#1AWAKE Advanced Detection and Response for the Hybrid Cloud Copyright 04/13/2020 Al Fight Feved RSA Conference Finalist Most Innovative Security Company 2018 WINNER TAG 1700 BUSINESS INSIDER 10** Se A POR TASW 30 Hottest Security Startups 449* Sublimas CARMEN Bwords 2019 EIR+ #security solution in the Global 1000#2OPPORTUNITY To be the market leader in cyber detection and response for the hybrid cloud C Peter Catale 8 DO male ža semalam manchering be PAPERS Walan ja ad alas The MELAMBAT MEŠKU 2009 Harapa 1#3Executive Summary TEAM 65 employees History of delivering category-leading products Persistent & unreasonable in our goals ☐☐☐ DIFFERENTIATORS Immediate time-to-value High efficacy detection & response Platform-as-a-service approach Patented Ava, EntityIQ & Adversarial Modeling TO KEY CUSTOMERS Strong customer traction eld & displacement opportunity (Cisco, RSA, Darktrace, etc.) Land and expand dynamics Gr FUND RAISE: $30 M CURRENT INVESTMENT Series A: Greylock eries B: Bain & Greylock -2#4Awake Market Opportunity MARKET GROWTH Information Security (8.3% CAGR) Network Detection & Response (14.1% CAGR) AWAKE momentumcyber.com/cybersecurity soapshot 2019 Garte Forecasts 2019 $121B $1.9B 2024 $182B $3.8B LEADERS BY CATEGORY Network Prevention Email Prevention Endpoint Detection & Response 27 Pure-play Security Companies on Public Markets paloalto proofpoint CROWIATRINE MARKET CAP $20B $6B $13B $6B (AVC) NETWORK DETECTION & RESPONSE 3#5Leadership Team Deep Expertise Across Security, Networking & Data Science RAHUL KASHYAP CEO DEBABRATA DASH Chief Data Scientist ASHEEM CHANDNA Founding BoD Palo Alto Networks Greylock Partners ArcSights Xbig switch networks hp FireEye KEITH AMIDON Chief Architect IntruVert ***WEFEL GARY GOLOMB Chief Scientist SARAH GUO Fmr. Board Member Demisto Greylock Partners Bromlum CISCO RUDOLPH ARAUJO VP. Marketing RAJDEEP WADHWA VP. Product KEVIN MANDIA Founder, Mandiant CEO, FireEye CYLANCE McAfee to NETWITNESS DARK TRACE E8 SECURITY symantec. SS8 RANDY CHEEK VP, Sales JEFFREY WANG VP. Engineering ENRIQUE SALEM Fmr. CEO Symantec Bain Capital Ventures FOUNDSTONE vmware®#6Key Customers & Pipeline REDACTED REDACTED#7The Analyst Perspective Security Operations Center Visibility Triad Source Gartner AWAKE splunk BM Network Detection & Response exabeam SIEM / UEBA EYLANCE GARBON BLACK Endpoint Detection & Response loT devices, mobile phones and OT technology, may not have agents available or even the ability to produce security logs. In those cases, network traffic becomes one of the only options to provide visibility into what happens on those systems" Gartner 66 Compliance mandates for network security are elevating NVDR more toward the 'must have' category, which is the easiest sales proposition in security. [...] Enterprise security teams justify NVDR purchases for multi-cloud transformations as a modernization effort for replacing aged IDS/IPS deployments, while satisfying clauses in compliance mandates. 451 Research 6#8The Challenge How Do You Secure the New Network? %~ > 50% Devices are "Unmanaged" N 50% Breaches See No Malware > 3M Unfilled Security Jobs 7#9Alerts →Answers Reducing Time, Cost & Risk of Security Operations From Alerts... 10/13/19 1:23:32 313 PM Financial Crime Threat intel {"timestamp":"2019-10-13T13:23:32.313424-0000", 0.137.100.123","src_part":49167,"dest_p":"209. llowed","gid":1,"signature_id":2021113,"rev": 13 t"."category":"Financial Crime Threat Intel"," &ct=15&init=0&s-f0708n-8714638871461389404753 ttp_user_agent":"Mozilla/5.0 (Macintosh: Intel A 11 3029.96 Safari/537.36","http_content_type":"te 001/draymond-green-wishes-cleveland-cavaliers-c Ⓡ tatus:200,"length":0},"app_proto":"http". "flow lient":3207,"start":"2019-10-13T13:23:32.214322 Intel Match FINA Command and Control/Credential Theft PRO- Bak depan PETERE SAGTE H TIENDA ALLA 11 P ...To Answers 8#10The Awake Security Platform Securing the New Network SEE THE NEW NETWORK Monitor the hybrid-cloud & loT KNOW CURRENT THREATS Identify insider & external mal-intent FIRE PROTECT WITH HIGH ROI Consolidate & automate with an expert system 9#11The Future of Detection & Response: Intent Detection Mal-Intent Threats Behavioral Threats Malware Threats THREAT COMPLEXITY Intent Detection Behavioral Detection Anomaly Detection Intrusion Detection SECURITY MATURITY Reactive Proactive A AWAKE Predictive 10#12Why We Win? Key Differentiators Designed to support the new network Consolidates various network tools Autonomous entity tracking with network ground truth Adversarial modeling for high-efficacy intent detection Autonomous triage with Ava 11#13Detection and Response for the Hybrid Cloud AWAKE NUCLEUS (Cloud or on Premise) AWAKE SENSORS On-Premise PaaS / laas SaaS Apps . AWAKE EXPERT SYSTEM "Ava" Autonomous Response 12#14RSA Netwitness Displacement Case Study INDUSTRY Media & Entertainment (Fortune 100) SIZE X000+ employees AWAKE DEPLOYMENT XXX Awake Sensors and Nucleus // 60 Gbps KEY USE CASES Insider threat detection Digital forensics and incident response Threat hunting WHY AWAKE VS. RSA? Lower operational costs especially for storage Broader set of use cases Workflow integrations $XXX (7 Figures) REDACTED 13#15Land, Renew & Expand Case Study INDUSTRY Retail (Fortune 200) SIZE XXX,000+ employees AWAKE DEPLOYMENT XXX Awake Sensors and Nucleus KEY USE CASES Identifying threats across 3000+ store locations Auditing existing controls/policies WHY RENEW? Satisfied Customer Expanded threat hunting use cases Single pane of glass $XXX (High 6 Figures) REDACTED 14#16Incident Response to Product Sale Case Study INDUSTRY Oil & Gas (Fortune 500) SIZE X,X00+ employees AWAKE DEPLOYMENT XXX Awake Sensors and Nucleus // 5 locations KEY USE CASES Digital forensics and incident response Unmanaged devices/Supply chain monitoring Threat hunting WHY AWAKE VS. SIEM? Immediate time to value Broader set of use cases Workflow integrations $XXX (High 6 Figures) Tit REDACTED 15#17Darktrace Displacement Case Study INDUSTRY High Tech SIZE XXX+ employees AWAKE DEPLOYMENT XXX Awake Sensors and Nucleus // 10 locations across the globe KEY USE CASES Living off the land & insider threats Global visibility WHY AWAKE VS. DARKTRACE? Broader IT and security integration Advanced threat hunting capabilities Managed Network Detection & Response $XXX (High 6 Figures) REDACTED 16#18Cisco Stealthwatch Displacement Case Study INDUSTRY Finance SIZE XXX+employees AWAKE DEPLOYMENT XXX Awake Sensors and Nucleus // 2 locations KEY USE CASES GDPR / PCI compliance Unknown attack surface monitoring WHY AWAKE VS. CISCO? Shadow IT visibility Support for forensic investigations and threat hunting Integrations with the security program $XXX (6 Figures) REDACTED 17#19Path to the First $100M REVENUE:>$10B REVENUE: $1B-S10B REVENUE: $500M- $1B 1200 TOTAL NUMBER OF COMPANIES WORLDWIDE 10,800 KAMDANNKINNKINİMƏNİNAMIN 15,500 $XB $X ASP $XB $X ASP $XB $X ASP $8.9B across 27,500 enterprises Source: Forbes Global 2000 www.obees.com/alba2CO NAICS US Business Fimographics.combusiness-istacounta-by.companyin World Bank Statistion padala worldbank oraindicatonNY GOP MKTP.CO most recent vales destaview-chat 18#20REDACTED DETAILED FINANCIAL METRICS, FORECASTS ETC. 19#21Summary TEAM 65 employees History of delivering category-leading products Persistent & unreasonable in our goals ☐☐☐ DIFFERENTIATORS Immediate time-to-value High efficacy detection & response Platform-as-a-service approach Patented Ava, EntityIQ & Adversarial Modeling TO KEY CUSTOMERS Strong customer traction eld & displacement opportunity (Cisco, RSA, Darktrace) Land and expand dynamics Gr FUND RAISE: $30 M CURRENT INVESTMENT Series A: Greylock eries B: Bain & Greylock 20#22AWAKE See More. Know More. Protect More. THANK YOU! AWAKESECURITY.COM | 833.292.5348 Copyright ©4/13/2020 All Rights Reserved#23The Malicious Insider HACKING THE VOIP PHONE SYSTEM Industry Consumer Finance Challenge IT contractor virtually tapped into phones, recorded calls and exfiltrated the data Results Awake identified the cluster of VoIP phones, spotted the outliers & the encrypted exfiltration and identified the attacker accessing the recordings 4 Devices Polycom dade Polycom 1138/17 Polycom 4 de 14d Polycom 430847 robert robert Admin7x32 100 aws.dkigja09usd... 22#24The Nation State Threat HACKING A MUNICIPAL WATER AUTHORITY Industry State & Local Government Challenge Critical infrastructure controlling the local water district was running an unsupported version of Microsoft Windows Results Awake identified a Windows 2003 server that had a Russian remote access tool installed B Ⓒ Entity Device Proble admin:watercontroller089954 Add TagAdde Risk Level MEDIUM Network Internal TYP Windows Device OS Windows XP O First Seen 23:04:30 Oct 18, 2019 (45) 06:01:08 Nov 21, 2019 (-30m 38.957) 1PM MAC Address +1 More Saurch Threats Threats 16:04:06 Nov 14, 2019 (012) Lateral Movement Authenticated acces Lateral Movement: Remote Desktop Use 16:00:27 Nov 14, 2019 (-1m 38 534) Lateral Movement: Authenticated acces 23#25The Targeted Attack HACKING THE CLOUD FROM ON-PREMISE ASSETS Industry Financial Services Challenge An AWS administrator's credentials were stolen and used to access the organization's cloud infrastructure Results Awake detected a malicious Chrome extension being used to steal browser information including login data P n Hasphem 00 Serg Carandjer Na Marbe merhettegt bevaluer WOHL SCALA 3. ga HESAPAT NERLINA 24