The State of M&A in the Cybersecurity Market

October 28, 2015

1

AGC is at the Forefront of Emerging Technology Advisory

Full-service, partner owned boutique investment bank with offices in Boston,Foster City, New York, Minneapolis, and London

50+ person team – among largest in the industry dedicated to emerging growth

Sector expertise in Technology (Energy, Communications, Infrastructure / Cloud,Fintech, HCIT, Information Security / Defense, Semiconductors and Software);Digital Media / Internet / Mobile; Business & IT Services

Provide M&A, private capital raising and capital market advisory services

Strong momentum: closed 28 deals in 2014; 45+ active engagements in 2015

Founded in 2003, 259 transactions closed to date; 76 in Security

Ranked the #1 most active M&A advisor in Information Security andEnterprise Networking in 2012, 2013, & 2014 by 451 Research

AGC Ranked Top Tech Boutique: 259 Deals Done Since Inception

Confidential Materials. Do Not Distribute.

2

AGC’s Strong Track Record with the Largest Acquirers

Recognized in the Information Security community as the leading domain expertand best networked investment banker

Maria has built upon her 30+ years of industry experience and 90+ deals tomake AGC Partners the leading name in Information Security

Hosts annual premiere investor and strategic partner event in Pre-RSA SecurityConference and recently launched Disrupt!on at Black Hat 2013

Recognized by the 451 Research as Top Dealmaker in Security and EnterpriseNetworking for 2012, 2013, and 2014

Maria Lewis KussmaulCo-Founding PartnerInvestment Banking

Panelist/presenter at RSA Conference; Security Innovation Network (SINET) Advisory Board Member Has facilitated multiple “Blue Sky” strategic planning sessions with leading teams in the Security

industry such as BMC, Intel Security, Cisco, HP, Trend Micro, EMC, IBM, CA, Symantec, Oracle,Verisign, and Juniper Networks

Maria Lewis Kussmaul: Trusted Industry Advisor to Security Industry

Denotes transactions with valuations greater than $100M

201120122013

2014

2015

3

has completed aSeries C Equity Financing with

February 2015

has sold its LYNXeon assets to

March 2015

UNDISCLOSED

has been sold to

May 2015

has been sold to

July 2015

has been sold to

August 2015

has been sold to

October 2015

AGC’s Recent Security Transactions: 28 Since 2010

Transactions prior to 2011 4

AGC’s Market Leading Security Practice: 48 Deals Through 2010

Advanced Persistent Threats

Next‐Generation Endpoint

SCADA / IoT

Anti‐Fraud / Identity Management

Threat Intelligence

Application Security

BYOD & Mobile

Encryption

5

User Behavior Monitoring & Analytics

Sought After Sectors: Strategic M&A

DateDate TargetTarget EVEV LTM RevLTM Rev($ in Millions)

EV/LTM RevEV/LTM RevAcquirerAcquirer

Oct. 2015 $63,100 $24,691 2.6x

Apr. 2015 4,613 1,048 4.4x

Mar. 2015 2,400 650 3.7x

Apr. 2015 1,300 385 3.4x

Apr. 2015 850 216 3.9x

Jun. 2015 635 ND ND

Sep. 2015 425 211 2.0x

Sep. 2015 270* ND ND

Apr. 2015 240 75 3.2x

Apr. 2015 200* 60* 3.3x

6* 451 estimate

2015 Top M&A Deals

7Source: Tracxn, CapitalIQ and 451 Research

Business Model # Transactions Funding

Endpoint 15 $822

Network Security 31 $709

IAM 25 $697

Data Security 14 $445

Cloud Security 30 $399

Application Security 22 $292

Threat Intelligence 14 $211

Stealth 6 $95

BYOD Security 4 $56

Total 161 $3,726

LTM period as of 3Q’15

Illumio, CoreOS, Sumo Logic, Netskope, VectraNetworks, SentinelOne, Aorato, ForgeRock,Lookout, Sookasa, Simility

Prevoty, Zerto, Risk I/O, ThreatMetrix

Awake Networks, Okta, Skyhigh Networks, SumoLogic, Synack, Guardicore, Zerto

CoreOS, Shape Security, Ionic Security, Bit9,Synack, Area1 Security, Endgame

Cohesity, Bit9, Sumo Logic, Skyhigh, Adallom,SafeBreach, CoreOS, Okta, Keen.io, Forter

Scalyr, Cohesity, Agari, Guardicore, Lightcyber,RiskIQ, Veradocs, Zerto, KeyMe, BlockScore

Ionic Security, Shape Security, Synack, ThreatStream, Duo Security, MapR, Team8

Illumio, Okta, Tanium, Cipher Cloud, Bluebox,SignalFX, Lookout, Sookasa

Cylance, DB Networks, Okta, Vectra Networks,BlockScore

Active Investors in past 12 months:($ in Millions)

LTM Funding by Sector

8

Cybersecurity Enthusiasm Driver: Leadership is up for Grabs

As the “changing of the guards” takes place, the winners and the losers are quickly being separated

Old GuardOld Guard UndecidedUndecided New GuardNew Guard

Agents of TransformationAgents of Transformation

“Old guard” companies are scrambling to stay relevant in the rapidly changing market Public markets continue to amply reward newly public security companies, as evidenced by Rapid7 and

Cyber-Ark, which are trading up 17% and 188% after their recent IPOs, respectively

“New guard” companies are driving forward at an accelerated pace, with the fortitude andcapital to back them New Guard companies continue to strategically employee M&A as an agent of transformation

Others?

*Aftermarket performance as of 10/23/15

9

Investors Eager to Exploit Leadership Shift…

“Next generation” security players haveevolved to keep up with increasinglysophisticated attacks by utilizing:

Today’s Information Security market is at a crossroads: Traditional security solutions are focused on barrier-based perimeter defenses

But the threat is already inside the Network/Enterprise

Endpoint and network visibility / detection solutions

Adversary intelligence – studying the attackers

Big Data collection and analytics that can be tracked, combined and acted upon

Leaders are combining pre and postcompromise detection, analytics, forensicsand response

10

…and Strong Sector Growth

With security budgets increasing across the board, InformationSecurity is exhibiting strong fundamental growth that is likely toremain robust

Source: Gartner, IDC, MarketsandMarkets

According to Gartner, enterprise security budgets are shifting towards anincreased focus on detection and response, and 60% of security budgets willbe allocated to these two areas by 2020

PwC Global State of Information Security Survey indicates 10,000+ respondentsreported their information security budgets increased by 24% in 2015 as aresponse to the 38% YoY increase in security incidents

IDC cites four hot areas for growth over next 5years: Security Analytics / SIEM (10% CAGR);Threat Intelligence (10%+); Mobile Security(30%); and Cloud Security (50%)

Additionally, IoT Security – a relatively newmarket – is expected to reach approximately $29billion by 2020

11

Rev

. Mul

tiple

Ent.

Valu

e ($

M)

April 2011 January 2014

EV: $145MMultiple: 4.8x

Rev Growth: 74%

Financing - $69M

EV: $989MMultiple: 9.7x

Rev Growth: 45%

Sale

2.7 Years

9.7x

4.8x

$989

$145

Ent.

Valu

e ($

M)

Rev

. Mul

tiple

July 2013 December 2013

EV: $315MMultiple: 7.5x

Rev Growth: 66%

Financing - $30M

EV: $415MMultiple: 8.5x

Rev Growth: 66%

Sale

6 months$315

$415

7.5x

8.5x

2.7 Years

Ent.

Valu

e ($

M)

Rev

. Mul

tiple

April 2008 April 2015

EV: $27MMultiple: 7.9x

Rev Growth: 521%

Financing - $22M

EV: $200MMultiple: 3.3x

Second Sale$200

$27

3.3x

7.9x

4.5x $90EV: $90M

Multiple: 4.5xRev Growth: 13%

First Sale

4.3 Years

August 2012

640% Enterprise Value Growth

*

*451 Research estimates

*

Cyber Success Stories

Source: 451 Research

12

OpenDNS provides Cisco a significant and valuable source of threat intelligence, which it

can leverage to improve a wide range of security and network products that it already sells,

most notably, its current strategy of building out its

security IoT segment

Acquiring CirroSecure solidifies Palo Alto’s position in cloud

application control technology and gives Palo Alto the ability to secure high risk, unsanctioned

applications with superior visibility and control

Adallom fills a gap between cloud-based IAM and third party

SaaS products, allowing Microsoft customers to add

much broader control over user authorization, monitoring and control of its cloud and office

programs

Xceedium complements CA’s privileged management portfolio allowing CA to

leverage a highly scalable offering for managing privileged access to virtualized and cloud-

based resources

Acquiring Voltage Security allows HP to utilize a powerful data-centric suite of protection solutions to further extend the capabilities of the HP Atalla portfolio, to bolster security, encryption, tokenization, and enterprise key management

Proofpoint’s advanced threat detection and response

products for email and social media security and compliance

will be further enhanced by pairing them with Emerging Threats’ deep research and

intelligence capabilities

Security Strategics Enhance Product Offerings

Combined with Metafor, Caspida allows Splunk to add

analytics into its emerging SIEM product to automate

detection, and provide better alerts on attacks and insider

threats in a digestible format for SOC analysts and incident

responders

BlackBerry will have significant additional capabilities to

support iOS and Android, which is the future for the enterprise mobility management (EMM)

provider as it increasingly steps away from its own device

business

13

Big 4 M&A Activity

June 2010 April 2014 December 2014

(assets)

May 2013 September 2015

July 2015January 2011

(Professional Services Security Practice)

June 2015

(assets)

March 2014

(Professional Services Consulting Group)

January 2010 August 2011 April 2013

October 2014

(assets)

November 2014 January 2015 March 2015 September 2015

$11.4M Private Placement

14

Resolution1 combined with Fidelis provides one of the most

comprehensive offerings in the TDR and incident-response

automation spaces for a comprehensive advanced threat

defense solution

Perspecsys' encryption gateway proxy should be a straightforward plug-in to Blue Coat's own proxy-based security appliances, while enabling Blue Coat to expand its addressable cloud security use

cases to clients facing data-residency requirements

Immediate Insight brings additional advanced security analytics to FireMon, giving it

more actionable security beyond firewall monitoring

Whitebox allows SailPoint to provide customers with a single

view of users and their associated privileges for accessing

applications, systems and, now, unstructured data

With an integrated suite of solutions that both shrink the

cyber-attack surface and contain breaches when they do occur,

BeyondTrust is well positioned to address anticipated market

demands

Bay31 enables Courion to extend its technology leadership in

identity analytics and enhance the company's product offerings in

role mining and role-based access control, particularly for large and complex applications

Private Equity Platform Plays

15

2007 2008 2009 2010 2011 2012 2013 2014 2015

$193M5.9x

$80M8.0x

$24M2.0x

ND

$233M3.0x

$1.3B3.4x

ND DIVESTED APR-15

$24MAssets DIVESTED JUL-15

$85M3.4x DIVESTED JAN-15

$140M5.0x DIVESTED MAR-15

ND DIVESTED JAN-15 Not Disclosed

Defense Contractor Activity

Record of defense players purchasing cyber product

companies has been mixed; divestitures becoming frequent

16

Jan – ‘12 Sep – ‘15Jan – ‘98 Sep – ‘01

Dotcom-Era Nasdaq Trading Multiples (TTM Rev.) Recent Security IPOs Trading Multiples (TTM Rev.)

Feb – ‘14Mar – ‘00

RSA Conference Exhibitor Numbers Cyber Security Unicorns

Source: CapitalIQ

Signs of Froth?

17

Growth Alone is No Longer a Golden Ticket

So far in 2015, cybersecurity firms have received more than $3.3 billion infunding in 130+ deals, putting the year on track to beat last year’s record pace

However, recent public marketvolatility has led to increasedscrutiny by investors and a “back-to-basics” mentality in venture tolate stage funding

* YTD as of September 23, 2015

Growth rate is no longer a golden ticket to attract capital as investors are nowlooking at growth coupled with profitability and cash flow generation

Strategics have also become more cautious with respect to paying the frothyvaluations seen in recent years, portending a possible slow down in deal activity

18

YTD Cybersecurity Share Pricing

Source: CapitalIQThrough October 23, 2015TTM as of 2Q’15

Valuations Driven by Public Sentiment

Jan – ‘15 Feb – ‘15 Mar – ‘15 Apr – ‘15 May – ‘15 Jun – ‘15 Jul – ‘15 Aug – ‘15

47.8%

(HACK)

12.26%

5.2%

31.1%

*HACK metrics based on median values of holdings

*

Oct – ‘15

18.6%

Sep – ‘15

4.3%

($ in millions) Market Data Operating Data(c)

Enterprise EV / EBITDA Revenue EBITDA Revenue Growth LQ Gross LQ Adj.Company Value(a) (b) TTM 2015E TTM 2015E TTM 2015E TTM 2015E 14A/'13A 15E/'14A Margin Op. Margin(d)

Palo Alto Networks $13,232 14.3x 11.9x NM 64.5x $928 $1,113 ($105) $205 53% 51% 74% (12%)

Splunk 6,371 11.9x 10.1x NM NM 537 632 (225) 38 49% 40% 83% (43%)

FireEye 3,840 7.2x 6.0x NM NM 530 640 (397) (170) 163% 50% 63% (86%)

(HACK) 1,666 2.5x 2.6x 12.1x 11.6x 403 533 32 65 7% 9% 76% 7%

CyberArk 1,176 8.8x 7.9x 36.7x 37.2x 134 148 32 32 56% 44% 83% 18%

Barracuda 761 2.5x 2.5x NM 10.4x 299 309 5 73 18% 16% 80% (0%)

19

Public Sentiment on Growth

A: 2014 earnings released: Surpassed analyst estimates by 22%B: Congress unanimously passes Cybersecurity Information Sharing ActC: Announces $600M convertible notes offeringD: Chinese economy declines

EV: $3.8B 2013 2014 2015E

Revenue $162M $426M $640M

Growth % 94% 163% 50%

EBITDA ($143M) ($380M) ($168M)

Margin % (88%) (89%) (26%)

A

DB C

Jan – ‘15 Oct – ‘15

Jan – ‘15 Oct – ‘15

A: 2014 earnings released: Surpassed analyst estimates by 125%B: Congress unanimously passes Cybersecurity Information Sharing ActC: Acquires behavior analytics and machine learning provider CaspidaD: Chinese economy declines

EV: $6.4B 2013 2014 2015E

Revenue $303 $451M $632M

Growth % 52% 49% 40%

EBITDA ($70M) ($203M) $39M

Margin % (23%) (45%) 6%

AB

DC

Source: CapitalIQThrough October 23, 2015

20

Public Sentiment on Growth + ProfitabilityA: 2014 earnings released: Surpassed analyst estimates by 12%B: Congress unanimously passes Cybersecurity Information Sharing ActC: Acquires enterprise SaaS application security startup CirroSecureD: Chinese economy declines

EV: $13.2B 2013 2014 2015E

Revenue $483M $739M $1,110M

Growth % 49% 53% 50%

EBITDA ($0.4M) ($73M) $204M

Margin % (0%) (10%) 18%

A

DC

B

A: 2014 earnings released: Surpassed analyst estimates by 320%B: Announces secondary Nasdaq offeringC: Congress unanimously passes Cybersecurity Information Sharing ActD: Chinese economy declines

EV: $1.2B 2013 2014 2015E

Revenue $66M $103M $148M

Growth % 40% 56% 44%

EBITDA $10M $21M $32M

Margin % 15% 20% 22%

A

BC

D

Jan – ‘15 Oct – ‘15

Jan – ‘15 Oct – ‘15

Source: CapitalIQThrough October 23, 2015

21

Public Sentiment on Negative Developments

A: 2014 earnings released: Surpassed analyst estimates by 17%B: Congress unanimously passes Cybersecurity Information Sharing ActC: Announced FY’Q1 billing growth at 8%, well below 16-18% guidanceD: Chinese economy declinesE: Announced FY’Q2 billing growth at 10%, down from 15% in Q2 last year

EV: $761M 2013 2014 2015E

Revenue $234M $277M $321M

Growth % 18% 19% 17%

EBITDA ($0.2M) $8M $72M

Margin % (0%) 3% 23%

Jan – ‘15 Oct – ‘15

*CUDA FY ends in February

A

B

E

C

D

Source: CapitalIQThrough October 23, 2015

22

HACK Fund

Source: CapitalIQThrough October 23, 2015TTM as of 2Q’15

HACK Fund($ in millions) Market Data Operating Data(c)

Enterprise EV / Revenue EV / EBITDA Revenue EBITDA Revenue Growth LQ Gross LQ Adj.Company Value(a) (b) TTM 2015E TTM 2015E TTM 2015E TTM 2015E 14A/'13A 15E/'14A Margin Op. Margin(d)

Cisco $114,255 2.3x 2.3x 8.5x 8.4x $49,161 $50,163 $13,391 $13,550 0% 4% 60% 23%

Palo Alto Networks 13,232 14.3x 11.9x NM 64.5x 928 1,113 (105) 205 53% 51% 74% (12%)

Check Point 13,319 8.5x 8.2x 16.0x 14.5x 1,559 1,627 834 921 7% 9% 89% 50%

Symantec 12,224 1.9x 2.0x 6.8x 6.1x 6,272 6,152 1,809 2,019 (3%) (7%) 84% 22%

Juniper 12,071 2.6x 2.5x 12.1x 9.3x 4,640 4,834 1,000 1,303 (1%) 4% 64% 21%

VeriSign 8,911 8.5x 8.4x 13.7x 12.5x 1,043 1,055 652 710 5% 4% 82% 58%

F5 7,687 4.1x 3.9x 12.9x 9.8x 1,884 1,969 596 783 17% 10% 82% 29%

Gemalto 6,675 2.1x 1.9x 13.0x 10.8x 3,154 3,479 515 616 (9%) 17% 38% 8%

Splunk 6,371 11.9x 10.1x NM NM 537 632 (225) 38 49% 40% 83% (43%)

Booz Allen Hamilton 5,570 1.1x 1.1x 11.0x 11.0x 5,304 5,275 507 508 (5%) (1%) 24% 9%

Fortinet 5,067 5.4x 5.0x 90.4x 30.8x 937 1,009 56 165 25% 31% 72% 2%

Trend Micro 4,129 4.2x 4.0x 12.2x 11.8x 986 1,022 338 351 (7%) 6% 83% 25%

Leidos 4,109 0.8x 0.8x 9.8x 10.2x 5,063 4,960 418 403 (12%) (2%) 11% 7%

FireEye 3,840 7.2x 6.0x NM NM 530 640 (397) (170) 163% 50% 63% (86%)

SAIC 2,978 0.7x 0.7x 10.6x 9.7x 4,064 4,342 281 306 (6%) 12% 10% 6%

Sophos(e) 2,587 5.8x ND 40.0x ND 447 ND 65 ND 18% NM NM NM

Proofpoint 2,466 10.0x 9.3x NM NM 247 264 (51) 4 42% 35% 70% (32%)

Imperva 1,632 8.5x 7.5x NM NM 192 217 (56) (7) 19% 32% 78% (32%)

AVG 1,416 3.5x 3.3x 11.6x 8.9x 403 433 122 159 (8%) 16% 85% 15%

CyberArk 1,176 8.8x 7.9x 36.7x 37.2x 134 148 32 32 56% 44% 83% 18%

ManTech 1,088 0.7x 0.7x 8.9x 9.2x 1,613 1,584 122 118 (23%) (11%) 15% 5%

Qualys 1,034 7.0x 6.2x 33.7x 21.7x 148 166 31 48 24% 24% 80% 13%

Rapid7 996 10.9x 9.6x NM NM 92 104 (24) (31) 28% 35% 74% (32%)

Barracuda Networks 761 2.5x 2.5x NM 10.4x 299 309 5 73 18% 16% 80% (0%)

Infoblox 635 2.1x 1.8x NM 16.4x 306 344 (17) 39 9% 29% 79% (5%)

Radware 587 2.5x 2.7x 12.4x 14.3x 231 215 47 41 15% (3%) 83% 14%

VASCO 558 2.3x 2.3x 9.8x 9.7x 246 238 57 58 30% 18% 59% 24%

Intralinks 525 2.0x 1.9x 43.2x 13.7x 268 274 12 38 9% 7% 72% (11%)

KEYW 395 1.3x 1.3x NM 43.4x 303 312 1 9 (3%) 7% 33% (5%)

F-Secure 373 2.1x 2.3x 13.5x 12.3x 174 162 28 30 (13%) (13%) 97% 16%

AhnLab 265 2.3x ND 19.9x ND 115 ND 13 ND (5%) NM 77% 6%

Zix 265 5.0x 4.8x 25.2x 16.9x 53 55 10 16 5% 9% 83% 25%

Absolute Software 210 2.2x 2.3x 12.0x 14.7x 94 93 17 14 8% (1%) 81% 1%

Guidance Software 165 1.5x 1.5x NM NM 109 110 (6) 1 (2%) 1% 66% (13%)

Comp S.A. 109 0.7x ND 7.6x ND 160 ND 14 ND (5%) NM 25% 6%

MEDIAN $1,632 2.5x 2.6x 12.4x 12.0x $403 $533 $32 $65 7% 9% 76% 7%

Notes(a) Based on closing stock prices on October 23 2015(b) Calculated as Equity Value plus total debt, minority interest (at book value unless otherwise noted) and preferred stock, less cash & equivalents(c) Projections represent Wall Street & Yahoo Finance estimates(d) Adjusted operating margin excludes extraordinary and non-recurring items(e) Sophos fiscal year ends March 31st

23

Cyber threats are endemic

Industry leadership is in flux

Demand for effective counter-measures is strong and rising

Capital availability is at unprecedented levels and valuations are high

Cyber talent is scarce

Cyber investments and M&A will undoubtedly continue …• … but at a more discriminating pace and with more disparate

outcomes

Concluding Thoughts