Banking, Financial Services and Insurance (BFSI) - Cyber risks & IT security challenges

1. State of Cybersecurity Report 2020

2. Security trends | BFSI Security governance 42% of CISOs are responsible for ownership of data privacy 57% said monitoring threats on unmanaged devices has been a challenge Supply chain security Security budget 40% of organizations have a security budget that is more than 8% of the IT budget 54% of organizations are highly confident about preventing risks from technology providers 57% said changing network topology has been a risk Top 2 cyber risks Top investment priority 87% said email phishing is a top risk 44% of organizations consider security orchestration and automation as a top Increase remote access/VPN capacity enablement 54% said third-party unprotected services a top risk priority 18% of organizations consider hybrid security solutions as a top priority Enabling secure collaboration Factors driving budget Simulation Exercise 70% said that new regulations are the reason for increase in budget allocation 54% of organizations participate in cyber attack exercises coordinated by third party service provider Secure digital transformation initiatives Cyber attack consequences 54% said that board oversight of cybersecurity is the reason for increase in budget allocation 52% of organizations participate in cyber attack exercises coordinated by National CERT / CSIRT Increase secure cloud migration to scale quickly 74% said a bad cyber event causes damaged brand reputation 11% of organizations never participated © confidential 2

3. Security trends | HLS Security governance 57% said monitoring threats on unmanaged devices has been a challenge 52% of CISOs report to CIO Supply chain security Security budget 14% of organizations have a security budget that is more than 12% of the IT budget 43% of organizations are not confident in preventing risks from third party consultants and contractors 57% said changing network topology has been a risk Top 2 cyber risks Top investment priority 71% said cloud hosting risks is a top risk 44% of organizations consider security orchestration and automation as a top Increase remote access/VPN capacity enablement priority 72% said lack of security awareness/ employee negligence is a top risk 17% of organizations consider DevSecOps Enabling secure collaboration as a top priority Factors driving budget Simulation Exercise 71% said that a breach related to peer/competitor is the reason for increase in budget allocation 86% of organizations participate in cyber attack exercises coordinated by third party service provider Secure digital transformation initiatives Cyber attack consequences 29% of organizations participate in cyber attack exercises coordinated by defense/intelligence 43% said that a change in CISO /CXO leadership is the reason for increase in budget allocation Increase secure cloud migration to scale quickly agencies 40% said a bad cyber event causes loss of business due to erosion of trust 29% of organizations never participated © confidential 3

4. Security trends | COMMS Security governance 57% said monitoring threats on unmanaged devices has been a challenge 40% of CPO/DPO are responsible for ownership of data privacy Supply chain security Security budget 20% of organizations have a security budget that is more than 15% of the IT budget 47% of organizations are highly confident about preventing risks from technology providers 57% said changing network topology has been a risk Top 2 cyber risks Top investment priority 100% agree email phishing is a top risk 50% of organizations consider zero trust architecture as a top priority Increase remote access/VPN capacity enablement 71% said cloud hosting risk is a top risk 25% of organizations consider security orchestration and automation as a top Enabling secure collaboration priority Simulation Exercise Factors driving budget 46% of organizations participate in cyber attack exercises coordinated by third party service provider 69% said that board oversight of cybersecurity is the reason for increase in budget allocation Secure digital transformation initiatives Cyber attack consequences 38% of organizations participate in cyber attack exercises coordinated by National CERT / CSIRT 63% said that new regulations is the reason for increase in budget allocation Increase secure cloud migration to scale quickly 74% said a bad cyber event causes missed business opportunities 15% of organizations never participated © confidential 4

5. Security trends | ENU Security governance 57% said monitoring threats on unmanaged devices has been a challenge Supply chain security Security budget 24% of CISOs report to CEO 33% of organizations have a security budget that is more than 10% of the IT budget 54% of organizations are not confident about preventing risks from third party consultants and 57% said changing network topology has been a risk contractors Top 2 cyber risks Top investment priority 71% said email phishing is a top risk 43% of organizations consider security orchestration and automation as a top Increase remote access/VPN capacity enablement priority 71% said IT/ OT integration risks is top risk 36% of organizations consider IT/OT initiatives as a top priority Enabling secure collaboration Simulation Exercise Factors driving budget 64% of organizations participate in cyber Attack exercises coordinated by National CERT / CSIRT 54% said that new regulations are the reason for increase in budget allocation Secure digital transformation initiatives Cyber attack consequences 55% of organizations participate in cyber attack exercises coordinated by third party service provider 69% said that board oversight of cybersecurity is the reason for increase in budget allocation Increase secure cloud migration to scale quickly 64% said a bad cyber event causes loss of revenue due to non-availability of services at critical times 9% of organizations never participated © confidential 5

6. Security trends | MFG Security governance 57% said monitoring threats on unmanaged devices has been a challenge Supply chain security Security budget 71% of CISOs report to CIO 46% of organizations have a security budget that is less than 6% of the IT budget 58% of organizations are not highly confident about preventing risks from supply chain providers 57% said changing network topology has been a risk Top 2 cyber risks Top investment priority 100% agree email phishing is a top risk 40% of organizations consider security awareness and training as a top priority 77% said lack of security awareness/ employee negligence is a top risk Increase remote access/VPN capacity enablement 50% of organizations consider zero trust architecture as a top priority Enabling secure collaboration Simulation Exercise Factors driving budget 58% of organizations participate in cyber attack exercises coordinated by third party service provider 54% said that new regulations are the reason for increase in budget allocation Secure digital transformation initiatives 17% of organizations participate in cyber Attack exercises coordinated by National CERT / CSIRT 54% said that board oversight of cybersecurity is the reason for increase in budget allocation Cyber attack consequences Increase secure cloud migration to scale quickly 42% of organizations never participated 74% said a bad cyber event causes Loss of revenue due to non-availability of services at critical times © confidential 6

7. Security trends | CBU Security governance 57% said monitoring threats on unmanaged devices has been a challenge Supply chain security Security budget 77% of CISOs report to CIO 17% of organizations have a security budget that is more than 8% of the IT budget 57% of organizations are somewhat confident about preventing risks from technology providers 57% said changing network topology has been a risk Top 2 cyber risks Top investment priority 86% said email phishing is a top risk 29% of organizations consider zero trust architecture as a top priority 67% said Lack of security awareness/ employee negligence is a top risk Increase remote access/VPN capacity enablement 21% of organizations consider hybrid cloud architecture as a top priority Enabling secure collaboration Factors driving budget Simulation Exercise 67% said that board oversight of cybersecurity is the reason for increase in budget allocation 70% of organizations participate in cyber attack exercises coordinated by third party service provider 15% of organizations participate in cyber Attack exercises coordinated by National CERT / CSIRT Secure digital transformation initiatives 54% said that new technology adoption is the reason for increase in budget allocation Cyber attack consequences 30% of organizations never participated Increase secure cloud migration to scale quickly 75% said a bad cyber event causes damaged brand reputation © confidential 7