Offer to Purchase for Cash All Outstanding Shares of Common Stock of ArcSight, Inc. at $43.50 Net Per Share by Priam Acquisition Corporation a wholly-owned subsidiary of Hewlett-Packard Company

QuickLinks -- Click here to rapidly navigate through this document

Exhibit (a)(1)(A)

Offer to Purchase for Cash
All Outstanding Shares of Common Stock
of

ArcSight, Inc.
at
$43.50 Net Per Share
by

Priam Acquisition Corporation

a wholly-owned subsidiary of

Hewlett-Packard Company

THE OFFER AND WITHDRAWAL RIGHTS WILL EXPIRE AT 12:00 MIDNIGHT, NEW YORK
CITY TIME, ON WEDNESDAY, OCTOBER 20, 2010 UNLESS THE OFFER IS EXTENDED.

Priam Acquisition Corporation, a Delaware corporation ("Purchaser") and a wholly-owned, direct or indirect, subsidiary of Hewlett-Packard Company, a Delaware corporation ("HP"), and HP as co-bidder, are offering to purchase all outstanding shares of common stock, par value $0.00001 per share (the "Shares"), of ArcSight, Inc., a Delaware corporation ("ArcSight"), at a price of $43.50 per Share, net to the seller in cash (the "Offer Price"), without interest thereon and less any required withholding taxes, upon the terms and subject to the conditions set forth in this Offer to Purchase and in the related Letter of Transmittal (which, together with any amendments or supplements thereto, collectively constitute the "Offer").

The Offer is being made in connection with, and subject to the terms and conditions of, the Agreement and Plan of Merger, dated as of September 13, 2010, among HP, Purchaser and ArcSight (the "Merger Agreement"), pursuant to which, after the completion of the Offer and satisfaction or waiver of certain conditions, Purchaser will be merged with and into ArcSight and ArcSight will be the surviving corporation (the "Merger").

The Offer is conditioned upon, among other things, (a) there being validly tendered and not withdrawn before the expiration of the Offer a number of Shares which, together with the Shares then owned by HP and its subsidiaries, including Purchaser, represents at least a majority of the total number of Shares outstanding on a fully diluted basis as more fully described below in this Offer to Purchase and (b) the expiration or termination of the applicable waiting period under the Xxxx-Xxxxx-Xxxxxx Antitrust Improvements Act of 1976, as amended, and the receipt of requisite regulatory approvals under the antitrust laws of Austria and Germany. The Offer is also subject to certain other terms and conditions. See "Introduction" and Sections 1 and 14—"Terms of the Offer" and "Conditions of the Offer." There is no financing condition to the Offer.

The ArcSight board of directors unanimously has (i) determined that the Merger Agreement and the transactions contemplated thereby, including the Offer and the Merger, are advisable and in the best interests of and are fair to ArcSight and ArcSight's stockholders and (ii) approved and authorized the Merger Agreement and the transactions contemplated thereby, including the Offer and the Merger. The ArcSight board of directors unanimously recommends that ArcSight stockholders accept the Offer, tender their Shares pursuant to the Offer and (if required under Delaware law) adopt the Merger Agreement.

The Information Agent for the Offer is:

000 Xxxxxxx Xxxxxx, 00xx Xxxxx
Xxx Xxxx, Xxx Xxxx 00000
Stockholders Call Toll-Free: (000) 000-0000
Banks and Brokers Call Collect: (000) 000-0000

September 22, 2010

IMPORTANT

If you desire to tender all or any portion of your Shares to Purchaser pursuant to the Offer, you should either (a) complete and sign the Letter of Transmittal for the Offer, which is enclosed with this Offer to Purchase, in accordance with the instructions contained in the Letter of Transmittal, mail or deliver the Letter of Transmittal (or a manually executed facsimile thereof) and any other required documents to BNY Mellon Shareowner Services, the depositary for the Offer (the "Depositary"), and either deliver the certificates for your Shares to the Depositary along with the Letter of Transmittal (or a manually executed facsimile thereof) or tender your Shares by book-entry transfer by following the procedures described in Section 3—"Procedures for Tendering Shares" of this Offer to Purchase, in each case by the Expiration Date (as defined below) of the Offer, or (b) request that your broker, dealer, commercial bank, trust company or other nominee effect the transaction for you. If you hold Shares registered in the name of a broker, dealer, commercial bank, trust company or other nominee you must contact that institution in order to tender your Shares to Purchaser pursuant to the Offer.

If you desire to tender your Shares to Purchaser pursuant to the Offer and the certificates representing your Shares are not immediately available, or you cannot comply in a timely manner with the procedures for tendering your Shares by book-entry transfer, or cannot deliver all required documents to the Depositary by the expiration of the Offer, you may tender your Shares to Purchaser pursuant to the Offer by following the procedures for guaranteed delivery described in Section 3—"Procedures for Tendering Shares" of this Offer to Purchase.

* * *

Questions and requests for assistance may be directed to Innisfree M&A Incorporated (the "Information Agent") at its address and telephone number set forth on the back cover of this Offer to Purchase. Requests for additional copies of this Offer to Purchase, the Letter of Transmittal, the Notice of Guaranteed Delivery and other tender offer materials may be directed to the Information Agent. You may also contact your broker, dealer, commercial bank or trust company for assistance.

THIS OFFER TO PURCHASE AND THE RELATED LETTER OF TRANSMITTAL CONTAIN IMPORTANT INFORMATION, AND YOU SHOULD CAREFULLY READ BOTH IN THEIR ENTIRETY BEFORE MAKING A DECISION WITH RESPECT TO THE OFFER.

TABLE OF CONTENTS

		Page

SUMMARY TERM SHEET		i
INTRODUCTION		1
THE TENDER OFFER		4
1.	Terms of the Offer	4
2.	Acceptance for Payment and Payment for Shares	6
3.	Procedures for Tendering Shares	6
4.	Withdrawal Rights	9
5.	Material United States Federal Income Tax Consequences of the Offer and the Merger	10
6.	Price Range of Shares; Dividends	12
7.	Possible Effects of the Offer on the Market for the Shares; NASDAQ Listing; Exchange Act Registration and Margin Regulations	13
8.	Certain Information Concerning ArcSight	15
9.	Certain Information Concerning Purchaser and HP	16
10.	Background of the Offer	18
11.	Purpose of the Offer and Plans for ArcSight	21
12.	The Transaction Documents	22
13.	Source and Amount of Funds	41
14.	Conditions of the Offer	42
15.	Dividends and Distributions	45
16.	Certain Regulatory and Legal Matters	45
17.	Appraisal Rights	47
18.	Fees and Expenses	47
19.	Miscellaneous	48
SCHEDULE A		A-1

SUMMARY TERM SHEET

The following are answers to some of the questions you may have as a stockholder of ArcSight, Inc. ("ArcSight") in connection with the proposed Offer. You should carefully read this entire Offer to Purchase and the other documents to which this Offer to Purchase refers to fully understand the Offer and the related transactions, as this summary may not contain all of the information that is important to you.


Securities Sought		All issued and outstanding shares of common stock, par value $0.00001 per share, of ArcSight
Price Offered Per Share		$43.50 per share, net to the seller in cash, without interest thereon and less any required withholding taxes
Scheduled Expiration of Offer		12:00 midnight, New York City time, on Wednesday, October 20, 2010
Purchaser		Priam Acquisition Corporation, a wholly-owned, direct or indirect, subsidiary of Hewlett-Packard Company
Co-Bidder		Hewlett-Packard Company

Who is offering to buy my shares?

Our name is Priam Acquisition Corporation ("Purchaser"). We are a Delaware corporation formed for the purpose of making this tender offer for all of the common stock of ArcSight. We are a wholly-owned, direct or indirect, subsidiary of Hewlett-Packard Company, a Delaware corporation ("HP").

References to "we," "us," or "our," unless the context otherwise requires, are references to Purchaser.

See "Introduction" and Section 9—"Certain Information Concerning Purchaser and HP."

How many shares are you offering to buy?

We are offering to purchase all of the outstanding shares of common stock, par value $0.00001 per share (the "Shares"), of ArcSight at a price of $43.50 per Share, net to the seller in cash (the "Offer Price"), without interest thereon and less any required withholding taxes, upon the terms and subject to the conditions set forth in this Offer to Purchase and in the related Letter of Transmittal (which, together with any amendments or supplements thereto, collectively constitute the "Offer").

See "Introduction" and Section 1—"Terms of the Offer."

Is there an agreement governing the Offer?

Yes. HP, Purchaser and ArcSight have entered into an Agreement and Plan of Merger, dated as of September 13, 2010 (as it may be amended, supplemented or otherwise modified from time to time, the "Merger Agreement"). The Merger Agreement provides, among other things, for the terms and conditions of the Offer and the subsequent merger of Purchaser with and into ArcSight with ArcSight continuing as the surviving corporation and a wholly-owned, direct or indirect, subsidiary of HP (the "Merger").

See Sections 12 and 14—"The Transaction Documents" and "Conditions of the Offer."

How much are you offering to pay for my Shares and what is the form of payment?

We are offering to pay you $43.50 per Share, net to you in cash without interest thereon and less any required withholding taxes.

Will I have to pay any fees or commissions if I tender my Shares?

Do you have the financial resources to pay for the Shares?

Yes. We estimate that the total amount of funds necessary to purchase all outstanding Shares of ArcSight pursuant to the Offer and to pay customary fees and expenses in connection with the Offer and the related transactions will be approximately $1.52 billion. We expect to fund all these payments through a loan or capital contribution from HP to Purchaser. As of July 31, 2010, HP had approximately $14.7 billion in cash and cash equivalents. The Offer is not conditioned upon any financing arrangements. See Section 13—"Source and Amount of Funds."

Is your financial condition relevant to my decision to tender my Shares?

We do not believe our financial condition is relevant to your decision whether to tender your Shares and accept the Offer because the Offer is being made for all outstanding Shares solely for cash. There is no financing condition to the Offer.

Does the ArcSight board of directors recommend that I tender my Shares?

The ArcSight board of directors unanimously recommends that ArcSight's stockholders accept the Offer, tender their Shares pursuant to the Offer and (to the extent necessary) adopt the Merger Agreement. See "Introduction" and Section 12—"The Transaction Documents."

A more complete description of the reasons for the ArcSight board of directors' approval and recommendation of the Offer and the Merger will be set forth in a Solicitation/Recommendation Statement on Schedule 14D-9 that will be filed with the United States Securities and Exchange Commission (the "SEC") by ArcSight.

Is there a deadline for tendering my Shares?

You may tender at any time prior to the end of the initial offering period for the Offer, which will end at 12:00 midnight, New York City time, on October 20, 2010, unless we extend the Offer in accordance with the Merger Agreement.

If you cannot deliver everything that is required to validly tender your Shares by that time, you may be able to use a guaranteed delivery procedure to tender your Shares. The procedures for tendering your Shares by guaranteed delivery are described later in this Offer to Purchase.

See Sections 1 and 3—"Terms of the Offer" and "Procedures for Tendering Shares."

Under what circumstances would you extend the Offer?

The Merger Agreement requires us to extend the Offer:

•: for one or more periods if required by any rule or regulation of the SEC or the NASDAQ applicable to the Offer; and
•: in the event that all of the conditions to the Offer, including the Minimum Condition (as defined below) or any of the other conditions set forth in Section 14—"Conditions of the Offer," are not satisfied or waived (if permitted under the Merger Agreement) as of any then scheduled expiration of the Offer, for successive extension periods of up to 10 business days each.

In addition, the Merger Agreement provides that, following our acquisition of Shares in the Offer, we may provide a subsequent offering period in accordance with Rule 14d-11 of the Securities Exchange Act of 1934, as amended (the "Exchange Act"). A subsequent offering period would be an additional period of time of between 3 business days and 20 business days, beginning no later than 9:00 a.m., New York City time, on the next business day following the expiration of the Offer, during which stockholders may tender Shares not tendered in the Offer. During a subsequent offering period, tendering stockholders will not have withdrawal rights, and we will promptly purchase and pay for any Shares tendered during the subsequent offering period at the same price paid in the Offer. Any subsequent offering period will be disclosed by public announcement thereof to be issued not later than 9:00 a.m., New York City time, on the next business day after the expiration of the Offer. We do not currently intend to provide a subsequent offering period, although we reserve the right to do so.

Under the Merger Agreement, we are not required to extend the Offer beyond March 13, 2011 (or, under certain circumstances, June 13, 2011) or after termination of the Merger Agreement. See Sections 1 and 14—"Terms of the Offer" and "Conditions of the Offer."

See Section 12—"The Transaction Documents."

How will I be notified if you extend the Offer?

We will announce any decision to extend the Offer in a press release stating the new expiration date no later than 9:00 a.m., New York City time, on the first business day after the previously scheduled expiration of the Offer. See Section 1—"Terms of the Offer."

What are the most significant conditions to the Offer?

The Offer is conditioned upon, among other things:

•: there being validly tendered and not withdrawn before the expiration of the Offer a number of Shares which, together with the Shares then owned by HP and its subsidiaries, including Purchaser, represents at least a majority of the total number of Shares outstanding on a fully diluted basis (taking into account all Shares that ArcSight would be required to issue pursuant to the conversion or exercise of options, rights and securities that are convertible into or exercisable for Shares) as of the scheduled expiration of the Offer; and
•: the expiration or termination of the applicable waiting period under the Xxxx-Xxxxx-Xxxxxx Antitrust Improvements Act of 1976, as amended, and the receipt of requisite regulatory approvals under the antitrust laws of Austria and Germany.

The Offer is also subject to other conditions. See Section 14—"Conditions of the Offer."

There is no financing condition to the Offer.

iii

What is the "Top-Up Option" and when could it be exercised?

ArcSight has granted us the option, exercisable only following our acquisition of Shares pursuant to the Offer, to purchase from ArcSight subject to the terms and conditions set forth in the Merger Agreement the number of authorized and unissued Shares equal to the lowest number of Shares that, when added to the number of Shares held by HP and/or Purchaser at the time of such exercise, will constitute one (1) Share more than 90% of the Shares outstanding on a fully diluted basis (taking into account all Shares that ArcSight would then be required to issue pursuant to the conversion or exercise of options, rights and securities that are then convertible into or exercisable for Shares), at a price per share equal to the Offer Price. This option is to enable us, following our acquisition of Shares pursuant to the Offer, to effect the Merger as a short-form merger under Delaware law without a vote or any further action by the stockholders of ArcSight.

How do I tender my Shares?

If you wish to accept the Offer, and:

•: you are a record holder (i.e., a stock certificate has been issued to you and registered in your name), you must deliver the stock certificate(s) representing your Shares (or follow the procedures described in this Offer to Purchase for book-entry transfer), together with a properly completed and duly executed Letter of Transmittal (or a manually signed facsimile thereof) and any other documents required by the Letter of Transmittal, to the Depositary. These materials must reach the Depositary before the Offer expires. Detailed instructions are contained in the Letter of Transmittal and in Section 3—"Procedures for Tendering Shares."
•: you are a record holder, but your stock certificate is not available or you cannot deliver it to the Depositary before the Offer expires, you may be able to obtain three additional trading days to tender your Shares using the enclosed Notice of Guaranteed Delivery. See Section 3—"Procedures for Tendering Shares."
•: you hold your Shares through a broker or a bank and wish to accept the Offer, you should promptly contact your broker or bank and give instructions that your Shares be tendered. See the Letter of Transmittal and Section 3—"Procedures for Tendering Shares."

May I withdraw previously tendered Shares?

You may withdraw Shares tendered pursuant to the Offer at any time on or prior to 12:00 midnight, New York City time, on Wednesday, October 20, 2010 (or, if we extend the initial offering period of the Offer, the latest time and date at which the offering period of the Offer, as so extended, will expire). In addition, unless and until we accept them for payment, such Shares may be withdrawn at any time after November 21, 2010.

In the event we provide a subsequent offering period following the Offer in accordance with the Merger Agreement, no withdrawal rights will apply to Shares tendered during such subsequent offering period or to Shares tendered in the Offer and accepted for payment.

See Sections 1 and 4—"Terms of the Offer" and "Withdrawal Rights."

How do I withdraw previously tendered Shares?

To withdraw Shares that you previously tendered, you must deliver a written notice of withdrawal, or a facsimile of one, with the required information to the Depositary at a time when you have the right to withdraw your Shares. If you tendered your Shares through your broker or bank, you must instruct the broker or bank to arrange for the withdrawal of your Shares.

See Sections 1 and 4—"Terms of the Offer" and "Withdrawal Rights."

If I decide not to tender my Shares, what will happen to my Shares?

If the Merger is consummated, stockholders not tendering their Shares in the Offer (other than those properly exercising their appraisal rights) will receive cash in an amount equal to the price per Share paid in the Offer, without interest thereon and less any required withholding taxes. Therefore, if the Merger takes place, the only difference between tendering and not tendering Shares in the Offer is that tendering stockholders will be paid earlier. If, however, the Merger does not take place and the Offer is consummated, the number of stockholders and the number of Shares that are still in the hands of the public may be so small that there will no longer be an active or liquid public trading market (or possibly any public trading market) for Shares held by stockholders other than Purchaser. We cannot predict whether the reduction in the number of Shares that might otherwise trade publicly would have an adverse or beneficial effect on the market price for, or marketability of, the Shares or whether the reduction would cause future market prices to be greater or less than the Offer Price.

See "Introduction" and Section 7—"Possible Effects of the Offer on the Market for the Shares; NASDAQ Listing; Exchange Act Registration and Margin Regulations."

Have any stockholders already agreed to tender their Shares in the Offer?

Yes. In connection with the execution of the Merger Agreement, certain stockholders of ArcSight and their affiliates, if applicable, who hold approximately 15.6% of the outstanding stock of ArcSight (the "Tendering Stockholders") have entered into tender and voting agreements with HP and Purchaser (the "Tender and Voting Agreements"), which provides, among other things, that the Tendering Stockholders (i) tender their Shares in the Offer and (ii) vote their Shares in favor of adopting the Merger Agreement, if applicable, and against certain contrary actions and agreements. Each Tender and Voting Agreement will terminate upon the earlier to occur of (a) the termination of the Merger Agreement in accordance with its terms, (b) the written agreement of the parties to terminate such agreement, (c) the Effective Time, and (d) any amendment or change to the Merger Agreement or the Offer that decreases the Offer Price.

See Section 12—"The Transaction Documents."

If the Offer is consummated, will ArcSight remain a public company?

Following the consummation of the Offer, we will complete the Merger if and when the conditions are satisfied. If the Merger is consummated, ArcSight will no longer be publicly owned. Even if the Merger is not consummated, following the consummation of the Offer, there may not be a public trading market for the Shares and ArcSight may cease making filings with the SEC or otherwise cease being required to comply with the rules relating to publicly held companies because we intend to cause ArcSight to apply for termination of registration of the Shares under the Exchange Act as soon after the completion of the Offer as the requirements for such delisting and termination are met.

See Section 7—"Possible Effects of the Offer on the Market for the Shares; NASDAQ Listing; Exchange Act Registration and Margin Regulations."

What is the market value of my Shares as of a recent date?

On September 10, 2010, the last full trading day prior to the public announcement of the Merger Agreement, the reported closing sales price per Share on The NASDAQ Global Market was $35.10 per Share. On August 25, 2010, the last full trading day prior to published rumors that ArcSight might be acquired at a price of more than $40.00 per Share, the reported closing sales price per Share on The NASDAQ Global Market was $28.23 per Share.

The Offer Price represents a premium of approximately 54% over the closing price of the Shares on The NASDAQ Global Market on August 25, 2010, the last full day of trading before published

rumors that ArcSight might be acquired at a price of more than $40.00 per Share, a premium of approximately 70% over the average closing price of the Shares over the 30-day period ended August 25, 2010 and a premium of approximately 81% over the average closing price of the Shares over the 60-day period ended August 25, 2010.

We encourage you to obtain a current market quotation for the Shares.

See Section 6—"Price Range of Shares; Dividends."

Will I have appraisal rights in connection with the Offer?

No appraisal rights will be available to you in connection with the Offer. However, you will be entitled to seek appraisal rights in connection with the Merger if you do not tender Shares in the Offer and do not vote in favor of the Merger, subject to and in accordance with Delaware law.

See Section 17—"Appraisal Rights."

What will happen to my ArcSight options in the Offer and the Merger?

The Offer is only for Shares and not for any ArcSight options to acquire Shares. At the Effective Time, each option to purchase ArcSight's common stock (each an "ArcSight Option") that is outstanding immediately prior to the Effective Time will be treated as follows:

•: each vested ArcSight Option (with vesting determined giving effect to any acceleration of vesting in connection with the Effective Time) that has an exercise price per Share less than the Offer Price will be cancelled in exchange for an amount in cash, without interest thereon and less any required withholding taxes, equal to the product of (i) the excess of the Offer Price over the exercise price per Share under such ArcSight Option, multiplied by (ii) the number of Shares subject to such ArcSight Option;
•: each unvested ArcSight Option that has an exercise price per Share less than the Offer Price, and is held by a person who will be a director, employee or other service provider of ArcSight immediately following the Effective Time, will be assumed by HP and converted automatically at the Effective Time into an option to purchase shares of HP common stock (proportionally adjusted) (an "Assumed ArcSight Option");
•: each ArcSight Option, whether vested or unvested, that has an exercise price per Share equal to or greater than the Offer Price will be cancelled, with no consideration payable in respect thereof; and
•: each unvested ArcSight Option (excluding any ArcSight Option that vests upon the Effective Time) that is held by a person who will not be a director, employee or other service provider of ArcSight immediately following the Effective Time will be cancelled, with no consideration payable in respect thereof.

See Section 12—"The Transaction Documents."

How are my Assumed ArcSight Options for Shares converted into HP options for shares of HP common stock?

Each Assumed ArcSight Option (or portion thereof) that is converted into an option to purchase shares of HP common stock will be converted as follows:

•: the number of shares of HP common stock subject to each such Assumed ArcSight Option shall be determined by multiplying the number of Shares subject to such ArcSight Option immediately prior to the Effective Time by a fraction (the "Exchange Ratio"), the numerator of which is the

Offer Price and the denominator of which is the average closing price of HP common stock on the NYSE over the five trading days immediately preceding (but not including) the date on which the Effective Time occurs (rounded down to the nearest whole share); and

•: the exercise price per share of HP common stock (rounded up to the nearest whole cent) shall equal (A) the exercise price per share of the Assumed ArcSight Option immediately prior to the Effective Time divided by (B) the Exchange Ratio.

What are the material United States federal income tax consequences of exchanging Shares pursuant to the Offer or the Merger?

If you are a U.S. Holder (as defined below), your receipt of cash in exchange for Shares pursuant to the Offer or the Merger will generally be a taxable transaction for U.S. federal income tax purposes. You will generally recognize gain or loss in an amount equal to the difference, if any, between (i) the cash you receive in the Offer or the Merger and (ii) your adjusted tax basis in the Shares you sell in the Offer or the Merger. You are urged to consult your own tax advisor as to the particular tax consequences of the Offer and the Merger to you, including the tax consequences under state, local, foreign and other tax laws.

See Section 5—"Material United States Federal Income Tax Consequences of the Offer and the Merger."

Whom should I call if I have questions about the Offer?

For further information, you can call Innisfree M&A Incorporated, the Information Agent for the Offer, at (000) 000-0000 (toll-free for stockholders) or (000) 000-0000 (collect for banks and brokers). See the back cover page of this Offer to Purchase.

vii

To All Holders of Shares of Common Stock of ArcSight, Inc.:

INTRODUCTION

Priam Acquisition Corporation, a Delaware corporation ("Purchaser") and a wholly-owned, direct or indirect, subsidiary of Hewlett-Packard Company, a Delaware corporation ("HP"), and HP, as co-bidder, hereby offer to purchase all outstanding shares of common stock, par value $0.00001 per share (the "Shares"), of ArcSight, Inc., a Delaware corporation ("ArcSight"), at a price of $43.50 per Share, net to the seller in cash (the "Offer Price"), without interest thereon and less any required withholding taxes, upon the terms and subject to the conditions set forth in this Offer to Purchase and in the related Letter of Transmittal (which, together with any amendments or supplements thereto, collectively constitute the "Offer").

Pursuant to the Merger Agreement, at the effective time of the Merger (the "Effective Time"), each Share outstanding immediately prior to the Effective Time (other than Shares owned by HP, Purchaser or ArcSight, or direct or indirect wholly-owned subsidiaries of HP, Purchaser or ArcSight, and any Shares held by stockholders who validly exercise their appraisal rights in connection with the Merger as described in Section 17—"Appraisal Rights") will be cancelled and extinguished and automatically converted in the Merger into the right to receive an amount in cash equal to the Offer Price, without interest thereon and less any applicable withholding taxes.

In connection with the execution of the Merger Agreement, certain stockholders of ArcSight who hold approximately 15.6% of the outstanding stock of ArcSight (the "Tendering Stockholders") have entered into tender and voting agreements with HP and Purchaser (the "Tender and Voting Agreements"), which provide, among other things, that the Tendering Stockholders will (i) tender their Shares in the Offer at least five business days prior to the initial expiration thereof and not withdraw the shares and (ii) vote their Shares in favor of adopting the Merger Agreement, if applicable, and against any action or agreement which would materially delay or interfere with, or prevent or nullify, the Merger. In addition, the Tendering Stockholders agree, subject to certain exceptions, to refrain from transferring their Shares. Each Tender and Voting Agreement will terminate upon the earlier to occur of (a) the termination of the Merger Agreement in accordance with its terms, (b) the written agreement of the parties to terminate such agreement, (c) the Effective Time, and (d) any amendment or change to the Merger Agreement or the Offer that decreases the Offer Price.

The Merger Agreement and the Tender and Voting Agreement are more fully described in Section 12—"The Transaction Documents," which also contains a discussion of the treatment of ArcSight stock options.

The Offer is conditioned upon, among other things, (a) there being validly tendered and not withdrawn before the expiration of the Offer a number of Shares which, together with the Shares then owned by HP and its subsidiaries, including Purchaser, represents at least a majority of the total number of Shares outstanding on a "fully diluted basis" (taking into account all Shares that ArcSight would be required to issue pursuant to the conversion or exercise of options, rights and securities that are convertible into or exercisable for Shares) as of the scheduled expiration of the Offer (the "Minimum Condition") and (b) the expiration or termination of the applicable waiting period under the Xxxx-Xxxxx-Xxxxxx Antitrust Improvements Act of 1976, as amended, and the receipt of requisite regulatory approvals under the antitrust laws of Austria and Germany (the "Antitrust Condition"). The

Offer is also subject to other conditions. See Section 14—"Conditions of the Offer." There is no financing condition to the Offer.

The ArcSight board of directors has unanimously (i) determined that the Merger Agreement and the transactions contemplated thereby, including the Offer and the Merger, are advisable and in the best interests of and are fair to ArcSight and ArcSight's stockholders and (ii) approved and authorized the Merger Agreement and the transactions contemplated thereby, including the Offer and the Merger. The ArcSight board of directors unanimously recommends that ArcSight stockholders accept the Offer, tender their Shares pursuant to the Offer and (if required under Delaware law) adopt the Merger Agreement.

According to ArcSight, as of September 9, 2010, (i) 34,764,555 Shares were outstanding and (ii) employee options to purchase 7,453,388 Shares were outstanding, of which 3,775,919 were vested and exercisable. Based on the foregoing, Purchaser estimates that the Minimum Condition would be satisfied if 19,270,238 Shares are validly tendered and not withdrawn prior to expiration of the Offer (not including Shares tendered pursuant to procedures for guaranteed delivery). The number of Shares required to be tendered to satisfy the Minimum Condition will depend upon the actual number of Shares and exercisable options to purchase Shares outstanding at the Expiration Date (as defined below) and the number of Shares tendered in the Offer pursuant to the guaranteed delivery procedures described herein as to which delivery has not been completed.

If your Shares are registered in your name and you tender directly to BNY Mellon Shareowner Services (the "Depositary") you will not be obligated to pay brokerage fees or commissions or, subject to Instruction 6 of the Letter of Transmittal, transfer taxes on the purchase of Shares by Purchaser. If you hold your Shares through a broker or bank you should check with your broker or bank as to whether they charge any service fees or commissions. However, if you do not complete and sign the Substitute Form W-9 that is included in the Letter of Transmittal, or a Form W-8BEN or other Form W-8, as applicable, you may be subject to a required backup federal income tax withholding, currently at a rate of 28% (which rate is scheduled to increase to 31% for taxable years beginning after December 31, 2010) of the gross proceeds payable to you. Backup withholding is not an additional tax and any amounts withheld under the backup withholding rules may be refunded or credited against your U.S. federal income tax liability provided you timely furnish the required information to the Internal Revenue Service (the "IRS"). See Section 5—"Material United States Federal Income Tax Consequences of the Offer and the Merger." Purchaser will pay all charges and expenses of the Depositary and Innisfree M&A Incorporated (the "Information Agent").

Shares previously tendered pursuant to the Offer to Purchase and the related Letter of Transmittal and not validly withdrawn constitute valid tenders for purposes of the Offer, as amended. Stockholders who have validly tendered and not withdrawn their Shares are not required to take any further action with respect to such Shares in order to receive the Offer Price of $43.50 per Share if Shares are accepted for payment and paid for by Purchaser pursuant to the Offer, except as may be required by the guaranteed delivery procedure if such procedure was utilized. See Section 3—"Procedures for Tendering Shares."

If we accept for payment and pay for any Shares pursuant to the Offer, the Merger Agreement provides that HP will be entitled to designate representatives to serve on the ArcSight board of directors in proportion to our ownership of Shares following such purchase. We currently intend, as soon as practicable after consummation of the Offer, to exercise this right and to designate Xxxxxx X. Xxxxxx, Xxxxxxx X. Xxxxxxx, Xxxxxxxxx X. Xxxxxx, Xxxx X. XxXxxxxx and Xxxx X. Xxxxxxx to serve as directors of ArcSight. We expect that such representation would permit us to exert substantial influence over ArcSight's conduct of its business and operations. We currently intend, as soon as practicable after consummation of the Offer, to consummate the Merger pursuant to the Merger Agreement. Following the Merger, the directors of Purchaser will be the directors of ArcSight.

Our right to amend the Offer (including amending the number of Shares to be purchased, the Offer Price and the consideration to be offered in the Merger) is limited pursuant to the terms of the Merger Agreement, a copy of which is filed as an exhibit to the Schedule TO. See Section 1—"Terms of the Offer."

The Offer will expire at 12:00 midnight, New York City time, on Wednesday, October 20, 2010, unless extended in accordance with the Merger Agreement. See Sections 1, 14 and 16—"Terms of the Offer," "Conditions of the Offer" and "Certain Regulatory and Legal Matters."

This Offer to Purchase and the related Letter of Transmittal contain important information and each such document should be read carefully and in its entirety before any decision is made with respect to the Offer.

THE TENDER OFFER

1. Terms of the Offer

Upon the terms and subject to the prior satisfaction or waiver of the conditions of the Offer (including, if the Offer is extended or amended, the terms and conditions of any extension or amendment), we will accept for payment and pay for all Shares validly tendered and not properly withdrawn by the Expiration Date in accordance with the procedures set forth in Section 4—"Withdrawal Rights." The term "Expiration Date" means 12:00 midnight, New York City time, on Wednesday, October 20, 2010, unless we have extended the initial offering period of the Offer, in which event the term "Expiration Date" shall mean the latest time and date at which the offering period of the Offer, as so extended by us, will expire.

The Offer is subject to the conditions set forth in Section 14—"Conditions of the Offer," which include, among other things, satisfaction of the Minimum Condition and the Antitrust Condition. The Merger Agreement provides that: (i) we will extend the Offer for any period required by any rule or regulation of the United States Securities and Exchange Commission (the "SEC") or The NASDAQ Global Market ("NASDAQ") which is applicable to the Offer; and (ii) in the event that all of the conditions to the Offer, including the Minimum Condition or any of the other conditions set forth in Section 14—"Conditions of the Offer," are not satisfied or waived (if permitted under the Merger Agreement) as of any then scheduled expiration of the Offer, we will extend the Offer for successive extension periods of 10 business days each in order to permit the satisfaction of all of the conditions to the Offer. However, we are not obligated to extend the Offer if the Merger Agreement is terminated pursuant to its terms and we will not extend the Offer if prohibited by law. There is no financing condition to the Offer.

Subject to any applicable rules and regulations of the SEC and the terms and conditions of the Merger Agreement, we expressly reserve the right to increase the Offer Price or to make any other changes in the terms and conditions of the Offer. Under the terms of the Merger Agreement, however, we are not permitted to, without ArcSight's consent, (i) amend or waive the Minimum Condition, (ii) decrease the Offer Price, (iii) change the form of consideration to be paid in the Offer, (iv) reduce the number of Shares to be purchased in the Offer, (v) extend the Offer, other than in a manner contemplated by the Merger Agreement, (vi) impose conditions to the Offer in addition to those described in Section 14—"Conditions of the Offer," or (vii) amend, modify or supplement any of the terms of the Offer in a manner adverse to the holders of Shares.

Upon the terms and subject to the conditions of the Offer, promptly following the Expiration Date, we will be required to accept for payment and pay for any Shares validly tendered and not withdrawn.

In any event, under the Merger Agreement, we are not required to extend the Offer beyond March 13, 2011 (or, under certain circumstances, June 13, 2011), or after termination of the Merger Agreement. See Sections 1, 12 and 14—"Terms of the Offer," "The Transaction Documents" and "Conditions of the Offer."

There can be no assurance that we will be required under the Merger Agreement to extend the Offer. During any extension of the initial offering period, all Shares previously tendered and not withdrawn will remain subject to the Offer and subject to withdrawal rights. See Section 4—"Withdrawal Rights."

If we make a material change in the terms of the Offer or the information concerning the Offer, or if we waive a material condition of the Offer, we will disseminate additional tender offer materials and extend the Offer if and to the extent required by Rules 14d-4(d), 14d-6(c) and 14e-1 under the Securities Exchange Act of 1934, as amended (the "Exchange Act") or otherwise. The minimum period during which a tender offer must remain open following material changes in the terms of the tender offer or the

information concerning the tender offer, other than a change in the consideration offered or a change in the percentage of securities sought, will depend upon the facts and circumstances, including the relative materiality of the terms or information changes. With respect to a change in the consideration offered or a change in the percentage of securities sought, a tender offer generally must remain open for a minimum of 10 business days following such change to allow for adequate disclosure to stockholders.

We expressly reserve the right, subject to the applicable rules and regulations of the SEC and the terms of the Merger Agreement, to not accept for payment any Shares if, at the expiration of the Offer, any of the conditions to the Offer set forth in Section 14—"Conditions of the Offer" have not been satisfied or upon the occurrence of any of the events set forth in Section 14.

We expressly reserve the right, subject to the applicable rules and regulations of the SEC and the terms of the Merger Agreement, to delay acceptance of Shares and to delay payment for Shares pending receipt of any governmental regulatory approvals specified in Section 16, without prejudice to our rights set forth in Section 14—"Conditions of the Offer." See Sections 14 and 16—"Conditions of the Offer" and "Certain Regulatory and Legal Matters." The reservation by us of the right to delay the acceptance of or payment for Shares is subject to the provisions of Rule 14e-1(c) under the Exchange Act, which requires us to pay the consideration offered or to return Shares deposited by or on behalf of tendering stockholders promptly after the termination or withdrawal of the Offer.

Any extension or amendment of the Offer, waiver of a condition of the Offer, delay in acceptance for payment or payment, or termination of the Offer will be followed, as promptly as practicable, by public announcement thereof, such announcement in the case of an extension to be issued not later than 9:00 a.m., New York City time, on the next business day after the previously scheduled Expiration Date in accordance with the public announcement requirements of Rules 14d-4(d), 14d-6(c) and 14e-1(d) under the Exchange Act.

The Merger Agreement provides that, following our acquisition of Shares in the Offer, we may provide a subsequent offering period in accordance with Rule 14d-11 of the Exchange Act. A subsequent offering period would be an additional period of time of between 3 business days and 20 business days, beginning no later than 9:00 a.m., New York City time, on the next business day following the expiration of the Offer, during which stockholders may tender Shares not tendered in the Offer. A subsequent offering period, if one is provided, is not an extension of the Offer, which already will have been completed, and no withdrawal rights will apply during a subsequent offering period with respect to Shares previously tendered in the Offer and accepted for payment. During a subsequent offering period, tendering stockholders will not have withdrawal rights, and we will promptly purchase and pay for any Shares tendered during the subsequent offering period at the same price paid in the Offer, without interest thereon and less any applicable withholding taxes. Any subsequent offering period will be disclosed by public announcement thereof to be issued not later than 9:00 a.m. New York City time, on the next business day after the Expiration Date. We do not currently intend to provide a subsequent offering period, although we reserve the right to do so in accordance with the Merger Agreement.

Without limiting our obligation under such rules or the manner in which we may choose to make any public announcement, we currently intend to make announcements by issuing a press release to the Dow Xxxxx News Service (or such other national media outlet or outlets HP deems prudent) and making any appropriate filing with the SEC.

We have received from ArcSight its stockholder list and security position listings for the purpose of disseminating the Offer to holders of Shares. We will send this Offer to Purchase and the related Letter of Transmittal to record holders of Shares and to brokers, dealers, commercial banks, trust companies and similar persons whose names, or the names of whose nominees, appear on the stockholder list or, if applicable, who are listed as participants in a clearing agency's security position listing for subsequent transmittal to beneficial owners of Shares.

2. Acceptance for Payment and Payment for Shares

Upon the terms and subject to the conditions of the Offer (including, if the Offer is extended or amended, the terms and conditions of any such extension or amendment), we will accept for payment, and will pay for, all Shares validly tendered and not properly withdrawn at the Expiration Date promptly after the Expiration Date. In addition, subject to the applicable rules of the SEC and the terms and conditions of the Merger Agreement, we reserve the right to delay acceptance for payment of, or payment for, Shares, pending receipt of any regulatory or governmental approvals specified in Section 16—"Certain Regulatory and Legal Matters." For information with respect to approvals that we are or may be required to obtain prior to the completion of the Offer, see Section 16—"Certain Regulatory and Legal Matters."

In all cases (including during any subsequent offering period), we will pay for Shares accepted for payment pursuant to the Offer only after timely receipt by the Depositary of (i) certificates representing such Shares or timely confirmation of the book-entry transfer of such Shares into the Depositary's account at The Depository Trust Company ("DTC") pursuant to the procedures set forth in Section 3—"Procedures for Tendering Shares," (ii) a properly completed and duly executed Letter of Transmittal (or facsimile thereof) with all required signature guarantees or, in the case of a book-entry transfer, an Agent's Message (as defined below) in lieu of the Letter of Transmittal, and (iii) any other documents required by the Letter of Transmittal. See Section 3—"Procedures for Tendering Shares."

For purposes of the Offer, we will be deemed to have accepted for payment and thereby purchased Shares validly tendered and not properly withdrawn if and when we give oral or written notice to the Depositary of our acceptance for payment of such Shares pursuant to the Offer. Payment for Shares accepted for payment pursuant to the Offer will be made by deposit of the purchase price therefor with the Depositary, which will act as agent for the tendering stockholders for purposes of receiving payments from us and transmitting such payments to the tendering stockholders. Under no circumstances will interest be paid on the Offer Price for Shares, regardless of any extension of the Offer or any delay in payment for Shares.

If any tendered Shares are not accepted for payment pursuant to the terms and conditions of the Offer for any reason, or if certificates are submitted for more Shares than are tendered, certificates for such unpurchased Shares will be returned (or new certificates for the Shares not tendered will be sent), without expense to the tendering stockholder (or, in the case of Shares tendered by book-entry transfer into the Depositary's account at DTC pursuant to the procedures set forth in Section 3—"Procedures for Tendering Shares," such Shares will be credited to an account maintained with DTC) promptly following expiration or termination of the Offer.

If, prior to the Expiration Date, we increase the consideration offered to holders of Shares pursuant to the Offer, such increased consideration will be paid to holders of all Shares that are purchased pursuant to the Offer, whether or not such Shares were tendered prior to such increase in consideration.

We reserve the right to transfer or assign in whole or in part, from time to time, to one or more direct or indirect wholly-owned subsidiaries of HP, the right to purchase all or any portion of the Shares tendered pursuant to the Offer, but any such transfer or assignment will not relieve Purchaser of its obligations under the Offer and will in no way prejudice the rights of tendering stockholders to receive payment for Shares validly tendered and accepted for payment pursuant to the Offer.

3. Procedures for Tendering Shares

Valid Tender of Shares. Except as set forth below, to validly tender Shares pursuant to the Offer, (i) the Depositary must receive at one of its addresses set forth on the back cover of this Offer to Purchase prior to the Expiration Date a properly completed and duly executed Letter of Transmittal

(or a manually executed facsimile thereof) in accordance with the instructions of the Letter of Transmittal, with any required signature guarantees, or an Agent's Message (as defined below) in connection with a book-entry delivery of Shares, and any other documents required by the Letter of Transmittal and either (x) certificates representing Shares tendered must be delivered to the Depositary or (y) such Shares must be properly delivered pursuant to the procedures for book-entry transfer described below and a confirmation of such delivery received by the Depositary (which confirmation must include an Agent's Message if the tendering stockholder has not delivered a Letter of Transmittal), in each case, prior to the Expiration Date, or (ii) you must comply with the guaranteed delivery procedures set forth below. The term "Agent's Message" means a message, transmitted by DTC to, and received by, the Depositary and forming a part of a Book-Entry Confirmation (as defined below), which states that DTC has received an express acknowledgment from the participant in DTC tendering the Shares which are the subject of such Book-Entry Confirmation that such participant has received and agrees to be bound by the terms of the Letter of Transmittal and that Purchaser may enforce such agreement against the participant.

Book-Entry Transfer. The Depositary will establish an account with respect to the Shares at DTC for purposes of the Offer within two business days after the date of this Offer to Purchase. Any financial institution that is a participant in DTC's systems may make a book-entry transfer of Shares by causing DTC to transfer such Shares into the Depositary's account in accordance with DTC's procedures for such transfer. However, although delivery of Shares may be effected through book-entry transfer, either the Letter of Transmittal (or facsimile thereof), properly completed and duly executed, together with any required signature guarantees, or an Agent's Message in lieu of the Letter of Transmittal, and any other required documents, must, in any case, be transmitted to and received by the Depositary at one of its addresses set forth on the back cover of this Offer to Purchase by the Expiration Date, or the tendering stockholder must comply with the guaranteed delivery procedures described below. The confirmation of a book-entry transfer of Shares into the Depositary's account at DTC as described above is referred to herein as a "Book-Entry Confirmation."

Delivery of documents to DTC in accordance with DTC's procedures does not constitute delivery to the Depositary.

Signature Guarantees and Stock Powers. Signatures on a Letter of Transmittal need not be guaranteed (i) if the Letter of Transmittal is signed by the registered owner(s) (which term, for purposes of this section, includes any participant in any of DTC's systems whose name appears on a security position listing as the owner of the Shares) of Shares tendered therewith and such registered owner has not completed the box entitled "Special Payment Instructions" or the box entitled "Special Delivery Instructions" on the Letter of Transmittal or (ii) if such Shares are tendered for the account of an Eligible Institution. See Instructions 1 and 5 of the Letter of Transmittal. In all other cases, all signatures on a Letter of Transmittal must be guaranteed by a financial institution (which term includes most commercial banks, savings and loan associations and brokerage houses) that is a member in good standing of a recognized Medallion Program approved by the Securities Transfer Association, Inc., including the Security Transfer Agents Medallion Program, the New York Stock Exchange Medallion Signature Program and the Stock Exchanges Medallion Program (each, an "Eligible Institution"). If the certificates for Shares are registered in the name of a person other than the signer of the Letter of Transmittal, or if payment is to be made or certificates for Shares not tendered or not accepted for payment are to be returned to a person other than the registered owner of the certificates surrendered, then the tendered certificates must be endorsed or accompanied by appropriate stock powers, in either case, signed exactly as the name or names of the registered owner(s) or holder(s) appear on the certificates, with the signatures on the certificates or stock powers guaranteed as described above. See Instructions 1 and 5 of the Letter of Transmittal.

If certificates representing Shares are forwarded separately to the Depositary, a properly completed and duly executed Letter of Transmittal (or facsimile) must accompany each delivery of certificates.

Guaranteed Delivery. If you wish to tender Shares pursuant to the Offer and your certificates for Shares are not immediately available, or you cannot comply with the procedure for book-entry transfer on a timely basis, or you cannot deliver all required documents to the Depositary prior to the Expiration Date, you may tender your Shares by satisfying all of the requirements set forth below:

•: such tender is made by or through an Eligible Institution;
•: a properly completed and duly executed Notice of Guaranteed Delivery, substantially in the form provided by us, is received by the Depositary (as provided below) prior to the Expiration Date; and
•: the certificates for all tendered Shares, in proper form for transfer (or a Book-Entry Confirmation with respect to all such Shares), together with a properly completed and duly executed Letter of Transmittal (or facsimile thereof), with any required signature guarantees (or, in the case of a book-entry transfer, an Agent's Message in lieu of the Letter of Transmittal), and any other required documents, are received by the Depositary within three trading days after the date of execution of such Notice of Guaranteed Delivery. A "trading day" is any day on which The NASDAQ Global Market is open for business.

The Notice of Guaranteed Delivery may be transmitted by facsimile transmission or mail to the Depositary and must include a guarantee by an Eligible Institution in the form set forth in such Notice of Guaranteed Delivery.

The method of delivery of Shares, the Letter of Transmittal and all other required documents, including delivery through DTC, is at your election and risk. Delivery of all such documents will be deemed made only when actually received by the Depositary (including, in the case of a book-entry transfer, by Book-Entry Confirmation). If such delivery is by mail, we recommend that you send all such documents by properly insured registered mail with return receipt requested. In all cases, please allow sufficient time to ensure timely delivery.

Other Requirements. Notwithstanding any provision hereof, we will pay for Shares pursuant to the Offer only after timely receipt by the Depositary of (i) certificates for (or a timely Book-Entry Confirmation with respect to) such Shares, (ii) a Letter of Transmittal (or facsimile thereof), properly completed and duly executed, with any required signature guarantees (or, in the case of a book-entry transfer, an Agent's Message in lieu of the Letter of Transmittal) and (iii) any other documents required by the Letter of Transmittal. Accordingly, tendering stockholders may be paid at different times depending upon when certificates for Shares or Book-Entry Confirmations with respect to Shares are actually received by the Depositary. Under no circumstances will we pay interest on the Offer Price for Shares, regardless of any extension of the Offer or any delay in making such payment.

Binding Agreement. Our acceptance for payment of Shares tendered pursuant to one of the procedures described above will constitute a binding agreement between the tendering stockholder and Purchaser upon the terms and subject to the conditions of the Offer.

Appointment as Proxy. By executing and delivering a Letter of Transmittal as set forth above (or, in the case of a book-entry transfer, by delivering an Agent's Message in lieu of a Letter of Transmittal), you irrevocably appoint our designees as your proxies, each with full power of substitution, to the full extent of your rights with respect to the Shares tendered by you and accepted for payment by us and with respect to any and all other Shares or other securities issued or issuable in respect of such Shares. All such proxies and powers of attorney will be considered coupled with an interest in the tendered Shares. Such appointment is effective when, and only to the extent that, we

accept for payment Shares tendered by you as provided herein. Upon the effectiveness of such appointment, all prior powers of attorney, proxies and consents given by you will be revoked, and no subsequent powers of attorney, proxies or consents may be given by you (and, if given, will not be deemed effective). Our designees will, with respect to the Shares or other securities and rights for which the appointment is effective, be empowered to exercise all of your voting and other rights as they, in their sole discretion, may deem proper at any annual, special, adjourned or postponed meeting of the stockholders of ArcSight, by written consent in lieu of any such meeting or otherwise. We reserve the right to require that, in order for Shares to be deemed validly tendered, immediately upon our payment for such Shares we must be able to exercise full voting, consent and other rights to the extent permitted under applicable law with respect to such Shares and other securities, including voting at any meeting of stockholders or executing a written consent concerning any matter.

Determination of Validity. All questions as to the validity, form, eligibility (including time of receipt) and acceptance of any tender of Shares will be determined by us in our sole and absolute discretion. We reserve the absolute right to reject any and all tenders determined by us not to be in proper form or the acceptance for payment of or payment for which may, in our opinion, be unlawful. We also reserve the absolute right to waive any defect or irregularity in the tender of any Shares of any particular stockholder whether or not similar defects or irregularities are waived in the case of any other stockholder. No tender of Shares will be deemed to have been validly made until all defects and irregularities relating thereto have been cured or waived. None of HP, Purchaser or any of their respective affiliates or assigns, the Depositary, the Information Agent, or any other person will be under any duty to give notification of any defects or irregularities in tenders or incur any liability for failure to give any such notification.

4. Withdrawal Rights

Except as otherwise provided in this Section 4, tenders of Shares pursuant to the Offer are irrevocable. You may withdraw Shares tendered pursuant to the Offer at any time on or prior to the Expiration Date and, unless and until we accept them for payment, such Shares may also be withdrawn at any time after November 21, 2010.

For your withdrawal to be effective, the Depositary must timely receive a written or facsimile transmission notice of withdrawal at one of its addresses set forth on the back cover of this Offer to Purchase. Any notice of withdrawal must specify the name of the person having tendered the Shares to be withdrawn, the number of Shares to be withdrawn and the name of the record holder of the Shares to be withdrawn, if different from that of the person who tendered such Shares. The signature(s) on the notice of withdrawal must be guaranteed by an Eligible Institution, unless such Shares have been tendered for the account of any Eligible Institution. If Shares have been tendered pursuant to the procedures for book-entry transfer as set forth in Section 3—"Procedures for Tendering Shares," any notice of withdrawal must specify the name and number of the account at DTC to be credited with the withdrawn Shares. If certificates representing the Shares have been delivered or otherwise identified to the Depositary, the name of the registered owner and the serial numbers shown on such certificates must also be furnished to the Depositary prior to the physical release of such certificates.

All questions as to the validity, form, eligibility (including time of receipt) and acceptance of any notice of withdrawal will be determined by us, in our sole discretion. No withdrawal of Shares will be deemed to have been properly made until all defects and irregularities have been cured or waived. None of HP or Purchaser or any of their respective affiliates or assigns, the Depositary, the Information Agent, or any other person will be under any duty to give notification of any defects or irregularities in any notice of withdrawal or incur any liability for failure to give such notification. Withdrawals of tenders of Shares may not be rescinded, and any Shares properly withdrawn will be deemed not to have been validly tendered for purposes of the Offer. Withdrawn Shares may, however,

be retendered by following one of the procedures for tendering Shares described in Section 3—"Procedures for Tendering Shares" at any time prior to the Expiration Date.

If we extend the Offer in accordance with the Merger Agreement, are delayed in our acceptance for payment of Shares or are unable to accept for payment Shares pursuant to the Offer for any reason, then, without prejudice to our rights under this Offer, the Depositary may nevertheless, on our behalf, retain tendered Shares, and such Shares may not be withdrawn except to the extent that tendering stockholders exercise withdrawal rights as described in this Section 4 before the Expiration Date or at any time after November 21, 2010 unless such shares have been accepted for payment as provided herein.

5. Material United States Federal Income Tax Consequences of the Offer and the Merger

The following is a summary of certain material U.S. federal income tax consequences to beneficial owners of Shares of the Offer and the Merger. This summary does not purport to be a comprehensive description of all of the tax consequences that may be relevant to a decision to dispose of Shares in the Offer or the Merger, including tax considerations that arise from rules of general application to all taxpayers or to certain classes of investors or that are generally assumed to be known by investors. This summary is based on the Internal Revenue Code of 1986, as amended (the "Code"), Treasury regulations, administrative rulings and court decisions, all as in effect as of the date hereof and all of which are subject to differing interpretations and/or change at any time (possibly with retroactive effect). No ruling has been or will be sought from the IRS with respect to the matters discussed below, and there can be no assurance that the IRS will not take a contrary position regarding the tax consequences of the Offer and the Merger or that any such contrary position would not be sustained by a court. In addition, this summary is not a complete description of all the tax consequences of the Offer and the Merger and, in particular, may not address U.S. federal income tax considerations to holders of Shares subject to special treatment under U.S. federal income tax law (including, for example, financial institutions, dealers in securities or currencies, traders that xxxx to market, holders who hold their Shares as part of a hedge, straddle or conversion transaction, insurance companies, S corporations, tax-exempt entities, holders who obtained their Shares by exercising options or warrants and holders who obtained Shares in connection with restricted share plans or in other compensatory transactions). This summary assumes that the Shares are not U.S. real property interests within the meaning of section 897 of the Code. In addition, this summary does not discuss any tax consequences to holders of options or warrants to purchase Shares, any aspect of state, local or foreign tax law that may be applicable to any holder of Shares, or any U.S. federal tax considerations other than U.S. federal income tax considerations. This summary also assumes that holders own Shares as capital assets within the meaning of section 1221 of the Code (generally, property held for investment).

YOU SHOULD CONSULT YOUR OWN TAX ADVISORS WITH RESPECT TO THE SPECIFIC TAX CONSEQUENCES OF THE OFFER AND THE MERGER TO YOU IN LIGHT OF YOUR OWN PARTICULAR CIRCUMSTANCES, INCLUDING THE TAX CONSEQUENCES UNDER ESTATE AND GIFT TAX LAWS, AND STATE, LOCAL, FOREIGN AND OTHER TAX LAWS.

U.S. Holders. Except as otherwise set forth below, the following discussion is limited to the material U.S. federal income tax consequences relevant to a beneficial owner of Shares that is, for U.S. federal income tax purposes, (i) an individual citizen or resident of the United States, (ii) a domestic corporation (or any other entity or arrangement treated as a corporation for U.S. federal income tax purposes that is created or organized in or under the laws of the United States, any state thereof or the District of Columbia), (iii) an estate the income of which is subject to U.S. federal income tax

regardless of its source, and (iv) a trust if (A) a court within the United States is able to exercise primary supervision over the administration of the trust and one or more U.S. persons have the authority to control all substantial decisions of the trust or (B) such trust has otherwise validly elected to be treated as a United States person for U.S. federal income tax purposes (a "U.S. Holder").

If a partnership (including any entity or arrangement treated as a partnership for U.S. federal income tax purposes) holds Shares, the tax treatment of a holder that is a partner in the partnership generally will depend upon the status of the partner and the activities of the partnership. Such holders should consult their own tax advisors regarding the tax consequences of exchanging the Shares pursuant to the Offer or the Merger.

Payments with Respect to Shares. The exchange of Shares for cash pursuant to the Offer or the Merger will be a taxable transaction for U.S. Holders for U.S. federal income tax purposes, and a U.S. Holder who receives cash for Shares pursuant to the Offer or the Merger will recognize gain or loss, if any, equal to the difference between the amount of cash received and the holder's adjusted tax basis in the Shares. Such gain or loss will generally be capital gain or loss, and will generally be long-term capital gain or loss if such U.S. Holder's holding period for the Shares is more than one year. Long-term capital gains recognized by certain U.S. Holders (including individuals) generally are subject to tax at a lower rate than short-term capital gains or ordinary income. There are limitations on the deductibility of capital losses. Gain or loss must be calculated separately for each block of Shares (i.e., Shares acquired at the same cost in a single transaction) exchanged for cash pursuant to the Offer or Merger.

In general, U.S. Holders who exercise appraisal rights will also recognize gain or loss. Any U.S. Holder considering exercising statutory appraisal rights should consult the holder's own tax advisor.

Backup Withholding Tax and Information Reporting. Payments made with respect to Shares exchanged for cash pursuant to the Offer or the Merger generally will be subject to information reporting and may be subject to U.S. federal backup withholding tax (currently at a rate of 28 percent, which rate is scheduled to increase to 31% for taxable years beginning after December 31, 2010) unless the U.S. Holder (i) furnishes an accurate tax identification number and otherwise complies with applicable U.S. information reporting or certification requirements (typically, by completing and signing a substitute Form W-9, which will be included with the Letter of Transmittal to be returned to the Depositary) or (ii) is a corporation or other exempt recipient and, when required, demonstrates such fact. Backup withholding is not an additional tax and any amounts withheld under the backup withholding rules may be refunded or credited against a U.S. Holder's U.S. federal income tax liability, if any, provided that such U.S. Holder furnishes the required information to the IRS in a timely manner.

Non-U.S. Holders. The following is a summary of certain material U.S. federal income tax consequences relevant to Non-U.S. Holders of Shares. The term "Non-U.S. Holder" means a beneficial owner, other than a partnership, of a Share that is not a U.S. Holder.

Non-U.S. Holders should consult their own tax advisors to determine the specific U.S. federal, state, local and foreign tax consequences that may be relevant to them and their eligibility for and the application of any relevant tax treaty.

Payments with Respect to Shares. Payments made to a Non-U.S. Holder with respect to Shares exchanged for cash pursuant to the Offer or the Merger generally will be exempt from U.S. federal income tax, unless:

(i) the gain on Shares, if any, is effectively connected with the conduct by the Non-U.S. Holder of a trade or business in the United States (and, if an applicable income tax treaty between the United States and the Non-U.S. Holder's country of residence applies, attributable to the

Non-U.S. Holder's permanent establishment in the United States) (in which event (A) the Non-U.S. Holder will be subject to U.S. federal income tax as described under "U.S. Holders," but such Non-U.S. Holder should provide a Form W-8ECI instead of a Form W-9, and (B) if the Non-U.S. Holder is a corporation, it may also be subject to branch profits tax on such gain at a 30 percent rate (or such lower rate as may be specified under an applicable income tax treaty));

(ii) the Non-U.S. Holder is an individual who was present in the United States for 183 days or more in the taxable year and certain other conditions are met, in which case the Non-U.S. Holder will be subject to tax at a flat rate of 30 percent (or such lower rate as may be specified under an applicable income tax treaty between the United States and the Non-U.S. Holder's country of residence) on the gain from the exchange of the Shares for cash pursuant to the Offer or the Merger, net of applicable U.S.-source losses from sales or exchanges of other capital assets recognized during the year; or

(iii) the Non-U.S. Holder is an individual subject to tax pursuant to U.S. tax rules applicable to certain former U.S. citizens and long-term residents of the United States.

If the gain on the Shares is described in (i) above then the Non-U.S. Holder will be subject to U.S. federal income tax as described under "U.S. Holders," but such Non-U.S. Holder should provide a Form W-8ECI instead of a Form W-9. In addition, if the Non-U.S. Holder is a corporation, all or a portion of such gain may also be subject to a "branch profits tax" at a rate of 30% or such lower rate as may be specified by an applicable tax treaty between the United States and the Non-U.S. Holder's country of residence.

Backup Withholding Tax and Information Reporting. In general, a Non-U.S. Holder may be subject to information reporting and backup withholding (currently at a rate of 28%, which rate is scheduled to increase to 31% for taxable years beginning after December 31, 2010) with respect to a payment made with respect to Shares exchanged for cash in the Offer or the Merger unless such Non-U.S. Holder provides a valid taxpayer identification number and complies with certain certification procedures or otherwise establishes an exemption from backup withholding (typically by providing the Depositary with a properly completed IRS Form W-8BEN (or a Form W-8ECI if the Non-U.S. Holder's gain is effectively connected with the conduct of a U.S. trade or business)). If Shares are held through a foreign partnership or other flow-through entity, certain documentation requirements also apply to the partnership or other flow-through entity. Backup withholding is not an additional tax and any amounts withheld under the backup withholding rules may be refunded or credited against a Non-U.S. Holder's United States federal income tax liability, if any, provided that such Non-U.S. Holder furnishes the required information to the IRS in a timely manner.

6. Price Range of Shares; Dividends

According to ArcSight's Annual Report on Form 10-K for the fiscal year ended April 30, 2010 (the "Form 10-K") the Shares are traded on The NASDAQ Global Market under the symbol "ARST." The following table sets forth, for the quarters indicated, the high and low intra-day sales prices per Share on the The NASDAQ Global Market as reported in the Form 10-K with respect to periods occurring

from the time of ArcSight's initial public offering in February 2008 through fiscal year 2010 and as reported by published financial sources with respect to periods occurring in fiscal year 2011:

Fiscal Period		High		Low

Fiscal Year ended April 30, 2009:
	First Quarter	$	11.74	$	7.19
	Second Quarter	$	13.00	$	5.25
	Third Quarter	$	10.00	$	4.17
	Fourth Quarter	$	16.10	$	7.70
Fiscal Year ended April 30, 2010:
	First Quarter	$	20.80	$	13.52
	Second Quarter	$	25.99	$	16.90
	Third Quarter	$	29.24	$	22.15
	Fourth Quarter	$	29.33	$	22.58
Fiscal Year ending April 30, 2011:
	First Quarter	$	25.59	$	24.87
	Second Quarter (through September 10, 2010)	$	36.13	$	34.52

According to the Form 10-K, ArcSight has never declared or paid cash dividends on the Shares and it has no current plans to pay any dividends in the future. Under the terms of the Merger Agreement, ArcSight is not permitted to declare or pay dividends with respect to the Shares without the prior written consent of HP. See Section 15—"Dividends and Distributions."

7. Possible Effects of the Offer on the Market for the Shares; NASDAQ Listing; Exchange Act Registration and Margin Regulations

Possible Effects of the Offer on the Market for the Shares. If the Merger is consummated, stockholders not tendering their Shares in the Offer (other than those properly exercising their appraisal rights) will receive cash in an amount equal to the price per Share paid in the Offer, without interest thereon and less any required withholding taxes. Therefore, if the Merger takes place, the only difference between tendering and not tendering Shares in the Offer is that tendering stockholders will be paid earlier. If, however, the Merger does not take place and the Offer is consummated, the number of stockholders and the number of Shares that are still in the hands of the public may be so small that there will no longer be an active or liquid public trading market (or possibly any public trading market) for Shares held by stockholders other than Purchaser. We cannot predict whether the reduction in the number of Shares that might otherwise trade publicly would have an adverse or beneficial effect on the market price for, or marketability of, the Shares or whether the reduction would cause future market prices to be greater or less than the Offer Price.

NASDAQ Listing. Depending upon the number of Shares purchased pursuant to the Offer, the Shares may no longer meet the requirements for continued listing on the NASDAQ. The rules of the NASDAQ establish certain criteria that, if not met, could lead to the delisting of the Shares from NASDAQ. Among such criteria are the number of stockholders, the number of shares publicly held and the aggregate market value of the shares publicly held. If, as a result of the purchase of Shares pursuant to the Offer or otherwise, the Shares no longer meet the requirements of the NASDAQ for

continued listing and the listing of the Shares is discontinued, the market for the Shares could be adversely affected. According to ArcSight, as of September 9, 2010 there were 34,764,555 Shares outstanding.

If the NASDAQ were to delist the Shares, it is possible that the Shares would continue to trade on other securities exchanges or in the over-the-counter market and that price or other quotations for the Shares would be reported by other sources. The extent of the public market for such Shares and the availability of such quotations would depend, however, upon such factors as the number of stockholders and the aggregate market value of such securities remaining at such time, the interest in maintaining a market in the Shares on the part of securities firms, the possible termination of registration under the Exchange Act as described below, and other factors.

Promptly after the acceptance of Shares for payment in the Offer, we intend to seek to cause ArcSight to elect "controlled company" status pursuant to Listing Rule 5615(c) of the NASDAQ rules, which means that ArcSight would be exempt from the requirements that its board of directors be comprised of a majority of "independent directors" and the related rules covering the independence of directors serving on the committees (other than the audit committee) of ArcSight's board of directors. The controlled company exemption does not modify the independence requirements for ArcSight's audit committee.

Exchange Act Registration. The Shares are currently registered under the Exchange Act. The purchase of the Shares pursuant to the Offer may result in the Shares becoming eligible for deregistration under the Exchange Act. Registration of the Shares may be terminated by ArcSight upon application to the SEC if the outstanding Shares are not listed on a "national securities exchange" and if there are fewer than 300 holders of record of Shares.

Termination of registration of the Shares under the Exchange Act would reduce the information required to be furnished by ArcSight to its stockholders and to the SEC and would make certain provisions of the Exchange Act (such as the short-swing profit recovery provisions of Section 16(b), the requirement of furnishing a proxy statement or information statement in connection with stockholders' meetings or actions in lieu of a stockholders' meeting pursuant to Section 14(a) and 14(c) of the Exchange Act and the related requirement of furnishing an annual report to stockholders) no longer applicable with respect to the Shares. In addition, if the Shares are no longer registered under the Exchange Act, the requirements of Rule 13e-3 with respect to "going private" transactions would no longer be applicable to ArcSight. Furthermore, the ability of "affiliates" of ArcSight and persons holding "restricted securities" of ArcSight to dispose of such securities pursuant to Rule 144 under the Securities Act of 1933, as amended, may be impaired or eliminated. If registration of the Shares under the Exchange Act were terminated, the Shares would no longer be eligible for continued inclusion on the Federal Reserve Board's list of "margin securities" or eligible for stock exchange listing or reporting on NASDAQ. We intend to seek to cause ArcSight to apply for termination of registration of the Shares as soon as possible after consummation of the Offer if the requirements for termination of registration are met.

Margin Regulations. The Shares are currently "margin securities" under the regulations of the Board of Governors of the Federal Reserve System, which has the effect, among other things, of allowing brokers to extend credit using the Shares as collateral. Depending upon factors similar to those described above regarding market quotations, the Shares might no longer constitute "margin securities" for the purposes of the margin regulations, in which event the Shares would be ineligible as collateral for margin loans made by brokers.

8. Certain Information Concerning ArcSight

The information concerning ArcSight contained in this Offer to Purchase has been based upon publicly available documents and records on file with the SEC and other public sources. Although we have no knowledge that any such information contains any misstatements or omissions, none of HP, Purchaser, or any of their respective affiliates or assigns, the Information Agent or the Depositary assumes responsibility for the accuracy or completeness of the information concerning ArcSight contained in such documents and records or for any failure by ArcSight to disclose events which may have occurred or may affect the significance or accuracy of any such information.

General. ArcSight is a Delaware corporation with its principal offices located at 0 Xxxxxxx Xxx, Xxxxxxxxx, Xxxxxxxxxx 00000. The telephone number for ArcSight is (000) 000-0000. ArcSight is a leading global provider of cybersecurity and compliance solutions that protect organizations from enterprise threats and risks. Based on the market-leading SIEM offering, the ArcSight Enterprise Threat and Risk Management (ETRM) platform enables businesses and government agencies to proactively safeguard digital assets, comply with corporate and regulatory policy and control the internal and external risks associated with cybertheft, cyberfraud, cyberwarfare and cyberespionage.

Available Information. ArcSight is subject to the information and reporting requirements of the Exchange Act and in accordance therewith is obligated to file reports and other information with the SEC relating to its business, financial condition and other matters. Certain information, as of particular dates, concerning ArcSight's business, principal physical properties, capital structure, material pending litigation, operating results, financial condition, directors and officers (including their remuneration and stock options granted to them), the principal holders of ArcSight's securities, any material interests of such persons in transactions with ArcSight, and other matters is required to be disclosed in proxy statements and periodic reports distributed to ArcSight's stockholders and filed with the SEC. Such reports, proxy statements and other information should be available for inspection at the public reference room at the SEC's office at 000 X Xxxxxx, XX, Xxxxxxxxxx, XX 00000. Copies may be obtained by mail, upon payment of the SEC's customary charges, by writing to its principal office at 000 X Xxxxxx, XX, Xxxxxxxxxx, XX 00000. Further information on the operation of the SEC's Public Reference Room in Washington, DC can be obtained by calling the SEC at 1-800-SEC-0330. The SEC also maintains an Internet web site that contains reports, proxy statements and other information about issuers, such as ArcSight, who file electronically with the SEC. The address of that site is xxxx://xxx.xxx.xxx.

Projected Financial Information. ArcSight provided HP and other potential acquirors certain projected financial information concerning ArcSight for fiscal years 2011 through 2013. HP did not base its evaluation of ArcSight on these projections. None of HP or any of its affiliates or representatives participated in preparing, and they do not express any view on, the projections summarized below, or the assumptions underlying such information. The summary of the ArcSight projections is not included in this Offer to Purchase in order to influence any ArcSight stockholder to make any investment decision with respect to the Offer, including whether to tender Shares in the Offer or whether or not to seek appraisal rights with respect to the Shares.

The financial projections reflect numerous estimates and assumptions with respect to industry performance, general business, economic, regulatory, market and financial conditions and other future events, as well as matters specific to ArcSight's business, all of which are difficult to predict and many of which are beyond ArcSight's control. These financial projections are subjective in many respects and thus are susceptible to multiple interpretations and would ordinarily be revised based on actual experience and business developments. As such, these financial projections constitute forward-looking information and are subject to risks and uncertainties that could cause actual results to differ materially from the results forecasted in such projections, including the various risks set forth in ArcSight reports filed with the SEC. The projected results may not be realized, and ArcSight's actual results may be

significantly higher or lower than projected. The financial projections cover multiple years and such information by its nature becomes less reliable with each successive year.

The financial projections do not take into account any circumstances or events occurring after the date they were prepared, including the August 26, 0000 Xxxx Xxxxxx Journal article or the announcement of the proposed acquisition of ArcSight by HP pursuant to the Offer and the Merger. For example, the Offer and the Merger may cause current and potential customers to delay or cancel purchases of the Company's products and services pending the consummation of the Offer and the Merger or the clarification of HP's intentions with respect to the conduct of ArcSight's business thereafter. Any such delay or cancellation of customer sales is likely to adversely affect the Company's ability to achieve the results reflected in such financial projections. Further, the financial projections do not take into account the effect of any failure of the Offer or the Merger to occur and should not be viewed as accurate or continuing in that context.

The financial projections were prepared solely for ArcSight's internal use and not with a view toward public disclosure or toward complying with generally accepted accounting principles, the published guidelines of the SEC regarding projections or the guidelines established by the American Institute of Certified Public Accountants for preparation and presentation of prospective financial information. Neither ArcSight's independent registered public accounting firm, nor any other independent accountants, have compiled, examined or performed any procedures with respect to the financial projections included below, nor have they expressed any opinion or any other form of assurance on such information or its achievability, and they assume no responsibility for, and disclaim any association with, the financial projections.

In light of the foregoing factors and the uncertainties inherent in the financial projections, stockholders are cautioned not to place undue, if any, reliance on the projections.

The inclusion of the financial projections herein shall not be deemed an admission or representation by ArcSight, HP or Purchaser that they are viewed by ArcSight, HP or Purchaser as material information of ArcSight.

	FY 2011 Projections			FY 2012 Projections			FY 2013 Projections

	(in thousands, except percentage and per share data)
Revenue	$	239,923		$	306,520		$	378,745
Operating margin(1)		19	%		21	%		24	%
Net income(1)	$	29,540		$	42,618		$	59,718
Fully-diluted EPS(1)	$	0.77		$	1.07		$	1.44

(1): Excludes amortization of intangible assets and stock-based compensation.

9. Certain Information Concerning Purchaser and HP

Purchaser. Purchaser is a Delaware corporation and, to date, has engaged in no activities other than those incident to its formation and to the Offer. Purchaser is a direct or indirect wholly-owned subsidiary of HP. HP expressly reserves the right to transfer all or part of its equity interest in Purchaser to one or more direct or indirect wholly-owned subsidiaries of HP prior to or following consummation of the Offer. The principal executive offices of Purchaser are located at 0000 Xxxxxxx Xxxxxx, Xxxx Xxxx, Xxxxxxxxxx 00000, and Purchaser's telephone number at such principal executive offices is (000) 000-0000.

HP. HP is a Delaware corporation incorporated in 1947 as the successor to a partnership founded in 1939 by Xxxxxxx X. Xxxxxxx and Xxxxx Xxxxxxx. Effective in May 1998, HP changed its state of incorporation from California to Delaware. HP's principal executive offices are located at 3000

Xxxxxxx Xxxxxx, Xxxx Xxxx, Xxxxxxxxxx 00000. The telephone number of HP's principal executive offices is (000) 000-0000. HP is a leading global provider of products, technologies, software, solutions and services to individual consumers, small- and medium-sized businesses and large enterprises. HP's offerings span multi-vendor customer services, including infrastructure technology and business process outsourcing, technology support and maintenance, application development and support services and consulting and integration services; enterprise information technology infrastructure, including enterprise storage and server technology, networking products and resources, and software; personal computing and other access devices; and imaging and printing-related products and services.

Additional Information. HP is subject to the informational requirements of the Exchange Act and in accordance therewith files periodic reports, proxy statements and other information with the SEC relating to its business, financial condition and other matters. HP is required to disclose in such proxy statements certain information, as of particular dates, concerning its directors and officers, their remuneration, stock options granted to them, the principal holders of its securities and any material interests of such persons in transactions with HP. Such reports, proxy statements and other information are available for inspection and copying at the offices of the SEC in the same manner as set forth with respect to ArcSight in Section 8—"Certain Information Concerning ArcSight."

The name, business address, citizenship, present principal occupation and employment history for the past five years of each of the members of the board of directors and the executive officers of HP and the members of the board of directors and the executive officers of Purchaser are set forth in Schedule A to this Offer to Purchase.

None of HP, Purchaser or, to the knowledge of HP or Purchaser after reasonable inquiry, any of the persons listed in Schedule A, has during the last five years (i) been convicted in a criminal proceeding (excluding traffic violations or similar misdemeanors) or (ii) been a party to any judicial or administrative proceeding (except for matters that were dismissed without sanction or settlement) that resulted in a judgment, decree or final order enjoining the person from future violations of, or prohibiting activities subject to, U.S. federal or state securities laws or a finding of any violation of U.S. federal or state securities laws.

Except as described elsewhere in this Offer to Purchase or in Schedule A: (i) none of HP, Purchaser or, to the knowledge of HP or Purchaser after reasonable inquiry, any of the persons listed in Schedule A or any associate or majority-owned subsidiary of HP, Purchaser or any of the persons so listed, beneficially owns or has a right to acquire, directly or indirectly, any Shares or any other equity securities of ArcSight, (ii) none of HP, Purchaser or, to the knowledge of HP or Purchaser after reasonable inquiry, any of the persons referred to in clause (i) above or any of their executive officers, directors, affiliates or subsidiaries has effected any transaction in Shares or any other equity securities of ArcSight during the past 60 days, (iii) none of HP, Purchaser, their subsidiaries or, to the knowledge of HP or Purchaser after reasonable inquiry, any of the persons listed in Schedule A, has any agreement, arrangement, or understanding, whether or not legally enforceable, with any other person with respect to any securities of ArcSight (including, but not limited to, any agreement, arrangement, or understanding concerning the transfer or the voting of any such securities, joint ventures, loan or option arrangements, puts or calls, guarantees of loans, guarantees against loss or the giving or withholding of proxies, consents or authorizations), (iv) in the past two years, there have been no transactions that would require reporting under the rules and regulations of the SEC between any of HP, Purchaser, their subsidiaries or, to the knowledge of HP or Purchaser after reasonable inquiry, any of the persons listed in Schedule A, on the one hand, and ArcSight or any of its executive officers, directors or affiliates, on the other hand, and (v) in the past two years, there have been no negotiations, transactions or material contacts between any of HP, Purchaser, their subsidiaries or, to the knowledge of HP or Purchaser after reasonable inquiry, any of the persons listed in Schedule A, on the one hand, and ArcSight or any of its affiliates, on the other hand, concerning a merger,

consolidation or acquisition, a tender offer or other acquisition of ArcSight's securities, an election of ArcSight's directors or a sale or other transfer of a material amount of assets of ArcSight.

10. Background of the Offer

As part of its ongoing evaluation of HP's business and strategic direction, our board of directors and senior members of our management, on occasion with outside financial and legal advisors, have from time to time evaluated strategic alternatives and prospects for acquisitions.

In April 2010, members of HP and ArcSight management had informal discussions about opportunities for potential strategic partnerships between the two companies.

On July 28, 2010, management teams from HP and ArcSight met to discuss opportunities for potential strategic partnerships. No formal arrangements or proposals regarding potential strategic partnerships were made during these meetings, nor was there discussion of a potential acquisition of ArcSight.

On August 5, 2010, Xxx Xxxxxx, President and Chief Executive Officer of ArcSight, had dinner with Xxxx Xxxxxx, Executive Vice President of HP Software & Solutions, and they discussed opportunities for potential strategic partnerships. No formal arrangements or proposals regarding potential strategic partnerships were made during the dinner, nor was there discussion of a potential acquisition of ArcSight.

On August 11, 2010, representatives of Xxxxxx Xxxxxxx & Co. Incorporated ("Xxxxxx Xxxxxxx"), ArcSight's financial advisor, at ArcSight's request, informed HP that ArcSight had received a written indication of interest to acquire ArcSight from a third party.

On August 18, 2010, HP and ArcSight entered into a mutual non-disclosure agreement in order to facilitate the exchange of confidential information in contemplation of a possible transaction between HP and ArcSight.

On August 19, 2010, certain members of ArcSight's senior management team and Xxxxxx Xxxxxxx delivered in-person presentations to representatives of HP and Xxxxxxx, Sachs & Co. ("Xxxxxxx Xxxxx"), HP's financial advisor, related to ArcSight's business and operations. In addition, from August 20 to 23, 2010, representatives of HP conducted follow-up sessions regarding certain financial and operational matters pertaining to ArcSight as part of HP's due diligence activities.

On August 23, 2010, Xx. Xxxxxx met with Xxxxx Xxxxxxx, Executive Vice President and Chief Strategy and Technology Officer of HP. At that meeting, Xx. Xxxxxx advised Xx. Xxxxxxx that ArcSight was expecting a proposal from a third party on August 24^th.

On August 24, 2010, HP submitted to ArcSight a preliminary non-binding indication of interest to acquire ArcSight in a transaction in which ArcSight stockholders would receive $42.00 per Share in cash. HP's indication of interest was subject to the satisfactory completion of due diligence, but was expressly not subject to a financing condition. In addition, HP stated that it would require that ArcSight negotiate exclusively with HP for 17 days.

On August 25 and 26, 2010, several discussions occurred between representatives of Xxxxxx Xxxxxxx and Xxxxxxx Xxxxx regarding the proposed purchase price set forth in HP's August 24th indication of interest. During these discussions, representatives of Xxxxxx Xxxxxxx advised representatives of Xxxxxxx Sachs that ArcSight had received multiple proposals from potential acquirors, was requesting "best and final" proposals by August 27, 2010 and would be prepared to

enter into an exclusivity period with the party that submitted the most attractive proposal by that time. Also on August 25^th, Xx. Xxxxxx called Xx. Xxxxxx to reiterate that ArcSight was asking the bidders to submit "best and final" offers on August 27^th.

On August 27, 2010, HP submitted to ArcSight a revised non-binding indication of interest to acquire ArcSight in a transaction in which ArcSight stockholders would receive $43.50 per Share in cash. HP's indication of interest was subject to completion of detailed due diligence, but was expressly not subject to a financing condition. HP also requested a 17-day exclusivity period.

Following a special meeting of the board of directors of ArcSight on August 27, 2010, representatives of Xxxxxx Xxxxxxx called representatives of Xxxxxxx Sachs to clarify certain terms of HP's proposal, process and timeline, and following such clarifications, informed them that ArcSight's board of directors had approved proceeding with HP's August 27^th indication of interest. HP and ArcSight subsequently entered into an exclusivity agreement pursuant to which HP was afforded the right to negotiate exclusively with ArcSight until ArcSight provided notice of termination of such exclusivity (which could not be delivered until midnight on September 9, 2010), whereupon exclusivity would expire 77 hours following such notice.

On August 28, 2010, ArcSight granted access to an electronic data room to representatives of HP and its outside advisors, including Xxxxxxx Xxxxx and Xxxxxx, Xxxx & Xxxxxxxx LLP ("Xxxxxx Xxxx"), HP's outside legal counsel. During the weeks of August 30 and September 6, 2010, ArcSight's senior management team held a series of due diligence sessions with representatives of HP and Xxxxxxx Sachs. Until September 13, 2010, HP conducted its due diligence investigation of ArcSight. HP's due diligence consisted of a review of the data and other materials made available in the electronic data room, various conference calls with representatives of ArcSight and its outside advisors, and in-person meetings with representatives of ArcSight and its outside advisors.

On August 30, 2010, a representative of Xxxxxxx Xxxxx communicated to a representative of Xxxxxx Xxxxxxx that, in HP's view, the termination fee for the transaction should be at the high end of the range for transactions of this scale, citing the recent bidding contests for public companies, the active bidding and negotiation process that ArcSight had engaged in, and the publication of the Wall Street Journal article, such that the ArcSight board of directors could feel confident that all potentially interested parties had been informed of the opportunity to acquire ArcSight and that ArcSight board of directors had achieved the best value available for stockholders.

On September 1, 2010, representatives of Xxxxxx Xxxx delivered a draft Merger Agreement to Fenwick & West LLP ("Fenwick"), ArcSight's outside legal counsel.

On September 2, 2010, representatives of Xxxxxx Xxxx delivered a draft Tender and Voting Agreement to Fenwick.

Representatives of Fenwick transmitted a revised draft of the Merger Agreement to representatives of Xxxxxx Xxxx on September 3, 2010 and advised that ArcSight proposed a termination fee equal to 2.4% of the equity value of the transaction.

Representatives of Fenwick transmitted a revised draft of the Tender and Voting Agreement to representatives of Xxxxxx Xxxx on September 4, 2010.

Over the course of September 5, 6 and 7, 2010, representatives of Fenwick and Xxxxxx Xxxx, as well as members of ArcSight's and HP's internal legal teams, negotiated the terms of the definitive Merger Agreement.

On September 7, 2010, at HP's direction, representatives of Xxxxxxx Sachs called Xxxxxx Xxxxxxx to discuss the termination fee amount and Xxxxxxx Sachs advised Xxxxxx Xxxxxxx that HP was seeking a termination fee amount equal to 4.3% of the equity value of the transaction.

Early in the morning of September 8, 2010, representatives of Xxxxxx Xxxx delivered a revised draft of the Merger Agreement to representatives of Fenwick, which draft included HP's proposed termination fee amount.

From September 7 to September 9, 2010, HP provided to 11 ArcSight employees proposed offer letters for employment with HP.

On September 8 and 9, 2010, representatives of Fenwick and Xxxxxx Xxxx, as well as members of ArcSight's and HP's internal legal teams, engaged in numerous discussions to resolve as many of the open items as possible in the draft Merger Agreement and Tender and Voting Agreements. Following these discussions, the key terms that remained unresolved included certain representations and warranties, the amount of the termination fee, the circumstances that would give rise to the parties' rights to terminate the Merger Agreement and ArcSight's obligation to pay the termination fee, the circumstances that would permit the ArcSight directors to consider and accept a superior acquisition proposal, and certain regulatory conditions to closing. In addition, HP and its representatives continued to conduct their due diligence investigation and review ArcSight's disclosure schedules.

On September 9, 2010, representatives of Xxxxxx Xxxx delivered a revised draft of the Merger Agreement to representatives of Fenwick. In addition, from September 9 through September 13, 2010, representatives of HP negotiated the proposed employment offer letters with key ArcSight employees and their counsel.

On September 10 and 11, 2010, representatives of Fenwick and Xxxxxx Xxxx, as well as members of ArcSight's and HP's internal legal teams, discussed the open items in the draft Merger Agreement. Following these discussions, the material terms of the Merger Agreement were largely negotiated, except for the amount of the termination fee, but HP continued to conduct its due diligence review, as well as its review of ArcSight's disclosure schedules. During the same period, representatives of Xxxxxx Xxxxxxx and Xxxxxxx Xxxxx had further conversations regarding the termination fee and ArcSight's advisors proposed a termination fee amount equal to 2.7% of the equity value of the transaction.

On September 12, 2010, representatives of Fenwick and Xxxxxx Xxxx, as well as members of ArcSight's and HP's internal legal teams, finalized the terms of the Merger Agreement and HP concluded its due diligence review. On the same day, representatives of Xxxxxxx Sachs and Xxxxxx Xxxxxxx had several discussions regarding the termination fee and Xxxxxxx Sachs again advised that HP continued to request a termination fee amount equal to 4.3% of the equity value of the transaction.

At a special meeting of the board of directors of ArcSight on September 12, 2010, the ArcSight directors reviewed the terms of the draft Merger Agreement and discussed the termination fee amount. Following that meeting, representatives of Xxxxxx Xxxxxxx and Xxxxxxx advised HP and its advisors that ArcSight would not accept HP's proposed termination fee amount.

Following various discussions among ArcSight's and HP's respective advisors, during the evening of September 12^th, HP proposed to ArcSight, and ArcSight agreed to propose to its board of directors, and ArcSight's board of directors approved a termination fee of $61 million, or approximately 3.5% of the equity value of the transaction. Later in the evening of September 12^th, the ArcSight board of directors met again and approved the Merger Agreement.

Early in the morning of September 13, 2010, the parties executed and delivered the Merger Agreement and Tender and Voting Agreements and three ArcSight officers executed employment offer letters with HP.

Between September 13, 2010 and September 14, 2010, the other eight ArcSight employees who had received employment offers letters executed them with HP.

11. Purpose of the Offer and Plans for ArcSight

The purpose of the Offer and the Merger is for HP, through Purchaser, to acquire control of, and the entire equity interest in, ArcSight. The Offer, as the first step in the acquisition of ArcSight, is intended to facilitate the acquisition of all outstanding Shares. The purpose of the Merger is to acquire all of the capital stock of ArcSight not purchased pursuant to the Offer or otherwise.

If you sell your Shares in the Offer, you will cease to have any equity interest in ArcSight or any right to participate in its earnings and future growth. If you do not tender your Shares, but the Merger is consummated, you also will no longer have an equity interest in ArcSight. Similarly, after selling your Shares in the Offer or the subsequent Merger, you will not bear the risk of any decrease in the value of ArcSight.

Pursuant to the terms of the Merger Agreement, effective upon our initial acceptance for payment of Shares pursuant to the Offer (the "Appointment Time") and from time to time thereafter, HP currently intends to seek representation on the ArcSight board of directors. See Section 12—"The Transaction Documents—Board of Directors."

If we acquire Shares pursuant to the Offer and depending upon the number of Shares so acquired and other factors relevant to our equity ownership in ArcSight, we may, subsequent to the consummation of the Offer, seek to acquire additional Shares through open market purchases, privately negotiated transactions, a tender or exchange offer or other transactions or a combination of the foregoing on such terms and at such prices as we shall determine, which may be different from the price paid in the Offer. We also reserve the right to dispose of Shares that we have acquired or may acquire.

Pursuant to the Merger Agreement, if we acquire more than a majority but less than 90% of the outstanding Shares, following our initial acceptance for payment of the Shares pursuant to the Offer, we have the option to purchase from ArcSight, subject to certain limitations, up to a number of additional Shares sufficient to cause HP and Purchaser to own one (1) Share more than 90% of the then outstanding Shares and Shares issuable under then outstanding options to purchase Shares. See Section 12—"The Transaction Documents—The Merger Agreement—Top-Up Option."

Under the terms of the Merger Agreement, if Purchaser acquires at least 90% of the total outstanding Shares, HP and Purchaser will act to effect the Merger under the "short-form" merger provisions of Section 253 of the General Corporation Law of the State of Delaware (the "DGCL"). See Section 12—"The Transaction Documents—The Merger Agreement—Short-Form Merger Procedure."

Based on available information, we are conducting a detailed review of ArcSight and its assets, corporate structure, dividend policy, capitalization, operations, properties, policies, management and personnel and will consider what, if any, changes would be desirable in light of the circumstances which exist upon completion of the Offer. We will continue to evaluate the business and operations of ArcSight during the pendency of the Offer and after the consummation of the Offer and will take such actions as we deem appropriate under the circumstances then existing. Thereafter, we intend to review such information as part of a comprehensive review of ArcSight's business, operations, capitalization and management with a view to optimizing development of ArcSight's potential in conjunction with HP's existing businesses. Possible changes could include changes in ArcSight's business, corporate structure, charter, bylaws, capitalization, board of directors, management or dividend policy, although, except as disclosed in this Offer to Purchase, we have no current plans with respect to any of such matters.

Except as disclosed in this Offer to Purchase, we have no present plans or proposals that would result in an extraordinary corporate transaction involving ArcSight or any of its subsidiaries, such as a merger, reorganization, liquidation, relocation of operations, or sale or transfer of a material amount of assets, or any material changes in ArcSight's capitalization, corporate structure, business or composition of its management or board of directors.

12. The Transaction Documents

The Merger Agreement.

This section of the Offer to Purchase describes certain provisions of the Merger Agreement but does not purport to describe all of the terms of the Merger Agreement. The following summary is qualified in its entirety by reference to the complete text of the Merger Agreement, which is filed as an exhibit to the Schedule TO and is incorporated herein by reference. You are encouraged to read the full text of the Merger Agreement because it is the legal document that governs the Offer and the Merger. The Merger Agreement may be examined and copies may be obtained in the manner set forth in Section 8—"Certain Information Concerning ArcSight—Available Information." The Merger Agreement is not intended to provide you with any other factual information about HP, Purchaser or ArcSight. Such information can be found elsewhere in this Offer to Purchase.

The Merger Agreement provides that following the satisfaction or waiver of the conditions described in this Section 12 under "—Conditions to the Merger," Purchaser will be merged with and into ArcSight and each then outstanding Share (other than Shares owned directly by HP, Purchaser or ArcSight, or Shares that are held by stockholders, in each case, if any, who are entitled to and who properly exercise appraisal rights under the DGCL) will be converted into the right to receive cash in an amount equal to the Offer Price, without interest thereon and less any applicable withholding taxes.

The Merger Agreement provides that, notwithstanding anything to the contrary set forth in the Merger Agreement, (i) we will extend the Offer for any period required by any rule or regulation of the SEC or the NASDAQ, in any such case which is applicable to the Offer; and (ii) in the event that all of the conditions to the Offer, including the Minimum Condition or any of the other conditions set forth in Section 14—"Conditions of the Offer," are not satisfied or waived (if permitted under the Merger Agreement) as of any then scheduled expiration of the Offer, we will extend the Offer for successive extension periods of up to 10 business days each in order to permit the satisfaction of all of the conditions to the Offer. However, we are not obligated under the Merger Agreement to extend the Offer beyond the Initial Termination Date (as defined below) or the Extended Termination Date (as defined below), as applicable, or if the Merger Agreement is terminated pursuant to its terms.

In addition, the Merger Agreement provides that, following our acquisition of Shares in the Offer, we may provide a subsequent offering period (in accordance with Rule 14d-11 of the Exchange Act. A subsequent offering period would be an additional period of time of at least 3 business days and not more than 20 business days following the expiration of the Offer during which stockholders may tender Shares not tendered in the Offer and receive the same Offer Price paid in the Offer, without interest thereon and less any applicable withholding taxes. During a subsequent offering period, we will promptly pay for Shares that are validly tendered during such subsequent offering period, and tendering stockholders will not have withdrawal rights.

Top-Up Option. Pursuant to the terms of the Merger Agreement following the Appointment Time, if we acquire more than a majority but less than 90% of the Shares outstanding, we have the option (the "Top-Up Option") to purchase from ArcSight, subject to certain limitations, up to a number of additional Shares (the "Top-Up Option Shares") sufficient to cause HP and Purchaser to own one (1) Share more than 90% of the Shares then outstanding, taking into account those Shares outstanding after the exercise of the option, calculated on a fully-diluted basis (assuming the issuance of all Shares issuable upon the conversion or exercise of options, rights and securities that are then convertible into or exercisable for Shares). The exercise price per Share for the Top-Up Option would equal the Offer Price and would be paid (x) entirely in cash or (y) in cash equal to the aggregate par value of the Top-Up Option Shares and by issuance by us to ArcSight of a full recourse unsecured promissory note. Pursuant to the terms of the Merger Agreement, the Top-Up Option is exercisable at any one time on or prior to the fifth business day after the later of (x) the acceptance for payment of Shares pursuant to the Offer and (y) the expiration of any subsequent offering period. The Top-Up Option will terminate

upon the earlier to occur of (i) the Effective Time and (ii) the termination of the Merger Agreement in accordance with its terms. The Merger Agreement provides that the Top-Up Option is not exercisable to the extent that the number of Shares issuable upon exercise of the Top-Up Option would exceed the number of authorized but unissued Shares. We could also acquire additional Shares after completion of the Offer through other means, such as open market purchases. In any event, if we acquire at least 90% of the issued and outstanding Shares entitled to vote on the adoption of the Merger Agreement, we would effect the Merger under the "short-form" merger provisions of the DGCL. Stockholders who have not sold their Shares in the Offer would have certain appraisal rights with respect to the Merger under the applicable provisions of the DGCL, if those rights are perfected.

The Merger. The Merger Agreement provides that, at the Effective Time, Purchaser will be merged with and into ArcSight with ArcSight being the surviving corporation (the "Surviving Corporation"). Following the Merger, the separate existence of Purchaser will cease, and ArcSight will continue as the Surviving Corporation and a wholly-owned, direct or indirect, subsidiary of HP.

Pursuant to the Merger Agreement, each Share outstanding owned by HP, Purchaser or ArcSight, or by any direct or indirect wholly-owned subsidiary of HP, Purchaser or ArcSight, in each case immediately prior to the Effective Time, will be cancelled and extinguished without any conversion thereof or consideration paid therefor.

Pursuant to the Merger Agreement, each Share that is outstanding immediately prior to the Effective Time (other than (A) Shares owned by HP, Purchaser or ArcSight, or by any direct or indirect wholly-owned subsidiary of HP, Purchaser or ArcSight, in each case immediately prior to the Effective Time, and (B) any Dissenting Shares (as defined below)) will be canceled and extinguished and automatically converted into the right to receive cash in an amount equal to the Offer Price (the "Merger Consideration"), without interest thereon and less any applicable withholding taxes, upon the surrender of the certificate representing such Share in the manner provided in the Merger Agreement.

Shares that are issued and outstanding immediately prior to the Effective Time and held by a stockholder (if any) who is entitled to demand, and who properly demands, appraisal for such Shares in accordance with Section 262 of the DGCL ("Dissenting Shares") will not be converted into, or represent the right to receive, the Merger Consideration but rather such stockholder will be entitled to receive payment of the appraised value of such Dissenting Shares in accordance with the provisions of Section 262 of the DGCL. However, all Dissenting Shares held by stockholders who have failed to perfect or who have otherwise waived, withdrawn or lost their rights to appraisal of such Dissenting Shares under such Section 262 of the DGCL will no longer be considered to be Dissenting Shares and will thereupon be deemed to have been converted into, and to have become exchangeable for, as of the Effective Time, the right to receive the Merger Consideration, without interest thereon and less any applicable withholding taxes, upon surrender of the certificate or certificates that formerly evidenced such Shares in the manner provided in the Merger Agreement. Stockholders who tender their Shares in the Offer will not be entitled to exercise appraisal rights with respect to such Shares, but rather, subject to the conditions of the Offer, will receive the Offer Price.

Short-Form Merger Procedure. Section 253 of the DGCL provides that if a parent company owns at least 90% of each class of stock of a subsidiary, the parent company can effect a "short-form" merger with that subsidiary without the action of the other stockholders of the subsidiary. Under the terms of the Merger Agreement, if HP or any direct or indirect subsidiary of HP, taken together, owns at least 90% of the total outstanding Shares, calculated on a fully-diluted basis (assuming the issuance of all Shares issuable upon the vesting, conversion or exercise of all outstanding options, warrants, convertible or exchangeable securities and similar rights) (the "Short-Form Threshold"), ArcSight, HP and Purchaser will, subject to the satisfaction or waiver of the conditions to the Merger, take all necessary and appropriate action to cause the Merger to become effective as soon as practicable without a meeting of the stockholders of ArcSight in accordance with Section 253 of the DGCL.

Vote Required to Approve Merger; Stockholders' Meeting. The ArcSight board of directors has approved the Merger Agreement, the Offer and the Merger. If the Short-Form Threshold is not met, then under the DGCL and ArcSight's Certificate of Incorporation we must obtain the affirmative vote of the holders of at least a majority of the outstanding Shares to adopt the Merger Agreement. The Merger Agreement provides that if ArcSight stockholder adoption is required, ArcSight will:

•: establish a record date for, call, give notice of, convene and hold a meeting of the ArcSight stockholders (the "ArcSight Stockholder Meeting") as promptly as practicable following the Appointment Time for the purpose of voting upon the adoption of the Merger Agreement in accordance with the DGCL; and
•: as soon as practicable following the Appointment Time, prepare, jointly with HP, and file with the SEC, the proxy statement for use in connection with the solicitation of proxies from the ArcSight stockholders for use in connection with the ArcSight Stockholder Meeting (the "Proxy Statement").

If the Minimum Condition is satisfied and Purchaser accepts for payment Shares tendered pursuant to the Offer, Purchaser will have sufficient voting power to adopt the Merger Agreement at a meeting of the stockholders of ArcSight without the affirmative vote of any other ArcSight stockholder.

ArcSight Options. Under the Merger Agreement, at the Effective Time, (1) each option to purchase ArcSight's common stock (each an "ArcSight Option") that (a) is outstanding and vested as of immediately prior to the Effective Time (after giving effect to any acceleration in connection with the Effective Time) and (b) has an exercise price per share that is less than the Merger Consideration will be cancelled and in exchange each former holder of any such cancelled ArcSight Option will be paid an amount in cash (without interest and less any applicable withholding taxes) equal to the product of (i) the excess of the Merger Consideration over the exercise price per share under such ArcSight Option and (ii) the number of shares subject to such ArcSight Option and (2) each ArcSight Option that (a) is outstanding and unvested as of immediately prior to the Effective Time (after giving effect to any acceleration in connection with the Effective Time) and (b) has an exercise price per share that is less than the Merger Consideration, will be assumed by HP and converted automatically at the Effective Time into an option to purchase shares of HP common stock (proportionally adjusted). See "Summary Term Sheet—How are my Assumed ArcSight Options for Shares converted into options for shares of HP common stock?"

Notwithstanding the foregoing, (i) each ArcSight Option, whether vested or unvested, that (A) is outstanding as of immediately prior to the Effective Time and (B) has an exercise price per Share that is equal to or greater than the Merger Consideration and (ii) each ArcSight Option that (A) is outstanding and unvested immediately prior to the Effective Time (other than those ArcSight Options that, by their terms, vest (through acceleration or otherwise) prior to or upon the Effective Time) and (B) is held by (1) a non-employee director of ArcSight, (2) a person who is not an employee of, or a consultant to, ArcSight or any of its subsidiaries immediately prior to the Effective Time, or (3) a person who ceases to be an employee or consultant of ArcSight upon the Effective Time, will be canceled, and the holder thereof will not be entitled to any cash payment, options to purchase shares of HP common stock, or other consideration in respect thereof.

ArcSight Employee Stock Purchase Plan. Under the Merger Agreement, within five business days after request from HP to do so (which shall be made no more than 5 business days prior to the Effective Time), ArcSight shall take such action as may be necessary to establish a new Purchase Date (as defined under the Company's 2007 Employee Stock Purchase Plan (the "ESPP")) prior to the Effective Time with respect to the Offering Periods (as defined in the ESPP) otherwise then in effect (the "Final Purchase Date"). Each outstanding purchase right under the ESPP on the Final Purchase Date shall be exercised on such date for the purchase of Shares in accordance with the terms of the ESPP.

Representations and Warranties. Under the Merger Agreement, ArcSight makes customary representations and warranties to HP and Purchaser, including representations with respect to ArcSight and, in certain cases, its subsidiaries, relating to: organization, existence, and good standing; capitalization; authorization, execution, delivery and performance of the Merger Agreement and the transaction contemplated thereby; no violations of law, conflicts with or consents or approvals required in connection with the Merger Agreement and the transactions contemplated thereby; ArcSight's public information and financial statements; absence of undisclosed liabilities; absence of certain changes or events; legal proceedings; compliance with applicable laws and possession of permits; employee benefits; labor matters; environmental matters; taxes; contracts; insurance; property and assets; intellectual property; customers and suppliers; government contracts; compliance with the U.S. Foreign Corrupt Practices Act of 1977 and other applicable anti-corruption laws; public grants; application of Section 203 of the DGCL; takeover laws; related party transactions; opinion of financial advisor; and brokers' and finders' fees.

In the Merger Agreement, HP and Purchaser make customary representations and warranties to ArcSight, including representations relating to: organization, existence, good standing and power; authorization, execution, delivery and performance of the Merger Agreement and the transactions contemplated thereby; no violations of law, conflicts with or consents or approvals required, and the absence of litigation, in connection with the Merger Agreement and the transactions contemplated thereby; information supplied in the Offer documents; brokers' and finders' fees; sufficient funds; and operations of Purchaser.

The representations and warranties contained in the Merger Agreement, some of which were made as of specific dates, are subject to certain limitations agreed upon by HP, Purchaser and ArcSight in the Merger Agreement, in some cases subject to a standard of materiality or material adverse effect provided for in the Merger Agreement, and are qualified by information in confidential disclosure schedules that were provided by ArcSight in connection with the signing of the Merger Agreement. These confidential disclosure schedules contain information that modifies, qualifies and creates exceptions to the representations and warranties set forth in the Merger Agreement. Moreover, the representations and warranties in the Merger Agreement have been negotiated with the principal purpose of allocating risk among HP, Purchaser and ArcSight, and establishing the circumstances under which HP and Purchaser have the right not to consummate the Offer or a party may have the right to terminate the Merger Agreement, rather than establishing matters of fact. Furthermore, information concerning the subject matter of such representations and warranties may change after the dates specified in the Merger Agreement, which subsequent information may not be reflected in public disclosures. Accordingly, you should not rely on the representations and warranties as disclosures or characterizations of the actual state of facts regarding ArcSight, Purchaser or HP.

The representations and warranties contained in the Merger Agreement will terminate at the Effective Time.

Operating Covenants. The Merger Agreement provides that, from the date of the Merger Agreement until the earlier of the termination of the Merger Agreement or the Appointment Time, except as contemplated by the Merger Agreement, set forth in the confidential disclosure schedules provided by ArcSight, or approved in advance by HP in writing (which approval may not be unreasonably withheld, conditioned or delayed), ArcSight and each of its subsidiaries will (i) carry on its business in all material respects in the ordinary course in substantially the same manner as previously conducted and in compliance with all applicable laws and regulations, (ii) pay its debts and taxes when due, subject to good faith disputes over such debts or taxes, (iii) pay or perform all material obligations when due and (iv) use commercially reasonable efforts, consistent with past practices and policies, to (A) preserve intact its business organization, (B) keep available the services of its officers and employees, (C) preserve its relationships with customers, suppliers, distributors, licensors, licensees and others with which it has significant business dealings, and (D) preserve and maintain in full force

and effect all material registered intellectual property rights of ArcSight and its subsidiaries, and timely effect certain payments and filings in connection therewith.

Between the date of the Merger Agreement and continuing until the earlier of the termination of the Merger Agreement or the Appointment Time, ArcSight is subject to customary operating covenants and restrictions, except as contemplated by the Merger Agreement, set forth in the confidential disclosure schedules provided by ArcSight, or approved in advance by HP in writing (which approval may not be unreasonably withheld, conditioned or delayed), including that ArcSight will not, or permit any of its subsidiaries to:

•: declare, set aside or pay any dividends on, or make any other distributions (whether in cash, stock or property) in respect of, any of its capital stock or other equity interests, except for dividends by a wholly owned subsidiary of ArcSight to its parent;
•: purchase, redeem or otherwise acquire shares of its capital stock or other equity interests or any options, warrants, or rights to acquire any such shares or other equity interests;
•: split, combine, reclassify or otherwise amend the terms of any of its capital stock or other equity interests;
•: issue, deliver, sell, grant, pledge or otherwise encumber any shares of its capital stock or other equity interests, any securities convertible into, or exchangeable for, or any rights, warrants or options to acquire, any such shares or other equity interests, or any rights linked to the value of such shares, with certain exceptions;
•: amend its certificate of incorporation or by-laws (or similar organizational documents);
•: directly or indirectly acquire or agree to acquire (i) any corporation, partnership, association or other business organization or division thereof, with certain exceptions for transactions among ArcSight and its wholly owned subsidiaries or (ii) any assets that are otherwise material to ArcSight and its subsidiaries, other than in the ordinary course of business consistent with past practice;
•: directly or indirectly sell, lease, license, sell and leaseback, abandon, or otherwise dispose of, in whole or in part, any of its material properties, assets or rights or any interest therein, except (i) sales of company products and non-exclusive intellectual property licenses in the ordinary course of business, and (ii) disposition of equipment and property no longer used in the operation of business;
•: directly or indirectly mortgage or otherwise subject to any lien in whole or in part any of its material properties, assets or rights or any interest therein;
•: adopt or enter into a plan of complete or partial liquidation, dissolution, restructuring, recapitalization or other reorganization;
•: incur, create, assume or otherwise become liable for, any indebtedness for borrowed money, any obligations under conditional or installment sale contracts or other retention contracts relating to purchased property, any capital lease obligations or any guarantee or any such indebtedness of any other person, issue or sell any debt securities, options, warrants, calls or other rights to acquire any debt securities, guarantee any debt securities of any other person, enter into any agreement to maintain any financial statement condition of any other person, enter into any arrangement having the economic effect of any of the foregoing except accounts payable to trade creditors, or amend, modify or refinance any of the foregoing;
•: except for advances to employees for travel and business expenses in the ordinary course of business, make any loans, advances or capital contributions to, or investments in, any other person, other than ArcSight or any of its wholly owned subsidiaries;

•: incur or commit to incur any capital expenditure or authorization or commitment with respect thereto in excess of $250,000, in the aggregate, except those provided for in the capital expenditure budget set forth in the confidential disclosure schedule provided by ArcSight;
•: (i) pay, discharge, settle or satisfy any claims, liabilities or obligations in excess of $250,000, in the aggregate, other than the payment, discharge or satisfaction in the ordinary course of business or as required by their terms as in effect on the date of the Merger Agreement of claims, liabilities or obligations reflected or reserved against in the audited financial statements most recently filed by ArcSight with the SEC prior to the date of the Agreement or incurred since the date thereof in the ordinary course of business, (ii) cancel any material indebtedness or (iii) waive, release, grant or transfer any right of material value;
•: compromise, settle or agree to settle any legal proceeding or governmental investigation (excluding certain compromises, settlements and agreements in the ordinary course of business that are not material to ArcSight and its subsidiaries);
•: change its financial or tax accounting methods, principles or practices, except insofar as required by a change in generally accepted accounting principles, as applied in the United States ("GAAP") or applicable law;
•: settle or compromise any material tax liability, amend any material tax return, enter into any material contract with or request any material ruling from any governmental entity relating to taxes, make, change or revoke any material tax election, change any method of accounting for tax purposes, take any material position on a tax return inconsistent with a position taken on a tax return previously filed, take any other action to materially impair (other than through actual utilization or in the ordinary course of business consistent with past practice) any tax asset reflected in certain of ArcSight's filings with the SEC, extend or waive any statute of limitations with respect to taxes, or surrender any claim for a material tax refund;
•: change its fiscal year;
•: grant any current or former director, officer, employee or independent contractor any increase in compensation, bonus or other benefits, grant any type of compensation or benefits to any such person not previously entitled to receive such type of compensation or benefit, or pay any bonus or amount to any such person (other than increases and grants of compensation or benefits and payments of bonuses, in each case, in the ordinary course of business, not in excess of $500,000 in the aggregate);
•: grant or pay to any current or former director, officer, employee or independent contractor any severance, change in control or termination pay, or modifications thereto or increases therein;
•: pay any benefit or grant or amend any stock option or other stock-related award except (1) as required to comply with applicable law or any employee benefits plan in effect as of the date of the Merger Agreement, (2) the issuance of Shares upon the exercise of stock options outstanding on September 9, 2010 in accordance with their terms as in effect on such date, (3) the issuance of Shares pursuant to the ESPP with respect to employees enrolled therein as of the date of the Merger Agreement (subject to certain limitations), and (4) grants to newly hired employees issued in the ordinary course of business;
•: adopt or enter into any collective bargaining agreement or other labor union contract;
•: take any action to accelerate the vesting or payment of any compensation or benefit under any employee benefit plan or other contract except as required by any employee benefit plan in effect as of the date of the Merger Agreement;

•: adopt any new employee benefit plan or arrangement or amend, modify or terminate any existing employee benefit plan, in each case for the benefit of any current or former director, officer, employee or independent contractor, other than as required by applicable law or by any employee benefit plan in effect on the date of the Merger Agreement;
•: fail to use commercially reasonable efforts to keep in force insurance policies or replacement or revised provisions regarding insurance coverage with respect to material assets, operations and activities of ArcSight and its subsidiaries as in effect on the date of the Merger Agreement;
•: renew or enter into any non-compete, exclusivity or similar agreement that would restrict or limit, in any material respect, ArcSight or any of its subsidiaries from engaging or competing in any line of business or geographic area;
•: enter into any new lease of real property or amend the terms of any existing lease of real property, other than in the ordinary course of business;
•: sell, lease, license, encumber or otherwise dispose of any properties, assets or any shares or other interests in any subsidiary except (i) sales of company products and non-exclusive intellectual property licenses in the ordinary course of business, and (ii) disposition of immaterial equipment and property no longer used in the operation of business;
•: grant any exclusive rights with respect to, or divest, any intellectual property rights owned by the ArcSight or any of its subsidiaries;
•: modify ArcSight's standard warranty terms for its products or services or amend or modify any product or service warranties in effect as of the date hereof in any material manner that is adverse to ArcSight or any of its subsidiaries, if the applicable warranty terms or warranty, as so amended or modified, differs materially from the warranty provisions in certain specified agreements;
•: enter into any agreement or commitment the effect of which would be to grant to a third party following the Merger any actual or potential right of license to any intellectual property rights owned by HP or any of its subsidiaries; or
•: authorize any of, or commit, resolve or agree to take any of, the foregoing actions.

No Solicitation Provisions. The Merger Agreement provides that ArcSight will, and will cause its subsidiaries and the respective Representatives (as defined below) to, immediately cease any and all existing activities, discussions or negotiations with any persons conducted heretofore with respect to any Acquisition Proposal (as defined below). The Merger Agreement further provides that at all times during the period commencing with the execution and delivery of the Merger Agreement and continuing until the earlier to occur of the termination of the Merger Agreement and the Appointment Time, ArcSight and its subsidiaries will not, nor will they authorize or knowingly permit any of their respective directors, officers or other employees, controlled affiliates, or any investment banker, attorney or other advisor or representative retained by any of them (collectively, "Representatives") to, directly or indirectly, (i) solicit, initiate, knowingly encourage or knowingly facilitate any inquiry, proposal or offer with respect to, or the making or completion of, any Acquisition Proposal, or any inquiry, proposal or offer that is reasonably likely to lead to any Acquisition Proposal, (ii) furnish to any person (other than HP, Purchaser or any of their designees) any non-public information relating to ArcSight or any of its subsidiaries, or afford access to the business, properties, assets, books or records of ArcSight or any of its subsidiaries to any person (other than HP, Purchaser or any of their designees), or take any other action with the intention to induce or facilitate any Acquisition Proposal or any inquiry, proposal or offer that is reasonably likely to lead to an Acquisition Proposal, (iii) participate or engage in discussions or negotiations with any person with respect to an Acquisition Proposal, (iv) approve, endorse or recommend an Acquisition Proposal, (v) enter into any letter of

intent, memorandum of understanding or contract contemplating or otherwise relating to an Acquisition Transaction other than a confidentiality agreement permitted by clause (B) in the next paragraph or (vi) terminate, amend or waive any rights under any "standstill" or other similar agreement between ArcSight or any of its subsidiaries and any person (other than HP).

However, prior to the Appointment Time, the ArcSight's board of directors may, directly or indirectly through its Representatives, subject to ArcSight's compliance with the provisions of Section 7.1 of the Merger Agreement, (A) engage or participate in discussions or negotiations with any person that has made (and not withdrawn) a bona fide Acquisition Proposal in writing that the ArcSight board of directors concludes in good faith (after consultation with a financial advisor of nationally recognized standing and ArcSight's outside legal counsel) constitutes or is reasonably likely to lead to a Superior Proposal (as defined below) and/or (B) furnish to any person that has made (and not withdrawn) a bona fide Acquisition Proposal in writing any information relating to ArcSight or any of its subsidiaries pursuant to a confidentiality agreement the terms of which are no less favorable to ArcSight than those contained in the Confidentiality Agreement (as defined below), provided that in the case of any action taken pursuant to the foregoing clauses (A) or (B), (1) none of ArcSight, any of its subsidiaries or any Representative of ArcSight or its subsidiaries shall have breached the terms of Section 7.1 of the Merger Agreement (other than breaches that are unintentional and not material in effect), (2) the ArcSight board of directors determines in good faith (after consultation with outside legal counsel) that the failure to take such action would reasonably be expected to result in a breach of its fiduciary duties to ArcSight stockholders under the DGCL, (3) at least one business day prior to engaging or participating in any such discussions or negotiations with, or furnishing any information to, such person, ArcSight gives HP written notice of the identity of such person and a copy of such Acquisition Proposal and of ArcSight's intention to engage or participate in discussions or negotiations with, or furnish information to, such person and (4) contemporaneously with furnishing any non-public information to such person, ArcSight furnishes such non-public information to HP (to the extent such information has not been previously furnished by ArcSight to HP).

The Merger Agreement further provides that any violation of the restrictions set forth in the preceding paragraphs by any Representative (other than employees that are not officers of ArcSight or any of its subsidiaries, unless such employees are acting at the direction of ArcSight or with the actual knowledge of certain ArcSight officers) will be deemed to be a breach of the foregoing provisions by ArcSight. The Merger Agreement further provides that ArcSight will not enter into any letter of intent, memorandum of understanding or other similar document or any agreement (other than a confidentiality agreement as permitted by clause (B) in the preceding paragraph) contemplating or otherwise relating to an Acquisition Proposal unless and until the Merger Agreement is terminated and ArcSight has paid all amounts due to HP pursuant to the terms of the Merger Agreement, if any.

The Merger Agreement also requires ArcSight to promptly (and in any event within one business day following receipt) advise HP in writing of (i) any Acquisition Proposal, (ii) any request for information that would reasonably be expected to lead to an Acquisition Proposal or (iii) any inquiry with respect to, or which would reasonably be expected to lead to, any Acquisition Proposal, such notice to include the terms and conditions of such Acquisition Proposal, request or inquiry (including a copy, if made in writing, or a written summary, if made orally), and the identity of the person or entity or group making any such Acquisition Proposal, request or inquiry. The Merger Agreement provides that ArcSight will keep HP informed on a reasonably current basis of the status and material details, terms and conditions (including all amendments or proposed amendments) of any such Acquisition Proposal, request or inquiry. In addition to the foregoing, ArcSight will provide HP with prior written notice of a meeting of the ArcSight board of directors at which the ArcSight board of directors is reasonably expected to consider an Acquisition Proposal, with HP receiving a similar amount of notice of such meeting as is provided to the members of the ArcSight board of directors.

As used in the Merger Agreement, an "Acquisition Proposal" means any offer or proposal, or indication of interest in making an offer or proposal (other than an offer, proposal or indication of interest in making an offer or proposal by HP or Purchaser) relating to any Acquisition Transaction.

As used in the Merger Agreement, an "Acquisition Transaction" means any transaction or series of related transactions (other than the transactions contemplated by the Merger Agreement) involving: (i) any acquisition or purchase from ArcSight or any of its subsidiaries by any person or "group" (as defined in or under Section 13(d) of the Exchange Act), directly or indirectly, of more than a fifteen percent (15%) interest in the total outstanding voting securities of ArcSight or any of its subsidiaries, (ii) any tender offer (including self-tender) or exchange offer that if consummated would result in any person or "group" (as defined in or under Section 13(d) of the Exchange Act) beneficially owning fifteen percent (15%) or more of the total outstanding voting securities of ArcSight or any of its subsidiaries (an "Acquisition Transaction Tender Offer"); (iii) any merger, consolidation, recapitalization, business combination or other similar transaction involving ArcSight or any of its subsidiaries, the business(es) of which, individually or in the aggregate, constitute more than 15% of the assets of ArcSight and its subsidiaries, taken as a whole, pursuant to which the stockholders of ArcSight or such subsidiary immediately preceding such transaction hold less than eighty-five percent (85%) of the voting equity interests in the surviving or resulting entity of such transaction; (iv) any sale, lease, exchange, transfer, license or disposition (other than (1) any lease in the ordinary course of business and (2) any sale, transfer, license or disposition of ArcSight products or inventory in the ordinary course of business) of more than fifteen percent (15%) of the assets of ArcSight and its subsidiaries, taken as a whole (measured by the lesser of book or fair market value thereof); or (v) any combination of the foregoing

As used in the Merger Agreement, a "Superior Proposal" means any bona fide written Acquisition Proposal involving the acquisition of at least eighty percent (80%) of the outstanding voting securities of ArcSight with respect to which the ArcSight board of directors shall have determined in good faith (after consultation with a financial advisor of nationally recognized standing and its outside legal counsel, and after taking into account, among other things, (i) the financial, legal and regulatory aspects of the Acquisition Transaction proposed in such Acquisition Proposal, including any financing contingencies, the timing and likelihood of consummation of such Acquisition Transaction and, to the extent the ArcSight board of directors deems it relevant, the payment of the Termination Fee (as defined below), and (ii) any binding (on HP) counter-offer or binding (on HP) offer made by HP pursuant hereto), that the proposed Acquisition Transaction would be more favorable to the holders of Shares (in their capacity as such), from a financial point of view, than the transactions contemplated by this Agreement, including the Offer and the Merger (or any binding (on HP) counter-offer or binding (on HP) offer made by HP pursuant hereto).

ArcSight's Recommendation. The Merger Agreement provides that the ArcSight board of directors will (i) recommend that the holders of Shares accept the Offer, tender their Shares to Purchaser pursuant to the Offer and, if necessary under Delaware law, adopt the Merger Agreement in accordance with the applicable provisions of Delaware law (the "ArcSight Board Recommendation") and (ii) include the ArcSight Board Recommendation (with respect to the Offer) in the Solicitation/Recommendation Statement on Schedule 14D-9 to be filed by ArcSight with the SEC (the "Schedule 14D-9") and permit HP to include the ArcSight Board Recommendation in the Offer documents. The ArcSight board of directors has approved the Merger Agreement, the Offer and the Merger, and rendered the ArcSight Board Recommendation.

Pursuant to the Merger Agreement, neither the ArcSight board of directors nor any committee thereof will (1) withdraw (or modify or qualify in any manner adverse to HP or Purchaser) the ArcSight Board Recommendation, (2) adopt, approve, recommend, endorse or otherwise declare advisable the adoption of any Acquisition Proposal or (3) publicly resolve, agree or publicly propose to take any such action (each such action set forth in any of clauses (1), (2) or (3) being referred to

herein as an "ArcSight Board Recommendation Change"); provided, that, making a "stop-look-and listen communication" pursuant to the provisions of Rule 14d-9(f) promulgated under the Exchange Act to the ArcSight stockholders will not be deemed an ArcSight Board Recommendation Change.

However, the Merger Agreement provides that the ArcSight board of directors may effect an ArcSight Board Recommendation Change at any time prior to the Appointment Time, if and only if, (A) the ArcSight board of directors has received an Acquisition Proposal that constitutes a Superior Proposal, (B) neither ArcSight nor any of its Representatives shall have breached the provisions set forth above under "No Solicitation", (C) the ArcSight board of directors determines in good faith (after consultation with outside legal counsel and after considering in good faith any binding (on HP) counter-offer or binding (on HP) offer made by HP pursuant to clause (E) below), that, in light of such Superior Proposal, that the failure of the ArcSight board of directors to effect an ArcSight Board Recommendation Change would reasonably be expected to result in a breach of its fiduciary duties to the ArcSight stockholders under Delaware law, (D) prior to effecting such ArcSight Board Recommendation Change, the ArcSight board of directors shall have given HP at least three (3) business days notice thereof and the opportunity to meet with the ArcSight board of directors and its outside legal counsel to enable HP and ArcSight to discuss in good faith a modification of the terms and conditions of the Merger Agreement so that the transactions contemplated thereby may be effected and (E) HP shall not have made, within such three (3) business days after receipt of ArcSight's written notice of its intention to effect an ArcSight Board Recommendation Change, a binding (on HP) counter-offer or binding (on HP) offer that the ArcSight board of directors determines in good faith, after consultation with a financial advisor of nationally recognized standing and its outside legal counsel, is at least as favorable to ArcSight stockholders as such Superior Proposal.

The Merger Agreement also provides that ArcSight will not take any action to exempt any person (other than HP, Purchaser and their respective affiliates) from the restrictions on "business combinations" contained in Section 203 of the DGCL (or any similar provision of any other takeover law) or otherwise cause such restrictions not to apply, or agree to do any of the foregoing, in each case unless such actions are taken substantially concurrently with a termination of the Merger Agreement.

The Merger Agreement does not prohibit the ArcSight board of directors from (i) taking and disclosing to the ArcSight stockholders a position contemplated by Rule 14e-2(a) under the Exchange Act or Item 1012(a) of Regulation M-A promulgated under the Exchange Act, (ii) otherwise complying with, the provisions of Rule 14d-9 promulgated under the Exchange Act, or (iii) otherwise disclosing any information to the ArcSight stockholders (including any factually accurate public statement by ArcSight that describes ArcSight's receipt of an Acquisition Proposal and the operation of the Merger Agreement with respect thereto) if the ArcSight board of directors has determined in good faith, after consultation with its outside legal counsel, that the failure to do so would reasonably be expected to result in a breach of its fiduciary duties to the ArcSight stockholders under Delaware law or a violation of any other applicable law; provided that, any such disclosure (other than a "stop-look-and listen communication" pursuant to the provisions of Rule 14d-9(f) promulgated under the Exchange Act to the ArcSight stockholders) will be deemed an ArcSight Board Recommendation Change unless such disclosure includes a reaffirmation of the ArcSight Board Recommendation.

Indemnification and Insurance. The Merger Agreement provides that, until the sixth anniversary of the Effective Time, the Surviving Corporation and its subsidiaries will honor and fulfill the obligations of ArcSight and its subsidiaries under any indemnification agreements between ArcSight or any of its subsidiaries and any of their respective current or former directors and officers and any person who becomes a director or officer of ArcSight or any of its subsidiaries prior to the Appointment Time. In addition, until the sixth anniversary of the Effective Time, the Surviving Corporation and its subsidiaries will cause the certificate of incorporation and bylaws (and other similar organizational documents) of such entities to contain indemnification and exculpation provisions that are at least as favorable as those contained in the organizational documents of such entities

immediately prior to the Appointment Time. Furthermore, the Surviving Corporation and its subsidiaries will, if requested by an officer or director, advance to such person expenses incurred in the defense of legal proceedings and investigations, subject, to the extent provided in the organizational documents of the applicable entity, to indemnification for advanced amounts or, if such person is ultimately determined not to be entitled to indemnification, the repayment thereof.

The Merger Agreement also provides that, until the sixth anniversary of the Effective Time, the HP and the Surviving Corporation will maintain in effect ArcSight's current directors' and officers' liability insurance in respect of acts or omissions occurring at or prior to the Appointment Time ("D&O Insurance"), or substitute insurance, covering each person covered by the D&O Insurance immediately prior to the Appointment Time, on terms with respect to coverage, retention, limitations of liability, and amounts that are no less favorable than those of the D&O Insurance, provided that in satisfying such obligations, HP and the Surviving Corporation are not obligated to pay annual premiums in excess of 250% of the amount paid by ArcSight for coverage for its last full fiscal year (such 250% amount, the "Maximum Annual Premium"). If the annual premiums of such insurance coverage exceed such amount, HP and the Surviving Corporation are obligated to obtain a policy with the greatest coverage available for a cost not exceeding the Maximum Annual Premium.

The Merger Agreement provides that, prior to the Appointment Time, HP or ArcSight may purchase a six-year "tail" or runoff policy on the D&O Insurance, on terms with respect to coverage, retention, limitations of liability, and amounts that are no less favorable than those of the D&O Insurance. If HP purchases such a policy, HP and the Surviving Corporation will maintain it in effect for such six-year period, in lieu of the obligations of HP and Surviving Corporation with respect to insurance described above.

Conditions to the Merger. The Merger Agreement provides that the respective obligations of each party to consummate the Merger are subject to the satisfaction or waiver (where permissible under applicable law) prior to the Effective Time, of each of the following conditions:

•: If the Short-Form Threshold has not been reached and the approval of the ArcSight stockholders is required under Delaware law to adopt the Merger Agreement in order to consummate the Merger, the required stockholder approval has been obtained;
•: Purchaser has accepted for payment and paid for all of the Shares validly tendered and not withdrawn pursuant to the Offer; and
•: No governmental entity located within the United States, Austria, Germany or any other jurisdiction shall have (i) enacted, issued, promulgated, entered, enforced or deemed applicable to the Merger any law, statute, rule or regulation that is in effect and has the effect of making the Merger illegal or which has the effect of prohibiting, requiring a mandatory filing or notification as a condition to the legality or approval of the Merger, or otherwise preventing the Merger or (ii) issued or granted any judgment, order, decree or injunction that is in effect and has the effect of making the Merger illegal or which has the effect of prohibiting or otherwise preventing the Merger; provided, however, with respect to any jurisdictions other than the United States, Austria and Germany, only if such event (a) reasonably would be expected to have a material adverse effect on (1) ArcSight and its subsidiaries, taken as a whole, or (2) the benefits expected to be derived by HP and its subsidiaries from the transactions contemplated by the Merger Agreement or (b) reasonably would be expected to have a material adverse effect on the operations or businesses of HP and its subsidiaries, taken as a whole (assuming for purposes of this determination that HP and its subsidiaries are of the equivalent size, and have equivalent revenues, to ArcSight and its subsidiaries, taken as a whole).

Employee Matters. The Merger Agreement provides that, from and after the Effective Time, HP will permit all Continuing Employees (as defined in the Merger Agreement) who become employees of

HP or any of its subsidiaries to participate in the benefit programs of HP or the subsidiary to the same extent as similarly situated employees of HP or the subsidiary. In addition, for a period of one year after the Effective Time, HP will honor all employment, change of control, severance and retention arrangements of ArcSight and its subsidiaries in accordance with their terms as in effect immediately prior to the Effective Time.

The Merger Agreement further provides that, at HP's request, ArcSight will terminate any 401(k) plans maintained by Arc Sight, effective as of the day immediately preceding the date ArcSight becomes a member of the same "Controlled Group of Corporations" under Section 414(b) of the Code. In addition, ArcSight will terminate any and all group severance, separation, deferred compensation or salary continuation plans, programs or policies maintained by ArcSight or any of its subsidiaries (other than the arrangements required to be honored by HP as described in the preceding paragraph), effective as of the day immediately preceding the last day of the initial period of the Offer.

Board of Directors. The Merger Agreement provides that effective upon the Appointment Time, HP is entitled to designate up to such number of directors on the ArcSight board of directors equal to the product (rounded up to the next whole number) obtained by multiplying (x) the number of directors on the ArcSight board of directors (giving effect to any increase in the number of directors as described in this paragraph) and (y) a fraction, the numerator of which is the number of Shares held by HP and Purchaser (giving effect to the Shares purchased pursuant to the Offer), and the denominator of which is the total number of then outstanding Shares. Following a request by HP, ArcSight will take all action necessary to cause the individuals so designated by HP to be elected or appointed to the ArcSight board of directors, including by increasing the size of the ArcSight board of directors or by seeking and accepting or otherwise securing the resignations of such number of then incumbent directors as is necessary to enable the individuals so designated by HP to be elected or appointed to the ArcSight board of directors. We currently intend, as soon as practicable after consummation of the Offer, to exercise this right and to designate Xxxxxx X. Xxxxxx, Xxxxxxx X. Xxxxxxx, Xxxxxxxxx X. Xxxxxx, Xxxx X. XxXxxxxx and Xxxx X. Xxxxxxx to serve as directors of ArcSight. We expect that such representation would permit us to exert substantial influence over ArcSight's conduct of its business and operations. Following the election or appointment of HP's designees to the ArcSight board of directors and until the Effective Time, the ArcSight board of directors will always have at least three directors who were members of the ArcSight board of directors immediately prior to such election or appointment (the "Continuing Directors").

Under the Merger Agreement, following the election or appointment of HP's designees to the ArcSight board of directors and until the Effective Time, the ArcSight board of directors shall have at least such number of directors as may be required by the rules of the NASDAQ or the federal securities laws who are considered independent directors within the meaning of such rules and laws ("Independent Directors"). After payment by Merger Sub for the Shares tendered pursuant to the Offer, ArcSight will, upon HP's request, take all action necessary to elect "controlled company" status pursuant to Listing Rule 5615(c) of the NASDAQ rules and make all necessary filings and disclosures associated with such status. If the number of Independent Directors is reduced below the such required number, the remaining Independent Directors will be entitled to designate persons to fill such vacancies or, if no other Independent Director then remains, the other directors will designate persons to fill such vacancies who will not be shareholders or affiliates of HP or Purchase (in each case, with such designated persons being deemed to be Independent Directors for purposes of this Agreement).

The Merger Agreement provides that, following the election or appointment of HP's designees to the ArcSight board of directors and until the Effective Time, the approval of a majority of the Continuing Directors is required to (i) amend, modify or terminate the Merger Agreement, or agree or consent to the same, on behalf of ArcSight, (ii) extend the time for performance of, or waive, any of the obligations or other acts of HP or Purchaser under the Merger Agreement, (iii) exercise or waive any of ArcSight's rights, conditions, benefits or remedies under the Merger Agreement, (iv) except as

provided in the Merger Agreement, amend or otherwise modify ArcSight's certificate of incorporation or bylaws, (v) authorize or execute any contract, or any amendment or modification of any contract, between ArcSight or any of its subsidiaries, on the one hand, and HP, Purchaser or any of their affiliates on the other hand, or the termination of any such contract by ArcSight or any of its subsidiaries or (vi) make any other determination or give any approval or authorization that is required to be taken or given by the ArcSight board of directors with respect to any action to be taken or not to be taken by or on behalf of ArcSight relating to the Merger Agreement or the transactions contemplated thereby, including the Offer and the Merger. Following the election or appointment of HP's designees to the ArcSight board of directors and until the Effective Time, any actions with respect to the enforcement of the Merger Agreement by ArcSight will be effected only by and at the direction of a majority of the Continuing Directors, and any such authorization will constitute the authorization of the full ArcSight board of directors, and no other action on the part of ArcSight, including any action by any other director of ArcSight, will be required to authorize any such action.

Termination. The Merger Agreement provides that it may be terminated and the Offer may be abandoned at any time prior to the Appointment Time (provided that the party terminating the Merger Agreement gives prompt written notice of such termination to the other party or parties to the Merger Agreement):

(a): by mutual written agreement of HP and ArcSight;
(b): by either HP or ArcSight, if the Offer has expired or been terminated in accordance with the terms of the Merger Agreement and the Offer without Purchaser having accepted for payment any Shares tendered pursuant to the Offer on or before March 13, 2011 (the "Initial Termination Date"; provided, however, that if the Antitrust Condition shall not have been satisfied on or prior to the Initial Termination Date and all of the other conditions to the Offer shall have been satisfied on or prior to the Initial Termination Date, either HP or ArcSight may elect to extend the Initial Termination Date, by written notice to the other prior to or on the Termination Date until June 13, 2011 (the "Extended Termination Date"), provided that the right to terminate the Merger Agreement pursuant to this section would not be available to any party whose action or failure to fulfill any obligation under the Merger Agreement has been the principal cause of or resulted in (i) any of the conditions to the Offer set forth in Section 14—"Conditions of the Offer" having failed to be satisfied and such action or failure to act constitutes a material breach of the Merger Agreement or (ii) the expiration or termination of the Offer in accordance with the terms of the Merger Agreement and the Offer without Purchaser having accepted for payment any Shares tendered pursuant to the Offer and such action or failure to act constitutes a material breach of the Merger Agreement;
(c): by ArcSight, in the event (i) of a breach of any covenant or agreement on the part of HP or Purchaser set forth in the Merger Agreement or (ii) that any of the representations and warranties of HP and Purchaser set forth in the Merger Agreement shall have been inaccurate when made or shall have become inaccurate, in either case so as to prevent HP and Purchaser from consummating the Offer in accordance with the terms of the Merger Agreement; provided, however, that notwithstanding the foregoing, in the event that such breach by HP or Purchaser or such inaccuracies in the representations and warranties of HP or Purchaser are curable by HP or Purchaser through the exercise of commercially reasonable efforts, then ArcSight will not be permitted to terminate the Merger Agreement pursuant to this provision until the earlier to occur of (1) (x) if the Antitrust Condition has not been satisfied, the Initial Termination Date or Extended Termination Date, as applicable or (y) if the Antitrust Condition has been satisfied, the expiration of a 30 calendar day period after delivery of written notice from ArcSight to HP of such breach or inaccuracy or (2) HP or Purchaser ceasing to exercise commercially reasonable efforts to cure such breach or inaccuracy, provided

that HP and Purchaser continue to exercise commercially reasonable efforts to cure such breach or inaccuracy (it being understood that ArcSight may not terminate the Merger Agreement pursuant to this provision if such breach or inaccuracy by HP or Purchaser is cured within the applicable time period;

(d): by HP, in the event (i) of a breach of any covenant or agreement on the part of ArcSight set forth in the Merger Agreement or (ii) that any of the representations and warranties of ArcSight set forth in the Merger Agreement shall have been inaccurate when made or shall have become inaccurate, in either case such that the conditions to the Offer set forth in clauses (C)(1) or (C)(2) of Section 14—"Conditions of the Offer," respectively, would not be satisfied as of the time of such breach or as of the time such representation and warranty became inaccurate; provided, however, that notwithstanding the foregoing, in the event that such breach by ArcSight or such inaccuracies in the representations and warranties of ArcSight are curable by ArcSight through the exercise of commercially reasonable efforts, then HP will not be permitted to terminate the Merger Agreement pursuant to this provision until the earlier to occur of (1) (x) if the Antitrust Condition has not been satisfied, the Initial Termination Date or Extended Termination Date, as applicable or (y) if the Antitrust Condition has been satisfied, the expiration of a thirty (30) calendar day period after delivery of written notice from HP to ArcSight of such breach or inaccuracy or (2) ArcSight ceasing to exercise commercially reasonable efforts to cure such breach or inaccuracy, provided ArcSight continues to exercise commercially reasonable efforts to cure such breach or inaccuracy (it being understood that HP may not terminate the Merger Agreement pursuant to this provision if such breach or inaccuracy by ArcSight is cured within the applicable time period;
(e): by ArcSight, immediately prior to entering into a definitive agreement with respect to a Superior Proposal, provided that (A) ArcSight has not breached the terms of certain non-solicitation provisions of the Merger Agreement (other than breaches that are unintentional and not material in effect) or the provisions of the Merger Agreement regarding the ArcSight Board Recommendation, (B) subject to the terms of the Merger Agreement, the ArcSight board of directors has effected an ArcSight Board Recommendation Change and authorized ArcSight to enter into a definitive agreement to consummate a transaction that constitutes a Superior Proposal, (C) immediately prior to the termination of the Merger Agreement, ArcSight pays to HP the Termination Fee (as defined below) and (D) immediately following such termination, ArcSight enters into a definitive agreement to effect such Superior Proposal; or
(f): by HP, in the event that a Triggering Event shall have occurred. For all purposes of and under the Merger Agreement, a "Triggering Event" shall be deemed to have occurred if, prior to the Effective Time, any of the following shall have occurred: (A) the ArcSight board of directors or any committee thereof shall have for any reason effected an ArcSight Board Recommendation Change; (B) ArcSight shall have failed to include the ArcSight Board Recommendation in the Schedule 14D-9 or to permit HP to include the ArcSight Board Recommendation in the Offer documents; (C) the ArcSight board of directors or any committee thereof shall have for any reason approved, or recommended that the ArcSight stockholders approve, any Acquisition Proposal or Acquisition Transaction (whether or not a Superior Proposal); or (D) an Acquisition Transaction Tender Offer shall have been made by a person unaffiliated with HP and, within ten (10) business days after notice of such Acquisition Transaction Tender Offer is first published, sent or given to the ArcSight stockholders, ArcSight shall not have made, pursuant to Rule 14e-2 under the Exchange Act, a statement unconditionally reaffirming the ArcSight Board Recommendation and unconditionally recommending that the ArcSight stockholders reject such Acquisition Transaction Tender Offer and not tender any Shares into such Acquisition Transaction Tender Offer.

Notwithstanding the prior adoption of the Merger Agreement by the ArcSight stockholders in accordance with Delaware law, (i) prior to the Appointment Time, the Merger Agreement may be terminated and the Offer and the Merger may be abandoned and (ii) prior to the Effective Time, the Merger Agreement may be terminated and the Merger may be abandoned (it being agreed that the party terminating the Merger will give prompt written notice of such termination to the other party or parties to the Merger Agreement), by either HP or ArcSight if any governmental entity in the United States, Austria or Germany has (i) enacted, issued, promulgated, entered, enforced or deemed applicable to the Offer and the Merger any law, statute, rule or regulation that is in effect and has the effect of making the Offer or the Merger illegal or which has the effect of prohibiting or otherwise preventing the Offer or the Merger or (ii) issued or granted any judgment, order or injunction that is in effect and has the effect of making the Offer and the Merger illegal or which has the effect of prohibiting or otherwise preventing the Offer or the Merger, and such judgment, order or injunction has become final and non-appealable.

Termination Fee. The Merger Agreement provides that ArcSight will pay to HP $61,000,000 (the "Termination Fee") in accordance with the terms set forth therein in the event that: (A) the Merger Agreement is terminated by HP or ArcSight pursuant to clause (b) set forth above under "Termination"; (B) after the execution and delivery of the Merger Agreement and prior to the termination of the Merger Agreement, an Acquisition Proposal shall have been publicly announced or shall have become publicly known, or shall have been communicated or otherwise made known to ArcSight; (C) either (x) in the event that the condition to the Antitrust Condition has not been satisfied at the time of such termination, ArcSight materially breached its obligations to use reasonable best efforts to complete the Offer and the Merger, including to satisfy the Antitrust Condition or (y) the Minimum Condition has not been satisfied at the time of such termination; and (D) within twelve (12) months following the termination of the Merger Agreement, either (1) an Acquisition Transaction (whether or not the Acquisition Transaction referenced in the preceding clause (B)) is consummated or (2) ArcSight enters into a definitive agreement providing for the consummation of an Acquisition Transaction and such Acquisition Transaction is subsequently consummated (whether or not the Acquisition Transaction referenced in the preceding clause (B)). For purposes of the foregoing, the (i) term "Acquisition Transaction" shall have the same meaning as an "Acquisition Transaction," except that all references therein to fifteen percent (15%) shall be deemed to be references to fifty percent (50%) and the reference therein to eighty five percent (85%) shall be deemed to be a reference to fifty percent (50%) and (ii) the term "Acquisition Proposal" shall incorporate such changes into its correlative meaning.

In addition, in the event that the Merger Agreement is terminated by ArcSight pursuant to clause (e) set forth above under "Termination," ArcSight will pay to HP the Termination Fee as a condition to the effectiveness of such termination. Furthermore, in the event that the Merger Agreement is terminated by HP pursuant to clause (f) set forth above under "Termination," ArcSight will pay to HP the Termination Fee within two (2) business days.

The parties to the Merger Agreement agreed that in the event the Termination Fee is paid by ArcSight, such payment will not be in lieu of, or replacement or substitution for, damages incurred in the event of any willful breach of the Merger Agreement.

Effect of Termination. The Merger Agreement provides that if it is properly and validly terminated, it will be of no further force or effect without liability of any party or parties, as applicable (or any stockholder, director, officer, employee, agent, consultant or representative of such party or parties) to the other party or parties hereto, as applicable, except (a) for the terms of the Merger Agreement relating to confidentiality, the effect of termination, the payment of fees and expenses and certain general provisions, each of which would survive the termination of the Merger Agreement, and (b) that nothing will relieve any party or parties to the Merger Agreement, as applicable, from liability for any willful breach of, or fraud in connection with, the Merger Agreement. In addition, no

termination of the Merger will affect the obligations of the parties set forth in the Confidentiality Agreement (as defined below), all of which obligations survive termination of the Merger Agreement in accordance with their terms.

No Third Party Beneficiaries. The Merger Agreement is not intended to, and does not, confer upon any other person or entity any rights or remedies thereunder, except as set forth in or contemplated by the terms and provisions of the Merger Agreement relating to directors' and officers' indemnification and insurance.

Remedies. Under the Merger Agreement, except as otherwise provided therein, any and all remedies expressly conferred upon a party will be deemed cumulative with and not exclusive of any other remedy conferred, or by law or equity upon such party, and the exercise by a party of any one remedy will not preclude the exercise of any other remedy. The parties to the Merger Agreement have agreed that irreparable damage would occur in the event that any of the provisions of the Merger Agreement were not performed in accordance with their specific terms or were otherwise breached. Accordingly, the parties agreed that the parties will be entitled to seek an injunction or injunctions to prevent breaches of the Merger Agreement and to enforce specifically the terms and provisions of the Merger Agreement in any court of the United States or any state having jurisdiction, in addition to any other remedy to which they are entitled at law or in equity.

Amendment. Subject to applicable law and subject to the other provisions of the Merger Agreement, the Merger Agreement may be amended by the parties at any time by execution of an instrument in writing signed on behalf of each of HP, Purchaser and ArcSight, provided that in the event that the Merger Agreement has been adopted by the ArcSight stockholders in accordance with Delaware law, no amendment may be made to the Merger Agreement that requires the approval of such ArcSight stockholders without such approval.

Tender and Voting Agreement. In connection with the execution of the Merger Agreement, certain stockholders of ArcSight who hold approximately 15.6% of the outstanding stock of ArcSight (the "Tendering Stockholders") have entered into tender and voting agreements with HP and Purchaser (the "Tender and Voting Agreements"), which provide, among other things, that the Tendering Stockholders will (i) tender their Shares in the Offer at least five business days prior to the initial expiration thereof and not withdraw the shares and (ii) vote their Shares in favor of adopting the Merger Agreement, if applicable, and against any action or agreement which would materially delay or interfere with, or prevent or nullify, the Merger. In addition, the Tendering Stockholders agree, subject to certain exceptions, to refrain from transferring their Shares. Each Tender and Voting Agreement will terminate upon the earlier to occur of (a) the termination of the Merger Agreement in accordance with its terms, (b) the written agreement of the parties to terminate such agreement, (c) the Effective Time, and (d) any amendment or change to the Merger Agreement or the Offer that decreases the Offer Price. The foregoing summary is qualified in its entirety by reference to the complete text of the Tender and Voting Agreements, which are filed as exhibits to the Schedule TO and are incorporated herein by reference.

Confidentiality Agreement. ArcSight and HP entered into a mutual nondisclosure agreement, dated as of August 18, 2010 (the "Confidentiality Agreement"). As a condition to being furnished confidential information of the other party, in the Confidentiality Agreement, each of HP and ArcSight agreed, among other things, to keep such confidential information confidential and to use it only for specified purposes.

Exclusivity Agreement. ArcSight and HP entered into an exclusivity letter agreement, dated as of August 27, 2010 (the "Exclusivity Agreement"), in connection with a possible negotiated transaction involving HP and ArcSight. Under the Exclusivity Agreement, ArcSight agreed not to, for a specified time period, directly or indirectly, solicit, initiate, negotiate or discuss any offer or proposal for a

business combination transaction involving ArcSight and any party other than HP. The foregoing summary is qualified in its entirety by reference to the complete text of the Exclusivity Agreement, which is filed as an exhibit to the Schedule TO and is incorporated herein by reference.

Executive Compensation Arrangements.

New Executive Offer Letters. HP has entered into offer letters with each of the ArcSight executives listed in the table below, all of whom are currently executive officers of ArcSight, describing the terms and conditions of their employment following the completion of HP's acquisition of ArcSight. The offer letters state the job title to be held by each individual upon completion of the Merger, as well as the annual base salary and annual target bonus (expressed as a percentage of base salary, with a maximum annual bonus opportunity equal to three times the target bonus) or, in the case of Xx. Xxxxxx, target sales incentive award (expressed as a dollar amount), and provide that the individual is expected to receive a long-term incentive grant of HP performance-based restricted units in December of 2010 on terms and in amounts consistent with awards granted to similarly-situated executives. In addition, as set forth in the table below, in connection with the Merger HP has promised under the offer letters to grant three executives new HP restricted stock awards, to grant four executives new cash awards and to continue to provide five executives with severance benefits. These awards are described in greater detail below. The summary in this Offer to Purchase is qualified in its entirety by reference to the complete text of the offer letters, each of which is attached as an exhibit to the Schedule TO and incorporated herein by reference.

The table below sets forth the following terms of the offer letters:

•: the executive's new base salary amount (under the heading "Annual Base Salary") and new target bonus amount or, in the case of Xx. Xxxxxx, new target sales incentive award (under the heading "Target Bonus Amount");
•: the value of the HP restricted stock grant to be made in connection with the Merger (under the heading "New HP XX Xxxxx") and the value of the cash award to be granted in connection with the Merger (under the heading "New Cash Award");
•: the estimated maximum value of the cash severance pay to which the executive would be entitled if his or her employment were terminated by HP without cause or by the covered executive with good reason following the Merger (under the heading "Potential Cash Severance"); and
•: the estimated maximum value of the equity acceleration to which the executive would be entitled if his or her employment were terminated by HP without cause or by the covered executive with good reason within one year following the Merger (under the heading "Potential Equity Acceleration"). Xx. Xxxxxxxx, Ms. Phi and Xx. Xxxxxx are also entitled to equity acceleration if they remain employed by HP for at least six months, one year or one year, respectively. While it is anticipated the executives will join HP and continue as employees, the Potential Equity Acceleration described below assumes the executives are terminated by HP without cause or by

the covered executive with good reason following the Merger with a closing of the Merger on November 1, 2010.

Name

Xxxxxxx Xxxxxxxx	310,000	124,000	—	—	77,500	511,500	1,944,720	(2)
Xxxxx Xxxxxx(3)	300,000	200,000	392,900	750,000	300,000	1,942,900	1,810,944
Xxxx Xxxxxxxx	310,000	155,000	785,800	310,000	155,000	1,715,800	4,328,837
Tram Phi	265,000	92,750	—	—	66,250	424,000	1,037,269	(4)
Xxxxxx Xxxxxx	440,000	308,000	1,768,050	1,000,000	440,000	3,956,050	14,455,585
Xxxxxxx Xxxxxx	280,000	112,000	—	210,000	—	602,000	1,363,054	(5)

					TOTAL	12,445,850	24,940,410

(1): Unless otherwise noted, the executive would be entitled to an equivalent amount of acceleration in the event of termination for good reason during the same period.
(2): Reflects the value of Xx. Xxxxxxxx'x potential equity acceleration if he remains employed by HP six months following the effective time of the Merger or if his employment is terminated by HP without cause. The value of Xx. Xxxxxxxx'x potential acceleration of equity is $1,296,491 in the event that Xx. Xxxxxxxx shall terminate service for a good reason within six months following the effective time of the Merger.
(3): HP and Xx. Xxxxxx have agreed to adjust his compensation such that his total annual salary and target bonus are an aggregate of $530,000 following the effective time of the Merger.
(4): Reflects the value of Ms. Phi's potential equity acceleration if she remains employed by HP one year following the effective time of the Merger or if her employment is terminated by HP without cause. The value of Ms. Phi's potential acceleration of equity is $691,533 in the event that Ms. Phi shall terminate service for a good reason within six months following the effective time of the Merger.
(5): Xx. Xxxxxx is not eligible for acceleration of equity upon termination for good reason.

Standard HP Employment Agreements. As part of the offer letter acceptance process, all ArcSight employees and executives who join HP are expected to execute certain other documents applicable to all new hires, including the HP Agreement Regarding Confidential Information and Proprietary Developments and the HP Letter of Assurance, certifying that the individual is not subject to any restrictions on his or her employment as a result of agreements made with any previous employer (other than ArcSight).

Converted ArcSight Stock Options. Under the Merger Agreement all of the ArcSight executives' unvested ArcSight stock options with an exercise price per share that is less than the Merger Consideration will be assumed by HP and converted into HP stock options not later than the Effective Time. Please see "—ArcSight Options" in this Section 12 for a description of this assumption and conversion. The vesting schedule of the converted ArcSight stock options will generally be the same vesting schedule that applied prior to the Merger. However, under the offer letters, HP has agreed to accelerate the vesting of certain individuals' converted ArcSight stock options under certain circumstances as follows:

•: If Ms. Phi and Xx. Xxxxxx remain employed with HP for 12 months following the Merger or are terminated by HP without cause during that time, then 75% (with respect to Ms. Phi) or 100% (with respect to Xx. Xxxxxx) of his or her converted ArcSight stock options that remain unvested as of that time will become fully vested.

•: If Xx. Xxxxxx is terminated by HP without cause within 12 months following the Merger, then 50% of his converted ArcSight stock options that remain unvested as of that time will become fully vested.
•: If Xx. Xxxxxxxx remains employed with HP for six months following the Merger or is terminated by HP without cause during that time, then 75% of his converted ArcSight stock options that remain unvested as of that time will become fully vested.

In addition, pursuant to a change in control agreement entered into between ArcSight and Xx. Xxxxxxxx on September 13, 2010, if Xx. Xxxxxxxx is terminated by HP without cause or he resigns with good reason within 18 months following the Merger (or another transaction in which the termination fee contemplated by the Merger Agreement will apply), then his converted ArcSight stock options that would have vested within 24 months following his termination will become fully vested. (We refer below to a termination of employment of a covered executive by HP without cause or by the covered executive with good reason as a "qualifying termination.")

Continuation of ArcSight Severance Benefits. Prior to the date of the offer contemplated by the Merger Agreement, ArcSight entered into offer letters with Messrs. Grierson, Mosher, Njemanze and Xxxxxx and Ms. Phi that provided the covered executives with severance benefits under certain circumstances. In connection with HP's entry into the Merger Agreement, HP has agreed under the offer letters to continue to provide these severance benefits for varying periods of time as follows:

•: If Xx. Xxxxxxxx experiences a qualifying termination within six months following the Merger, he is entitled to receive cash severance equal to three months base salary and 50% of his converted ArcSight stock options that remain unvested as of that date will become fully vested.
•: If Xx. Xxxxxx experiences a qualifying termination within 24 months following the Merger, he is entitled to receive cash severance equal to 12 months base salary and his converted ArcSight stock options that would have vested within 24 months following his termination will become fully vested. These benefits are modified from Xx. Xxxxxx'x original offer letter with ArcSight, which provided Xx. Xxxxxx with severance benefits only for 12 months following a change in control.
•: If Xx. Xxxxxxxx experiences a qualifying termination within 12 months following the Merger, he is entitled to receive cash severance equal to six months base salary. These benefits are modified from Xx. Xxxxxxxx'x original offer letter with ArcSight, which provided Xx. Xxxxxxxx with severance benefits only upon a termination by ArcSight for any reason.
•: If Ms. Phi experiences a qualifying termination within six months following the Merger, she is entitled to receive cash severance equal to three months base salary and 50% of her converted ArcSight stock options that remain unvested as of that date will become fully vested.
•: If Xx. Xxxxxx experiences a qualifying termination within 12 months following the Merger, he is entitled to receive cash severance equal to 12 months base salary and 100% of his converted ArcSight stock options that remain unvested as of that date will become fully vested.

The estimated maximum value of the cash severance pay is reflected in the table above under the column with the heading "Potential Cash Severance." The estimated maximum value of the acceleration of the ArcSight Assumed Options is reflected in the table above under the column with the heading "Potential Equity Acceleration."

New HP Restricted Stock Awards. In connection with HP's entry into the Merger Agreement, HP has agreed under the offer letters to grant Messrs. Xxxxxx, Xxxxxxxx and Xxxxxx awards of HP restricted stock (the "New HP RS Awards") pursuant to HP's Amended and Restated Hewlett-Packard Company 2004 Stock Incentive Plan. The value of the New HP RS Awards is based on each individual's compensation and position with HP and is reflected in the table above under the column

with the heading "New HP XX Xxxxx." For Xx. Xxxxxxxx, the New HP RS Awards will vest in two equal installments on each of the second and third anniversaries of the date of grant, subject to the holder's continued employment with HP. Messrs. Xxxxxx and Xxxxxx'x New HP RS Awards will vest in two equal installments on each of the first and second anniversaries of the date of grant, subject to the holder's continued employment HP. In the event of the holder's termination of employment due to disability or retirement, the New HP RS Awards will continue to vest in accordance with the vesting schedule described in the previous sentence, subject to the holder's agreement to perform services for the Company as an independent contractor and adhere to non-competition, confidentiality, and assignment of invention covenants. In the event of the holder's death while employed, the holder's estate or designated beneficiary will have the right to receive a pro rata number of shares as determined by the Company. In accordance with their offer letters, HP expects to make a grant to each such executive officer in December 2010 of performance-based restricted units, on terms and in amounts consistent with awards to similarly situated HP executives.

New Cash Awards. In connection with HP's entry into the Merger Agreement, HP has agreed under the offer letters to make cash awards to Messrs. Mosher, Njemanze, Xxxxxx and Xxxxxx. With respect to each covered executive other than Xx. Xxxxxx, these awards will be paid in two equal installments if he or she remains employed with HP through the first and second anniversaries of the closing of the Merger or his or her employment is terminated by HP without cause prior to the payment date. Xx. Xxxxxx'x cash award will be paid in one installment if he remains employed with HP through the first anniversary of the closing of the Merger or his employment is terminated by HP without cause prior to the payment date. The value of these cash awards is reflected in the table above under the column with the heading "New Cash Award."

Effects of Inability to Consummate the Merger. If, following the consummation of the Offer, the Merger is not consummated for any reason (see "—The Merger Agreement—Conditions to the Merger" in this Section 12), HP, which directly or indirectly owns 100 percent of the common stock of Purchaser, will indirectly control the Shares acquired by Purchaser pursuant to the Offer, as well as any other Shares held by HP or its subsidiaries. Under the Merger Agreement, promptly following payment by Purchaser for Shares purchased pursuant to the Offer, and from time to time thereafter, subject to Section 14(f) of the Exchange Act and applicable NASDAQ rules and regulations regarding director independence, ArcSight is required to take all actions necessary to cause a pro rata portion (based on the percentage of outstanding Shares acquired by Purchaser) of the directors of ArcSight to consist of persons designated by Purchaser (see "—The Merger Agreement—Board of Directors" in this Section 12).

If HP controls more than 50 percent of the outstanding Shares following the consummation of the Offer but the Merger is not consummated, stockholders of ArcSight, other than those affiliated with HP, will lack sufficient voting power to elect directors or to cause other actions to be taken which require majority approval. This concentration of influence in one stockholder may adversely affect the market value of the Shares.

13. Source and Amount of Funds

HP will provide Purchaser with sufficient funds to pay for all Shares accepted for payment in the Offer and to make all payments in respect of ArcSight Options contemplated by the Merger Agreement. HP estimates that the total amount of funds necessary to purchase all outstanding Shares of ArcSight pursuant to the Offer and the Merger, and to pay customary fees and expenses in connection with the Offer and the related transactions will be approximately $1.52 billion. We expect to fund all these payments through a loan or capital contribution from HP to Purchaser. As of July 31, 2010, HP had approximately $14.7 billion in cash and cash equivalents. The Offer is not conditioned upon any financing arrangements. The Offer is not conditioned upon any financing arrangements.

14. Conditions of the Offer

Notwithstanding any other provision of the Offer, but subject to compliance with the terms and conditions of the Merger Agreement, and in addition to (and not in limitation of) the obligations of Purchaser to extend the Offer pursuant to the terms and conditions of the Merger Agreement, Purchaser (i) will not be required to accept for payment or, subject to any applicable rules and regulations of the SEC (including Rule 14e-1(c) under the Exchange Act (relating to our obligation to pay for or return tendered Shares promptly after termination or withdrawal of the Offer)), pay for any Shares, (ii) may delay the acceptance for payment of or, subject to the restriction referred to above, the payment for, any tendered Shares and (iii) may terminate or amend the Offer as to Shares not then paid for, in the event that at or prior to the scheduled expiration of the Offer (as it may be extended pursuant to the Merger Agreement), (A) the Antitrust Condition shall not have been satisfied, (B) the Minimum Condition shall not have been satisfied or (C) any of the following shall have occurred:

(1): any of the representations and warranties of ArcSight set forth in the Merger Agreement (i) shall not have been true and correct in all respects as of the date of the Merger Agreement or (ii) shall not be true and correct in all respects on and as of the expiration date of the Offer with the same force and effect as if made on and as of such date, except, in the case of the foregoing clauses (i) and (ii), (A) for any failure to be so true and correct as has not had and would not be reasonably expected have, individually or in the aggregate, an ArcSight Material Adverse Effect (as defined below); provided, however, that such ArcSight Material Adverse Effect qualifier shall be inapplicable with respect to representations and warranties set forth in Section 2.2(a), Section 4.2(a), Section 4.4 and Section 4.25 of the Merger Agreement, each of which individually shall have been true and correct in all material respects as of the expiration date of the Offer, (B) for changes contemplated by the Merger Agreement and (C) for those representations and warranties which address matters only as of a particular date (which representations shall have been true and correct as of such particular date); and provided further that, for purposes of determining the accuracy of the representations and warranties of ArcSight set forth in the Merger Agreement for purposes of this clause (C)(1), (i) all "ArcSight Material Adverse Effect" and materiality qualifications and other qualifications based on the word "material" or similar phrases contained in such representations and warranties will be disregarded (it being understood and hereby agreed that (x) the phrase "similar phrases" as used in this proviso will not be deemed to include any dollar thresholds contained in any such representations and warranties and (y) the representation and warranty set forth in Section 4.8(b) of the Merger Agreement will not be disregarded pursuant to the terms of this proviso) and (ii) any update of or modification to the confidential disclosure schedules provided by ArcSight made or purported to have been made after the date of the Merger Agreement will be disregarded;
(2): ArcSight has failed to perform in any material respect any obligation or to comply in any material respect with any material covenant or other material agreement of ArcSight to be performed or complied with by it under the Merger Agreement;
(3): there shall be pending, or HP or ArcSight shall have received notice (oral or written) of an intent to commence, any suit, action or proceeding by any governmental entity against HP, Purchaser, ArcSight or any subsidiary of ArcSight (i) challenging the acquisition by Purchaser (or HP on Purchaser's behalf) of any Shares pursuant to the Offer, seeking to restrain or prohibit the making or consummation of the Offer or the Merger or the performance of any of the other transactions contemplated by the Merger Agreement, or (ii) seeking to compel HP, ArcSight or any of their respective subsidiaries to agree to any sale, divestiture, license or other disposition of shares of capital stock or of any business, assets or property, or the imposition of any limitation on the ability of any of them to conduct their respective businesses or to own or exercise control of such stock, businesses, assets or properties, if

(A) such actions reasonably would be expected to have a material adverse effect on (x) ArcSight and its subsidiaries, taken as a whole, or (y) the benefits expected to be derived by HP and its subsidiaries from the transactions contemplated by Merger Agreement or (B) such actions reasonably would be expected to have a material adverse effect on the operations or businesses of HP and its subsidiaries, taken as a whole (assuming for purposes of this determination that HP and its subsidiaries are of the equivalent size, and have equivalent revenues, to ArcSight and its subsidiaries, taken as a whole);

(4): any governmental entity of competent jurisdiction located within the United States, Austria, Germany or any other jurisdiction shall have (i) enacted, issued, promulgated, entered, enforced or deemed applicable to the Offer and the Merger any law, statute, rule or regulation that is in effect and has the effect of making the Offer or the Merger illegal or which has the effect of prohibiting, requiring a mandatory filing or notification as a condition to the legality or approval of the Offer and/or Merger, or otherwise preventing the Offer and the Merger or (ii) issued or granted any judgment, Order or injunction that is in effect and has the effect of making the Offer and the Merger illegal or which has the effect of prohibiting or otherwise preventing the Offer and the Merger; provided, however, with respect to any jurisdictions other than the United States, Austria and Germany, only if such event (a) reasonably would be expected to have a material adverse effect on (1) ArcSight and its subsidiaries, taken as a whole, or (2) the benefits expected to be derived by HP and its subsidiaries from the transactions contemplated by the Merger Agreement or (b) reasonably would be expected to have a material adverse effect on the operations or businesses of HP and its subsidiaries, taken as a whole (assuming for purposes of this determination that HP and its subsidiaries are of the equivalent size, and have equivalent revenues, to ArcSight and its subsidiaries, taken as a whole; or
(5): the Merger Agreement has been terminated in accordance with its terms.

For purposes of the Merger Agreement, the term "ArcSight Material Adverse Effect" means any fact, circumstance, change or effect that, individually or when taken together with all other such facts, circumstances, changes or effects, (i) has had or is reasonably likely to have a material adverse effect on the business, operations, assets (including intangible assets), financial condition or results of operations of ArcSight taken as a whole with its subsidiaries or (ii) materially impairs the ability of ArcSight to consummate, or prevents or materially delays, the Offer, the Merger or any of the other transactions contemplated by the Merger Agreement or would reasonably be expected to do so provided, however, that, for purposes of clause (i) above, none of the following facts, circumstances, changes or effects, by itself or when aggregated with any one or more of the other such facts, circumstances, changes or effects, will be deemed to be or constitute an ArcSight Material Adverse Effect and none of the following facts, circumstances, changes or effects, by itself or when aggregated with any one or more of the other such facts, circumstances, changes or effects, will be taken into account when determining whether an ArcSight Material Adverse Effect has occurred or may, would or could occur:

(A): any changes resulting from or arising out of general market, economic or political conditions (including any changes arising out of acts of terrorism or war, weather conditions or other force majeure events), provided that such changes do not have a substantially disproportionate impact on ArcSight and its subsidiaries, taken as a whole, relative to other companies operating in the same industries in which ArcSight or any of its subsidiaries conduct business;
(B): any changes resulting from or arising out of general market, economic or political conditions in the industries in which ArcSight or any of its subsidiaries conduct business (including any changes arising out of acts of terrorism, or war, weather conditions or other force majeure events), provided that such changes do not have a substantially disproportionate impact on

ArcSight and its Subsidiaries, taken as a whole, relative to other companies operating in the same industries in which ArcSight or any of its subsidiaries conduct business;

(C): any changes or effects resulting from, arising out of or related to the disclosure of a potential acquisition of ArcSight prior to the date of the Merger Agreement (excluding any such disclosure by ArcSight, any subsidiary thereof or any representative that is not in accordance with applicable law), the announcement of the execution of the Merger Agreement or the pendency of the Offer or the Merger, as the case may be, including any loss of, or adverse change in, the relationship of ArcSight or any of its subsidiaries with its employees, customers, distributors, partners or suppliers to the extent related thereto;
(D): any stockholder class action, derivative litigation or other legal proceedings made or brought by any of the current or former ArcSight stockholders (on their own behalf or on behalf of ArcSight) arising out of or related to the Merger Agreement or any of the transactions contemplated thereby (including the Offer and the Merger);
(E): changes in GAAP or other accounting standards (or the interpretation thereof by a third party), law or regulatory conditions (or the interpretation thereof by a third party), provided that such changes do not have a substantially disproportionate impact on ArcSight and its subsidiaries, taken as a whole, relative to other companies operating in the same industries in which ArcSight or any of its subsidiaries conduct business;
(F): any failure to take any action or the taking of any specific action at the express written request (including via electronic mail) of HP or Purchaser;
(G): the taking of any specific action expressly required by the Merger Agreement or the failure to take any specific action expressly prohibited by the Merger Agreement;
(H): changes in the trading price or trading volume of ArcSight's stock, in and of themselves (it being understood that any underlying cause of any such change may, subject to the other terms of this definition, be deemed to constitute a Material Adverse Effect and may be taken into consideration when determining whether a Material Adverse Effect has occurred); or
(I): any failure by ArcSight to meet any public estimates or expectations of ArcSight's bookings, revenue, earnings or other financial performance or results of operations for any period, or any failure by ArcSight to meet any internal budgets, plans or forecasts of its bookings, revenues, earnings or other financial performance or results of operations (it being understood that any underlying cause of any such failure may, subject to the other terms of this definition, be deemed to constitute a Material Adverse Effect and may be taken into consideration when determining whether a Material Adverse Effect has occurred).

The foregoing conditions are for the sole benefit of HP and Purchaser. We expressly reserve the right, at any time and from time to time, prior to expiration of the Offer, to increase the Offer Price or to make any other changes in the terms and conditions of the Offer, except that we reserve the right to waive or otherwise modify those conditions to the Offer that depend upon receipt of government regulatory approvals at any time prior to the acceptance of Shares for Payment. Under the terms of the Merger Agreement, however, we are not permitted to, without ArcSight's consent, (i) amend or waive the Minimum Condition, (ii) decrease the Offer Price, (iii) change the form of consideration to be paid in the Offer, (iv) reduce the number of Shares to be purchased in the Offer, (v) extend the Offer, other than in a manner contemplated by the Merger Agreement, (vi) impose conditions to the Offer in addition to those described in this Section 14 or (vii) amend, modify or supplement any of the terms of the Offer in a manner adverse to the holders of Shares.

15. Dividends and Distributions

The Offer Price will be adjusted appropriately to reflect the effect of any stock split, reverse stock split, stock dividend (including any dividend or distribution of securities convertible into ArcSight common stock), cash dividend, reorganization, recapitalization, reclassification, combination, exchange of shares or other like change with respect to ArcSight common stock occurring on or after the date of the Merger Agreement and prior to Purchaser's acceptance for payment of, and payment for, Shares pursuant to the Offer.

The Merger Agreement provides that, from the date of the Merger Agreement to the Effective Time, ArcSight will not, and will not permit any of its subsidiaries to (i) declare, set aside or pay any dividends on, or make any other distributions (whether in cash, stock or property) in respect of, any of its capital stock or other equity interests, except for dividends by a wholly owned subsidiary of ArcSight to its parent, (ii) purchase, redeem or otherwise acquire shares of its capital stock or other equity interests or any options, warrants, or rights to acquire any such shares or other equity interests or (iii) split, combine, reclassify or otherwise amend the terms of any of its capital stock or other equity interests. See "The Merger Agreement—Operating Covenants" in Section 12.

16. Certain Regulatory and Legal Matters

General. Except as otherwise set forth in this Offer to Purchase, based on our review of ArcSight's publicly available SEC filings and other information regarding ArcSight, HP and Purchaser are not aware of any licenses or other regulatory permits which appear to be material to the business of ArcSight and which might be adversely affected by the acquisition of Shares pursuant to the Offer or of any approval or other action by any governmental, administrative or regulatory agency or authority which would be required for the acquisition or ownership of Shares pursuant to the Offer. In addition, except as set forth below, we are not aware of any filings, approvals or other actions by or with any governmental authority or administrative or regulatory agency that would be required for our acquisition or ownership of the Shares. Should any such approval or other action be required, we currently expect that such approval or action would be sought or taken. There can be no assurance that any such approval or action, if needed, would be obtained or, if obtained, that it would be obtained without substantial conditions, and there can be no assurance that, in the event that such approvals were not obtained or such other actions were not taken, adverse consequences might not result to ArcSight's or HP's business or that certain parts of ArcSight's or HP's business might not have to be disposed of or held separately. In such an event, we may not be required to purchase any Shares in the Offer under certain conditions. See Section 14—"Conditions of the Offer."

Antitrust Compliance.

United States. Under the Xxxx-Xxxxx-Xxxxxx Antitrust Improvements Act of 1976, as amended (the "HSR Act"), and the related rules and regulations that have been issued by the Federal Trade Commission (the "FTC"), certain transactions having a value above specified thresholds may not be consummated until specified information and documentary material ("Premerger Notification and Report Forms") have been furnished to the FTC and the Antitrust Division of the Department of Justice (the "Antitrust Division") and certain waiting period requirements have been satisfied. The requirements of the HSR Act apply to the acquisition of Shares in the Offer and the Merger.

The purchase of Shares in the Offer cannot be completed until the expiration of a 15 calendar day waiting period following the filing by HP, as the ultimate HP entity of Purchaser, of a Premerger Notification and Report Form concerning the Offer with the FTC and the Antitrust Division, unless the waiting period is earlier terminated by the FTC and the Antitrust Division. HP filed the Premerger Notification and Report Forms with the FTC and the Antitrust Division on September 22, 2010 in connection with the purchase of the Shares in the Offer. The required waiting period with respect to

the Offer will expire 15 calendar days from the date of such filing, unless earlier terminated by the FTC or the Antitrust Division or unless the FTC or the Antitrust Division issues a request for additional information and documentary material (a "Second Request") prior to that time. If within the 15 calendar day waiting period either the FTC or the Antitrust Division were to issue a Second Request, the waiting period with respect to the Offer would be extended until 10 calendar days following the date of substantial compliance by HP with that request, unless the FTC or the Antitrust Division terminated the additional waiting period before its expiration. After the expiration of the 10 calendar day waiting period, the waiting period could be extended only by court order or with consent of HP. In practice, complying with a Second Request can take a significant period of time. Although ArcSight is required to file certain information and documentary materials with the FTC and the Antitrust Division in connection with the Offer, neither ArcSight's failure to make those filings nor a request for additional documents and information issued to ArcSight from the FTC or the Antitrust Division will extend the waiting period with respect to the purchase of Shares in the Offer.

The FTC and the Antitrust Division will consider the legality under the antitrust laws of our proposed acquisition of ArcSight. At any time before or after our acceptance for payment of Shares pursuant to the Offer, if the Antitrust Division or the FTC believes that the Offer would violate the U.S. federal antitrust laws because it may substantially lessen competition in any line of commerce affecting U.S. consumers, the FTC and the Antitrust Division have the authority to challenge the transaction by seeking a federal court order enjoining the transaction or, if Shares have already been acquired, requiring disposition of such Shares, or the divestiture of substantial assets of HP, ArcSight, or any of their respective subsidiaries or affiliates. U.S. state attorneys general and private persons may also bring legal action under the antitrust laws seeking similar relief or seeking conditions to the completion of the Offer. While we believe that the consummation of the Offer will not violate any antitrust laws, there can be no assurance that a challenge to the Offer on antitrust grounds will not be made or, if a challenge is made, what the result will be. If any such action is commenced by the FTC, the Antitrust Division or any state or any other person and an order is issued prohibiting the consummation of the Offer, we may not be obligated to consummate the Offer. See Section 14—"Conditions of the Offer."

Germany. The Act against Restraints of Competition requires HP and ArcSight to file a notification with the Federal Cartel Office ("FCO") and provides that the acquisition of Shares in the Offer shall not occur until a one month waiting period, or in case of an in-depth investigation, a waiting period of four months, from submission of a complete notification to the FCO has expired or otherwise terminated. HP filed the notice of merger on behalf of itself and ArcSight on September 21, 2010.

Austria. The Cartel Act requires HP to file a notification with the Federal Competition Authority ("FCA") in Austria and provides that the acquisition of Shares in the Offer shall not occur until a four week waiting period from submission of a complete notification to the FCA, or in case of an in-depth investigation, an additional waiting period of five months, has expired or otherwise terminated. HP filed the notice of merger on September 20, 2010.

Other Foreign Jurisdictions. Under competition laws of certain other foreign jurisdictions, HP and, in certain instances, ArcSight are required to make certain filings with the applicable competition authorities in connection with the Offer and the Merger. HP and, where applicable, ArcSight intend to make such filings in Brazil, Italy, Macedonia (The Former Yugoslav Republic of), Montenegro, Serbia and Ukraine.

"Going Private" Transactions. Rule 13e-3 under the Exchange Act is applicable to certain "going private" transactions and may under certain circumstances be applicable to a merger. However, Rule 13e-3 will be inapplicable if (a) the Shares are deregistered under the Exchange Act prior to a merger or another business combination or (b) a merger or other business combination is

consummated within one year after the purchase of the Shares pursuant to the Offer and the amount paid per Share in a merger or other business combination is at least equal to the amount paid per Share in the Offer.

17. Appraisal Rights

No appraisal rights are available to the holders of Shares in connection with the Offer. However, if the Merger contemplated by the Merger Agreement is consummated, each holder of Shares at the effective time of the Merger who has neither voted in favor of the Merger nor consented thereto in writing, and who otherwise complies with the applicable statutory procedures under Section 262 of the DGCL, will be entitled to receive a judicial determination of the fair value of the holder's Shares (exclusive of any element of value arising from the accomplishment or expectation of the merger) and to receive payment of such judicially determined amount in cash, together with such rate of interest, if any, as the Delaware court may determine for Shares held by such holder. Unless the Delaware court in its discretion determines otherwise for good cause shown, this rate of interest will be five percent over the Federal Reserve discount rate (including any surcharge) as established from time to time between the Effective Date and the date of payment and will be compounded quarterly.

Any such judicial determination of the fair value of the Shares could be based upon considerations other than or in addition to the price paid in the Offer and the market value of the Shares. Stockholders should recognize that the value so determined could be higher or lower than the price per Share paid pursuant to the Offer or the per share price to be paid in the Merger. Moreover, ArcSight may argue in an appraisal proceeding that, for purposes of such a proceeding, the fair value of the Shares is less than the price paid in the Offer and the Merger.

In addition, several decisions by Delaware courts have held that, in certain circumstances, a controlling stockholder of a company involved in a merger has a fiduciary duty to other stockholders that requires that the merger be fair to such other stockholders. In determining whether a merger is fair to minority stockholders, Delaware courts have considered, among other things, the type and amount of consideration to be received by the stockholders and whether there was fair dealing among the parties. The Delaware Supreme Court has stated that the remedy ordinarily available to minority stockholders in a cash-out merger is the right to appraisal described above. However, a damages remedy or injunctive relief may be available if a merger is found to be the product of procedural unfairness, including fraud, misrepresentation or other misconduct.

The foregoing summary of the rights of dissenting stockholders under the DGCL does not purport to be a statement of the procedures to be followed by stockholders desiring to exercise any appraisal rights under Delaware law. The preservation and exercise of appraisal rights require strict and timely adherence to the applicable provisions of Delaware law which will be set forth in their entirety in the proxy statement or information statement for a merger, unless effected as a short-form merger, in which case they will be set forth in the notice of merger. The foregoing discussion is not a complete statement of law pertaining to appraisal rights under Delaware law and is qualified in its entirety by reference to Delaware law.

You cannot exercise appraisal rights at this time. The information provided above is for informational purposes only with respect to your alternatives if a merger is consummated. If you sell your Shares in the Offer, you will not be entitled to exercise appraisal rights with respect to your Shares but, rather, subject to the conditions of the Offer, will receive the Offer Price therefor.

18. Fees and Expenses

We have retained the Depositary and the Information Agent in connection with the Offer. Each of the Depositary and the Information Agent will receive customary compensation, reimbursement for

reasonable out-of-pocket expenses, and indemnification against certain liabilities in connection with the Offer, including liabilities under the federal securities laws.

As part of the services included in such retention, the Information Agent may contact holders of Shares by personal interview, mail, electronic mail, telephone, telex, telegraph and other methods of electronic communication and may request brokers, dealers, commercial banks, trust companies and other nominees to forward the Offer materials to beneficial holders of Shares.

Except as set forth above, we will not pay any fees or commissions to any broker or dealer or other person for soliciting tenders of Shares pursuant to the Offer. Brokers, dealers, commercial banks and trust companies will upon request be reimbursed by us for customary mailing and handling expenses incurred by them in forwarding the offering material to their customers.

19. Miscellaneous

We are not aware of any jurisdiction where the making of the Offer is prohibited by any administrative or judicial action pursuant to any valid state statute. If we become aware of any valid state statute prohibiting the making of the Offer or the acceptance of the Shares, we will make a good faith effort to comply with that state statute or seek to have such statute declared inapplicable to the Offer. If, after a good faith effort, we cannot comply with the state statute, we will not make the Offer to, nor will we accept tenders from or on behalf of, the holders of Shares in that state.

We have filed with the SEC a Tender Offer Statement on Schedule TO (including exhibits) in accordance with the Exchange Act, furnishing certain additional information with respect to the Offer and may file amendments thereto. The Schedule TO and any amendments thereto, including exhibits, may be examined and copies may be obtained from the SEC in the manner set forth in Section 8 under "Available Information."

No person has been authorized to give any information or make any representation on behalf of HP or Purchaser not contained in this Offer to Purchase or in the Letter of Transmittal and, if given or made, such information or representation must not be relied upon as having been authorized. No broker, dealer, bank, trust company, fiduciary or other person will be deemed to be the agent of Purchaser, the Depositary or the Information Agent for the purpose of the Offer. Neither delivery of this Offer to Purchase nor any purchase pursuant to the Offer will, under any circumstances, create any implication that there has been no change in the affairs of HP, Purchaser, ArcSight or any of their respective subsidiaries since the date as of which information is furnished or the date of this Offer to Purchase.

Priam Acquisition Corporation

September 22, 2010

SCHEDULE A

INFORMATION CONCERNING MEMBERS OF THE BOARDS OF DIRECTORS AND
THE EXECUTIVE OFFICERS OF HP AND PURCHASER

HP

Set forth below are the name, business address and current principal occupation or employment, and material occupations, positions, offices or employment for the past five years of each director and executive officer of HP. Except as otherwise noted, positions specified are positions with HP.

Name	Business Address	Principal Occupation or Employment	Citizenship

Board of Directors
Xxxx X. Xxxxxxxxxx	0000 Xxxxxxx Xxxxxx Xxxx Xxxx, XX 00000	Independent Non-Executive Director.	United States
		Co-founder and a general partner of Andreessen Xxxxxxxx, a venture capital firm founded in July 2009, Co-Founder and Chairman of Ning, Inc., an online platform founded in late 2004 for people to create their own social networks; Non-Executive Director of eBay Inc. Previously, Chairman of Opsware, Inc., a software company that he co-founded from September 1999 to July 2007.
Xxxxxxxx X. Xxxxxx, Xx.	0000 Xxxxxxx Xxxxxx Xxxx Xxxx, XX 00000	Independent Non-Executive Director.	United States
		Senior Advisor to Warburg Pincus, a private equity firm, since June 2007. Previously, Vice Chairman and President of Verizon Communications, Inc., a telecommunications company, from 2000 until his retirement in April 2007.
Xxxx X. Xxxxxxx	0000 Xxxxxxx Xxxxxx Xxxx Xxxx, XX 00000	Independent Non-Executive Director.	Finland
		Non-Executive Director at Fortum Oyj, Daimler AG, F-Secure Corporation and CapMan Plc. Previously, Executive Vice President and General Manager of the Networks business group of Nokia Corporation, a communications company, from July 1998 until February 2005.

A-1

Name	Business Address	Principal Occupation or Employment	Citizenship

Xxxxx X. Xxxxx	0000 Xxxxxxx Xxxxxx Xxxx Xxxx, XX 00000	Independent Non-Executive Director.	United States
		Senior Advisor to New Mountain Capital, LLC, a private equity firm, since July 2009; Non-Executive Director of The Vanguard Group and Tyco International Ltd. Previously, Chairman and Chief Executive Officer of Rohm and Xxxx Company, a worldwide producer of specialty materials, from October 1999 to April 2009; Vice Chairman of Rohm and Xxxx Company from 1998 to 1999; Director of the Electronic Materials business of Rohm and Xxxx Company from 1996 to 1999; and Vice President and Regional Director of the Asia-Pacific Region from 1993 to 1998.
Xxxx X. Xxxxxxxxxx	0000 Xxxxxxx Xxxxxx Xxxx Xxxx, XX 00000	Independent Non-Executive Director.	United States
		Chairman of McKesson Corporation, a healthcare services and information technology company, since July 2002; President and Chief Executive Officer of McKesson since April 2001; Non-Executive Director of Nadro, S.A. de C.V. (Mexico).
Xxxx X. Xxxxx	0000 Xxxxxxx Xxxxxx Xxxx Xxxx, XX 00000	Independent Non-Executive Director.	United States
		Vice Chairman of Current Media, LLC, a cable and satellite television company, since July 2009. Previously, Chief Executive Officer of Current Media from September 2002 until July 2009; Lecturer in Entrepreneurship at the Stanford University Graduate School of Business from September 1998 to June 2003; Founder and Chief Executive Officer of Hyatt Legal Plans, Inc., a provider of employer-sponsored group legal plans.

A-2

Name	Business Address	Principal Occupation or Employment	Citizenship

Xxxx X. Xxxxx	0000 Xxxxxxx Xxxxxx Xxxx Xxxx, XX 00000	Independent Non-Executive Director.	United States
		Non-Executive Director of Sabre, Inc. and Intelsat, Ltd. Previously, Managing Director at Silver Lake, a private equity firm, from July 2005 through March 2010; from 1975 to July 2005, multiple roles for IBM, a global technology firm, including Senior Vice President and Group Executive of the IBM Global Services division; Chief Financial Officer; President, IBM Asia Pacific; and Vice President and Controller for IBM's global operations.
Xxxxxx X. Xxxx	0000 Xxxxxxx Xxxxxx Xxxx Xxxx, XX 00000	Lead Independent Non-Executive Director.	United States
		HP's Lead Independent Director since September 2008; Non-Executive Director of General Xxxxx, Inc.; The Black and Xxxxxx Corporation; and Citigroup, Inc. Previously, Senior Vice President and Chief Financial Officer of Medtronic, Inc., a medical technology company, from 1993 until his retirement in May 2005.
Xxxxxxx X. Xxxxxxx	0000 Xxxxxxx Xxxxxx Xxxx Xxxx, XX 00000	Independent Non-Executive Director.	United States
		President and Chief Executive Officer of JHMedia, a consulting company, since 1997; Partner and Director of Echo Bridge Entertainment, an independent film distribution company, since 2003.

A-3

Name	Business Address	Principal Occupation or Employment	Citizenship

X. Xxxxxxx Xxxxxxxx	0000 Xxxxxxx Xxxxxx Xxxx Xxxx, XX 00000	Independent Non-Executive Director.	United States
		Executive Advisor to Aquiline Capital Partners LLC, a private equity firm, since June 2009. Previously, Chairman of Wachovia Corporation, a financial services company, from February 2003 until June 2008; Chief Executive Officer of Wachovia from 2000 until June 2008; and President from 1999 until June 2008.
Executive Officers
Xxxxxxxxx X. Xxxxxx	0000 Xxxxxxx Xxxxxx Xxxx Xxxx, XX 00000	Interim Chief Executive Officer since August 2010; Chief Financial Officer since January 2007; Senior Vice President from 2003 until December 2006; Treasurer from 2003 until March 2007.	Canada
Xxxxx X. Xxxxxx	0000 Xxxxxxx Xxxxxx Xxxx Xxxx, XX 00000	Executive Vice President and Chief Administrative Officer since December 2008.	United States
R. Xxxx Xxxxxxx	0000 Xxxxxxx Xxxxxx Xxxx Xxxx, XX 00000	Executive Vice President, Personal Systems Group since June 2005.	United States
Xxxxxxx X. Xxxxxxx	0000 Xxxxxxx Xxxxxx Xxxx Xxxx, XX 00000	Executive Vice President and General Counsel since February 2007 and Secretary since March 2007.	United States
Xxxxxxx X. Xxxxx	0000 Xxxxxxx Xxxxxx Xxxx Xxxx, XX 00000	Executive Vice President, Imaging and Printing Group since 2002.	United States
Xxx X. Xxxxxxxxx	0000 Xxxxxxx Xxxxxx Xxxx Xxxx, XX 00000	Executive Vice President, HP Enterprise Business since May 2004.	United States
Xxxx X. XxXxxxxx	0000 Xxxxxxx Xxxxxx Xxxx Xxxx, XX 00000	Senior Vice President and Treasurer since March 2007; Vice President of Finance for HP's Imaging and Printing Group from May 2002 until March 2007.	United States
Xxxxxxx X. Xxxx	0000 Xxxxxxx Xxxxxx Xxxx Xxxx, XX 00000	Executive Vice President and Chief Information Officer since July 2005.	United States

A-4

Name	Business Address	Principal Occupation or Employment	Citizenship

Xxxxx X. Xxxxxx	0000 Xxxxxxx Xxxxxx Xxxx Xxxx, XX 00000	Senior Vice President, Controller and Principal Accounting Officer since March 2007; Vice President of Finance for the former Technology Solutions Group from 2004 until March 2007.	United States
Xxxxxxx Xxxxx xx Xxxxxx	0000 Xxxxxxx Xxxxxx Xxxx Xxxx, XX 00000	Executive Vice President, Human Resources since January 2004.	United States
Xxxxx X. Xxxxxxx	0000 Xxxxxxx Xxxxxx Xxxx Xxxx, XX 00000	Executive Vice President and Chief Strategy and Technology Officer since May 2002.	United States

PURCHASER

Set forth below are the name, business address and current principal occupation or employment, and material occupations, positions, offices or employment for the past five years of each director and executive officer of Purchaser. Except as otherwise noted, positions specified are positions with HP.

Name	Business Address	Principal Occupation or Employment	Citizenship

Xxxx X. Xxxxxxx	0000 Xxxxxxx Xxxxxx Xxxx Xxxx, XX 00000	President and Secretary of Purchaser since September 2010; director of Purchaser since September 2010. Vice President, Deputy General Counsel and Assistant Secretary of HP since June 2008; previously, held various other positions in HP's legal department since 2001.	United States
Xxxxxxxxx X. Xxxxxx	0000 Xxxxxxx Xxxxxx Xxxx Xxxx, XX 00000	Chief Financial Officer of Purchaser since September 2010; director of Purchaser since September 2010. Interim Chief Executive Officer of HP since August 2010; Chief Financial Officer since January 2007; Senior Vice President from 2003 until December 2006; Treasurer from 2003 until March 2007.	Canada
Xxxxxx X. Xxxxxx	0000 Xxxxxxx Xxxxxx Xxxx Xxxx, XX 00000	Director of Purchaser since September 2010. Senior Vice President of Global Tax of HP since May 1999; previously, held various positions in HP's tax department since 1980.	United States

A-5

Facsimile copies of the Letter of Transmittal will be accepted. The Letter of Transmittal, certificates for Shares and any other required documents should be sent by each stockholder of ArcSight or such stockholder's broker, dealer, commercial bank, trust company or other nominee to the Depositary as follows:

The Depositary for the Offer Is BNY Mellon Shareowner Services, a Subsidiary of:


By Mail:		By Overnight Courier:
BNY Mellon Shareowner Services Attn: Corporate Action Dept. X.X.Xxx 0000 Xxxxx Xxxxxxxxxx, XX 00000		BNY Mellon Shareowner Services Attn: Corporate Action Dept., 27th Floor 000 Xxxxxxxxxx Xxxxxxxxx Xxxxxx Xxxx, XX 00000

Any questions or requests for assistance or additional copies of the Offer to Purchase and the Letter of Transmittal may be directed to the Information Agent at its telephone number and location listed below. You may also contact your broker, dealer, commercial bank or trust company or other nominee for assistance concerning the Offer.

The Information Agent for the Offer is:

000 Xxxxxxx Xxxxxx, 00xx Xxxxx
Xxx Xxxx, Xxx Xxxx 00000
Stockholders Call Toll-Free: (000) 000-0000
Banks and Brokers Call Collect: (000) 000-0000

QuickLinks

Exhibit (a)(1)(A)