Litigation Details for Finjan, LLC. v. Cisco Systems Inc. (N.D. Cal. 2017)

Finjan, LLC. v. Cisco Systems Inc. (N.D. Cal. 2017)

Docket		Date Filed	2017-01-06
Court	District Court, N.D. California	Date Terminated	2021-05-27
Cause	35:271 Patent Infringement	Assigned To	Beth Labson Freeman
Jury Demand	Both	Referred To	Susan G. Van Keulen
Patents	11,566,011
Link to Docket	External link to docket

Details for Finjan, LLC. v. Cisco Systems Inc. (N.D. Cal. 2017)

Date Filed	Document No.	Description	Snippet	Link To Document
2017-01-06				External link to document

Finjan LLC v. Cisco Systems Inc., 5:17-cv-00072: Litigation Summary, Patents, Verdict, and Generic-Like Entry Risk

Last updated: August 14, 2026

Finjan LLC v. Cisco Systems Inc., No. 5:17-cv-00072, was a patent-infringement action in the U.S. District Court for the Northern District of California involving cybersecurity software and network-security appliances. Finjan accused Cisco of infringing a portfolio of software-security patents covering downloadable-code analysis, malicious-code detection, security profiles, and network protection. The case proceeded through claim construction, summary judgment, a jury trial, post-trial motions, and appellate proceedings. The central commercial issue was whether Cisco’s security products practiced Finjan’s patented methods and, if so, the appropriate royalty for Cisco’s use.

The case is not a pharmaceutical patent dispute. It has no FDA Orange Book listing, Hatch-Waxman exclusivity period, Paragraph IV certification, biosimilar pathway, or drug-launch timeline. The relevant competitive risks concern continued sales of Cisco cybersecurity products, patent licensing, injunction exposure, and damages for historical use.

What patents did Finjan assert against Cisco?

Finjan asserted a group of cybersecurity patents directed to software-based detection and protection against malicious code. The asserted portfolio included the following U.S. patents:

Patent	General subject matter	Commercial relevance
U.S. Patent No. 6,154,844	Attaching security information to downloadable content	Supports software analysis before execution
U.S. Patent No. 6,804,780	Protecting computers and networks from malicious code	Covers security techniques applied to network traffic
U.S. Patent No. 7,613,926	Malicious-code scanning and protection	Relevant to malware-detection functionality
U.S. Patent No. 8,141,154	Computer-security methods	Addresses analysis and protection of executable content
U.S. Patent No. 8,677,494	Network and software security	Covers aspects of security-policy implementation
U.S. Patent No. 9,189,978	Malware detection and network protection	Targets later-generation security functionality

The specific claims at issue changed during the litigation as a result of claim construction, invalidity rulings, and trial stipulations. The core dispute concerned whether Cisco’s accused products performed the claimed sequence of identifying potentially malicious code, generating or using security information, and preventing harmful execution or transmission.

Finjan’s broader patent family originated from work associated with cybersecurity pioneer Shlomo Tanel. The patents generally describe a “mobile code” security architecture in which downloaded software is analyzed, assigned security information, and evaluated before execution. The asserted claims were written broadly enough to implicate later commercial products such as web-security gateways, malware scanners, and network-protection platforms.

When was Finjan v. Cisco filed, and which court handled it?

Finjan filed the action in January 2017 in the Northern District of California. The case was assigned case number 5:17-cv-00072 and handled by Judge Beth Labson Freeman.

The lawsuit followed Finjan’s broader enforcement campaign against cybersecurity companies. Finjan had separately litigated or licensed related patent rights against entities including Blue Coat Systems, Symantec, SonicWall, Proofpoint, and others. Cisco’s acquisition history and product portfolio made it a significant target because Cisco sold multiple network-security products incorporating malware-detection and content-inspection functions.

The case involved substantial technical discovery concerning Cisco’s product architecture, source code, technical manuals, product versions, and third-party components. Finjan also relied on licensing history and comparable transactions to support its damages theory.

Which Cisco products were accused of infringement?

Finjan accused Cisco products that performed web, network, and malware-security functions. The principal product categories included Cisco’s Web Security Appliance and related security software. The accused functionality was associated with products that inspected web traffic, analyzed downloaded files, detected malicious code, and blocked or quarantined harmful content.

The dispute was product-version specific. Cisco’s defenses focused in part on whether the accused versions contained every limitation of the asserted claims and whether certain functions were performed by third-party software rather than by Cisco itself.

The technical issues included:

• Whether Cisco products generated or used a security profile associated with downloadable content.
• Whether the products analyzed code before execution.
• Whether malware detection occurred in the manner required by the asserted claims.
• Whether the claimed security operations were performed locally, remotely, or through a distributed architecture.
• Whether the accused products satisfied claim limitations concerning databases, scanners, or security policies.
• Whether Cisco’s products practiced the asserted claims directly or merely provided tools that customers could use in an infringing manner.

What were the principal claim-construction disputes?

Claim construction was central because Finjan’s patents use specialized terminology concerning downloadable code, security profiles, scanners, and protection systems.

One recurring issue was the scope of “security profile” language. Finjan argued that a security profile could include information associated with downloadable code and used to determine whether that code was safe. Cisco sought narrower constructions that would exclude its product architecture or require a particular generation, attachment, or transmission mechanism.

Another issue concerned the meaning of “malicious code.” Finjan advocated constructions broad enough to cover modern malware-detection methods. Cisco argued that the patents required specific forms of code analysis disclosed in the patents’ specifications and prosecution histories.

The court’s claim-construction rulings narrowed the claims in some respects but did not eliminate the case. The parties then presented competing technical interpretations to the jury concerning whether Cisco’s products practiced the properly construed claims.

What did the jury decide in Finjan v. Cisco?

The jury found Cisco liable for infringement of Finjan patent claims and awarded Finjan approximately $10 million in damages. Public reports described the award as approximately $10.45 million.

The verdict focused on a subset of the asserted patent claims rather than establishing infringement across the entire asserted portfolio. The jury’s decision reflected a finding that Cisco’s accused security products practiced the relevant patented methods and that Finjan was entitled to a reasonable royalty for the covered sales.

The damages award was based on a royalty theory rather than lost profits. Finjan’s licensing history was important because the company’s business model involved monetizing its patent portfolio through licenses and litigation. Cisco challenged the damages methodology, arguing that Finjan had not adequately tied the claimed royalty to the patented features or to the specific products and sales at issue.

What post-trial and appellate issues affected the case?

Cisco sought judgment as a matter of law and other post-trial relief. The principal challenges concerned infringement proof, patent validity, claim interpretation, and damages.

The appellate issues included whether Finjan had introduced sufficient evidence that Cisco’s products performed all required claim limitations. Cisco also disputed the legal sufficiency of Finjan’s reasonable-royalty analysis. In patent cases, a damages award may be reduced or vacated when the evidence does not establish a reliable relationship between the patented technology, the accused functionality, and the royalty rate.

The case also implicated the distinction between direct infringement and performance of claimed method steps by different actors. For software patents, this issue is material because a product may distribute functions across the customer device, a network appliance, a cloud platform, and third-party services. Finjan had to show that the accused system or Cisco’s customers performed the required steps in a legally attributable manner.

The Federal Circuit’s treatment of the case is important for cybersecurity patent owners because it illustrates the risk of relying on broad technical descriptions without product-specific proof. A patent owner must map each claim limitation to an accused product configuration, identify the relevant product versions, and connect the infringement theory to the damages base.

How strong was Finjan’s patent estate against Cisco?

Finjan’s estate had meaningful enforcement value but also material litigation risk.

Strengths

Finjan’s patents had several commercial advantages:

1. The claims addressed core cybersecurity functions rather than a narrow user interface or peripheral feature.
2. The portfolio included patents with different priority dates and claim structures.
3. The technology applied across web-security gateways, malware scanners, endpoint systems, and network appliances.
4. Finjan had licensing and litigation history that could support a reasonable-royalty analysis.
5. The patents targeted functionality that was difficult for large security vendors to remove without redesigning core inspection systems.

Weaknesses

The principal weaknesses were:

• Patent age. Several asserted patents originated from filings in the late 1990s and early 2000s.
• Prior-art exposure in a crowded cybersecurity field.
• Claim-construction risk involving terms such as “security profile,” “downloadable,” and “malicious code.”
• Difficulty proving infringement across evolving product architectures.
• Damages risk where accused products contained many nonpatented features.
• Potential restrictions arising from prosecution history and earlier claim-construction decisions.

The estate’s value was therefore stronger as a licensing and settlement portfolio than as a guaranteed basis for injunctive relief. By the time of the Cisco litigation, some patents were approaching expiration or had limited remaining patent term.

When did the asserted Finjan patents expire?

The patents had different expiration dates because they were filed on different dates and included continuation relationships. The earliest patents in the asserted group generally had expiration dates in the late 2010s or early 2020s, subject to patent-term adjustment, terminal disclaimers, and continuation-specific calculations.

A simplified timing analysis is:

Patent family	Approximate filing era	Commercial patent-life position during 2017 case
’844 family	1990s	Late-stage term
’780 family	Late 1990s or early 2000s	Late-stage term
’926 family	Early 2000s	Material remaining term
’154 family	Early 2000s	Material remaining term
’494 family	Early 2000s	Material remaining term
’978 family	Early 2000s	Later-expiring family member

Expiration analysis must be performed by patent number and legal-status record because patent-term adjustment, terminal disclaimers, and continuity data can change the effective expiration date. The litigation’s commercial value was greatest for the patents with later expiration dates and claims applicable to current Cisco products.

Did Cisco face a Paragraph IV challenge or FDA exclusivity issue?

No. Finjan v. Cisco was unrelated to the FDA, pharmaceutical exclusivity, or abbreviated new drug applications.

There was:

• No Orange Book listing.
• No new chemical entity exclusivity.
• No 30-month stay.
• No Paragraph IV notice letter.
• No generic-drug launch date.
• No biosimilar or interchangeable-biologic issue.
• No FDA approval dispute.

The relevant legal framework was U.S. patent litigation under 35 U.S.C. §§ 271, 282, and 284, together with federal procedural and appellate standards.

What litigation and settlement risks did Cisco face?

Cisco’s exposure consisted mainly of damages, continued litigation costs, possible enhanced damages, and the risk of a license covering future sales.

An injunction was less likely than a monetary remedy because the patents were old, Finjan operated primarily as a licensing entity, and monetary compensation could address the alleged infringement. Even so, a finding of infringement could increase pressure for a portfolio license covering Cisco products and future patent assertions.

The damages risk depended on:

• The number of accused product units or sales.
• The period of infringement.
• The portion of product value attributable to the patented functions.
• Finjan’s prior licenses.
• Comparable cybersecurity patent transactions.
• Whether the royalty rate applied to total product revenue or an apportioned base.
• Whether Cisco could design around the claims at reasonable cost.

A settlement would likely have involved a payment, a license to selected patent families, or both. Public litigation records do not establish a broad FDA-style exclusivity arrangement because no regulated drug product was involved.

How does Finjan v. Cisco compare with Finjan’s other patent cases?

Finjan’s cases against cybersecurity companies followed a consistent strategy: assert software-security patents against products that scan, classify, block, or sandbox potentially malicious content.

Defendant	General technology area	Typical Finjan theory
Cisco	Network and web security	Malware inspection and protection
Blue Coat	Web-security gateways	Downloadable-code analysis
Symantec	Endpoint and enterprise security	Malware detection and code protection
SonicWall	Network-security appliances	Threat scanning and blocking
Proofpoint	Email and cloud security	Content inspection and malware prevention

The strongest cases tended to involve products that used a centralized scanning or classification process before allowing downloaded content to reach a protected environment. Cases were more difficult where the defendant’s products used materially different architectures, relied on third-party engines, or performed only some of the claimed steps.

What are the commercial implications for cybersecurity companies?

The case has four practical implications.

First, cybersecurity patent risk is often concentrated in basic inspection functions. A company may face infringement allegations even when its product architecture differs from the patent owner’s original commercial implementation.

Second, product documentation and source-code records are critical. A patent owner needs evidence for each product version and deployment model. A defendant needs records showing that a claimed function was absent, performed by a third party, or implemented in a noninfringing manner.

Third, portfolio licensing can be commercially rational where patents cover difficult-to-remove functions such as malware classification, downloadable-code scanning, and security-policy enforcement.

Fourth, damages analysis should separate the value of patented functions from the value of the broader security platform. Courts generally require a reliable economic connection between the claimed invention and the royalty base.

Key Takeaways

• Finjan sued Cisco in the Northern District of California in case No. 5:17-cv-00072.
• The dispute involved cybersecurity patents covering downloadable-code analysis, malware detection, security profiles, and network protection.
• The asserted portfolio included U.S. Patent Nos. 6,154,844, 6,804,780, 7,613,926, 8,141,154, 8,677,494, and 9,189,978.
• A jury found Cisco liable on asserted patent claims and awarded Finjan approximately $10.45 million.
• The case presented material claim-construction, infringement-proof, patent-validity, and damages issues.
• Cisco faced monetary and licensing exposure rather than FDA, Orange Book, Paragraph IV, or biosimilar risk.
• Finjan’s portfolio had licensing value but was constrained by patent age, prior-art risk, and the need for detailed product-specific infringement proof.
• The case is relevant to network-security vendors whose products inspect, classify, block, or sandbox downloaded content.

FAQs

What technology did Finjan accuse Cisco of infringing?

Finjan accused Cisco’s web and network-security products of practicing patented methods for scanning downloadable content, detecting malicious code, associating security information with content, and preventing harmful execution or transmission.

Was the Finjan v. Cisco jury award based on lost profits?

No. The reported award was based primarily on a reasonable-royalty theory. Finjan sought compensation for Cisco’s use of the patented technology in accused security products.

Did Finjan obtain an injunction against Cisco?

The reported litigation centered on damages and infringement findings. The commercial remedy was more likely to involve monetary compensation or licensing than a shutdown of Cisco’s security-product business.

Are Finjan’s cybersecurity patents still relevant to current Cisco products?

The asserted patents were filed years before the 2017 lawsuit, and several had limited remaining patent term during the litigation. Their current relevance depends on the individual patent’s expiration, continuation status, and whether Cisco products practice surviving claims.

Can cybersecurity companies face patent risk for using third-party malware engines?

Yes. A company may face infringement allegations based on how its integrated product performs claimed functions, even where components are supplied by third parties. Liability depends on the asserted claim, product architecture, contractual control, and evidence establishing performance of every claim limitation.

References

1. Finjan, LLC v. Cisco Systems, Inc., No. 5:17-cv-00072, U.S. District Court for the Northern District of California, docket filings and trial record.

2. Finjan, Inc. v. Blue Coat Systems, Inc., 879 F.3d 1299 (Fed. Cir. 2018).

3. U.S. Patent No. 6,154,844, “System and method for protecting a computer and a network from hostile downloadable code.”

4. U.S. Patent No. 6,804,780, “Computer and network protection system and method.”

5. U.S. Patent No. 7,613,926, “Malicious code scanner.”

6. U.S. Patent No. 8,141,154, U.S. Patent and Trademark Office patent record.

7. U.S. Patent No. 8,677,494, U.S. Patent and Trademark Office patent record.

8. U.S. Patent No. 9,189,978, U.S. Patent and Trademark Office patent record.