specified that the following authorization will be submitted to the Annual General Meeting of May 9, 2018:

Type of delegation or authorization	Date of the Extraordinary General Meeting	Expiration date	Authorized ceiling	Issue price of the shares
Authorization to increase the share capital through capitalization of reserves, profits or additional paid-in capital (9th resolution)	05.09.2018	07.08.2020	€40,000,000	-
Authorization to issue ordinary shares and securities with preemptive rights for shareholders (10th resolution)	05.09.2018	07.08.2020	€300,000 for shares €20,000,000 for debt securities*	The issue price will be determined by the Management Board subject to the ceiling set by the AGM
Authorization to issue ordinary shares and securities without preemptive rights for shareholders through a public offering and priority period (11th resolution)	05.09.2018	07.08.2020	€300,000 for shares €20,000,000 for debt securities*	(1)
Authorization to issue ordinary shares and securities, without preemptive rights for shareholders, via a private placement (12th resolution)	05.09.2018	07.08.2020	€300,000 for shares (Maximum of 20% of the share capital per year) €20,000,000 for debt securities*	(1)
Authorization to issue ordinary shares and securities without preemptive rights for shareholders for a particular category of person (2) (13th resolution)	05.09.2018	11.08.2019	€300,000 for shares €20,000,000 for debt securities*	(1)
Authorization to increase the amount of issuance in the event of surplus demand (14th resolution)	05.09.2018	30 days from the closing date for the capital increase provided for in the 10th to 13th resolutions of the AGM of May 9, 2018	Subject to the ceiling of the delegation used and 15% of the amount of the initial issue	-
Authorization to increase the capital without preemptive rights for shareholders for the benefit of members of a company savings plan (15th resolution)	05.09.2018	07.08.2020	0.50% of the share capital at the time of the Management Board's decision to proceed with the capital increase	The shares subscribed for will be priced in accordance with Article L. 3332-20 of the French Labor Code
Authorization to issue stock options (16th resolution)	05.09.2018	07.08.2021	10% of the share capital existing on the day of the AGM of May 9, 2018***	the share subscription and/or purchase price for beneficiaries will be

Type of delegation or authorization	Date of the Extraordinary General Meeting	Expiration date	Authorized ceiling	Issue price of the shares
				set on the date on which the options are granted by the Management Board in accordance with the provisions of Article L. 225-177-4 of the French Commercial Code
Authorization to award bonus shares (17th resolution)	05.09.2018	07.08.2021	10% of the share capital existing on the day of the AGM of May 9, 2018***	-
Authorization to award stock warrants (BSAs), stock warrants for the subscription or purchase of new or existing shares (BSAANEs), or redeemable stock warrants (BSAARs) (18th resolution)	05.09.2018	07.08.2021	10% of the share capital existing on the day of the AGM of May 9, 2018***	the subscription and/or purchase price of the shares to which the warrants give entitlement, after taking into account the issue price of the warrants, will be at least equal to the average closing price of WALLIX GROUP shares over the 20 trading days preceding the date of the decision to issue the warrants

(1) the price of ordinary shares issued will be at least equal to the average of the volume-weighted average price in the three trading days prior to the fixing date, less, where appropriate, a maximum discount of 20%, after adjusting the average in the event of a difference in dividend entitlement dates. The issue price of the securities convertible to equity will be such that the amount immediately received by the Company, plus, where appropriate, the amount it is likely to receive upon the exercise or conversion of the securities is, for each share issued as a consequence of the issuance of those securities, at least equal to the issue price of the ordinary shares defined above.

(2) the category of person is as follows: legal persons governed by French or foreign law (including holding companies, legal entities, investment companies, mutual funds or collective savings management funds) or natural persons, each having the status of qualified investor (as defined in Articles L.411-2 II and D.411-1 of the French Monetary and Financial Code) and investing normally in listed companies in the fields or sectors of computing, computer systems and networks, telecoms, network infrastructure, internet, cryptography, computer security, computer equipment suppliers, information systems and advanced technologies, for a minimum individual subscription amount of €100,000 per transaction or the equivalent of that amount and subject to a maximum of 50 investors.

(4) bonus shares may be awarded for the benefit (i) of employees of the company or companies affiliated directly or indirectly therewith, as defined in Article L. 225-197-2 of the French Commercial Code, (ii) and/or corporate officers who satisfy the conditions laid down by Article L. 225-197-1 of the French Commercial Code.

(5) Stock warrants, stock warrants for the subscription or purchase of new or existing shares, and redeemable stock warrants may be issued for the benefit of the following categories of people: (i) employees and/or corporate officers of the Company or a group company within the meaning of Article L.233-3 of the French Commercial Code; (ii) and/or service providers or consultants who have signed a contract with the Company or a group company within the meaning of Article L.233-3 of the French Commercial Code.

21.1.6 Information on the capital of any member of the Company which is under option or subject to a firm or contingent agreement to be placed under option

To the best of the Group's knowledge, there is no option on the capital of a Group company and no firm or contingent agreement to issue such an option.

21.1.7 History of share capital

21.1.7.1 Changes in share capital over the past three years

The table below summarizes the changes in share capital over the past three years.

Transactio n date	Type of transaction	Number of shares issued or canceled	Nominal transaction amount	Additional paid-in capital	Issue price	Cumulativ e nominal amount of share capital	Total cumulative number of shares outstandin g	Par value
05.06.2015	10-for-1 stock split	2,731,212	€2,731,212	-	-	€303,468	3,034,680	€0.10
07.17.2015	Public offer as part of the Company's flotation on Euronext Growth (including the extension and over allotment clause)	962,500	€96,250	€10,010,000	€10.50	€399,718	3,997,180	€0.10
09.26.2016	Exercise of 10,810 founders' warrants of 2014	10,810	€1,081	€29,187	€2.80	€400,799	4,007,990	€0.10
09.21.2017	Subscription of 22,500 options of 2012	22,500	€2,250	€80,685	€3,686	€403,049	4,030,490	€0.10
10.06.2017	Exercise of 14,220 stock warrants	14,220	€1,422	€50,992.92	€3,686	€404,471	4,044,710	€0.10

21.1.7.2 Changes in the breakdown of the Company's capital during the last three financial years

Please refer to the table in Section 18.1 of this document.

21.1.7.3 Breakdown of the Company's share capital and voting rights

Please refer to the table in Section 18.1 of this document.

21.2 Articles of Incorporation and Bylaws

21.2.1 Corporate purpose (Article 2 of articles of association)

The purpose of the Company, directly or indirectly, both in France and abroad, is:

the design, marketing and sale of existing or future computer software, processes or programs;
the marketing, sale and provision of consulting or other computer services, including maintenance and hosting, in Europe and worldwide, associated directly or indirectly with its corporate purpose;
and, in general, any financial, commercial, industrial, securities and property transactions which may be directly or indirectly related to the above purpose, including any similar or associated purpose, that may facilitate its expansion or development.

It may undertake any transaction that is compatible with, relates to, or contributes to the achievement of its corporate purpose.

21.2.2 Management and supervisory bodies

21.2.2.1 Management Board

The Management Board administers and conducts the Company's operations under the control of a Supervisory Board. The number of Management Board members shall be set by the Supervisory Board and may not exceed five. If a seat is vacant, the Supervisory Board must within two months change the number of seats that it had previously set or fill the vacancy.

Members of the Management Board, who must be natural persons, do not need to be shareholders.

Appointed by the Supervisory Board, they may have their positions revoked by the Annual General Meeting or by the Supervisory Board.

The Management Board is appointed for a term of three years.

The duties of members of the Management Board or, as the case may be, of the Chief Executive Officer, shall cease at the close of the Annual General Meeting convened to approve the financial statements for the past financial year, held in the year during which their term of office expires.

All members of the Management Board who reach the age of 80 shall automatically be deemed to have resigned from their Board position on the date of the next meeting of the Supervisory Board.

The Supervisory Board shall designate one of the Management Board members as the Chairman of that Board, but the Management Board shall permanently assume responsibility for the general management of the Company.

Management Board meetings may be held at a location that is not the Company's headquarters.

Members of the Management Board may attend its meetings by videoconference or any other telecommunication method that permits their identification and guarantees their effective participation.

The videoconference or other telecommunication method used must transmit at least each participant's voice and have the technical capability to ensure continuous and simultaneous transmission of the meeting.

Management Board decisions shall only be valid if taken in the presence of at least half its members. When calculating the quorum and the majority, the members of the Management Board attending the meeting by such videoconference or other telecommunication method shall be deemed to be present.

Decisions shall be taken by a majority vote of the members present, each member entitled to cast only his/her own vote, plus the vote of no more than one colleague.

In the case of a tied vote, the Chairman shall cast the deciding vote.

The Chairman shall record the Board's deliberations in the form of minutes kept in a special register and signed by him/herself and one other member.

The minutes of the meeting shall indicate the names of the members present, represented, excused, absent or attending the meeting by videoconference or other telecommunication method. The minutes shall record the presence or absence of the persons duly convened to the meeting as well as the presence of any other person attending all or part of the meeting.

With respect to third parties, the Management Board has the widest powers to act in all circumstances on behalf of the Company, within the limits of the corporate purpose and subject to restrictions where powers are expressly granted by law to the Supervisory Board and to meetings of the shareholders.

At least once per quarter, the Management Board shall submit a report to the Supervisory Board. Within three months after the end of each fiscal year, the Management Board shall submit to the Supervisory Board, for checking and audit purposes, the financial statements that have to be submitted to the Annual General Meeting.

The Chairman of the Management Board represents the Company in its relations with third parties. The Supervisory Board may grant the same power of representation to one or more members of the Management Board who shall consequently have the title of Managing Director. The status of Chairman and of Managing Director may be withdrawn from the persons holding those titles by the Supervisory Board. With respect to third parties, all actions committing the Company may be executed by the Chairman of the Management Board or any member to whom the Supervisory Board has granted the title of Managing Director.

The Supervisory Board shall set, as applicable, the method and amount of any compensation paid to each member of the Management Board.

21.2.2.2 Supervisory Board

The Supervisory Board shall be composed of at least 3 and no more than 18 members; however, in the event of a merger, this maximum may be exceeded to the extent permitted by applicable legislation.

Supervisory Board members shall be appointed for a three-year term by an Ordinary General Meeting which may revoke their appointment at any time.

Any Supervisory Board member who has reached the age of 80 shall automatically be deemed to have resigned from their Board position.

The Board shall elect from among its members a Chairman and Vice Chairman who are responsible for convening Board meetings and guiding their deliberations, and exercise their functions during the term of the Supervisory Board. The Chairman and Vice Chairman must be natural persons.

The Supervisory Board shall set the amount of their compensation, if any.

The Supervisory Board shall deliberate and make decisions in accordance with applicable legislation, with each member entitled to cast only his or her own vote plus the vote of no more than one colleague. In the case of a tie, the Chairman shall cast the deciding vote.

The Supervisory Board may hold its meetings by videoconference or other telecommunication method, with the exception of meetings for which such methods are prohibited by law. An internal regulation shall specify how the presence of Supervisory Board members attending by such videoconferencing or other telecommunication methods shall be calculated for quorum and majority purposes. The videoconferencing and telecommunication methods used must comply with applicable laws and regulations.

The Supervisory Board exercises permanent control over the Management Board's exercise of its management duties. It may, at any time of year, carry out any checks and audits that it considers appropriate and may demand any documents it considers necessary to enable it to do so. It is responsible for authorizing the Management Board, in accordance with applicable laws and regulations, to issue endorsements and guarantees on behalf of the Company, to sell all or part of any real estate or equity interests, and to pledge securities.

Furthermore, internal regulations which are not binding on third parties require prior consent by the Supervisory Board for the following:

the issuance of any type of securities that may or may not grant access to share capital;
the awarding of stock warrants or stock options;
the awarding of bonus shares;

21.2.2.3 Non-voting Directors

An advisory board may be set up consisting of non-voting Directors.

Non-voting Directors shall be appointed by the Annual General Meeting for a term set by that meeting when appointing them.

Non-voting Directors shall be convened to Supervisory Board meetings and shall receive the same documents as the members of the Supervisory Board. They shall participate in the deliberations of the Supervisory Board in a non-voting advisory capacity and their absence from a meeting shall not detract from the validity of Board deliberations provided they had been duly invited to the Board meeting in the same way and with the same notice as the voting members of the Supervisory Board.

21.2.3 Rights, privileges and restrictions attached to Company shares

21.2.3.1 Type of financial instruments

Unless otherwise specified in the issuance contract or in legislation, equity instruments and all other transferable securities that the Company issues shall be in registered or bearer form, at the choice of their holder. Shares may not be in bearer form until they are fully paid-up.

21.2.3.2 Voting rights

The voting rights attached to common stock are proportional to the percentage of share capital that they represent with each share granting the right to at least one vote, unless otherwise specified in applicable legislation and the articles of association.

When share ownership entitles the beneficial owner and/or bare owner to partial tax relief under Article 787B of the French General Tax Code, the beneficial owner's right to vote on profit allocation decisions and the bare owner's right to vote on all other decisions shall be exercised by the beneficial owner at Annual General Meetings and by the bare owner at Extraordinary General Meetings.

At the annual general meeting of May 9, 2018, shareholders will be asked to harmonize these provisions with Article 787b of the French General Tax Code and to provide that, in the event of the division of share ownership, the voting rights would be allocated as follows:

where the bare owner benefits, upon the transfer of ownership accompanied by a reservation of beneficial title for the benefit of the donor, from the provisions relating to partial exemption under Article 787B of the General Tax Code, the voting rights belong to the beneficial owner for decisions concerning the allocation of profits and to the bare owner for all other decisions. This arrangement is not time-limited. To ensure its execution, this distribution of voting rights between the beneficial owner and the bare owner
will be mentioned in the account where their rights are registered. - in other cases, the voting rights belong to the beneficial owner at Ordinary General Meetings and to the bare owner at Extraordinary General Meetings.

Shares that a shareholder has held in registered form for at least two years and are fully paid-up shall entitle their owner to voting rights double that of other common stock, in proportion to the percentage of the share capital that they represent.

This double voting right shall also apply to shares that are granted free of charge to a shareholder as part of a capital increase by the incorporation of reserves, profits or issue premiums, on the basis of one free share for each existing share with double voting rights.

Registered shares that are entitled to a double voting right shall lose the right to a double vote when converted to bearer shares or when ownership is transferred, unless otherwise specified by legislation.

21.2.3.3 Rights to dividends and profits

Each share confers the right to ownership of share capital, to a share of profits, and to a share of liquidation surplus in proportion to the percentage of share capital that it represents.

21.2.3.4 Pre-emptive rights

Company shares confer a pre-emptive right to subscribe to capital increases in accordance with the French Commercial Code.

21.2.3.5 Limitation of voting rights

No statutory clause may restrict the voting rights attached to the shares.

21.2.3.6 Identifiable bearer shares

The Company is authorized to demand, at any time, that the central depositary for financial instruments disclose the information specified in law relating to the identification of holders of bearer securities which currently, or may in the future, confer the right to vote at meetings of shareholders. The Company is also entitled to demand, in the manner set by law, proof of shareholders' identities when it suspects that shares are being held on behalf of third parties.

The Company may require any legal entity holding more than 2.5% of the share capital or voting rights to disclose to it the identity of persons directly or indirectly holding more than one-third of the share capital or voting rights of said entity at the time of the Company's general meeting.

21.2.3.7 Purchase by the Company of its own shares

See Section 21.1.3 of this document.

21.2.3.8 Transfer of equity instruments and securities giving access to share capital

Equity instruments and securities giving access to share capital shall be transferred directly from account to account as specified by applicable regulations.

There shall be no restrictions on the sale or transfer of securities. The same applies to the sale or transfer of options on such instruments and securities.

21.2.4 Procedure for amending shareholders' rights

Shareholders' rights as laid down in the Company's articles of association may be amended only by an Extraordinary General Meeting of the Company.

21.2.5 General Meetings of Shareholders

Annual General Meetings, Extraordinary General Meetings, and Special Meetings, have the respective competencies granted to them by applicable legislation.

General Meetings shall be convened and deliberate in accordance with applicable laws and regulations.

They shall meet at the Company's headquarters or at any other location indicated in the Notice of Meeting.

Shareholders shall be entitled to attend General Meetings, be represented by proxy, and vote remotely, irrespective of the number of shares that they hold, provided their shares are recorded in their own name at 0:00 a.m. Paris time of the second day preceding the Meeting, either in the Company's nominative shareholder register or in a bearer account held by an authorized intermediary.

Holders of a particular class of shares may attend special meetings for the holders of that class of shares, in the same manner and on the same terms and conditions as apply to General Meetings.

When calculating quorum and majority, shareholders attending a Meeting by videoconference or other telecommunication method that permits their identification and complies with applicable regulations shall be deemed to be present, should the Management Board decide, prior to convening the General Meeting, to use such participation methods, provided the laws and regulations governing the use of such methods are complied with.

A shareholder may agree to be represented by another shareholder, spouse, or civil solidarity pact partner. A shareholder may also be represented by any other natural person or legal entity of their choice.

A power of attorney may be granted or rescinded by electronic means.

Shareholders may vote by post using a form that shall be counted only if received by the Company no later than three days before the Meeting. The voting form may, where applicable, appear on the same document as the form of proxy.

The remote voting form and the form of proxy submitted by a shareholder must be signed by that shareholder, which may be a secure electronic signature as defined by Article 1367 of the French Civil Code, or a signature made by an electronic process approved by the Management Board, using a reliable identification process that guarantees that the signature relates to the document in question.

Shareholders may use the electronic voting form or proxy form on the Company website set up for this purpose, provided it reaches the Company no later than 3:00 p.m. Paris time the day before the General Meeting. That electronic form must bear an electronic signature that meets the criteria in this Article.

Votes may be cast by a show of hands or by any other appropriate method decided by the Management Board.

21.2.6 Provisions permitting the delay, deferral or prevention of a change of control

The Company's articles of association contain no provisions that permit the delay, deferral, or prevention of a change of control.

21.2.7 Breach of statutory thresholds

A natural person or legal entity who separately or in concert, directly or indirectly, holds a number of shares representing more than 5%, 10%, 15%, 20%, 25%, 30%, 1/3, 2/3 or 90% of the Company's capital or voting rights must inform the Company before close of markets no later than four trading days after the investment threshold is breached, of the total number of shares or voting rights that it holds.

The information specified above must also be disclosed within the same deadlines when holdings of capital and voting rights fall below the thresholds mentioned in this Section.

Should the holder fail to meet this statutory obligation, the undeclared shares exceeding the threshold shall be deprived of voting rights at all General Meetings for two years after the breach is rectified, if one or more shareholders representing at least 5% of the Company's share capital demand such a sanction and the sanction is recorded in the minutes of a General Meeting.

21.2.8 Special stipulations governing changes to capital

Changes to capital shall comply with applicable regulations.

22. MAJOR CONTRACTS

To date, the Group has not signed any major contracts, other than those agreed in the normal course of business, that impose major obligations or commitments on the Group as a whole.

No member of the Group has signed contracts, other than those in the normal course of business, that contain provisions imposing on any member of the Group major obligations or commitments for the entire Group, as of the date of this Registration Document.

23. THIRD-PARTY DISCLOSURES, EXPERT STATEMENTS, AND DECLARATIONS OF INTEREST

23.1 Appointment of experts

N/A.

23.2 Use of third parties

N/A.

24. PUBLICLY AVAILABLE DOCUMENTS

Copies of this Registration Document are available free of charge at the Company's headquarters, 250 bis rue du Faubourg, Saint Honoré, 75008 Paris, France. This Registration Document is also available on the Group's website (www.wallix.com) and on the AMF website (www.amf-france.org). The articles of association, minutes of General Meetings, and other corporate documents of the Group, as well as the historic financial information and all assessments and statements by experts commissioned by the Group, that are required to be available for shareholders in accordance with applicable legislation, may be consulted free of charge at the Company's headquarters.

Regulated information as defined by the AMF General Regulations is available on the Company's website (www.wallix.com).

25. DISCLOSURE OF EQUITY INTERESTS

As of the date of this Registration Document, the Group has no equity interests in any other company.

26. GLOSSARY

Active Directory	A company's corporate user ID directory
Agent	An IT system, bounded by a particular environment, which acts autonomously and flexibly to achieve the objectives for which it was designed
ANSSI	The French national information system security agency (Agence nationale de la sécurité des systèmes d'information)
API	Application Programming Interface to enable software components to communicate with each other
Application	Serves as an interface between a company and its users
Application to Application Password Management (AAPM)	Management of application-to-application passwords
Permissions account	An account that permits a user to access a company's devices, networks and applications and is managed and maintained by an administrator authorized by the company, for the use of which the company may be held liable
Cloud computing	The use of remote servers, generally accessible by Internet, to process or store information
Maintenance contract	Service contract with a provider to keep the system updated
Cybersecurity	The protection of computer systems from cyberspace events that may compromise the availability, integrity or confidentiality of the data stored, processed or transmitted, and the associated services that those systems offer or provide access to. Cybersecurity demands secure information system techniques and relies on vigilance against cybercrime and the implementation of cyberdefences
Advanced persistent threat	A sophisticated persistent long-term attack on a specific entity
Privileged Account Management (PAM)	The management and reporting of privileged users' access accounts

Privileged Session Management (PSM)	Monitoring of all privileged users' logins and sessions
General Data Protection Regulation (GDPR)	Regulatory framework for IT systems that requires companies to meet IT security rules
Remote Desktop Protocol (RDP)	Secure protocol that enables a user to connect securely to a Windows-based server
Value added reseller	A service provider that resells the WAB product while adding integration and/or associated services
Critical business sectors	These sectors include: • State sector activities: civil, military, judicial, aerospace and research; • Public protection sectors: health, water management, power; • National social and economic sectors: energy, communication, electronic, audiovisual and information, transportation, finance, industry.
Secure SHell (SSH)	Secure protocol that enables a user to connect securely to a Unix or Linux based server
Single Sign On (SSO)	Centralized access via a single account. Allows users seamless access when switching between applications, or between a laptop and tablet, without having to "re-logon"
Bounce-access solution	A device, access to which is limited to persons individually authorized to do so. It is a mandatory gate for connecting to IT devices in order to control and monitor access to them
Shared Account Password Management (SAPM)	Management of shared account passwords
Super User Privilege Management (SUPM)	Management of the privileges of system administrators and other users with high-level rights

27. CONCORDANCE TABLES

27.1 Table of concordance of the Management Report with the French Commercial Code

As an aid to readers, the following table shows where, in this Registration Document, they can find the information provided for by the French Commercial Code.

Heading	Section
1. CORPORATE ACCOUNTS	20.4
2. CONSOLIDATED FINANCIAL STATEMENTS	20.1
3. MANAGEMENT REPORT
3.1. Business report	6
• Explanation of the Company's activities and the activities of its subsidiaries and equity interests, broken down by segment	6.3.2, 6.4, 7.2 and 9.1
• Analysis of the Company's and Group's business development, earnings, financial position and debt	6.4.1 and 9.1 9.2 10 10.1
• Foreseeable changes in the Company and/or the Group	12 and 13
• Key financial and non-financial indicators of the Company and the Group	6 and 9
• Post closing events of the Company and the Group	5.1.5 and 20.7
• Disclosure of use of financial instruments including the financial, price, credit, liquidity, and cash risks, of the Company and the Group	4
• Main risks and uncertainties of the Company and the Group	4
• Information about R&D of the Company and the Group	11
3.2. Legal, financial and tax information of the Company	Legal: 5.1, 7.1, 14, 16.3, 16.4 Financial: 9, 20 Tax: 10.1.3 9.2.4.2,

• Composition of and changes in shareholding structure	18
• Names of controlled entities participating in the self-monitoring of the Company, and the share of the equity that they hold	NA
• Acquisitions of significant holdings, during the year, in companies based in France	NA
• Notification of a holding more than 10% of the share capital of another joint stock company; disposal of crossholdings	NA
• Purchase and sale by the Company of its own shares (share buybacks)	21.2.3.7
• Statement of shareholdings by employees in the share capital	17.3, 17.4, 25
• Disclosure of adjustments:	21.1
- for securities granting access to capital and stock options in the case of share buybacks
- for securities granting access to capital in the case of financial transactions
• Dividend payments made in the past three years	20.5
• Non tax deductible expenses and charges	20.7
• Supplier and customer payment deadlines	20.8
• Injunctions or monetary penalties for anticompetitive practices	NA
• Existing branch offices	7.2
• Intercompany loans and certifications by statutory auditors	7.3, 19.1.1 and 19.2
• Profit and loss table for the past five financial years	20.6
• Where stock options are awarded, an explanation of the Board's decision:	21.1.4
- either to prohibit executives from exercising their options before expiry of their term of office;
- or to require them, until expiry of their term of office, to hold in registered form all or part of the shares resulting from exercised options (specifying the percentage thus held)
• Where bonus shares are awarded, an explanation of the Board's decision:	21.1.4

term of office, the bonus shares awarded to them; - or to set the number of shares that they are required to keep in registered form until expiry of their term of office (specifying the percentage thus set)
• Statement of transactions by executives and related parties in the Company's securities	18.1.2 and 18.1.3
5. Statutory auditors' report on the corporate accounts	20.4
6. Statutory auditors' report on the consolidated financial statements	20.1

27.2 Supervisory Board report on corporate governance in accordance with the French Commercial Code

Heading	Section

• List of all positions held in any company by each corporate officer during the year	14.1
• Contracts entered into between a corporate officer, or a shareholder with more than 10% of voting rights, and a subsidiary (excluding current contracts)	14.4.2
• Statement of unexpired authorizations by the AGM regarding increases in capital	14.4.3
• Observations by the Supervisory Board regarding the Management Board report and the financial statements for the year	14.4.4

27.3 Additional documents

The following table shows where information may be found in this Registration Document, dispensing with the need to publish it separately:

Heading	Section
Description of the share buyback plan	21.2.3.7
Report of the Corporate Governance Committee (see table above)	16.4

AI assistant

Wallix Group — Annual Report 2017

1763_10-k_2018-05-16_c487adf2-8634-45f2-aec9-cabf49a89e9b.pdf

TRANSLATION OF THE FRENCH REGISTRATION DOCUMENT FISCAL YEAR ENDED DECEMBER 31, 2017

IN ACCORDANCE WITH ANNEX 1 OF EUROPEAN REGULATION (EC) NO. 809/2004

TABLE OF CONTENTS

Note

Disclaimer

Information on the market and the competition

Forward-looking statements

Risk factors

1. PERSONS RESPONSIBLE

1.1 Person responsible for the Registration Document

1.2 Declaration by the person responsible

1.3 Person responsible for financial information

2. STATUTORY AUDITORS

2.1 Principal statutory auditor

2.2 Alternate statutory auditor

2.3 Statutory auditors who have resigned

2.4 Statutory auditors' fees

3. SELECTED FINANCIAL INFORMATION

Selected financial information for the years ended December 31, 2015, 2016 and 2017 (French GAAP)

4. RISK FACTORS

4.1 Risks related to the Group's activities and the markets in which it operates, and to the implementation of its strategy

4.1.2 Risks related to markets, competition and technological development

4.1.5 Risks from protectionism

4.1.6 Risks of dependence on customers and risks associated with suppliers

4.2 Legal and regulatory risks

4.2.1 Litigation risks

4.2.2 Risks related to intellectual property rights

Processing of personal data

• The Group's obligations and responsibilities as a service provider under the data regulation

• Group's compliance with the data regulation

Regarding export control

4.3 Risks related to the Group's organization

4.4 Insurance and risk cover

• Civil, professional, and operational liability policy with AXA

• Professional multi-risk policy with Allianz

4.5 Risks related to disputes to which the Group is party

4.6 Financial risks

4.6.2 Risks related to historical losses

4.6.4 Dilution risk

4.6.6 Financing and liquidity risks

4.6.7 Interest rate risk

4.6.8 Credit risk and counterparty risk

4.6.9 Risk related to equities and other financial instruments

4.6.11 Risks related to the impairment of intangible assets

5. INFORMATION ABOUT THE COMPANY

5.1 History and development of the Company

5.1.2 Registration place and number of the Company

5.1.5 Important milestones in the growth of the Group's business activities

5.2 Investments

5.2.2 Main ongoing investments

5.2.3 Main future investments

6. OVERVIEW OF ACTIVITIES

6.1 Company Presentation

Privileged access protection: a key requirement when faced with cyber risk

The PAM market

Financial overview

6.2 The WALLIX market

6.2.2 Why protect privileged access?

6.2.3 Growth factors and outlook for PAM

6.3 The WALLIX Bastion solution

6.3.1 Overview

6.4 The competitive advantages of WALLIX

Figure 2: Awards and prizes received by WALLIX

PSA Group

Claranet

SIAAP

CASDEN – Banque Populaire

6.5 WALLIX's development strategy

6.6 The regulatory framework

6.6.1 The General Data Protection Regulation (GDPR)

6.6.5 Consequences for WALLIX

6.7 The WALLIX customer portfolio

6.8 WALLIX's economic model

6.9 Distribution channels

6.10 WALLIX competitors in the PAM market

CyberArk

Thycotic

Wallix Group Annual Report 2017